kw1281test: A Free VDS-Pro / VagTacho Alternative

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
For anyone interested, I bumped into this other GitHub project a while ago: https://github.com/fjvva/ecu-tool
and completely forgot about it until yesterday. It's a hardware project to read and flash EDC15 ECUs, sort of like a poor-man's FlashZilla/QLoader. All the source code to talk to the EDC15 is included in the project and it looks like it might not be that hard to merge it into kw1281test. No hardware would be needed other than a KKL cable and a laptop. I'll give it a whirl when I get time.
That would be sweet!
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
I changed coding in my ccm on my 2005 Passat wagon, sections 04370-2 to a decimal value of 4. I had changed it to 97, and it made the hatch unlocked with the doors, and that stayed the same with the value of 4.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Hmmm.. I wanted to dump a friends TT and its come up as IMMO 4 on VDCS and if i run the BeetleDumpMem command it comes back as unsupported software.. the car is a 2005 8N not heard of these having IMMO 4
Would kw1281test be able to to read the eeprom for the SKC?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Hmmm.. I wanted to dump a friends TT and its come up as IMMO 4 on VDCS and if i run the BeetleDumpMem command it comes back as unsupported software.. the car is a 2005 8N not heard of these having IMMO 4
Would kw1281test be able to to read the eeprom for the SKC?
I don't know. What's the part number of the cluster? What info is returned by the kw1281test ReadIdent command?
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Hi, my bad, was looking at channel CH25 for the time out blocks not CH24!
part number...
Component: KOMBI+WEGFAHRS. M73 D09
Coding: 00444
Shop #: WSC 00000
just going to re run kw1281 to confirm output.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Jusst ran the kw1281, basicaly lists the above and says Unsupported software.
same pn as my clusters but its D09 Not D14?
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Cant work out how to copy command shel tect to show you!
Or upload an image!
Having a right day today!! 😀😀😀😀😀
 

BobnOH

not-a-mechanic
Joined
May 29, 2004
Location
central Ohio
TDI
New Beetle 2003 manual
Yea, it takes a bit of fiddling to get the new upload and post routine down. See signature below.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
I'll get on it today and report back!

Maybe with a picture too, if I can work it out!
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Okay, heres what i got back

KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com3 9600 17 DumpBeetleMem 14336 2048
Opening serial port com3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920980A KOMBI+WEGFAHRS. M73 D09
Software Coding 00444, Workshop Code: 00000
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpCcmRom
DumpClusterNecRom
DumpEeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRB8Eeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)
Sending EndCommunication block
KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)
Args:
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpCcmRom
DumpClusterNecRom
DumpEeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRB8Eeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)


Am i still supposed to use the BeetkDumpMem command?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Use the DumpMarelliMem command.

I renamed DumpBeetleMem to DumpMarelliMem because it works on clusters made by Magneti Marelli, which include both the Beetle and the TT.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Right will head out again 😀
Still use the parameters 14336 2048?
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Not good news i fear!

KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com3 9600 17 DumpMarelliMem 14336 2048
Opening serial port com3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920980A KOMBI+WEGFAHRS. M73 D09
Software Coding 00444, Workshop Code: 00000
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 33
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 57
at BitFab.KW1281Test.Program.WriteMarelliBlockAndReadAck(Byte[] data) in C:\Users\gmeno\src\kw1281test\Program.cs:line 727
at BitFab.KW1281Test.Program.DumpMarelliMem(IKW1281Dialog kwp1281, ControllerInfo ecuInfo, UInt16 address, UInt16 count) in C:\Users\gmeno\src\kw1281test\Program.cs:line 488
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 188
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 24
KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)

Cluster makes a whiring sound before the Unhandeled exception report.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
I'll just swap over and check..
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
sitting in mine and it dumped fine.
Cluster whir after dump.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I think the whir is the cluster rebooting. Not sure why it's not working with the M73 D09 cluster. You could try disconnecting the battery for a minute then reconnect and try again once or twice.
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Okay, I'll give it a try in a while..(y)
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Unfortunatley it's the same result.. very strange:unsure:
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
My Mate was over again and we gave the M73 09 another go...
If the whirring is the cluster shutting down it happening after receiving the ACK where as the other cluster is waiting for the entire dump.
I can get a partial dump from Bag K-CAN but it's the same length for both clusters..so not sure it's actually reading anything from the 09 version... 🤔
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Well, there are at least 2 different versions of the Beetle Marelli clusters and they differ slightly in how to dump the EEPROM. Your Marelli cluster uses the same technique to dump the EEPROM as the newer Beetle cluster. I assumed the "M73 D09" worked the same, but perhaps it works like the older Beetle cluster. I will need to build a new version for you to try out but I can't do that until tonight.

If you're dying to try earlier, you can edit kw1281test.exe with a hex editor and change "V.0.7" with "D.0.9". Don't replace the ".0.", just replace the V with a D and the 7 with a 9:

1615913022050.png
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
I never take any of your great work for granted.. 👍
I may take a look later.. but I'm in no hurry.. just a few observations ..we all have busy lives.
Alan
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I never take any of your great work for granted.. 👍
I may take a look later.. but I'm in no hurry.. just a few observations ..we all have busy lives.
Alan
I updated version 0.50 with alternate dump logic for "M73 D09" clusters. Give it a try when you get a chance:
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
Okay, will do. I'll let you know how it goes.

Thanks
 

70chips

Active member
Joined
Feb 16, 2021
Location
UK
TDI
2001 C5 Allroad 2.5TD. 2008 C6 Allroad 3.0TDI. Cheeky tt Roadster 2001
I meant to ask, still use the same command as before?
 
Top