As of September 2026, most immobiliser and adaptation data does not live in the same memory as the calibration you are trying to change — it sits in a small separate EEPROM, and that split is why one job reads happily over the OBD port while another one requires the case open on a bench. Understanding which data lives where is the difference between ordering the right operation and ordering an operation that physically cannot touch what you need.
This post is the memory-map version of a question we answer every week: “why can't you just do it through the port?” The answer is almost never about software permission. It is about which silicon holds the bytes.
The three memories inside a typical controller
Strip the marketing away and a conventional engine controller has a processor and, functionally, three places bytes can live.
Program flash.The large non-volatile memory holding the operating software and the calibration maps — fuelling, timing, torque limits, diagnostic thresholds. This is what a reflash writes and what a calibration change edits. It is big, it is what OE programming updates, and on most platforms it is reachable through the diagnostic port because the manufacturer needs it to be for service updates.
EEPROM. A much smaller memory holding the things that must survive a power cycle but are specific to this car rather than this software version: immobiliser keys and secrets, the VIN, mileage on some platforms, adaptation values, security counters, option coding. This is the memory that makes a controller belong to one particular vehicle. On a great many families it is a physically separate chip on the board, and that is why it is named on the part label of our coverage entries.
RAM and volatile working state. Gone the moment power drops. Irrelevant to any of this except that it explains why a battery disconnect clears some faults and not others.
“People arrive convinced the problem is authorisation. Half the time it is geography — the data they want is on a chip the port was never wired to reach. No subscription fixes a wiring diagram.” — Bench technician, remote programming desk
Why the split exists at all
It is a security and reliability decision, not an accident. Program flash is designed to be rewritten in service, so it is addressable from the outside under manufacturer control. Immobiliser secrets are designed not to be rewritten in service by anyone who happens to plug in, so they are placed where a routine reprogram cannot reach them, protected by a separate access procedure, or both.
The practical consequence for the independent trade is that the two most common jobs sit on opposite sides of that wall. A manufacturer calibration update is a program-flash operation and routes cleanly to a remote session on OE software. An immobiliser-data operation frequently is not, and routes to a file or to a bench.
| What you want to change | Where it usually lives | Typical route |
|---|---|---|
| Manufacturer calibration update | Program flash | Remote OE session, $100–$250 |
| Module configured to this VIN after replacement | Flash and EEPROM, depending on platform | Remote OE session |
| Immobiliser data removed from the file | EEPROM, or an immo region of flash | Uploaded read, $100 instant IMMO-OFF |
| Locked controller opened for your own tooling | Protection layer, not a data region | $150 uploaded, $250 mail-in |
| Everything moved from one module to a donor | Flash and EEPROM together | $250 mail-in clone |
| Checksum made valid after an edit | Computed across flash regions | Checksum repair |
Those prices are our posted ones rather than estimates, and the full list is on the pricing page. The clone vs IMMO-OFF vs virgin comparison explains why the bottom three rows are genuinely different products rather than three names for one thing.
Read methods follow the memory, not your preference
This is the part people find annoying and it is not negotiable. The read method is dictated by where the data sits and how the manufacturer protected it — not by which method is most convenient for you on the day.
An OBD read is comfortable and needs nothing removed, but it can only reach what the diagnostic stack exposes. A bench read means the module comes out and is powered on a table with a wiring harness, which opens access the port does not provide. A boot-mode read means putting the processor into a low-level state before it runs its normal software, which is what some protected families require. Our bench, boot and OBD read-method comparison is the full treatment, including what each one costs you in time and risk.
The Saab Trionic family is a clean worked example. Our catalogue lists T5 and T7 as live for both IMMO-OFF and checksum, with T8 in beta for IMMO-OFF — and the Trionic IMMO-OFF guide walks through exactly which read gets you a file we can work with. Get the read method wrong and you do not get a partial result; you get nothing usable.
What “95040” and friends actually mean
When a coverage entry or a forum post names a small chip, it is naming a serial EEPROM family. The number describes capacity and interface rather than anything brand-specific, which is why the same chip designation turns up across completely unrelated vehicles. One of our Bosch ME7 catalogue entries is listed explicitly against that memory part because the operation is defined by the chip, not by the badge on the car.
Two consequences worth internalising. First, a chip designation alone does not identify a vehicle — plenty of cars share it. Second, and more usefully, it means an operation proven on one platform often transfers to another with the same memory arrangement, which is part of why our coverage grows in clusters rather than one car at a time.
