Free VDS-Pro / VagTacho Alternative

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
So I've been a happy VCDS user since buying my Golf in 2003 (it had 65000 miles on it so it conveniently needed an immediate timing belt replacement, hence needing VCDS - though it was named VAG-COM way back then).

However there are things that VCDS doesn't do, such as pulling the SKC from an instrument cluster, changing the odometer of a used cluster, reading/writing bytes in the CCM, retrieving a used radio's Safe code, etc.

Since I have a part-time "business" (really more like a hobby at this point) involving fixing up MKIV instrument clusters and reselling them, VagTacho or similar (VAG Commander, VAGdashCOM, VAG EEPROM Programmer, etc.) is a necessity. The problem is that legitimate copies of these tools cost hundreds of dollars and require special dedicated cables. You can find cheap pirated copies of many of these, but some still require special cables and you never know what malware might be lurking on the plain white mini-CDs that the software comes on. (I eventually did by a real copy of VAGdashCOM after having lots of trouble with flaky eBay VagTacho cables). And it's not only me that needs these tools. If I sell a cluster to someone, they need to know their SKC in order to install it. If I set the odometer to 0, they can adjust it to the correct value with VCDS, but no VagTacho, no SKC, no start.

I've also always wanted to use VDS-PRO to enable the "Roll windows up/down with key fob" CCM feature and other options, but it only runs on DOS and hasn't been maintained in many years. I've had lots of trouble getting it to run at all on newer computers.

Fast forward to a couple of months ago: I bumped into Mike Naberezny's GitHub page: https://github.com/mnaberez/vwradio
Mike has done the amazing job of reverse engineering 8 (so far) VW/Seat/Skoda radios and has found various hidden commands and discovered ways to retrieve the Safe code from most of them via the K-Line and some open-source hardware/software that he created. He's made all the info available for free. The only downside is that his software runs on a custom circuit board and that's a barrier to most people.

So that got me thinking that maybe I could do something similar in software that runs on a PC and a generic cable. I was able to find a good bit of info about VW's proprietary KW1281 K-Line protocol here and learned some more by reading Mike's code. I bought a Saleae logic analyzer and was able to use it to spy on the K-Line while using various cluster tools and VDS-PRO in order to figure out which KW1281 commands were being used to read/write the EEPROM, reboot the cluster, etc.

I was then able to write a program that could wake up a module and send simple commands over the K-Line. Eventually I got it to the point where it could read/write bytes in the CCM EEPROM like VDS-PRO and retrieve the Safe code from a VW Premium V radio like Mike's tool. The big thing missing was the ability to read/write the cluster EEPROM. That required performing a successful challenge/response with the cluster. The commercial tools all know how to do that but it's not documented anywhere that I could find. Finally with some pointers from Mike, I was able to partially disassemble the cluster ROM in order to find how the challenge/response works and am now able to dump the entire cluster EEPROM to a file for editing. I only just got this working yesterday so I haven't tried writing the EEPROM back yet but that should be pretty straightforward to get working.

I uploaded all the source code to GitHub: https://github.com/gmenounos/kw1281test

You can download the source code and build it yourself or there's a .zip file containing a precompiled version that runs on Windows 10 here:
https://github.com/gmenounos/kw1281test/releases/

Currently it just runs from the command line but that might be just fine for now. It requires a dumb KKL cable, basically something with an OBD connector on one end and that looks like a serial port to the PC. I've successfully used a KKL cable I bought 7 years ago that connects to an actual serial port on my really old laptop. I've also used a genuine VCDS cable configured to run in VCP (Virtual COM Port mode). I've only run it on an old Dell laptop that runs 32-bit Windows 10. It should work fine on 64-bit Windows 10 but I haven't actually tried that yet. It's written in C# for .NET Core, which is cross-platform, so it might also run on Macs and Linux but I haven't tried either. You're welcome to give it a shot and let me know.

To run the tool, you have to know what COM port your cable is using, what baud rate to use, what controller address to connect to and what command you want to send. A fancier tool like VCDS will automatically detect the baud rate of the controller but I was too lazy to figure out how to do that so you must know the baud rate. I can tell you that the cluster uses 10400.

