kw1281test: A Free VDS-Pro / VagTacho Alternative

[gmenounos]

You can try to connect to the ECU:

.\kw1281test COM5 9600 1 ReadIdent

That'll at least verify that kw1281test is working with your laptop and cable.

 

[TdiRN]

I'm still getting the timeout error. I used a generic obd ii reader and it was able to connect to the ECU as a test.

The Rosstech shows up in the COM port section and the USB in device manager....is this correct?

 

[gmenounos]

I'm still getting the timeout error. I used a generic obd ii reader and it was able to connect to the ECU as a test.

The Rosstech shows up in the COM port section and the USB in device manager....is this correct?

Yeah, that's correct. I think it's pretty clear that your cluster is dead. Especially if VCDS can't connect to the cluster with your KII-USB cable either.

 

[TdiRN]

I tried your code for the ECU and I get the timeout error. Clearly I must be missing something.

 

[gmenounos]

I tried your code for the ECU and I get the timeout error. Clearly I must be missing something.

Sorry, my bad. I misread your post as saying that you tried a generic cable with kw1281test.

With your KII-USB cable, VCDS should be able to connect to the cluster if the cluster is still functional. Doesn't matter whether the cable is configured in VCP mode or regular mode. Can VCDS connect to the cluster?

 

[TdiRN]

No, won’t connect to it. I wonder why your program won’t connect to ECU for me?

Also, I can’t run test in VCDS off the virtual port, does that sound right?

 

[gmenounos]

I just tried VCDS Test and it worked ok for me with the cable configured in Virtual COM Port mode.

 

[TdiRN]

Ok I tried selecting COM1 in VCDS after changing com port in device manager....didn’t work

 

[gmenounos]

You have to leave it set to USB. The setting I just posted worked (for me at least) for both VCDS and kw1281test.

 

[TdiRN]

Hopefully I can test the other cluster I'm being given today. I know my Ross-Tech cable is good as I can access the ABS module and do the auto scan with VCDS.

 

[IJskonijn]

Quick question, I was able to get a (hopefully) full cluster dump by using this command:
.\kw1281test.exe com2 10400 17 DumpEeprom 0 2048

But is there already a function to write a full cluster dump?
That would be awesome!

 

[gmenounos]

Quick question, I was able to get a (hopefully) full cluster dump by using this command:
.\kw1281test.exe com2 10400 17 DumpEeprom 0 2048

But is there already a function to write a full cluster dump?
That would be awesome!

.\kw1281test.exe com2 10400 17 LoadEeprom 0 DumpFile.bin

(where "DumpFile.bin" is the name of the dump file that you want to write to the cluster)
Use at your own risk! I don't think this has been tested by many people other than me. I apologize in advance if it bricks your cluster but hopefully it won't (and I'm not responsible if it does).

 

[TdiRN]

Well we have a new error message with the second cluster!

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 10400 17 DumpEeprom 204 6
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Unhandled exception: System.InvalidOperationException: Wrote 0xF0 to port but echo was 0x0F
at BitFab.KW1281Test.KwpCommon.WriteByteAndDiscardEcho(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 172
at BitFab.KW1281Test.KwpCommon.WriteComplement(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 105
at BitFab.KW1281Test.KwpCommon.ReadAndAckByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 87
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 482
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 460
at BitFab.KW1281Test.KW1281Dialog.ReadEcuInfo() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 79
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 284
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 189
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28

 

[TdiRN]

Also VCDS is now communicating with the cluster and the immobilizer...

 

[TdiRN]

Hold on I think we have a winner!!

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 10400 17 DumpEeprom 204 6
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920906L KOMBI+WEGFAHRSP VDO V11
Software Coding 07232, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VWK501LL $00 $01
01: $75 $18
02: $09 $05 $01 $0A $0F $37
03: VW/Sk LL Serie Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VWK501LL $00 $01 is 36 3D 3E 47
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Block: 57 5F 39 B5 F3 BF 2E C2 01 00
Sending Custom "Key response" block
Saving EEPROM dump to WVWSP61J43W141881_____VWZ7Z0B5521278_$00CC_eeprom.bin
Sending ReadEeprom block (Address: $00CC, Count: $06)
Received "Read EEPROM Response" block: F8 14 F8 14 F8 14
Saved EEPROM dump to WVWSP61J43W141881_____VWZ7Z0B5521278_$00CC_eeprom.bin
Sending EndCommunication block

 

[TdiRN]

Now is it possible to program this cluster (which is actually working) to pair with my ECU??

