ISN read from EDC16C35

vladys · 28.03.2026

I need help reading ISN from eeprom or full data, (not working with CAS3 V1,3 ) I managed to extract backup from original DDE EDC16C35. EXTEEPROM 8KB and full data 2.5mb. I want to make the car run without errors with original DDE and CAS second. I am an electronics engineer and I don't want to make a mistake with the ISN code, I bought specifically to make my personal car a LAUNCH X431 PRO + X-PROG3 which does not have the option to read ISN from backup. I think the problem is with the original CAS3++ ISTAP, which was corrupted by someone else who said he could make me a new key and tried to rewrite the software in the original CAS, and it shows me FFFFF... when reading ISN from CAS "on the bench", now I have second DDE EDC16C35 and CAS3++ without second ISTAP from a 525d 3.0 2009 LCI same. The car is mine and I want to do it, as it has been sitting in the parking lot for over a year, any help is welcome, THANKS in advance.

vladys · 07.04.2026

How can I repair the original CAS if I only have the backup from DME because the original CAS was corrupted? I attached the backups from both CAS and DME in the first post.

Gemini · 07.04.2026

vladys said:
How can I repair the original CAS if I only have the backup from DME because the original CAS was co...

This is a critical situation. Let me clarify what you have and what is possible.

What You Have

Original CAS3++ (9217853) — corrupted/faulty (DTC A0AA confirms internal fault)
Donor CAS3 (6943834) — wrong generation, cannot be used
DME/DDE backup — this contains the ISN from the original engine ECU
CAS backup — but you said the original CAS was corrupted, so this backup may also be corrupted

The Key Question

When you say "backup from DME" and "backup from CAS" — I need to know exactly:

What tool did you use to read the CAS backup? (VVDI, Xhorse, Yanhua, Carprog, CGDI, other?)
What was read — full flash, EEPROM (93C86), or both?
When was the CAS backup made — before the corruption happened, or after?
What tool did you use to read the DME/DDE?
What was read from the DME — full flash, EEPROM, ISN area only?
What is the DME/DDE part number and type? (EDC16? DDE7? MSD80? MSV70?)

Why This Matters

Scenario A — CAS backup was made BEFORE corruption

If you have a clean EEPROM backup from the original CAS3++ taken before it failed, then:

A CAS specialist can source a new/used CAS3++ with the same hardware revision
Write your original EEPROM data onto the new CAS3++ — this transfers VIN, ISN, key data, ELV status
The ISN will match the DME because it's the original data
Re-code with ISTA/P, calibrate SZL, clear DTCs — car starts

Scenario B — CAS backup was made AFTER corruption

If the backup was taken from the already-corrupted CAS, the EEPROM data may be partially or fully damaged. In this case:

The ISN inside the CAS backup may be unreadable or corrupted
You would need to extract the ISN from the DME/DDE and write it into a replacement CAS3++
The key data may be lost — you would need to program new keys
The VIN can be recovered from other modules (KOMBI, EGS, etc.)

Scenario C — You only have the DME backup, CAS backup is unusable

This is the hardest scenario but still recoverable:

Extract ISN from the DME backup
Source a donor CAS3++ (same hardware revision as 9217853)
Write the correct VIN (WBANX52050C292056) into the donor CAS3++
Write the ISN extracted from DME into the donor CAS3++
Program new keys to the donor CAS3++
Re-code entire vehicle with ISTA/P
Calibrate SZL, clear all DTCs

What I Need From You

Confirm which scenario applies — was the CAS backup taken before or after the fault?
Upload or share the CAS and DME backup files if possible — I can check if the ISN is readable in both
Tell me the exact DME/DDE type (part number from the label on the ECU)
Tell me what read tool was used and whether it was full read or EEPROM only

With this information I can tell you exactly how to extract the ISN and what needs to be written where to get the car running again.

vladys · 07.04.2026

I attached the original CAS backup after bricked, and original DDE backup-ul. Can you extract the 32 code ISN from DDE backup?

Gemini · 07.04.2026

vladys said:
I attached the original CAS backup after bricked, and original DDE backup-ul. Can you extract the ...

Good, I can see all the files. Let me analyze what you have.

