topblog Ivoire blogs


Xhorse VVDI2 latest software version V5.1.0

Xhorse VVDI2 latest software version update to V5.1.0 on Jan.18,2018.

Require firmware V5.1.0.

VVDI2  V5.1.0 detail update information:

===== VAG V5.1.0 =====

1. Improvement MQB NEC35xx immoblizer/KM function, support following cars:

Audi A3/S3 2014+
Audi Q2
VW Golf7
VW Polo(MQB)
VW Tiguan II
VW Touran II
VW crafter 2017+
VW Passat B8 without virtual cockpit
Skoda Octavia III 2014.07+
Skoda Rapid 2015.06+
Skoda Kodiaq
Skoda Superb III
Seat Ibiza/Ateca/Toledo 2015.06+

Attention 1: This type only support cars with cluster Continental/VDO. JCI type and virtual cockpit was not includ

Attention 2: MQB Immobilizer function support original blank key and MQB key made by VVDI2

Attention 3: part of original blank key not support write data

Attention 4: MQB Immobilizer function require extra license. Customer who have copy 48 (96 bit) license will get MQB license for free

2. Improvement for autodetct in IMMO4 system

3. Add spanish language

4. Bugfix

===== BMW V5.1.0 =====

1. Improvement for read ISN from MSx8x ECU, require VVDI2 database file verison V1.0.0
2. Improvement for load MEV17xx EEPROM dump
3. Support change second hand FEM/BDC ISN and make original key working
4. Add spanish language
5. Bugfix

===== Porsche V5.1.0 =====

1. Add spanish language
2. Bugfix

===== PSA V5.1.0 =====

1. Add spanish language
2. Bugfix

===== Transponder Programmer V5.1.0 =====

1. Bugfix for update remote database
2. Bugfix for save points
3. Immobilizer data tool: bugfix for Fiat Ducato 93C56
4. Add spanish language
5. Bugfix

===== J2534 V5.1.0 =====

1. Add spanish language
2. Bugfix
===== Online Upate Tool V5.1.0 =====

1. Add spanish language
2. Bugfix

===== Quick Start V5.1.0 =====

1. Bugfix!PoJBSBKD!nn1ai-JfcoqAM4hbnitabziaSWY-5v...

Xhorse VVDI2 Product details:


How to change VCMII module type

I fixed the issue with error 500 on the VCMII module type change.


All standard recovery functionality has been preserved
You can still boot to recovery and flash software via normal methods.

Additional Features:

  • Root password “hackedVCM” (no quotes)
  • Telenet server
  • FTP server
  • Testmode web server (all original testmode functionality preserved including serial number change)
  • Added change module type (Ford, Mazda, whatever) to web server
    ‘Other Functions’ > ‘Set Module Type’
  • SD card & JFFS2 partition are mounted RW in the same place they would be in production, /mnt/sd & /etc/vci/config respectively.
  • Added WiFi support in recovery but leaving the interface disabled for now. I have concerns about browning out the device if external power isn’t present as USB only power isn’t sufficient. If you want to test it out you can use standard linux ifconfig commands to bring the interface up, all drivers are present.
  • Custom recovery currently survives reflash (until they change the way they deploy updates)

To Do:
The next thing I am working on is my custom web browser based flasher.

To deploy the firmware:
If you are updating from my previous firmware you only need to perform steps 1, & 4-7.

  1. Download and extract the firmware from this post
  2. Use the testmode exploit from my first post and then launch telnet
  3. Run the following commands to change the root password (non persistent):
    1. echo “root:$1$quzG9B6u$qqNRmEdJ0igLcxha0qzp3/:0:0:root:/:/bin/bash” > /etc/passwd.tmp
    2. tail -n 14 /etc/passwd >> /etc/passwd.tmp
    3. mv /etc/passwd.tmp /etc/passwd
    4. chmod a+r /etc/passwd
  4. launch your favorite FTP client and connect to using user ‘root’ and password ‘hackedVCM’
  5. upload the two firmware files ‘’ & ‘’ to the ‘/tmp’ folder
  6. Returning to the Telnet session, run the following commands to flash the new recovery firmware:
    1. /usr/local/mtd/flash_unlock /dev/mtd4
    2. /usr/local/mtd/flashcp -v /tmp/ /dev/mtd4
    3. /usr/local/mtd/flash_unlock /dev/mtd5
    4. /usr/local/mtd/flashcp -v /tmp/ /dev/mtd5
  7. Reboot your VCMII into recovery (hold the button in while applying power and keep it depressed until the VCM beeps)

Congrats, You are now on the hacked recovery firmware. You should be able to cross-flash to Ford/Mazda/Landrover/whatever after changing the module type to an appropriate value. Same goes for serial number changes.

