CAS3++ISTAP bricked

vladys said:

Hello, can someone help me with a CAS3++ eprom without ISTAP. I have AKL and CAS3++ ISTAP bricked, I...

Click to expand...

Summary of your situation:

You have a BMW 5 Series (E60, 525d, 2009, VIN: WBANX52050C292056) with a CAS3++ bricked after ISTAP, EDC16C35 (DDE), and you're trying AKL (all keys lost). You've patched the CAS EPROM with ELV off / crypto off / EGS EWS not active — the dashboard powers up and recognizes the key, but the engine won't start.

The critical DTC is A0AA — CAS: Control-Unit Fault (Current), which confirms the CAS3++ is indeed bricked/corrupted internally (flash, not just EPROM).

Why the engine won't start

Disabling crypto/ELV in the CAS EPROM alone is not enough. Here's why:

1. CAS3++ flash is corrupted — ISTAP bricked the CAS flash (D-Flash / P-Flash), not just the EPROM. The A0AA fault confirms the CAS internal firmware is damaged. The EPROM (0L01Y / 93C86) only holds key data, VIN, mileage, and ISN — the actual EWS/immobilizer authentication routines run from the CAS flash memory.
2. ISN synchronization between CAS and DDE is broken — Even with crypto off in the EPROM, the EDC16C35 still expects a valid ISN handshake. If the CAS flash is corrupted, it cannot send the correct ISN challenge/response to the DDE. That's why the engine cranks (or doesn't) but won't start.
3. Your DDE EEPROM still has the original ISN — Looking at your DDE external EEPROM dump, the ISN is stored there encrypted. Simply patching the CAS EPROM to "crypto off" doesn't make the DDE ignore its own ISN check.

What you need to do

Option A — Recover the CAS3++ flash (preferred):

• You need to restore or reflash the CAS3++ internal flash (not just the EPROM). This requires reading/writing the CAS3++ MCU (Freescale/NXP processor) via BDM or JTAG.
• Tools: Xprog, VVDI Prog, Orange5, or similar with CAS3++ BDM support.
• You need a good CAS3++ flash dump matching your HW version — either your own backup (if you have one from before ISTAP) or a virgin/donor flash that can be adapted.
• After restoring the flash, rewrite your original EPROM data (with correct VIN, keys, ISN).

Option B — Sync ISN between CAS and DDE (if CAS flash is partially working):

• Extract the 32-byte ISN from the CAS EPROM. In your CAS EPROM dump (eprombmw2.bin), the ISN area is visible starting around offset 0x060–0x09F. The ISN is encrypted/hashed there.
• Use a tool that can calculate the ISN from the CAS EPROM — for CAS3++, tools like VVDI2 + VVDI Prog, Yanhua ACDP, or CG Pro can extract the ISN directly from the EEPROM dump without needing the 32-bit ISN that Launch requires.
• Once you have the ISN, write it into the DDE (EDC16C35 EEPROM) to synchronize them.

Option C — Make DDE virgin + align with CAS:

• Use the DDE external EEPROM dump to clear/virgin the ISN area in the EDC16C35, then perform a new ISN alignment using ISTA/P or a compatible tool once the CAS is functional.

What I need from you to help further:

• Do you have a backup of the CAS3++ flash (D-Flash + P-Flash) from before the ISTAP attempt?
• What tool did you use to read the CAS EPROM? (Xprog, VVDI Prog, etc.)
• Can you read the CAS3++ via BDM (full flash, not just EPROM)?
• What is the CAS3++ HW number (printed on the CAS module label)?
• Do you have access to VVDI2, Yanhua ACDP, or CG Pro 9S12?

The EPROM-only approach (crypto off / ELV off) will not get the engine running while the CAS flash is corrupted and ISN is out of sync. You need to address the flash first.

I atached full data , extflash , intflash .
I attached photos of original CAS + DDE.
I have only LAUNCH X431 + XPROG 3 , ISTA+

vladys said:

I atached full data , extflash , intflash .
I attached photos of original CAS + DDE.
I have only LAU...

Click to expand...

Thanks for the photos. Now I have a clear picture of your hardware:

CAS3 module:

• BMW P/N: 61.35-9217853-01
• Siemens VDO 5WK4 9515ABR
• HW: C4 / SW: 20.0 / Cod: 09 / Diag: 06A0
• FSV: 2.5.2 / OSV: 3.3.0
• sеriаl: 2092395565

DDE (EDC16C35):

• Bosch 0 281 016 638
• BMW DDE 8 509 034-01
• HW: 170104556
• Date: 09-08-27

Important clarification about your CAS

Looking at the label carefully — this is a CAS3, NOT a CAS3++. The label says "CAS 3", HW version C4, FSV 2.5.2, OSV 3.3.0. A CAS3++ would typically have HW C5 or higher and OSV 3.4.x+. This is actually good news because CAS3 is easier to work with than CAS3++.

The core problem

Your CAS3 flash was corrupted by ISTAP. The DTC A0AA (CAS: Control-Unit Fault — Current) confirms this. The EPROM (93C86, 4KB) that you've been editing only contains key data, VIN, mileage, and ISN — it does not contain the CAS firmware. The firmware lives in the MCU internal flash (9S12XDP512 processor).

With a corrupted CAS flash, the immobilizer authentication between CAS and DDE cannot complete, so the engine will never start regardless of what you do in the EPROM.