 

[gmenounos]

Is your ECU Immo2 or Immo3? If you don't know, post the part number of your old cluster or your ECU and I can figure it out.

 

[TdiRN]

VW 1JO 920 906M

 

[gmenounos]

VW 1JO 920 906M

Ok, last digit is 6 so you have Immo3. That means you need your old cluster's SKC and your new cluster's SKC in order to pair the cluster with the ECU.

Since your old cluster is dead, you can try this to retrieve your SKC from the ECU:

.\kw1281test COM5 9600 1 dumpedc15eeprom ecu.bin

 

[TdiRN]

Ok that worked as well! But I don't know which is the SKC...

Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 038906012FD 1,9l R4 EDC G000SG 4102
Software Coding 00002, Workshop Code: 00066
Sending EndCommunication block
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 01 F1 10 89 0D (startDiagnosticSession)
Received: 82 F1 01 50 89 4D (startDiagnosticSession ACK)
Sent: 82 01 F1 10 85 09 (startDiagnosticSession)
Received: 83 F1 01 7F 10 78 7C (startDiagnosticSession NAK reqCorrectlyRcvdRspPending)
Received: 83 F1 01 50 85 2F 79 (startDiagnosticSession ACK)
Sent: 82 01 F1 27 41 DC (securityAccess)
Received: 84 F1 01 67 41 00 00 1E (securityAccess ACK)
Sent: 82 01 F1 27 42 DD (securityAccess)
Received: 83 F1 01 67 42 34 52 (securityAccess ACK)
Sent: 08 34 40 E0 00 00 00 04 40 A0 (requestDownload)
Received: 02 74 FF 75 (requestDownload ACK)
Sent: 00 FF 36 A5 A5 14 E0 00 00 3C E0 00 00 42 E0 00 00 40 E4 00 00 02 47 13 00 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0C 00 0D 00 0E 00 0F 80 0F A0 0F C0 0F 00 10 45 2F 7D 64 9B C3 BE 88 4F D8 E6 F0 FE E7 BB 6A 48 61 2D 50 48 62 2D 1F E6 F1 00 E6 F4 41 01 00 47 F4 23 00 2D 1A 47 F4 36 00 2D 1A 47 F4 A2 00 2D 1B 47 F4 A3 00 2D 20 47 F4 A4 00 2D 21 47 F4 A5 00 2D 29 47 F4 A6 00 2D 2A 47 F4 A7 00 2D 2A 47 F4 A8 00 2D 2B BB 31 0D DA CA 00 3C E3 0D D7 CA 00 CC E2 BB 33 0D D3 BB 31 CA 00 82 E2 E7 FE 55 00 BB 63 B7 48 B7 B7 E7 FE 55 00 BB 5E 0D C7 BB 25 CA 00 82 E2 E0 02 F4 41 02 00 F6 F2 B4 FE E7 FE AA 00 0D F3 BB 1A CA 00 AA E3 0D E3 BB 16 BB 67 0D E0 BB 13 CA 00 9C E2 0D DC BB 0F CA 00 AC E2 0D D8 A9 E1 09 E1 0D E1 88 10 88 20 E6 F1 00 E6 2E (transferData)
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 E1 14 B9 41 E7 F4 7F 00 0D 08 88 10 88 20 E6 F1 00 E6 E1 14 B9 41 E7 F4 76 00 E4 41 01 00 BB 1C 0D 18 88 10 88 20 88 30 E6 F1 00 E6 BB 28 E0 02 F1 4E F1 6E B9 E1 08 11 BB 2A 48 60 3D 09 B9 E1 01 6E 08 11 A0 02 3D F8 21 6E 41 6E 2D 01 E0 26 98 30 98 20 98 10 CB 00 88 10 88 20 88 30 E6 F1 00 E6 E0 02 A9 41 E1 06 99 E1 01 6E BB 05 A0 02 3D FB F1 E6 BB 01 0D EC F7 FE B0 FE 0D 00 A7 58 A7 A7 9A B7 FC 70 F2 F7 B2 FE 7E B7 CB 00 88 10 E6 F1 FF FF E0 06 A7 58 A7 A7 8A B7 04 70 A0 01 3D FA E0 16 0D 03 F2 F7 B2 FE 7E B7 0D D3 8F E1 8F E0 9F E1 9F E0 BB 66 BB 65 BB 23 E7 FE AC 00 BB 46 BB 32 E1 0E BB 43 BB 2F BB 23 BB 1A E7 FE AD 00 BB 3D BB 29 E0 05 E6 F2 FE 01 E0 75 BB 52 A0 05 3D FD BB 3F BB 2C BB C7 A0 02 3D F7 BB 3A BB C3 9F E0 8F E0 BB 4A 9E E0 BB 48 8E E0 98 (transferData)