As of right now I don’t see a reason to modify the production firmware that normally boots as everything we are trying to accomplish can be done in recovery.


Download: VCM2 FW 20151219!IFJznTpb!4EQRcpXggxp148Qhr_VUb4aYuIEZaL...



How to add/delete RPO F45 option codes with TECH 2 scan tool

This details out what exactly is needed to add/change RPO option codes to existing 1997+ Corvette's, using a Tech 2 scan tool.

These instructions will also help owners of F45 real time dampening suspension option convert to regular shocks that don't have sensors built in. Right now people are paying upwards of $200.00 for emulators that plug into the wiring harness to trick the BCM. A simple solution is to just go into the BCM's function and toggle off the F45 suspension options. No codes will be set and the car will not go into reduced engine power mode.

Defrost vent:

tech-2-add-RPO-option-codes-2 tech-2-add-RPO-option-codes-1

Step 1: Obtain a working TECH2 (original or HQ clone- both ok)


note: Tech 2 knockoff has many types and here is a chart for you to know all.

Item NO. Package Weight(kg) 32MB Card CANDI TIS2000 USB Key Hot Selling
SP23 Plastic Case 5.1 Yes Yes YES ★★★★★
SP23-1 Carton Box 3.5 Yes Yes yes ★★★★★
SP23-B Plastic Case 4.8 Yes Yes yes ★★★★★
SP23-B3 Carton Box 3.2 Yes Yes yes ★★★★★
SP23-C Plastic Case 8.9 Yes Yes yes ★★★
SP23-D Plastic Case 8.9 Yes Yes yes ★★★
SP23-D1 Plastic Case 8.9 yes yes yes just add 1*sp23-v vci module
All of GM Tech2 are same functions, they are just from different factory.
SP23,SP23-1 the same, just the package case is different, one is with plastic case, one not.
SP23-B,SP23-B3 the same factory, the packing is different, one is with plastic case, one not.

Step 2: Startup TECH2


Step 3: Enter Diagnostics menu


Step4: Enter year of car


Step5: Enter Passenger Car menu


Step 6: Select Body from the menu


Step 7: Select Y body from menu


Step 7: Select Y body from menu


Step 9: Select transmission type


Step 10: Enter body control module menu for adding/deleting option codes such as automatic headlamps,F45 suspension.


Step 11: Enter Special Functions menu


Step 12: Enter BCM RPO Reprogram

Step 13: Enter cars country of origin


Step 14: Toggle functions on and off. The asterisk next to the option code indicates this function has been turned on. Note that the Automatic and Manual HVAC controls are both turned on. This is normal and should be ignored. Go ahead and hit the save option button when you're done and power off the TECH2.


Note: If your vehicle was built after Feb 02 you may or may not have the sensor installed from the factory required to make the T82 automatic headlamp function by simply turning it on in the cars BCM. A quick way to verify this is to remove (no tools required) the defroster vent on the center of your dash. There should be 2 sensors installed. The sensor on the right is for your climate control and the sensor on the left is for the T82 automatic headlamp control. If this sensor is not present it can be purchased from GM for about $12.00. The part number is 12450121 and it simply snaps into a space already provided on the defroster grill.

Next you need to find the pigtail that plugs into the sensor. It is on the right side of the steering column and has a piece of white tape holding it folded in half. Cut or tear the tape and leave it dangling down.

Now, take a metal clothes hanger, and stick it down through the defroster hole in the dash. You will see a little 1 inch by 1/4 inch slit to slide the hanger through, then force it to the floor. Tape the pigtail to the hanger and pull it back up through the hole in the dash. Then plug it in to the sensor, snap the grill back in and you are done.

Have fun!