Free VDS-Pro / VagTacho Alternative

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Well, I downloaded the beta V0.50and got the TT round.
Connected up and used the DumpMarelliMem 14336 2048 command and no joy, just the same. tried disconnecting for a while and re attempted but the same result.
I've copied the results incase I'm not doing something right! 😀
On a technical note, what actually is the difference between the D14 and D09? Is it the type of chip or a different manufacturer?
Never ceases to amaze me how many variable there are in electronics on cars, even with identical part numbers with identical sub letters too!!

KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com3 9600 17 DumpMarelliMem 14336 2048
Opening serial port com3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920980A KOMBI+WEGFAHRS. M73 D09
Software Coding 00444, Workshop Code: 00000
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 33
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 57
at BitFab.KW1281Test.Program.WriteMarelliBlockAndReadAck(Byte[] data) in C:\Users\gmeno\src\kw1281test\Program.cs:line 727
at BitFab.KW1281Test.Program.DumpMarelliMem(IKW1281Dialog kwp1281, ControllerInfo ecuInfo, UInt16 address, UInt16 count) in C:\Users\gmeno\src\kw1281test\Program.cs:line 488
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 188
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 24


Regards

Alan
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
On a technical note, what actually is the difference between the D14 and D09? Is it the type of chip or a different manufacturer?
Never ceases to amaze me how many variable there are in electronics on cars, even with identical part numbers with identical sub letters too!!
I don't own an TT clusters, so I can't speak for what's inside them. The 2 Beetle clusters I have are different internally:
  • The 2002-2003 Beetle cluster (part number 1C0920921G, software M73 V08) uses a Motorola MC912DG128ACPV processor and has a 2K EEPROM.
  • The 1998-2001 Beetle cluster (part number 1C0920901C, software M73 V07" uses a Motorola 68HC912D60 processor and has a 1K EEPROM.
Both processors run the same instruction set but the EEPROM, RAM and register bank are at different addresses (hence the need to specify "3072 1024" for one cluster and "14336 2048" for the other).

The Audi TT 8N2920980A cluster with software M73 D14 seems to be similar enough internally to the 2002-2003 Beetle cluster that EEPROM can be dumped with the same command.

The M73 D09 version of that Audi cluster must have something different enough about it that kw1281test can't dump the EEPROM. If you can ever find an inexpensive one at a scrap yard and send it to me, I can take a look. Or if you can take one apart, share a photo of the biggest chip on the board. It would look something like this: https://photos.app.goo.gl/Px9MxAfgkmGMwSWE8
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
And VW sells cluster with exactly the same part number, but made by different suppliers with different internals. The MFA clusters with part number 1J0920926C are made mostly by VDO, but a few are made by Bosch and those are completely different inside.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Ha.. nothing's easy. I thought nissanswere bad At mixing part suppliers!
Trying to remember how deep the chip is in the cluster.. had one to bits years ago!
Is it on the back side of the board e.g. opposite from the LCD? That would be too easy though.. 😁👍
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
I'd have to convince him it's worth me taking it out!
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Trying to remember how deep the chip is in the cluster.. had one to bits years ago!
Is it on the back side of the board e.g. opposite from the LCD? That would be too easy though.. 😁👍
In the Beetle clusters, the chip is visible as soon as you remove the rear of the case. Looks like it's the same in the TT:
I'll have to watch that video in slow motion and see if I can make out the numbers on the chips.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Ahh, even the 09 version.. I've tried 30 odd screen shots of this in various positions, but I can't quite read it..☹
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I think the processor might actually be the slightly smaller chip just to the left of the largest one. Do you have any close-up photos of that one?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Actually, I was wrong. It's the biggest chip after all. I think it might be part number MC68HC912DG128ACPV, which corresponds pretty closely to the processor in the 2003 Beetle cluster. So I still don't understand why kw1281test isn't able to dump the EEPROM. Thanks for all the effort and photos!
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Hey.. no problem... if it helped you out , it's all good... !v
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Added the ability to dump the EEPROM from EDC15 ECUs. This will allow retrieving the SKC from Immo3 ECUs without needing to get it from the cluster. Once this gets a bit of testing, it will not be much work to add an Immobilizer delete/undelete command as that just involves changing a couple of bytes in the EEPROM and writing them back to the ECU.

Note: The ECU is pretty picky about the exact timing of the commands needed to wake it up and dump the EEPROM, so this feature may not work for everyone just yet.