Here's the tool reading a cluster's software version:

Code:
PS C:\> .\kw1281test.exe com4 10400 17 ReadSoftwareVersion
Opening serial port com4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3B7920946E  KOMBI+WEGFAHRSP VDO V095
Sending Custom "Unlock Additional Commands" block
Sending Custom "Read Software Version" blocks
00: VWK501MH $10 $01
01: $81 $19
02: $18 $08 $01 $0B $1C $09
03: VW/Sk MH Serie/Flash
Sending EndCommunication block
Maybe not too exciting, but here's it dumping the cluster EEPROM to a file:

Code:
PS C:\> .\kw1281test.exe com4 10400 17 DumpEeprom 0 2048
Opening serial port com4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3B7920946E  KOMBI+WEGFAHRSP VDO V095
Sending Custom "Unlock Additional Commands" block
Sending ReadIdent block
Sending Custom "Unlock partial EEPROM read" block
Sending Custom "Are you unlocked?" block
Sending Custom "Seed request" block
Block:  7A 42 2A DE 80 28 6F 45 01 00
Sending Custom "Key response" block
Sending ReadEeprom block (Address: $0000, Count: $10)
Received "Read EEPROM Response" block: 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
Sending ReadEeprom block (Address: $07F0, Count: $10)
Received "Read EEPROM Response" block: FF 4C 00 00 00 00 00 FF FF FF 08 0E 08 0E 08 0E
Saving EEPROM dump to WVWUK63B33P247312_____VWZ7Z0B6069175_$0000_eeprom.bin
Sending EndCommunication block
Here's a full list of commands. You'll see that same info if you just run the program and don't specify any parameters.

Code:
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
       PORT    = COM1|COM2|etc.
       BAUD    = 10400|9600|etc.
       ADDRESS = The controller address, e.g. 17 (cluster), 46 (CCM), 56 (radio)
       COMMAND = ReadIdent
                 ReadSoftwareVersion
                 ReadEeprom ADDRESS
                            ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                 WriteEeprom ADDRESS VALUE
                             ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                             VALUE   = Value in decimal (e.g. 138) or hex (e.g. $8A)
                 DumpEeprom START LENGTH
                            START  = Start address in decimal (e.g. 0) or hex (e.g. $0)
                            LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
                 DumpRom START LENGTH
                         START  = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
                         LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
                 MapEeprom
                 Reset
                 DelcoVWPremium5SafeCode
So if this sounds useful, please give it a try and let me know if it works for you. I'm interested in hearing what cables it works with, which controllers it can talk to and which is has trouble with, bug reports and suggestions for new features.
 
Last edited:

Nero Morg

Veteran Member
Joined
Oct 19, 2017
Location
OR
TDI
2003 Jetta wagon, 2001 Jetta TDI, 2014 Passat TDI
Darn, that had to be very time consuming, good job on all your hard work! I'll have to try the CCM mods, been wanting to do the fob windows mod for a while, but too cheap to buy the hardware to try toying with VCDS-PRO.
 

shoebear

Veteran Member
Joined
Aug 1, 2002
Location
Colorado Springs, CO
TDI
1998 Jetta, 2003 Jetta Wagon, 2005 New Beetle, 2013 Sportwagen
Great work! I've subscribed to this thread. I don't have time to try it right now, but I should have more time in September, and I will certainly try it the first chance I have.

I have a VCDS HEX-CAN OBD2 to USB cable. Will that work? I'm pretty sure the cable does serial port emulation, and I should be able to tell what COM port it's emulating.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I have a VCDS HEX-CAN OBD2 to USB cable. Will that work? I'm pretty sure the cable does serial port emulation, and I should be able to tell what COM port it's emulating.
Yes, that will work. You have to do 2 things:
  1. Install and configure the VCP drivers as described here.
  2. Uncheck "Boot in intelligent mode" as described in section 4.16 here.
 

mnaberez

Member
Joined
Jun 24, 2020
Location
California
TDI
'98 Jetta
Congratulations, Greg! Cracking the cluster is an accomplishment. Thank you for putting your findings and tool online so others may benefit. I am excited that more low-level information about the VAG modules is being freely shared.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Well I may have spoken a bit too soon about the VagTacho-like functionality. I've been doing all my testing on a W8 cluster, ROM version 01.10 (as described here). I just tried it on a half-FIS cluster, ROM version 01.00 and my program is not able to dump the EEPROM. I think different ROM versions may use slightly different keys to authenticate. I'll research and update the program once I figure out what's going on. In the meantime, the CCM EEPROM functionality should still work.
 
Last edited:

shoebear

Veteran Member
Joined
Aug 1, 2002
Location
Colorado Springs, CO
TDI
1998 Jetta, 2003 Jetta Wagon, 2005 New Beetle, 2013 Sportwagen
What's the matter with you? All my programs work perfectly the first time! (JUST KIDDING!!!).

