MB Comand TV Unlock: Kufatec for NTG 4.5

Hello,

Since there's no software unlock available for the MB Comand system, I ordered a Kufatec module. It uses an AT90CAN128 microcontroller, and the people at Kufatec unknowingly programmed a huge bug into it.

Because: when the MB module starts up, it sends the vehicle identification number (VIN) to the COMAND system via the CAN bus. The COMAND system then checks this VIN. However, since the module becomes active immediately and influences the CAN communication, the VIN is not reported correctly, causing the COMAND system to enter theft mode.

If you disable the module before each shutdown (by holding down the back button in the menu for about 10 seconds), this phenomenon does not occur.

The following program modification would be necessary: the module should not become active until approximately 30 seconds after the Comand starts and only then should it influence the communication of the CAN bus. As far as I can see, there are pads for an ISP interface (possibly also JTAG). How complex is it to actually program/modify such a gateway yourself? It seems like the controller has a very large memory capacity. I recently implemented an electronic door control system with voice output on an ATmega 1284P; it doesn't have more memory than the AT90CAN128. What does this module do with so much memory?

And: Does anyone know who the programmers at Kufatec are, or do they source their modules from a factory in China?