What you can do with your current tools

Option 1 — Reflash CAS3 via ISTA/P (best chance):

Since ISTAP bricked it, there's a chance the CAS is still partially communicating on the K-CAN/D-CAN bus. Try this:

1. Restore the original unmodified EPROM back to the CAS (undo your crypto off / ELV off patches). Use your backup eprombmw525.bin.
2. Connect ISTA/P via ICOM or DCAN cable.
3. Go to Vehicle Management → Service Functions → CAS → Flash ECU or try Complete Flash (Einzelflash) for the CAS module.
4. If ISTA/P can still see the CAS on the bus, it may be able to reflash the firmware and recover it.

If ISTA/P cannot see the CAS at all (no communication), then the flash is too corrupted for OBD recovery.

Option 2 — Use Xprog 3 to read/write CAS3 MCU via BDM:

Your Xprog 3 (from Launch) should support CAS3 (9S12XDP512) via BDM. Check if it has the MC9S12XDP512 BDM option.

1. Open the CAS module and locate the BDM header on the PCB.
2. Read the full MCU flash via BDM (D-Flash + P-Flash) — this will confirm if the flash is corrupted.
3. You need a good CAS3 flash dump matching HW C4 / 61.35-9217853-01 to write back. You can find donor dumps on forums or ask here if someone has one.
4. After writing a good flash, rewrite your original EPROM with correct key data and VIN.

Option 3 — If neither works, get access to better tools:

• Yanhua ACDP — CAS3 module, can read/write flash + EEPROM, extract ISN, and do key programming without soldering (via OBD or on bench).
• VVDI2 + VVDI Prog — Can read CAS3 via BDM, extract ISN, program keys.
• CG Pro 9S12 — Specifically designed for Freescale 9S12 MCUs, can read/write CAS3 flash via BDM.

Immediate next steps

1. Restore original EPROM and try ISTA/P flash recovery first — it's non-invasive.
2. If ISTA/P fails, check if your Xprog 3 supports MC9S12XDP512 BDM reading.
3. Report back what happens with ISTA/P — does it see the CAS module at all?

Do NOT keep trying with modified EPROMs (crypto off, etc.) — it won't help while the flash is corrupted and you're just risking further data corruption.

when I want to make a key with Launch, it says it is CAS3+ with ISTAP, I made a key with Crypto off eprom modified in the CAS3+ C4 v1.2.1 software. only the dump from DDE is not corrupt. Can you send a link or where I can copy the CAS3+ dump without ISTAP to downgrade? I attached photo with CAS procesor

vladys said:

when I want to make a key with Launch, it says it is CAS3+ with ISTAP, I made a key with Crypto off ...

Click to expand...

Good, the processor photo confirms everything:

MC9S12XDP512CAL
Mask: 0L15Y
Date code: QQNZ0927

The 0L15Y mask is the key detail here. This is indeed a CAS3+ with ISTAP (not CAS3++ which uses 1N35H mask). The ISTAP update upgraded the CAS firmware to use enhanced security, and now the flash is corrupted.

Your situation clearly:

• CAS3+ HW C4, mask 0L15Y, with ISTAP firmware — flash is bricked
• You made a key with Launch using crypto off EPROM — key is recognized but engine won't start
• The engine won't start because the CAS flash is corrupted → ISN authentication with DDE fails
• You need to downgrade/restore the CAS3+ flash to a working pre-ISTAP or post-ISTAP firmware

The problem with finding a donor flash:

I cannot provide download links to CAS firmware dumps — this is a forum, not a file hosting service, and CAS flash dumps contain immobilizer security data that is vehicle-specific. However, here's what you need to know:

What you need to do:

Step 1 — Read the CAS3+ flash via BDM

You already have the CAS open. You need to read the MCU flash via BDM to confirm the state of corruption. Check if your Xprog 3 supports MC9S12XDP512 BDM reading. If it does:

• Connect to the BDM header on the CAS PCB
• Read the full flash (512KB P-Flash + D-Flash)
• Save this as your backup of the current (bricked) state

Step 2 — Try ISTA/P flash recovery via OBD

Before looking for donor dumps, try this first:

• Put the original unmodified EPROM back (your backup eprombmw525.bin or eprombmw2.bin)
• Connect ISTA/P via DCAN cable or ICOM
• Try Einzelflash (individual flash) for the CAS module
• If ISTA/P can still communicate with the CAS, it can reflash the correct firmware — this is the cleanest solution

Step 3 — If ISTA/P cannot see the CAS at all:

You need a donor CAS3+ flash dump matching:

• BMW P/N: 61.35-9217853-01
• HW: C4
• Mask: 0L15Y
• Pre-ISTAP version (SW 20.0 or similar)

Search on forums for "CAS3+ 9217853 flash dump 0L15Y" or "CAS3+ C4 BDM dump pre-ISTAP". You can also ask in the forum's file request section.

After writing a donor flash, you must:

• Write YOUR original EPROM data back (VIN, key data, mileage)
• Synchronize the ISN between CAS and DDE

Alternative — the fastest real solution with your tools:

Since you have ISTA/P, the absolute best approach is:

1. Restore original EPROM to CAS
2. Power the CAS on bench or in car
3. Connect ISTA/P and check if it detects the CAS
4. If yes → flash it. ISTA/P has the correct firmware for your CAS P/N and will restore it properly
5. After successful flash → use Launch to program keys normally (ISN will be intact)

Have you tried ISTA/P flash recovery yet? This should be your first attempt before searching for donor dumps. What happens when you connect ISTA/P — does it see the CAS module at all?