What it does not mean is that every controller in a family behaves alike. Our Bosch ME7 guide exists because the ME7 entries in our catalogue sit at different statuses to one another, and the MED17 guide covers a family where the checksum work is live while the immobiliser work is not. Publishing that difference is the point.
Where the wall is absolute
On newer controllers the separation stops being a memory-layout question and becomes a cryptographic one. If the bootloader validates a signature before it accepts a write, the location of the data is no longer the limiting factor — the signature is. Our catalogue lists VAG's Simos PCR2.1 as RSA-signed and not supported, and that entry is deliberate: it is a permanent statement rather than a coming-soon. The signed-bootloader post explains why better tooling does not change that answer.
Equally, a module that does not power up has no accessible memory of any kind. If you are looking at P0606 internal processor faults or a controller that is simply dark, no read method applies until the hardware fault is addressed.
Cloning: moving identity rather than removing it
Once the memory split is clear, cloning stops looking like a trick and starts looking like the obvious operation it is.
A clone takes the identity and configuration out of an original module — the EEPROM contents, the vehicle-specific data — and writes it into a working donor of the same family, so the donor becomes, from the car's point of view, the module it replaced. The vehicle needs no reconfiguration because nothing about its expectations changed, and the immobiliser arrangement stays entirely intact.
That last point is why cloning is frequently the better product than an immobiliser removal for a road car. Our clone vs IMMO-OFF vs virgin comparison sets the three side by side, and our post on what changes after IMMO-OFF covers what you give up by choosing the other route.
The constraint is that a clone needs both modules. Our mail-in clone is $250 and you ship the original alongside the donor; if the original is destroyed rather than merely faulty, cloning is off the table and the job becomes a configuration exercise on the replacement instead. That is one of several reasons our used-module matching guide argues for buying a donor before scrapping anything.
Practical rules that save money
- Identify before you read. Photograph the label and drop it into the free identifier. Reading the wrong way wastes a removal.
- Always keep the original read. The untouched binary is the only true undo. Our return-to-stock guide is blunt about what happens to people who did not keep one.
- Power the module properly. A marginal supply during a read produces a file that looks complete and is not.
- Do not edit and hope. A modified region with a stale checksum will be rejected or will run badly. Our checksum repair guide covers what has to be recomputed and why.
- If you cannot read it, mail it. Mail-in service is $250 and needs no interface, software or read on your part. The packing guide covers doing it without static damage.
Why a checksum sits across the whole picture
One more region deserves naming, because it is not a place so much as a property. Controllers verify their own contents with a checksum computed across defined areas of memory. Change a byte in a protected region without recomputing that value and the controller detects the inconsistency.
What happens next varies by family and it is rarely dramatic enough to be obvious: a refusal to accept the write, a limp mode, a stored fault, or an engine that runs but badly. That last outcome is the dangerous one, because it looks like a tuning problem rather than a data-integrity problem and people chase it in entirely the wrong direction.
This is why checksum repair is a separate product on our coverage matrix with a separate status from IMMO-OFF — a family can be live for one and not the other, and our checksum repair guide covers what gets recomputed and when you need it.
Why this matters more every year
S&P Global Mobility put the average age of light vehicles on U.S. roads at 12.6 years in its 2024 study. That is precisely the band in which controllers fail, get replaced with used units, and arrive with another car's EEPROM contents inside them. The symptom is a swapped ECU that will not start or a U0100 lost-communication code, and the cause is almost always that the vehicle-specific memory was never dealt with.
Standards and the legal line
The aftermarket reaches any of this through a published interface: SAE J2534 defines the pass-thru layer, and NASTF administers the registry U.S. technicians use where secure vehicle access is involved.
We do not provide emissions defeat, delete files, or services intended to bypass emissions laws. Our services exist for tuning preparation, diagnostics, repair, motorsport, and off-road use where legally permitted. Customer is responsible for confirming legal use in their location and application.
Section 203(a)(3) of the federal Clean Air Act is the reason that paragraph is not boilerplate. Knowing exactly which bytes control an emissions monitor does not make editing them a repair.
The short version
Calibration lives in program flash; identity lives in EEPROM. That one sentence predicts most routing decisions on this site. Flash work usually routes to a remote OE session; identity work usually routes to a file or a bench. Check the coverage matrixfor your controller family before you remove anything, and if the answer is “not here”, the specialist network is free to post to.