Thanks again for your work on this. It's very helpful, and I look forward to being able to try it out!
 

Kravt

Well-known member
Joined
Jul 31, 2018
Location
Lexington, Ky
TDI
2005 Passat
Very excited about using this. Was looking the other day for how to do how to do CCM mods and was disappointed that I needed a DOS machine and serial cable when I already had a VCDS cable laying around. I'll try it on my b5.5 passat here soon. Thanks for sharing!
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Today I tried it out for the first time in an actual car (everything up 'till now has been on the bench) and it worked great. Using a VCDS KII-USB cable in VCP mode connected to a Windows 10 x64 laptop and my 99.5 Golf, I was able to enable the key fob windows up/down mod by writing to the CCM's EEPROM and I was able to extract an EEPROM dump from the cluster (though the cluster is an Immo3 cluster from a newer car, not the original 99.5 cluster). So the tool can talk to 1J0 and 1C0 CCMs and Immo3 VDO clusters.
 

KrashDH

Veteran Member
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
THIS IS SO FREAKING COOL!

Thank you for all the hard work on this.
As an aspiring programmer (I'll be taking classes starting Oct.) And a mech engineer, this is nerding out and I'm stoked! I will definitely have to try this out as I need to pull the SKC from my 02 Golf to make another RFID flip key. The PO didn't have it and every place I talk to wants a couple hundred bucks to fetch it. I will follow this thread and hopefully you don't mind if I message you in the future!
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Sure, let me know if you run into any issues and I will try to help. I don't think anyone else has tried this yet so I'm looking for some feedback. I'll try to write up better instructions over the next week or two. I wish I had done this 5+ years ago when there were more MKIV owners around...
 

shoebear

Veteran Member
Joined
Aug 1, 2002
Location
Colorado Springs, CO
TDI
1998 Jetta, 2003 Jetta Wagon, 2005 New Beetle, 2013 Sportwagen
Sure, let me know if you run into any issues and I will try to help. I don't think anyone else has tried this yet so I'm looking for some feedback. I'll try to write up better instructions over the next week or two. I wish I had done this 5+ years ago when there were more MKIV owners around...
Thanks again for doing this. I agree, this is TOTALLY COOL, and I can't wait to try it. However, I have to get my 05 Beetle running again for my daughter in grad school, and I'm doing major work on it, so I have to finish that first.
 

mittzlepick

Veteran Member
Joined
Mar 18, 2001
Location
union maine
TDI
2004 jetta wagon (365k)2001 wagon tire burner 6spd 2003 wagon(417k)
I have several clutters in the board pm me if you want them. Cost of shipping
 

Nuje

Veteran Member
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2015 Sportwagen; Golf GLS 2003; 2016 A3 e-tron
I just received my $17 generic USB->KKL cable and can confirm that it works with the this software to dump the cluster EEPROM to a file: https://www.amazon.com/gp/product/B00K6498D0
First off: AWESOME!! Thanks for all the work on this!!
I already have three cables (old-timey Vag-com Serial port, VAG-TACHO, and real VCDS HEX-NET), so don't really want another cable. Would the knock-off VAG-TACHO cable work as a generic USB-KKL cable? Or do I add to the collection?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I have several clutters in the board pm me if you want them. Cost of shipping
Thanks! I already have about 45 clusters myself :eek: and am trying to downsize but I might be interested in a couple for testing if they're not ones that I already have. When you get a chance could you PM me the part numbers of the ones you have?
 

Buckzor

New member
Joined
Oct 9, 2020
Location
Romania
TDI
Bora
How can i write in ccm i want remote windows
for exemple how can i select byte 1 to change 74 to 66
04361 74 66
04362 74 66
04363 74 66
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Congratulations! You might be the first person other than me to use this thing. :)

First download the latest version here: https://github.com/gmenounos/kw1281test/releases/download/v0.15-beta/kw1281test.zip
There should be a single .exe in the .zip and it should run on 32-bit or 64-bit Windows 10. Put the .exe in some folder and then open up a command prompt in that folder.

You need to know what COM port your KKL cable is assigned to. You can look in Windows Device Manager in the "Ports (COM & LPT)" section.

Assuming it's COM4, you would run it like this (9600 is the baud rate of the CCM and 46 is the CCM device address):

kw1281test.exe COM4 9600 46 ReadEeprom 04361
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0959799C 1H Komfortgerat HLO 0003☻♦B
Sending Login block
Sending ReadEeprom block (Address: $1109, Count: $01)
Received "Read EEPROM Response" block: 8A
Address 4361 ($1109): Value 138 ($8A)
Sending EndCommunication block

That will read address 4361 of the CCM's EEPROM and tell you what value is stored there. Do that for all 3 addresses and verify that they are 74 in your CCM.

