MB CR3.44 how to immo off any way to do that ?

upload eeprom,renew and teach with star diag

Hello i use MPPSv21 to make copy ecu. Any one help witch immo off egr off ?

Hello here is my ECU full bakup. Any one can help witch immo off.

CR3.44
Bosh ED16C/C2-7.x MPC
A0014469130
Hardware 3904
Software 1407

A6461500391
0281012225

I need that immo off becouse that engine om646 and 6 speed manual gearbox Goes to my Old Nissan Cabstar also need egr off

Yes, I have C4 and Xentry Openshell. I have winols too, but I don't know how.

bluen47 said:

Yes, I have C4 and Xentry OpenShell. I have Java winols too, but I don't know how.

Click to expand...

Good — you have the right tools. Let me give you a practical step-by-step plan.

Step 1 — IMMO OFF in WinOLS

Since this is standalone (with no EIS on the CAN bus), you need to find and disable the IMMO routine in the flash.

Open your file in WinOLS:

• Load the Mercedes om646.bin as Bosch EDC16C2, MPC5xx, 1MB flash
• If you have a DAMOS/A2L for this SW (1037372414 / P467), import it — this will label all maps automatically
• If you don't have DAMOS, you need to search manually

To find the IMMO flag manually in WinOLS:

Look in the data/calibration area (typically 0x70000–0x80000 range). You are looking for a single byte that controls IMMO mode. Common patterns on EDC16C2:

• 0x01 = IMMO enabled (factory)
• 0x00 = IMMO disabled

A known method for EDC16C2 Mercedes is to search for the byte sequence related to the IMMO status. In many EDC16C2 files from this SW family, the IMMO enable byte is near the CAN configuration area.

However — since you are new to WinOLS, I don't want you to patch the wrong byte and brick the ECU.

Safer approach — use your tools together

Since you have Xentry/DAS + C4, here is what you can do before putting it in the Cabstar:

While the ECU is still on the bench or connected to a test harness:

1. Use Xentry to read the ECU and confirm all current coding/adaptation values
2. Note down the current IMMO status and all SCN codes
3. This gives you a baseline to revert to if needed

Step 2 — EGR OFF in WinOLS

This is easier and safer than IMMO. In WinOLS:

1. Open the file and look for maps with axis values that match typical EGR parameters (RPM vs load/injection quantity)
2. You are looking for 2D or 3D maps where values go from 0 to ~100% (EGR valve position target)
3. Set all values in the EGR target position map to 0
4. Set all values in the EGR PWM/duty cycle map to 0
5. If there is a DTC enable map for EGR, disable it to prevent fault codes

What I need from you to help further

Can you do the following:

1. Open the file in WinOLS and tell me whether WinOLS recognizes it automatically and finds the maps. Does it show a map list, or is it blank?
2. Check whether you have a DAMOS — in WinOLS go to File → Search DAMOS online or check whether your WinOLS installation has a matching DAMOS for Bosch 1037372414
3. Screenshot the map list if WinOLS finds maps — post it here and I can identify exactly which maps are for IMMO and EGR
4. Do you have the full wiring diagram for the OM646 ECU? You will need to know which pins to wire and which to leave disconnected for standalone use in the Cabstar

Once I know what WinOLS shows you, I can guide you through the exact maps to modify. Don't change anything in the file until we confirm the correct locations.

hello edc16c2 it is possible to change orginal ecu to standalone ecu ?

Yes, it can be done — but "standalone" on a Mercedes EDC16C2 means solving two separate things, and only one of them is a file edit.

1. What actually blocks the start
On CR3.x the DME does not start until it gets the release from the EIS/DAS over CAN (on some vans there is also a separate WSP/immo box in the loom). No release = injectors stay dead. So either you remove that dependency in the firmware, or you carry the factory immo set over to the Cabstar.

2. Two realistic routes

• Keep the donor set (safest, no file work): transplant DME + EIS/ignition lock + original key + the immo section of the MB loom. Everything stays paired, you just power it and turn the MB key to release the DME. Many engine swaps are done exactly this way.
• IMMO OFF in the flash: the authorization/WSP block in the EDC16C2 firmware gets patched so the DME no longer waits for the release. This is not a single byte in the calibration area — on MB CR3 it sits in the code/authorization block and the EEPROM (95320) usually has to match. Realistically this is a job for a file service or a tool with a verified MB EDC16C2 / OM646 profile. Also worth checking thread #2142, same ECU family (0281012225 / A6461500391), where the WSP immo module topic came up.

3. What still has to be handled after immo
Even with immo off the DME expects: T15/T50, crank + cam, rail pressure and actuator, accelerator pedal, glow relay, fan, and it will log CAN timeouts for cluster/ESP/EIS. Those DTCs normally don't stop the engine, but you won't have a working tacho/temp gauge unless you feed the Nissan cluster or use the MB cluster.

