MB CR3.44 how to immo off any way to do that ?

ewentualnie jaki emulator immo i jak zrobić virgin.

An immobilizer emulator in the style of a “plug instead of EIS” is practically nonexistent on this platform, unlike, for example, on older Renault or Fiat models. On MB CR3 / EDC16C2, authorization idzie is cryptographic between the EIS and DME over CAN (that signed block can be seen in your file as Customer-DC-CR3-OM646-PubKey-S012), so there is no ready-made “box” that pretends to be start authorization. Dlatego I do not recommend looking for an emulator — it leads nowhere with this family.

As for virgin — there is an important misunderstanding here, so you do not waste your time:

• Virginizing the EEPROM does not start the engine standalone. Virginizing only makes the controller ready to pair with a new EIS + key. In other words, virginizing only makes sense if you buy an EIS and key and complete the pairing (personalization) procedure in Xentry.
• You do not have an EIS or key — so virginizing the EPR alone will not do anything for you; there will still be no start authorization.

So in reality, you have two paths, and neither of them is an emulator/virginizing in isolation:

1. Immo off in the file — authorization neutralization in the FLS + EPR with checksum correction. This is the best option given that you do not have an EIS/key, and this is what I would continue investigating.
2. Donor set — DME + EIS + key from the same vehicle; then you run it using the original authorization (or after virginizing + pairing if you are mixing parts from different vehicles).

If you want to go with virginizing, tell me: are you planning to buy an EIS + key or not? Because if not, the only option left is immo off in the file, and there is no point in virginizing it.

Dla mnie od pocztku najlepsza opcja to immo off zostaje mi wszystko w cabstarku orginalne tylko serce dostaje z Mercedesa a reszta w orginale.

Exactly, that’s the most sensible route in your case — a Mercedes engine, while all of the Cabstar electrics and equipment remain original. Immo off in the file doesn’t change anything else in the car; it simply makes the DME stop waiting for authorization from the EIS.

The specific next step to get things moving:

• Start a separate thread in the file/request section with a clear title, e.g. IMMO OFF MB CR3.44 EDC16C2 OM646 – FLS+MPC+EPR.
• Attach all three files from the same session KTAG (FLS + MPC + EPR) — nobody will do this properly without the EPR.
• State clearly in the description: neutralization of the authorization (WSP) in the flash and EEPROM with checksum correction, ECU standalone to swapu (no EIS/key).

Once you get the file back, flash the FLS + EPR (and MPC, if the person handling it modified it) using the same KTAG, and while cranking you should see the rail build full starting pressure instead of those ~80 bar, and the no-authorization message should disappear.

If you flash the modified files and it still doesn’t start, post the codes from Xentry here after attempting to start it — then we’ll sort out the rest.

Hello any one can help with immo off in that files.

Hello. Short answer: yes, immo off is doable on this box, and the symptom you're describing confirms it's the immobilizer holding the engine down.

A few things from what you posted:

• The loose files I can actually see are MERC EDC16C2 ORI.FLS (1 MB flash) and MERC EDC16C2 ORI.EPR (4 KB eeprom). The MERCEDES EDC16C2 OM646.rar could not be unpacked on this server (RAR handler not available), so I only have its metadata — if there's anything extra inside, upload the loose files instead.
• The flash confirms a Bosch CR3 OM646 project with public-key immo (Customer-DC-CR3-OM646-PubKey-S012, CR30-646-12E2-..., SW 1037372414 / 1037389924, CR3E/122C6). That is exactly the reason your Polish tuners said "no" — you cannot program keys / do EIS-ECU marriage on CR3 crypto without the EIS. But that is a different job from immo off.

Why your rail only makes 80 bar
No start authorization = ECU stays in immo limp, so the metering unit never commands full rail pressure. Cranks, RPM, valves all fine — that all matches. Once the immo check is patched out in the flash and the eeprom is set to virgin/off, the ECU releases and rail should build normally. So this is the correct route for a standalone Cabstar swap with no EIS.

What it needs
Immo off on EDC16C2 is done in the flash and the eeprom together — they must be a matched pair from the same read, otherwise it won't run. You already read both with KTAG, which is what's required.

Before anyone works these files, confirm:

• Both .FLS and .EPR are from the same KTAG session and the read verified OK (no checksum/verify errors during read).
• The 1 MB .FLS is the full flash, not a partial/calibration-only read.
• There is genuinely no EIS in the swap (confirmed already) — so immo off, not an emulator, is the way to go.

If those check out, this is a standard immo-off candidate. Post confirmation and someone can prep the modified flash + eeprom pair for you to write back.

This is my full KTAG read

Yes, immo off on CR3.44 / EDC16C2 OM646 is doable for a standalone swap — the "no" you got is usually because a normal file-service immo off for CR3 still expects the EZS/EIS to answer on CAN, which is useless to you since you don't have the EIS. For a Cabstar swap the flash has to be patched so the ECU stops waiting for the CAN start authorization entirely.