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 BB 46 0D 08 8F E0 9F E0 BB 42 8E E0 BB 40 9E E0 BB 3E CB 00 8E E0 BB 3B 9F E0 BB 39 8F E0 CB 00 BB 36 9F E0 BB 34 9E E0 CB 00 E0 07 8E E1 BB 2F 9F E0 BB 2D 4A E0 F7 80 9E E0 BB 29 8E E0 8F E1 CB 00 8E E0 BB 24 9F E0 BB 22 9E E0 BB 20 CB 00 88 10 E0 71 5C 87 5C 17 4A 88 E0 18 BB E1 A0 01 3D FA 8E E0 0D 54 88 10 8E E1 E0 71 E0 07 9F E0 BB 0E 5C 17 4A E0 F7 80 9E E0 BB 09 A0 01 3D F7 8F E1 8E E0 0D 44 88 30 E6 F3 00 01 0D 02 88 30 E0 73 A7 58 A7 A7 28 31 48 30 3D FB 98 30 CB 00 BB B1 E6 F7 AC 00 BB D4 BB C0 48 70 3D F9 0D 07 BB A9 E6 F7 AE 00 BB CC BB B8 48 70 3D F9 CA 00 7C E1 BB C6 BB B2 CA 00 7C E1 BB C2 BB AE 0D A2 88 10 88 20 88 30 88 40 E6 F3 00 E6 E0 02 F4 43 02 00 F4 33 03 00 F4 23 04 00 E0 04 A9 83 28 44 7C 14 28 41 08 35 A7 58 A7 A7 99 E3 99 F3 0B (transferData)
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 BB 09 08 12 18 20 A0 04 3D F7 98 40 98 30 98 20 98 10 CB 00 88 10 88 70 E6 F1 AA AA E7 FE AA 00 CA 00 22 E4 E6 F1 55 55 E7 FE 55 00 BB 7D E6 F1 AA AA E7 FE A0 00 BB 78 98 70 98 10 BB 7B BB 65 CB 00 88 10 88 20 88 30 88 40 88 50 E6 F3 00 E6 E0 02 F4 43 02 00 F4 33 03 00 F4 23 04 00 E0 04 F4 83 05 00 09 81 B9 83 08 31 E7 FE 36 00 B9 E3 08 31 29 81 BB 0A B9 E3 08 31 08 11 18 20 A0 04 3D F9 CA 00 56 E1 98 50 0D C0 88 10 A7 58 A7 A7 BB 04 66 F1 FF 3F A9 E1 0D BB 88 10 88 20 5C 22 66 F2 FC 00 1C 21 68 13 70 21 F6 F2 00 FE 0D AF 88 10 88 20 88 30 88 70 E6 F3 00 E6 E6 F2 20 00 E6 F1 AA AA E7 FE AA 00 BB 2F E6 F1 55 55 E7 FE 55 00 BB 2A E6 F1 AA AA E7 FE 80 00 BB 25 E6 F1 AA AA E7 FE AA 00 BB 20 E6 F1 55 55 E7 FE 55 00 BB 1B E6 F1 AA AA E7 FE 10 00 BB 16 CA 00 9E (transferData)
Received: 01 76 77 (transferData ACK)
Sent: 00 49 36 82 E2 E7 FE 80 00 BB 02 98 70 0D 81 88 20 88 70 26 F2 18 00 F1 FE 67 FF 80 00 BB B8 67 FE 80 00 41 EF 3D FB 98 70 98 20 CB 00 88 10 BB B7 66 F1 FF 3F B9 E1 0D 05 88 10 BB B1 66 F1 FF 3F B8 71 98 10 CB 00 17 1C E1 E3 02 (transferData)
Received: 01 76 77 (transferData ACK)
Sent: 02 31 02 35 (startRoutineByLocalIdentifier)
Received: 03 7F 31 22 D5 (startRoutineByLocalIdentifier NAK conditionsNotCorrectOrRequestSequenceError)
Sent: 01 A6 A7 (166)
Received: 01 76 77 (transferData ACK)
Saved EEPROM to ecu.bin
Received: 01 76 77 (transferData ACK)
Sent: 01 A2 A3 (162)
Received: 01 76 77 (transferData ACK)
Reboot successful!

