Car On-board diagnostic system

Ktag bench flashing Citroen C5 Marelli IAW 6LP

Publié le 12/01/2018 à 09:36, Aéroport de Paris - Roissy Charles-de-Gaulle
Mots clefs : Ktagktag 7.020ktag 6.070
This is IAW 6LPB Magneti Marelli Bench Flashing with a Ktag master ecu programmer in Boot Mode.
Citroen C5 bench flashing – STF10280 boot mode
Disassemble the ECU
Select the model
Manufacturer: Citroen
Model: C5 (II)
Version: 2000 16v
Type: RFJ (EW10A)
KW: 103
HP: 140
Fuel: Petrol
MY: 2008
ECU: Magneti Marelli IAW 6LP
FAM: 45
CHK: √
RO: √
Connection instruction
So, the connection mode of Magneti Marelli IAW 6LPB is like what displayed in the Galletto Manual Type B, but use KTag BOOT PIN connection
Connected to CAN High and CAN Low, but CAN protocol not woek
Connect ed through K Line
K-Tag is reading Marelli IAW 6LP1.49 PSA
Ktag master reads Marelli successfully
Save ECU data
Exit Ktag Ksuite software.

Ktag Kess unlock CRP3 LPC2478 via J-link

Publié le 15/11/2017 à 08:30, Paris - Charles-de-Gaulle
Mots clefs : Kess v2Ktagk-tagktag 6.070J-link

As you know, for crp3 we can do the trick for unlock crp3 heating on Ktag or Kess V2 programmer or buy a new NXP and write it (only one time)
Here are some questions & answers on Google form, questions about “how will you use J-ink if its crp3 ?”…

Q: Can I update NXP directly if at this moment I have Ktag 6.070? Or I will need to replace it with new one and then to update to 7.030 ?
A: if your actual fw is crp3 you will have to do “heating trick ” or change nxp, you will know if jlink doesn’t recognise firmware ( i think message about cannot find cpu chain or something like that) , simple

Q: More information this real version or china version? and whats this you can update or or only talk?? thanks
A: this is fw 7.030 we are talking about REAL firmware, not modding number in sw or similar, about second question i don’t understand what you ask.


Q: Need connect 12v ? my led red always off if not connect 12v

A: LED needs to monitor the state of the processor and it must be switched by the controller. If you do not have the power on the controller when connected by USB, then connect the other power source.


Q: How work on ktag, i tried but led already on

A: LED need to monitor the state of the processor and it must be switched by the controller. If you do not have the power on the controller when connected by USB, then connect the other power source.
To flash the LPC2478 via J-link, the level of protection should be CRP0, ie protection should be disabled. If security levels CRP1 and CRP2 have the ability to erase and reflash LPC2478 via UART, eg via USB to UART TTL adapter ftdi232 or cp2102 and Flashmagic program.


Q: LPC2478 connect Flash Magic, KESS or KTAG?

A: KESS V2 & KTAG…both ok

Note: not all ktag 5.001 can be read with j-link
some are crp3 protected
some are not


Attachment 1: Code Read Protection (CRP)

CRP explanation CRP status Volume label
The user flash can be read or written. No CRP CRP DISABLD
The user flash content cannot be read but can be updated. The flash memory sectors are updated depending on the new firmware image CRP1 CRP1 ENABLD
The user flash content cannot be read but can be updated. The entire user flash memory is erased before writing the new firmware image. CRP2 CRP2 ENABLD
The user flash content cannot be read or updated. The USB bootloader ignores the Entry Mechanism (P0.15 pin) and always executes the user application if present. If user application is not present then “Update” mode is entered. CRP3 CRP3 ENABLD


Attachment 2: Here are all pinouts

A method of disabling the protection CRP3 microcontroller LPC2478…. make a photo high resolution of connection on pcb of that wire…and also,what pin you must to touch on nxp



K-Tag pins.


Attachment 3: Photos ofLPC2478 connect Flash Magic

It allows you to erase the NXP MCUs on both Kess & KTag via UART0. This will work for firmwares up to CRP2. CRP0, best off using J-Link as it only takes 30s as opposed to 30 minutes. If you’ve blocked your KTag properly (CRP3), it won’t help you. You will need to swap the processor.


Kess V2 connection method 1:


Kess V2 connection method 2:


KTag connection:


Disclaimer: Photography of Pinouts is not mine. I am not responsible for a bad use.

Ktag K-tagread VAG Bora Bosch 2010 MED17.5 ECU

Publié le 9/03/2016 à 04:34, New York
Mots clefs : ktag 6.070ktagk-tag

Here are some pinout of VAG UDS Bora 2010 C.S Line Recovery by using KTAG K-tag Ksuite firmware v6.070 ecu tuning master.

vag-uds-bora-cs-line-recovery-1 vag-uds-bora-cs-line-recovery-2vag-uds-bora-cs-line-recovery-3vag-uds-bora-cs-line-recovery-4

Mes albums

Où suis-je actuellement ?


Mes amis

Sites favoris