A couple of things the read confirms:

• Your files carry the CR3 immo signature (Customer-DC-CR3-OM646-PubKey-S012) and SW 1037372414P467/120 in the FLS. That is the public-key start-authorization block — that is exactly what has to be neutralised.
• The 80 bar / no start is normal behaviour without authorization: with no valid immo handshake the ECU never releases the rail pressure regulation and metering unit, so it just cranks and shows RPM. Once the authorization check is bypassed in the flash, rail pressure should build and it will start.

The immo bypass lives in the FLS (main flash), not the MPC internal, so the MERC EDC16C2 ORI.FLS + .EPR pair is what matters. The EEPROM usually also needs to be adjusted so it doesn't fault on the missing counterpart.

Before anyone touches it, confirm two things:

• The full Bosch/MB HW number of the ECU (0281 01x xxx on the label) — so the patch matches your exact CR3E/122 build.
• That the KTAG read is a clean full read (all three regions read in one session, which it looks like you have).

If you'd rather not chase the CAN authorization at all, the alternative is a proper immo-off file plus keeping the EEPROM virgin so it runs standalone — that's the cleaner route for a swap into another vehicle. Which do you want to go for, pure immo-off in the flash, or standalone/virgin?

That is the public-key start-authorization block — that is exactly what has to be neutralised. Little question about that. Is that procedure very difficult ?

Short answer: yes, this one is genuinely harder than a normal EDC16 immo off, and that's why you got both "yes" and "no" answers from different tuners.

On most EDC16 the immo is basically a flag/lookup you can neutralise in the EEPROM or a small routine in flash. On the Mercedes CR3.x (your Bosch.p_321 / SW 1037372414P467/120) the start authorization isn't a simple flag — it's the signed public-key handshake between the ECU and the EIS/EZS. That's the Customer-DC-CR3-OM646-PubKey-S012 block you spotted. Just zeroing that block does not make the ECU "start authorized"; it makes verification fail, which is exactly the state you're in now — no authorization, rail capped at ~80 bar because the pressure/metering control never gets released.

To actually do it properly you have to patch the code path in the FLS that evaluates the authorization result, so the firmware treats it as passed regardless of the crypto answer, and neutralise the EEPROM side so it doesn't re-trigger a fault. That's firmware-level work on the MPC555 core, not a data edit — which is why the reputable guys said no. It's doable but it's a real reverse/patch job for that specific software version, not a plug-in solution.

Before anyone can tell you if it's realistic on your exact file, confirm:

• Full ECU hardware number (Bosch 0281xxxxxx) and the MB part number off the label
• Exact SW version in your read — is it the 1037372414P467/120 shown, or 1037389924P467/122?
• Whether you have a matching EIS/key at all, or truly nothing (that changes whether adaptation is even an option vs. immo off)

With those, someone here can say whether a patch already exists for that CR3-646 version or whether it has to be built from scratch.

So i need to decide the engine and gearbox ecu and wiring going for sale

Hold off on that decision for a minute — you're closer than it feels right now. Nothing is wrong with your hardware: you've got a clean full KTAG read (FLS + EPR from one session), the engine cranks, sensors and valves check out, and the only thing stopping it is the CR3 authorization block. That's a software problem, not a reason to scrap a good engine and box.

The reason it feels like a dead end is that you've been asking general chip-tuners, and immo off on CR3.44 is a firmware patch job, not their usual EGR/DPF edit. It's a narrower group who do it, but they exist.

Before you list anything for sale, do one thing: open a dedicated request thread in the file/request section with a clear title like IMMO OFF MB CR3.44 EDC16C2 OM646 – standalone swap, no EIS, attach the FLS + EPR, and state plainly that you need the CAN start authorization neutralised in flash so it runs with no EIS/key. That puts it in front of the people who actually patch this family instead of the ones who just decline it.

If nobody bites after that, then selling is a fair fallback — but you haven't really put it in front of the right eyes yet. Don't give up on it at the theory-thread stage.

My friend i looking long time sombody to do that thing, unfortunetly nobody can help, so i try to sell engine gearbox wiring ecu than i look to bought 2.0 or 3.0 BMW Diesel engine from e46 e83 e60....

Don't scrap it yet, honestly. The reason you're getting "no" everywhere isn't that your files are wrong — it's that CR3.44 with the public-key start authorization (Customer-DC-CR3-OM646-PubKey-S012 in your FLS) is one of the genuinely hard EDC16 immo systems. It's crypto-based, not a simple byte-patch like the older EDC16 truck files, so most people who do casual immo-off just decline it.