 

[csstevej]

Damn I wish I understood this......

 

[Mozambiquer]

@gmenounos have you got it set up so you can do an immo delete with it yet? I got a cheap ALH with immobilizer issues, I want to just make sure it'll run, but the immobilizer is blocking that, as the chip reader ring seems to be bad.

 

[gmenounos]

@gmenounos have you got it set up so you can do an immo delete with it yet? I got a cheap ALH with immobilizer issues, I want to just make sure it'll run, but the immobilizer is blocking that, as the chip reader ring seems to be bad.

Maybe I can add that this weekend. But first, can you try reading the ECU's EEPROM and send it to me? You'd use a command like this (but replace COM5 with the actual COM port that your cable is configured for)

.\kw1281test COM5 9600 1 dumpedc15eeprom ecu.bin

Send me ecu.bin as an email attachment. My email address is on this page: https://github.com/gmenounos

 

[Mozambiquer]

Maybe I can add that this weekend. But first, can you try reading the ECU's EEPROM and send it to me? You'd use a command like this (but replace COM5 with the actual COM port that your cable is configured for)

.\kw1281test COM5 9600 1 dumpedc15eeprom ecu.bin

Send me ecu.bin as an email attachment. My email address is on this page: https://github.com/gmenounos

I'll try that when I get back to the car. It's over at the shop right now.

 

[OkamiTech]

Has key pairing been added in? I need to get some new keys done and was wondering if i could use this to pair them, both immo and remote.

 

[gmenounos]

Not yet, but I could add it at some point if people would find it useful.

 

[Mozambiquer]

Has key pairing been added in? I need to get some new keys done and was wondering if i could use this to pair them, both immo and remote.

If you have Vagcom, that can do the key pairing, and this software can read the skc code for the keys.

 

[OkamiTech]

If you have Vagcom, that can do the key pairing, and this software can read the skc code for the keys.

I have read up on how to do it with VCDS or even VagTacho. Just not sure if I am ready to drop $200US on VCDS right now. Just bought the car and still working on get the mechanical parts in good order.

 

[Peacetilence]

1st time poster, registered because of your tool I'd love to see key pairing added. Just used kw1281test today to extract the SKC for my Golf (came w/ only one very beaten up key..) I have a 2nd master key coming that I need to pair. My shop won't do it for me, but they may let me use their VCDS. Looked into VCDS-lite, haven't see an indication it wouldn't work after unlocking it ($100 is my understanding.) So, yes, pairing would be great ! Still have to go through the same procedure with my 2000 Jetta VR6

Thank you for all the work writing a great tool !

 

[delibury]

I too would love key pairing. I'm struggling to justify spending $100 on 9 year old software (VCDS-lite).

Del