Then you would write the new values like this:

kw1281test.exe COM4 9600 46 WriteEeprom 04361 66
kw1281test.exe COM4 9600 46 WriteEeprom 04362 66
kw1281test.exe COM4 9600 46 WriteEeprom 04363 66
 

KrashDH

Veteran Member
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
Congratulations! You might be the first person other than me to use this thing. :)

First download the latest version here: https://github.com/gmenounos/kw1281test/releases/download/v0.15-beta/kw1281test.zip
There should be a single .exe in the .zip and it should run on 32-bit or 64-bit Windows 10. Put the .exe in some folder and then open up a command prompt in that folder.

You need to know what COM port your KKL cable is assigned to. You can look in Windows Device Manager in the "Ports (COM & LPT)" section.

Assuming it's COM4, you would run it like this (9600 is the baud rate of the CCM and 46 is the CCM device address):

kw1281test.exe COM4 9600 46 ReadEeprom 04361
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0959799C 1H Komfortgerat HLO 0003☻♦B
Sending Login block
Sending ReadEeprom block (Address: $1109, Count: $01)
Received "Read EEPROM Response" block: 8A
Address 4361 ($1109): Value 138 ($8A)
Sending EndCommunication block

That will read address 4361 of the CCM's EEPROM and tell you what value is stored there. Do that for all 3 addresses and verify that they are 74 in your CCM.

Then you would write the new values like this:

kw1281test.exe COM4 9600 46 WriteEeprom 04361 66
kw1281test.exe COM4 9600 46 WriteEeprom 04362 66
kw1281test.exe COM4 9600 46 WriteEeprom 04363 66
If I have some time on Sunday I'd like to try this. I have the Key-USB Ross-Tech Cable (Dual K Vag-Com) OBD interface.
I went hunting for ports on my computer and couldn't find them.

When running a powershell cmd in the folder, what exactly should I type in?
Will it even work with my cord?
 

ekincaid

Active member
Joined
Jun 28, 2013
Location
North Carolina
TDI
03 Golf TDI
I think I might have to purchase a cable and give this a try, Where can I find information on the addresses and values for some of the other mk4 mods? Any ideas?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I think I might have to purchase a cable and give this a try, Where can I find information on the addresses and values for some of the other mk4 mods? Any ideas?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
If I have some time on Sunday I'd like to try this. I have the Key-USB Ross-Tech Cable (Dual K Vag-Com) OBD interface.
I went hunting for ports on my computer and couldn't find them.

When running a powershell cmd in the folder, what exactly should I type in?
Will it even work with my cord?
You need to configure the drivers for your VCDS cable to that it appears as a COM port:

As for what to type in, what are you trying to do? Are you trying to mod your CCM or your cluster?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
For me, I just need my skc at this point so I can program another key.

I'm going to have to give that a thorough read...
For a 2002 cluster, you want to do something like (assuming your port is COM4):

kw1281test.exe COM4 10400 17 DumpEeprom 204 6

You should get 3 identical pairs of values back. Here's a sample:

Received "Read EEPROM Response" block: 07 0B 07 0B 07 0B

Multiply the second number by 256 and add the first number, keeping in mind that 0A = 10, 0B = 11, 0C = 12, 0D = 13, 0E = 14, 0F = 15. So for the example here, (11 x 256) + 7 = 2823 so SKC = 02823
 

Buckzor

New member
Joined
Oct 9, 2020
Location
Romania
TDI
Bora
and if i want to modify trunk how can i do?

Bytes 04361-04363, bit 1: Tailgate operation via remote (1: disabled; 0: enabled)
AND
Bytes 04367-04369, bit 1 (1: disabled; 0: enabled.)
if i modified on 04361 with 66
 

KrashDH

Veteran Member
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
For a 2002 cluster, you want to do something like (assuming your port is COM4):

kw1281test.exe COM4 10400 17 DumpEeprom 204 6

You should get 3 identical pairs of values back. Here's a sample:

Received "Read EEPROM Response" block: 07 0B 07 0B 07 0B

Multiply the second number by 256 and add the first number, keeping in mind that 0A = 10, 0B = 11, 0C = 12, 0D = 13, 0E = 14, 0F = 15. So for the example here, (11 x 256) + 7 = 2823 so SKC = 02823
Thanks again! Hopefully I can give this a shot Sunday!
 
Top