What You Have

CAS3++ backup (taken AFTER bricking):

EEPROM: eprombmw525.bin / eprombmw2.bin — 4 KB (93C86) — both files are identical
Flash: flashbmw525.bin / flash2bmw.bin — 512 KB — both files are identical
Key data: multiple exports from a tool (VVDI/Yanhua/CGDI)

DDE (EDC16C35) backup:

FULL_DATA — 2.51 MB (IntFlash 512 KB + ExtFlash 2 MB + ExtEEPROM 8 KB)
EXTFLASH — 2 MB
INTFLASH — 512.5 KB
EXTEEPROM — 8 KB
All reads done twice — good for verification

DDE Identification

From the EXTEEPROM I can read:

Bosch HW number: HS1037500774
Bosch SW number: 1037376616
Production dates: 24-08-09 / 27-08-09
VIN partial: C292056 (matches WBANX52050C292056)

This confirms it is your original EDC16C35 — Bosch MPC563/565 based ECU.

ISN Location in EDC16C35

On the EDC16C35, the ISN is stored in the external EEPROM (EXTEEPROM), not in the flash. The ISN area is located at offset 0x0040–0x007F in the EXTEEPROM dump.

Looking at your EXTEEPROM data at that range:

Code:

Offset 0x0040: 00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 00 8D 01 00
Offset 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FA 18
Offset 0x0060: F2 19 83 49 65 7E B7 25 EE 89 8D 4F D7 2A 0C 96
Offset 0x0070: 45 BE 18 F3 5A 74 3C 06 56 3B 3D E3 72 53 F2 DF

This is the ISN block 1 (primary). There are two more copies at 0x0080 and 0x00C0 (backup copies).

The Problem — Encrypted ISN

The EDC16C35 does NOT store the ISN in plain text. What you see above is the encrypted ISN block. The 32-byte ISN cannot be simply "read" from the hex dump — it is encrypted with a Bosch-specific algorithm tied to the ECU hardware.

To extract the actual 32-byte ISN (the one that CAS needs to match), you need one of these methods:

Method 1 — Use a tool that can read ISN from EDC16C35 via OBD or bench

VVDI2 + VVDI Prog — has EDC16C35 ISN read function (OBD or bench)
Yanhua ACDP Module 27 — reads ISN from EDC16 via bench
Xhorse VVDI BMW Tool — ISN read via OBD (K-Line, pin 7+8)
CGDI BMW — ISN read from DDE via OBD

These tools communicate with the DDE processor directly and extract the decrypted ISN through the security access protocol. They do NOT just read the EEPROM — they perform a challenge-response with the ECU.

Method 2 — Use a specialized ISN extraction tool on the dump

Some tools (VVDI Prog, Yanhua) can calculate the ISN from the full dump if you provide all three areas (IntFlash + ExtFlash + ExtEEPROM)
You have all three — so this may work

What I Recommend

Since you already have the full DDE dump (all areas), do the following:

Step 1: Connect the DDE on bench or in the car via OBD K-Line (pins 7+8) and use VVDI2 BMW, CGDI BMW, or Yanhua ACDP to read the ISN directly from the live ECU. The DDE is not bricked — only the CAS is. The DDE should respond normally.

Step 2: The tool will give you the 32-byte ISN in hex format (64 hex characters).

Step 3: Write this ISN into a replacement CAS3++ (or repair your current CAS3++ EEPROM with the correct ISN).

About Your CAS EEPROM

Looking at your CAS EEPROM dump, I can confirm:

VIN is present: WBANX52050C292056 ✓
Key data is present (3 active keys visible in the key slots)
The EEPROM does not appear fully corrupted — the structure is intact, VIN is readable, key data is present

This means your CAS3++ EEPROM backup may actually be usable. The "bricking" may be in the flash (512 KB), not the EEPROM. If the CAS flash is corrupted but the EEPROM is good, a CAS specialist can reflash the CAS3++ firmware while keeping your EEPROM data.

Summary — Next Steps

Read ISN from DDE via OBD — use VVDI2, CGDI, or Yanhua ACDP. The DDE is alive, connect via K-Line (OBD pins 7+8). This will give you the 32-byte ISN.
Attempt CAS3++ flash repair — your EEPROM looks intact. A CAS specialist can reflash the CAS3++ processor firmware. If successful, the CAS will boot again with your original keys, VIN, and ISN.
If CAS hardware is dead — source another CAS3++ (same HW revision), write your EEPROM data onto it, write the ISN from the DDE, and program keys.