4. Before anything else — backup
Confirm you have a full flash read + the 95320 EEPROM. MPPS v21 on EDC16C2 is OBD and often gives only a partial/calibration read. For this job read on bench with BDM/KTAG (BDM100, KTAG, etc.) so you have a complete, restorable original.

To point you further, tell me:

• donor vehicle exactly (Sprinter W906 / Vito W639 / W211, year)
• do you have the EIS + original key + loom, or only the DME?
• is your read a full flash or partial, and do you have the 95320 dump?

i have a engine, gearbox, engine cables and ecu, no key eis etc. may i use other ecu for this 646 engine with no immo ?

Short answer: swapping in "another ECU without immo" is not really a thing on this engine — every CR3.44 / EDC16C2 that came on an OM646 left the factory immo-linked to an EIS. There is no factory variant of that ECU sold without the authorization block. So your realistic options are:

1. Immo off in your own ECU (best fit for a Cabstar swap)
This is what most engine-swap builds do. You keep the ECU that already belongs to your engine, so injector codes, variant coding and SCN stay correct — nothing to re-teach. The authorization/WSP part of the firmware gets patched so the DME stops waiting for the EIS release. For MB CR3 this normally needs both:

• full flash read (not just the calibration area)
• the EEPROM (95320 on most CR3.44) read as well

With MPPS v21 you can do that, but on EDC16C2 the reliable way is bench/BSL, not OBD. If you already have both files, that's the package a file service needs.

2. Buy a used ECU + EIS + key as a matched set from one donor car
Works, but then the ECU is not yours: it will have the donor's injector correction codes and variant coding, so you'd have to recode injectors and the variant data with Xentry to match your engine. Also a random EIS + key from another car will not pair with your ECU without a renew/teach procedure — which is what mercis meant earlier, and it needs the ECU EEPROM virginized first.

Given you have no key and no EIS at all, option 1 is clearly cheaper and cleaner.

To move forward, tell me:

• What exactly did you manage to read with MPPS — full flash only, or flash + EEPROM? OBD or bench?
• EEPROM type on the board (95320 / 95160 — it's printed on the chip)
• Confirm ECU data again: A0014469130, HW 3904, SW 1407, 0281012225 / A6461500391

Also worth deciding now whether you want EGR off in the same file — better to do both patches in one write than to flash the ECU twice.

i have full read of ECU i use KTAG for the process, i dont now why some person spek to me edc16c2 is not possible and another one spoke yes its no problem can you explane me ?

Both camps are half right — that's why you got two different answers. Let me clear it up.

Why "not possible": On MB CR3 / EDC16C2 the immo (WSP) is not a single calibration byte you flip like on an old VW EDC15. The authorization sits in the protected code/authorization area and it is crypto-based — you can even see it in your own file: the FLS contains the string Customer-DC-CR3-OM646-PubKey-S012, which is the signed authorization key block. People who only know the "flip one byte in the map area" method correctly say that approach won't work here.

Why "no problem": It is doable when you have the full flash + the EEPROM together, because the immo state lives across both and can be neutralised consistently. It just needs a tool or file service with a verified MB EDC16C2 / OM646 immo-off routine, not a manual hex guess.

The good news — your read looks complete. From what you uploaded I can see:

• MERC EDC16C2 ORI.FLS — 1 MB external flash, SW 1037372414P467/120 + 1037389924P467/122, variant CR30-646-12E2
• MERC EDC16C2 ORI.MPC — the MPC555 internal flash (startup/boot block present)
• MERC EDC16C2 ORI.EPR — 4 KB, this is your 95320 EEPROM

That is exactly the set needed for immo off on this ECU. KTAG in BSL/bench is the right way to read it, so you did the correct thing.

One thing I can't tell just from the strings: the immo-off itself must be applied to both the flash and the EEPROM and then checksum-corrected. I did not verify the checksums or patch anything here — I only read the identifiers.

So: not a myth, but not a one-byte trick either. Next step is to run these through a verified CR3.44 immo-off solution/service. Do you want to attempt it in WinOLS with a proper profile, or hand the flash+EEPROM to a file service? And can you confirm the MPC + FLS are from the same KTAG session as the EEPROM, so everything matches?

All 3 files come from one session KTag. I asked Polish tuners whether they would do immo off after I sent them the files attached above, and I was told no. I don't know what to do; if it's not possible, I'll sell the OM646 and buy something else for swapu.

The fact that Polish tuners refused doesn’t mean it can’t be done — it only means that the particular people you asked don’t offer this specific procedure. Immo off on MB CR3.44 / EDC16C2 isn’t a matter of switching a single byte in a map, but work on the protected authorization block (WSP), which is cryptographic — in your FLS, this signed block appears as Customer-DC-CR3-OM646-PubKey-S012. Many "chip tuners" only handle EGR/DPF in the calibration area and simply don’t touch this block, hence the answer "it can’t be done".