Code:
KW1281Test 0.51-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 1 dumpedc15eeprom 038906012GN.bin
Opening serial port COM1
Sending wakeup message
Sent: 81 01 F1 81 F4 (startCommunication)
Sent: 81 01 F1 3E B1 (testerPresent)
Received: 83 B1 01 7F 00 13 C7 (0 NAK 19)
Sent: 82 01 F1 10 85 09 (startDiagnosticSession)
Received: 83 F1 01 7F 10 78 7C (startDiagnosticSession NAK reqCorrectlyRcvdRspPending)
Received: 83 F1 01 50 85 2F 79 (startDiagnosticSession ACK)
Sent: 82 01 F1 27 41 DC (securityAccess)
Received: 84 F1 01 67 41 00 00 1E (securityAccess ACK)
Sent: 82 01 F1 27 42 DD (securityAccess)
Received: 83 F1 01 67 42 34 52 (securityAccess ACK)
Sent: 08 34 40 E0 00 00 00 03 B0 0F (requestDownload)
Received: 02 74 FF 75 (requestDownload ACK)
Sent: 00 FF 36 A5 ...
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 B9 ...
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 8F ...
Received: 01 76 77 (transferData ACK)
Sent: 00 B7 36 00 ...
Received: 01 76 77 (transferData ACK)
Sent: 02 31 02 35 (startRoutineByLocalIdentifier)
Received: 03 7F 31 22 D5 (startRoutineByLocalIdentifier NAK conditionsNotCorrectOrRequestSequenceError)
Sent: 01 A6 A7 (166)
Received: 01 76 77 (transferData ACK)
Saved EEPROM to 038906012GN.bin
Received: 01 76 77 (transferData ACK)
Sent: 01 A2 A3 (162)
Received: 01 76 77 (transferData ACK)
Reboot successful!
 

caffeine

Active member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
00 ALH Jetta
Do you know anything about the 07+ Mk4.5 Jetta City/Golf City clusters sold in Canada? I picked one up the other day from an 09; it's made by VDO and on the outside it looks identical to any other Mk4 MFA sport cluster, but with R32-style gauge faces and silver-center needles. I couldn't get kw1281test to dump the EEPROM though.

Also, tried dumping the ECU EEPROM from an 02 ALH Golf but was unsuccessful. It has an aftermarket tune on it so I'm not sure if that's a factor as to why. I'll test it on my 00 ALH Jetta at some point as well which has an unmodified ECU.
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Do you know anything about the 07+ Mk4.5 Jetta City/Golf City clusters sold in Canada? I picked one up the other day from an 09; it's made by VDO and on the outside it looks identical to any other Mk4 MFA sport cluster, but with R32-style gauge faces and silver-center needles. I couldn't get kw1281test to dump the EEPROM though.

Also, tried dumping the ECU EEPROM from an 02 ALH Golf but was unsuccessful. It has an aftermarket tune on it so I'm not sure if that's a factor as to why. I'll test it on my 00 ALH Jetta at some point as well which has an unmodified ECU.
Unfortunately I don't own any City clusters so I can't say why it didn't work. If you can send me kw1281test.log, I can investigate both of those issues.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Thanks for the logs and the photos. It's definitely the same processor (Micronas) as the earlier VDO MKIV clusters and probably runs similar software. VDO clusters have a 4-byte unlock code that must be sent to the cluster before it will allow dumping the EEPROM. kw1281test has a few common ones that it tries. I've added some more in the latest version: https://github.com/gmenounos/kw1281test/releases/tag/v0.52-beta
Give it a try again when you get a chance and let me know if it works. It may take a while as it chews through all the codes, but if it finds one that works, it will log a message like "Unlock code for software version VMMJ08MH $00 $09 is $01 $02 $03 $04. Please report this to the program maintainer."
If you see that message, please report it to me and I'll enhance kw1281test so it uses that unlock code immediately the next time it sees that same cluster version.

