An in depth look at the KVW100 auto window close module

I could stick them on my server, email them to perkins.jason at gmail

-J

All of this new info is sure to help the project, but I still need a 2002 to early 2004 CCM to experiment on, if anyone comes across one for a good deal please let me know.

I should have mine boxed up & shipped out tomorrow, if you still want it. Let me know.

Source Comments:
FLASH_2_3:0E00 Init_CCM - This is first entry point for starting CCM
FLASH_2_3:11DA MainLoop - This is the CCM OS main function.
FLASH_1:8E00: ADC - Reset function

RAM_1:0050 - is used as memory for variables

I found a cpu options for ida:
MC68HC908AZ60 - 2J74Y
MC68HC08AZ60 - 1J35D

and the links for dumps: here and here

It's been awhile since an update so here goes:

I had been waiting to get a proper rev CCM to do more testing.
I was finally able to buy one for a great deal that was the correct rev. Around the same time I received some info from another member which really helped the project.

To that end, I can now unlock a CCM that has been locked with a KVW100 and can confirm it can be done with VDS-pro.

I can also program auto-closing window code into a CCM without any kind of lock.

So that's the good news; now to the bad news.

When I started this project I was driven by two things:

#1 I didn't like that the KVW100 locked the end users CCM without warning (I still don't like that and don't agree with it).

#2 I had made the assumption that the auto-closing window feature was simply an option bit or bits that nobody else had discovered.

Throughout this process I have learned a great deal regarding the CCM and the KVW100 code. At the end of the day it is actual assembly code that the KVW100 adds to the CCM to perform the window closing.

This has led me to an ethical dilemma; I don't feel comfortable deciphering all of the code and then posting it for all to use. I have no real respect for the KVW100 people because of the locking issue but it *is* their work. If this project revolved around a product such as VCDS it would have been locked down long ago.

There are further issues in that the code is not the same for all CCMs, you need different code depending on the rev of CCM. If you program the wrong code in it's very very easy to brick the CCM so it appears completely dead. To recover the CCM it has to be removed from the car and a programmer has to be soldered to the Motorola processor inside so its eeprom can be restored.

The unlocking process I will consider posting, again though, it could be risky as you have to blindly program a byte into the CCM -- if it's incorrect in any way the CCM could easily be bricked. The unlock process will disable the auto windows but they will be re-enabled if you re-lock the CCM.

All of the information posted in this thread will stay as it is, including my before and after CCM eeprom samples.

There has been great support from members here for this project so I hope everyone understands.

At some point I will probably ask for a mod to lock this thread but before that I'll throw it open to everyone, what do you guys think?

hi

congratulations, btw, what revisions are supported to enable the autoclose?,

thinking about, is great to enable that feature without locking the ccm,

in worst case and ccm brick a exchange will solve the problem, ccm is easy accesed and not a expensive part (second hand),
unbrick I guess can be done with any motorola programer soldering few wires on isp, I can do it at home,
recode the ccm is just upload a previous backup, so the risk at my point of view is low,

so you found a state of the art mode, like when folding roll up was discovered or even better,

about kvw100 none to say, alienwindows is old stuff not selling anymore for this cars plataform so I don´t find a good reason to release it,

anyway, is up to you do it and whatever you do you deserve our respect,


best regards
Invisible

Hello Steve99
This project is very interesting....
If you want a little participation of me (money or other....) please MP

Great job.
Is the code flexible/extensible? Can we add code for auto mirror folding/unfolding ?

Best regards.

0xFF said:

Great job.
Is the code flexible/extensible? Can we add code for auto mirror folding/unfolding ?

Best regards.

Click to expand...

Yes, other features can be added.

I Concur

Good night to all.

I'll start by stating that my opinion is biased since I already have auto window rollup ... and a locked CCM.

I'll have to concur with Steve on this. We all hate the unwanted/unadvertised/no-warning-whatsoever CCM locking "feature" of the KVW100 Module BUT these guys came up not only with the idea, but also the dedication and talent to make it work, and did the investment to launch a new, innovative product. In other words: If KVW100 code was my invention, and I decided mass produce a dongle to make money out of it, I wouldn't like somebody else to give it away for free.

Now, perhaps the KVW100 guys are aware of this thread and are considering enabling the auto window without the CCM-locking "feature".
I was very close on buying the thing but I read the warning first on some other VW forum so I decided not to (bought alientec module some 5 years ago, but removed when upgrading from 2002 Jetta to my current 2003 Passat)

So, about the CCM unlocking-relocking procedure with VDSPro... I would have to say to Steve: Yes, please share it!!! These unlocking procedure will not reveal the actual code of KVW100, right? It will just help people to correct the wrong doing of KVW100 guys.... so: no ethical dilemma here, right???