A couple of facts from what you posted:

• The 80 bar rail cap and "no start authorization" is the expected limp behaviour when the ECU hasn't been authorized. That confirms the block is active and doing its job — it's not a fuel/mechanical fault.
• Your read looks complete for the job: the FLS plus the 4 KB internal EPR (the MPC555 EEPROM holds the adaptation/auth data). That's the right combination anyone would need to work on it.

Before you sell, the realistic options for a standalone swap like your Cabstar are:

• A proper CR3 immo-off/virgin done by a specialist who actually handles the public-key variant — it exists, it's just not the freeware patch crowd.
• A start-authorization emulator that satisfies the ECU on the bench, if you'd rather not touch the flash.

To point you at the right approach, what's the exact Bosch software number on your ECU — is it the 1037372414P467/120 or the 1037389924P467/122? And which tool are you running (KTAG only, or do you have anything with a CR3 immo-off function)? That decides whether flash-side or emulator is the cleaner route.

davinci show me that is edc16c31 is that possible ?

Yes, the ID is correct — the flash strings back up DaVinci here. In the .FLS you can see EDC16C31 plus Bosch SW 1037372414 / 1037389924, and the project block CR30-646-12E2-211xx-100kW-EU4O (OM646 CR3, MPC555, 1 MB). So DaVinci reading it as EDC16C31 is right, even though your files are named "EDC16C2" — C2/C31 are close siblings, the string data is what matters.

One important caveat though: the START/STOP toggle in the DaVinci solutions panel is not the Mercedes start authorization. What you actually have to defeat is the DC public-key immo block — the file literally shows Customer-DC-CR3-OM646-PubKey-S012. That is a flash-side patch to the start-authorization routine so the ECU commissions rail pressure and injection without a valid key challenge from the EZS/CAN. It is a real, doable job on CR3 OM646, but it is not a checkbox in a DPF/EGR tool.

That also explains your symptom exactly: RPM and valves fine, but rail capped at ~80 bar and no authorization — the ECU is refusing full pressure because start auth never passes.

Before anyone patches it, confirm a couple of things:

• Is the 1 MB .FLS a full read (full flash, not just a cal/EEPROM region)? The tail looks padded with FF from 0x70000 — post the read range or KTAG read type.
• The .EPR you attached — is that the EEPROM from the same ECU? It samples as EDC16C2, so make sure both dumps are from the physical unit on the bench.

If those two are from the same ECU and the flash is complete, a proper CR3 immo-off patch is the way to keep everything original in the Cabstar like you wanted — no need to sell the engine.

I can open ECU now and i can reda with KTAG BDM100 with one You want ?

Either tool can pull a full dump, but for immo/start-authorization work you need the complete read — full flash plus EEPROM, not just the map area. BDM100 will give you the flash over BDM but it won't touch the EEPROM, so on its own it's not enough. KTAG in BDM/boot mode can grab both, so go with the KTAG full read and make sure the EEPROM file comes out too.

One thing to sort out first: your title says CR3.44 but DaVinci is reporting EDC16C31 (BOSCH SW 10373724141037389924). Those aren't the same platform, so the auto-ID may be wrong. Can you post:

• the exact ECU/hardware number printed on the ECU label (Bosch 0281... number)
• the vehicle and engine it came out of (you mentioned a Cabstar donor — which BMW/MB engine exactly)
• the KTAG read once it's done, both flash and EEPROM

Once the real ECU type is confirmed and the EEPROM is in hand, we can tell you whether the start-auth block is neutralised in flash, in EEPROM, or needs an emulator.

that is my ecu label

Yes, that's consistent — CR3.44 is Bosch's Mercedes designation for the EDC16C31/CP31 family, so DaVinci reading it as EDC16C31 is correct. Label confirms it: Bosch 0 281 012 225, A 646 150 03 91, HW 39.04 / SW 37.04, OM646 2.2 CDI. That's the classic Sprinter/Vito/Viano unit.

One thing to be clear on: the immo on this ECU is not a Kia-style DPF/EGR "solution" like the DaVinci screen you posted (that Sportage bin and the DPF/EGR/AdBlue toggles are for a different platform). CR3.44 uses the CDI CAN start-authorization handshake with the EIS/EZS, so immo off means neutralising that authorization routine in the flash so the ECU cranks and runs standalone. For an engine swap into the Cabstar (Mercedes heart, rest original) that's exactly the right path — you're not going to feed it a valid EIS anyway.

For the read: on EDC16C31 do a full BDM read via BDM100 (or KTAG in BDM mode) so you get the complete flash plus the internal/EEPROM area — the start-auth block lives there and can't be reliably patched from a partial read.

Post the full BDM read and confirm:

• exact tool/mode used (BDM100 BDM, or KTAG BDM vs boot)
• whether the dump is the full BDM (flash + internal) or flash-only
• the Bosch SW string DaVinci logged (you had 10373724141037389924 on the previous shot)

With the correct full BDM read the immo/start-auth can be worked on this one — it's a known unit, not a dead end.