As for the ECU, it's trying to wake up the EDC15 a special way so that it talks KW2000 protocol instead of KW1281, which is needed to dump the EEPROM. The exact timing of the wakeup seems to be pretty finicky and if it isn't just right, the ECU won't wake up. I've just added this feature this week and only tested it with one of my three cables. I'll see what I can do to improve things.
 

caffeine

Active member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
00 ALH Jetta
Thanks for the logs and the photos. It's definitely the same processor (Micronas) as the earlier VDO MKIV clusters and probably runs similar software. VDO clusters have a 4-byte unlock code that must be sent to the cluster before it will allow dumping the EEPROM. kw1281test has a few common ones that it tries. I've added some more in the latest version: https://github.com/gmenounos/kw1281test/releases/tag/v0.52-beta
Give it a try again when you get a chance and let me know if it works. It may take a while as it chews through all the codes, but if it finds one that works, it will log a message like "Unlock code for software version VMMJ08MH $00 $09 is $01 $02 $03 $04. Please report this to the program maintainer."
If you see that message, please report it to me and I'll enhance kw1281test so it uses that unlock code immediately the next time it sees that same cluster version.
Unfortunately it seems that none of the new lock codes worked
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Well, if you have even more free time, you can try to dump a portion of the cluster ROM and send it to me and I may be able to figure it out from that.

.\kw1281test.exe COM2 10400 17 DumpMem 163840 32768

Beware: It could take 30-40 minutes.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Thanks for taking the time to dump that portion of the ROM. I was able to find the unlock code and have re-released v0.52-beta:
Please download it and let me know if it works.
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW 02Q, 2003 Jetta Ute 02J swap, 2003 Golf 02J swap
The M73 D09 version of that Audi cluster must have something different enough about it that kw1281test can't dump the EEPROM. If you can ever find an inexpensive one at a scrap yard and send it to me, I can take a look. Or if you can take one apart, share a photo of the biggest chip on the board. It would look something like this: https://photos.app.goo.gl/Px9MxAfgkmGMwSWE8
I've maybe seen *two* Audi TT's at the junkyard, ever. There might still be one now, but I somehow doubt it has an instrument cluster, but if it does, consider it yours.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I've maybe seen *two* Audi TT's at the junkyard, ever. There might still be one now, but I somehow doubt it has an instrument cluster, but if it does, consider it yours.
Thanks! But I would suggest holding out for a D09 cluster - or at least don't bother with a D14 cluster as we know it already works with that version. The TT clusters that I've seen on eBay seem to be pretty well marked on the back as to what software version is inside.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Here's a link to me attempting to read an EDC15 EEPROM a couple times:
ECUFail.log
Can you give the EDC15 another try with the newest version? I've changed the method used to wake up the ECU so hopefully it will work this time.

 

caffeine

Active member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
00 ALH Jetta
Can you give the EDC15 another try with the newest version? I've changed the method used to wake up the ECU so hopefully it will work this time.

I don't have access to the same car I tested on before, but I just tested on my 00 ALH car and after "Reading sync byte" I get "Unhandled exception... Unexpected sync byte: Expected $55, Actual $B5
 

caffeine

Active member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
00 ALH Jetta
Hold on, I tried with 9600 baud rate instead of 10400 just now, and it seems to have dumped the binary successfully...
 

caffeine

Active member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
00 ALH Jetta
I spoke too soon... it definitely dumped SOMETHING, but it's only 512 bytes in size (and a ECU dump with MPPS produced a 512kb file) so it would seem it only got a very small amount of data. Here's a copy of the log, first with the attempt at 10400 baud rate and then at 9600, and a copy of both the file that kw1281test produced and the 512kb dump that MPPS gave me.
ECURead.zip
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I spoke too soon... it definitely dumped SOMETHING, but it's only 512 bytes in size (and a ECU dump with MPPS produced a 512kb file) so it would seem it only got a very small amount of data. Here's a copy of the log, first with the attempt at 10400 baud rate and then at 9600, and a copy of both the file that kw1281test produced and the 512kb dump that MPPS gave me.
No, it's working the way it's supposed to. The ECU has both a 512-byte EEPROM like the clusters do, and a 512KB flash ROM. The DumpEDC15EEPROM command only dumps the EEPROM. That's useful because on Immo3 cars, the ECU's EEPROM has the same SKC as the cluster, so it's an alternative way to determine your SKC. It also contains a secondary odometer reading, so you can double-check against the cluster's odometer if you're concerned that it might be fraudulent. Finally, there are a couple of bytes in the EEPROM that are used to enable/disable the Immobilizer.

It's good to see that the DumpEDC15EEPROM is working for you (sorry I forgot to mention that you need to use 9600 baud, but you figured it out). Next I'll work on commands to modify the EEPROM and to dump the flash ROM.
 
Top