Now.. how about the auto mirror folding/unfolding?? that would certainly be non-kvw100 thing, right??? What can I do to help???

Steve: my deepest respect and admiration!! remarkable job!!!!!

Have a great weekend!!!

Alejandro

Well said Steve and Alejandro.

I can see no ethical impediment to unlocking a CCM to perform other mods.

If someone wants Auto windows they can buy the KVW100 without risk and get the unlocking code from Steve if they should require it.

Now...on to the good stuff - auto mirror folding/unfolding

Great Job Steve!!!

I believe that all victims of blocked CCM´s without warning will be very grateful if you teach them how to recover access to his ccm.

I see nothing wrong with that, because the script can not be copied even reading it using vds. In any case those that play dirty are the KVW100 people when not warning.

My personal opionion is that it would be great if you publish how to recover ccm acces.

Have a great weekend, Agustín

I understand the position of Steve99

Is is only possible to publish :
- the process to unlock CCM ?
- the process to auto mirror folding/unfolding ?

Many thanks

I will post the unlock instructions but they need to be tested first, so that is being worked on.

The auto mirror folding/unfolding may not be possible, someone else is working on it. I don't have any folding mirrors myself.

I am more interested in adding a feature to have the windows go down all the way with 1 touch(or maybe two) from the keyfob.

hi

the script can be copied just reading when vcds and enabling the locking bit again,
is just to find what is changed for every ccm revision,

I don´t see any trouble giving out the kvw100 script,
this device had been cloned and can be purchased on ebay easy,
I guess 90% of them are not original, also golf4 plataform is old, yes, old,
is a "old mod" only usefull for those of us keeping this car,

best regards
Invisible

Steve99 said:

I will post the unlock instructions but they need to be tested first, so that is being worked on.

The auto mirror folding/unfolding may not be possible, someone else is working on it. I don't have any folding mirrors myself.

I am more interested in adding a feature to have the windows go down all the way with 1 touch(or maybe two) from the keyfob.

Click to expand...

I have folding mirrors...
If you need to test the process I will do this...

Invisible said:

hi

the script can be copied just reading when vcds and enabling the locking bit again,
is just to find what is changed for every ccm revision,

I don´t see any trouble giving out the kvw100 script,
this device had been cloned and can be purchased on ebay easy,
I guess 90% of them are not original, also golf4 plataform is old, yes, old,
is a "old mod" only usefull for those of us keeping this car,

best regards
Invisible

Click to expand...

Well if others have cloned it that is out of my control, although I don't think it has been, I think they all come from the same guys in China.

The bigger problem is that there is no universal script, it has to be modified to match each CCM.

agustinfx said:

Great Job Steve!!!

I believe that all victims of blocked CCM´s without warning will be very grateful if you teach them how to recover access to his ccm.

I see nothing wrong with that, because the script can not be copied even reading it using vds. In any case those that play dirty are the KVW100 people when not warning.

My personal opionion is that it would be great if you publish how to recover ccm acces.

Have a great weekend, Agustín

Click to expand...

I tried sending you a PM but I don't seem to be able to. The module you have only does the power doorlocks and sunroof so the auto window feature is not possible. The power windows you have are controlled by a different module from what I can tell.
It may be possible to have an auto closing sunroof but that is all.

KVW100 CCM unlock procedure v1.0 (November 7th, 2010):

READ THIS FIRST:

-This has only been tested on North American CCM's with part number 1C0 959 799 C.
-I cannot guarantee it will work on your CCM as there are a lot of CCM variations and there may be
versions of the KVW100 I have not seen.
-It's possible it will brick your CCM!
-When entering addresses and data values they must be perfect!
-If you are happy with your KVW100 auto-closing windows and don't need your CCM unlocked don't mess with it!
-Removing the KVW100 lock also disables the auto-closing windows.
-If you brick your CCM I am not responsible in any way, shape or form.

***YOU HAVE BEEN WARNED***


You will need a computer with a hardware serial port running DOS, the program VDS-Pro
and an OBDII data cable for this procedure.


Using VDS-Pro connect to the CCM (option 46)

select 10 - Adaption

Change channels 06, 07, 08, 09 to 0 (while doing this make a note of the
original settings, all will 1 or 0 and determine if the lights flash and if
the horn honks during locking and unlocking, the default is normally 0 for 06
and 1 for the rest)


Select 11 - Login

Login with password 19283


select option 27 - EEPROM (serial) write

enter address $11A0 and value $FF


select 11 - Login

Login with password 19283


You now have full read/write access to your CCM EEPROM to change other
parameters, note that your auto-closing windows are also disabled.
Now would be a good time to fully backup the CCMs EEPROM.

