VW EDC17C64 (Golf 7 2.0 TDI): Multimap with Custom Immobilizer

Reverse Engineering the EDC17C64 VW ECU 🔧

We successfully reverse-engineered the EDC17C64 (Golf 7 2.0 TDI) and implemented a custom immobilizer. There’s also a service mode to disable it when needed, with all state stored in EEPROM. And because it wouldn’t be complete without it, we added a multimap with three power stages.

Goals¶

• Add custom immobilizer that binds to this ECU and keeps a service/maintenance mode.
• Build a three-stage multimap and clean selector (no A2L dependency).
• Keep it reproducible and recoverable (checksums, bench validation).

Path we took¶

1) Recon & layout¶

• Bench readout, quick map reconnaissance, and a pass over start-inhibit logic.
• Identified EEPROM bytes for immobilizer state and a small key slot.

2) Custom immobilizer¶

• Immobilizer check runs during early init. It derives a device-bound key from a processor UID and a pair of magic constants.
• Service mode (for diagnostics/maintenance) is persisted in EEPROM; power cycles keep the mode until you clear it.

VIDEO:

Video¶

```c // sketch (illustrative) bool service = eeprom_read8(EE_SERVICE_FLAG); uint64_t uid = read_processor_uid(); // device-unique uint64_t key = kdf(uid, MAGIC1, MAGIC2); // lightweight keyed hash

if (!service) { if (eeprom_read64(EE_KEY_SLOT) != key) { inhibit_start(); // no crank / no run } }

// service toggle path (tool/button) if (request_service) { eeprom_write8(EE_SERVICE_FLAG, 1); }