What matters in your case: you have the complete set of files that such a service needs — the full 1 MB flash (FLS), the internal MPC555 (MPC), and the 4 KB 95320 EEPROM (EPR), all from a single KTAG session. So you did everything correctly on the reading side, and nothing is missing.

Before you sell the engine:

• Look for a service/tuner that explicitly lists immo off for Mercedes CR3 / EDC16C2 / OM646 in its description, rather than some generic "immo off". Ask specifically whether they neutralize the authorization in the flash and in the EEPROM with checksum correction — if someone does this for this family, they’ll answer right away.
• Always send all three files (FLS + MPC + EPR), because the immobilizer status is stored in both the flash and the EEPROM — nobody will do this properly using the flash alone.

An alternative, if you can’t find anyone to work from the file: buy a used set from a single car — controller + EIS + key and run it with the original authorization. The downside is that such a controller contains the donor’s injector codes and coding, so it would need to be recoded for your engine in Xentry. If you don’t have the EIS and key, it still works out cheaper immo off in your own controller.

Write which area/which platform you searched on — I’ll suggest how to phrase the inquiry so you can immediately filter out those who only do maps.

I'm from Poland; I searched on Polish classified-ad websites. This engine suits me idealnie. It isn't very large, I have the original 6-speed manual gearbox, I'm having a driveshaft made, and I'm ready to go. I just can't start it because there is no start authorization, and the engine isn't building pressure in the rail.

That’s exactly how it all fits together — lack of rail pressure isn’t a separate fault, but a consequence of the missing start authorization. Until the DME receives authorization (or you have it disabled in the file), the ECU keeps the engine in "no start" mode and doesn’t control the metering valve / pressure regulator, so the pump doesn’t build pressure in the rail. DlategoThe engine has no chance of starting. Sorting out the immobilizer should resolve both symptoms at once.

Since you’re happy with the engine idealnie and want to keep it, I’d stick with the immo off file-based route — you have the complete set (FLS + MPC + EPR from one KTAG session), which is exactly what such a service needs. Don’t sell the engine just dlatego because several tuners refused; it’s a matter of finding someone with a verified procedure for CR3 / EDC16C2 / OM646, rather than a generic "immo off" in the calibration area.

Before you attribute the lack of pressure solely to the immobilizer, though, it’s worth checking the following mechanically after the immo off work has been done:

• whether the pump and rail are filling (bleed the fuel system after swapie)
• the crankshaft / camshaft speed sensor — without a speed signal, the DME won’t command pressure anyway
• the metering valve on the pump and the pressure regulator on the rail — whether they are receiving ground/control

To advise more precisely: what exactly does Xentry show when you attempt to start — which fault codes (especially those relating to WSP/authorization and rail pressure), and can you see crankshaft speed in the live data while cranking the starter?

Yes, you can see the RPM; everything works, the valves, etc.—everything has been checked, but the maximum rail pressure is only 80 bar, and there is no start authorization. I don't know, maybe there's someone on the forum who can do immo off. If not, the decision is to sell the engine and buy another one, perhaps an M47 or M57.

It all adds up to one picture: since there is cranking speed, the sensors and valves have been checked, and the rail reaches only ~80 bar while there is a no-authorization message — this is a classic symptom of an immobilizer lockout. Without authorization, the DME does not enter starting mode and deliberately does not provide full control to the metering/regulator valve, so the pump cannot build starting pressure (in reality, you need ~250+ bar for injection to start at all). So you do not have a mechanical fault — the start is blocked. Immo off should remove both symptoms at once.

Dlatego I wouldn't sell the engine just yet if I were you. You have a complete set of files from one session KTAG (FLS + MPC + EPR), which is exactly what someone with a ready-made procedure for this family needs.

What I would do specifically:

• Create a separate thread in the file section / request area with a clear title, e.g. "IMMO OFF MB CR3.44 EDC16C2 OM646 – FLS+MPC+EPR" and attach all three files. Here, in a theory thread, it is easy to overlook that you are looking for someone to do the job.
• In the description, state explicitly that the authorization (WSP) is to be neutralized in the flash and EEPROM with checksum correction — this will immediately filter out those who only do EGR/DPF calibration.
• Do not send the flash alone — nobody will do this properly without the EPR.

As for the alternative of using a different engine — the M47/M57 (BMW) is a different story; there is also EWS/immobilizer to deal with there when swapie, so you will not escape the authorization issue, you will only change platforms. So before giving up on the OM646, I would first try to find someone to do it immo off — you have already completed the most difficult part (a correct, complete readout).

If you want, paste the exact error code from Xentry concerning authorization/WSP as well — sometimes the wording shows whether the lockout is on the DME side alone or whether there is also a separate WSP controller in the wiring harness.