At this point you will probably want to go back to the Adaption menu and
change channels 06, 07, 08 and 09 back to there original settings (most
likely 0 for channel 06 and 1 for the rest)


To re-enable your auto-closing windows(and the CCM locking)

select 11 - Login

Login with password 19283

select option 27 - EEPROM (serial) write

enter address $11A0 and value $9D

You CCM is now locked and your auto-closing windows will work again.


The above Adaption procedures can also be done with VCDS however the EEPROM
reads/writes can only be done with VDS-Pro.

Steve99 said:

Well if others have cloned it that is out of my control, although I don't think it has been, I think they all come from the same guys in China.

The bigger problem is that there is no universal script, it has to be modified to match each CCM.

Click to expand...

hi

correct me if I am wrong, but same ccm with same reference can be write with a backup (cloned) and autoclose will be enabled,

all eeprom can be write, there is nothing like a serial number to play with,
even if will be, wiring and programing motorola mcu will do the job,

best regards
Invisible

Invisible said:

hi

correct me if I am wrong, but same ccm with same reference can be write with a backup (cloned) and autoclose will be enabled,

all eeprom can be write, there is nothing like a serial number to play with,
even if wiring and programing motorola mcu will do the job,

best regards
Invisible

Click to expand...

There are several versions of the KVW100 code.

If you have anything but the newest version and read the CCM eeprom with the KVW100 code installed and then program it into a second CCM the auto-windows will not work as the code stops functioning when new remotes are added.(this assumes the CCMs are the same revision)

If you copy the EEPROM from a CCM with the newest KVW100 code and program it into a second CCMs EEPROM then the auto-closing windows should work if the CCMs are the same revision.
When I say revision I mean that the CCMs must use the same Motorola processor core, just having the same VW CCM Part number is *not* enough.

When I refer to a custom script for each CCM I am referring not only to the processor core(which cannot be automatically determined with a VDS-pro script) but also the individual settings programmed into the CCM as some option bytes get changed. A script would be hardcoded with some values that may not be what was previously programmed into the CCM.

If you do want to copy someone elses eeprom with auto-windows it is also risky to blindly write that code in with VDS-pro as the bytes need to be written in a specific manor and order. If you start from the beginning and go to the end the CCM will stop responding before you write all of the needed code, and your CCM will be locked.

If you want to write to the Motorola processor directly with a CPU programmer you may need to know the security bytes for the processor as some CCMs have direct read/write permission locked by the CPU(nothing to do with KVW100 code)

hi

I see, about the motorola processor I can bypass security with a programmer, no need to know security bytes,

I can determine what mcu inside (revision) just openning the ccm, processor have masked reference,

so only the latest code will be suitable for cloning..one more question,
how to distings it?

best regards
Invisible

I found 1j0 ccm on my frend's 2000 y. Japan Golf4. There is factory enabled windows roll up from keyfob, with holded lock button. If it is interesting, tell me what adresses dump from ccm?

Hi Steve,

Congratulation to your work!

Can you say me if kvw100 modify flash content and/or only eeprom content?

By the way, I know security bytes for mask 2J74Y if needed.

++
Bal.

Mega old thread I know but this is the only decent one regarding the KVW100 I can find...

I'm about to install one of these on my mk1 Seat Leon FR just as I did with my previous mk4 Golf but was wondering about the CCM been locked as I need to make a couple of adaptions (auto locks off & one touch all doors unlock) when my VCDS arrives in the post.
Will the KVW100 stop me making these changes and should I do them first?

thai-wronghorse said:

Mega old thread I know but this is the only decent one regarding the KVW100 I can find...

I'm about to install one of these on my mk1 Seat Leon FR just as I did with my previous mk4 Golf but was wondering about the CCM been locked as I need to make a couple of adaptions (auto locks off & one touch all doors unlock) when my VCDS arrives in the post.
Will the KVW100 stop me making these changes and should I do them first?

Click to expand...

It will. Do you have VDS-PRO?

No I don't have VDS-Pro and tbh don't know much about it. Is it considerably different to VCDS then?

thai-wronghorse said:

No I don't have VDS-Pro and tbh don't know much about it. Is it considerably different to VCDS then?

Click to expand...

Yes, you cannot modify things with VCDS like you can with VDS-pro. There are stickied threads in the Upgrade section that you should read.

As tongsli has stated the kvw100 will lock you out. But you can unlock it again with vdspro.