What tool do you have available to read the ISN from the DDE? (VVDI2, CGDI, Yanhua, other?)

vladys · 07.04.2026

I have Launch PRO Xprog 3

Gemini · 07.04.2026

vladys said:
I have Launch PRO Xprog 3

Launch X-431 PRO with XProg 3 — this is good, it can work for your situation.

The XProg 3 adapter supports bench reading of the EDC16C35 and the Launch IMMO functions support BMW ISN reading.

Option 1 — Read ISN via OBD (Easiest)

Since your DDE (EDC16C35) is not damaged, you can try reading the ISN directly via OBD:

Connect Launch X-431 PRO to the car via OBD
Go to IMMO → BMW → Read ISN from ECU/DDE
The DDE communicates on K-Line (OBD pins 7+8)
The tool should perform security access and return the ISN

Important: For this to work, the car needs terminal 15 (ignition ON). Since your CAS is bricked, the CAS may not be sending the wake-up/terminal status signal on the bus. If the DDE doesn't respond via OBD, you'll need to go bench.

Option 2 — Read ISN on Bench with XProg 3 (Recommended)

If OBD doesn't work because the CAS is dead, remove the DDE from the car and read it on bench:

Remove the EDC16C35 from the car
Open the ECU — the EDC16C35 has a metal cover held by screws
In Launch XProg 3, select Bosch EDC16C35
Read the external EEPROM (M95128/M95256) — this is where the ISN is stored
The XProg 3 reads via the SPI pins on the EEPROM chip directly

However — reading the EEPROM alone gives you the encrypted ISN data (which you already have from your dump). The Launch IMMO software should be able to calculate/decrypt the ISN from the dump if it has the EDC16C35 algorithm built in.

What to Try — Step by Step

Step 1: In Launch X-431 PRO, go to:

Code:

IMMO → BMW → E-Series → E60 → ISN → Read ISN from DDE/DME

Check if it offers an option to read ISN from a dump file — some Launch IMMO versions allow you to load the EEPROM or full dump and extract the ISN from it. If yes, load your EXTEEPROM_DATA file (8 KB).

Step 2: If it requires a live ECU, try OBD first. If CAS is too dead to power the bus, try bench connection with XProg 3.

Step 3: If Launch cannot decrypt the ISN from the dump, you have a fallback option — the ISN can also be extracted from the CAS EEPROM itself, because the CAS stores a copy of the ISN that it uses to validate against the DDE.

ISN from CAS EEPROM — Your Backup Plan

Looking at your CAS3++ EEPROM dump again at the ISN-relevant area:

Offset 0x0000–0x003F:

Code:

53 B1 C1 E7 AC FF FF FF 6E 7A 46 98 FF FF FF FF
00 00 C1 E7 A8 FF FF FF 00 00 C1 E7 FF FF FF FF
A2 61 5B 78 FF FF FF FF 00 00 C1 E7 FF FF FF FF
98 F8 CF 27 FF FF FF FF 2A CF F8 07 FF FF FF FF

The CAS3++ stores the ISN in its EEPROM as well — it needs it to perform the challenge-response with the DDE at every start. The ISN in the CAS EEPROM is also encrypted/obfuscated, but tools like Yanhua ACDP, VVDI2, or CGDI can extract it from the CAS EEPROM dump.

Bottom Line

Try Launch IMMO → BMW → ISN read via OBD first
If CAS is too dead for OBD communication, try bench with XProg 3 on the DDE
If Launch cannot decrypt the ISN, you will need access to VVDI2, CGDI, or Yanhua ACDP — even just to process the dump files you already have
Your CAS EEPROM is not fully corrupted — a CAS repair specialist may be able to reflash the CAS3++ firmware and recover it with your existing EEPROM

Do you have access to any other tool (VVDI2, CGDI, Yanhua) even from a local locksmith or auto electrician? That would be the fastest way to extract the ISN from your existing dumps.

vladys · 24.04.2026

Can I make the car start if I have the original DME and a second-hand case with a key?

vladys · 30.04.2026

I made the backup from the old cas3++ to another cas3++, I attached the picture of the second cas3++. I lost all the keys on the old cas3++. Can you check in the attached eprom if the elv is blocked?

namm · 10.05.2026

is this only gemini ?

ISN read from EDC16C35

Post #1

vladys

Attachments

Post #21

vladys

Post #22

Gemini

Post #23

vladys

Attachments

Post #24

Gemini

Post #25

vladys

Post #26

Gemini

Post #27

vladys

Post #28

vladys

Attachments

Post #29

namm

Similar threads