kw1281test: A Free VDS-Pro / VagTacho Alternative

[70chips]

Well, I downloaded the beta V0.50and got the TT round.
Connected up and used the DumpMarelliMem 14336 2048 command and no joy, just the same. tried disconnecting for a while and re attempted but the same result.
I've copied the results incase I'm not doing something right!
On a technical note, what actually is the difference between the D14 and D09? Is it the type of chip or a different manufacturer?
Never ceases to amaze me how many variable there are in electronics on cars, even with identical part numbers with identical sub letters too!!

KW1281Test 0.50-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com3 9600 17 DumpMarelliMem 14336 2048
Opening serial port com3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920980A KOMBI+WEGFAHRS. M73 D09
Software Coding 00444, Workshop Code: 00000
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 33
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 57
at BitFab.KW1281Test.Program.WriteMarelliBlockAndReadAck(Byte[] data) in C:\Users\gmeno\src\kw1281test\Program.cs:line 727
at BitFab.KW1281Test.Program.DumpMarelliMem(IKW1281Dialog kwp1281, ControllerInfo ecuInfo, UInt16 address, UInt16 count) in C:\Users\gmeno\src\kw1281test\Program.cs:line 488
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 188
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 24


Regards

Alan

 

[gmenounos]

On a technical note, what actually is the difference between the D14 and D09? Is it the type of chip or a different manufacturer?
Never ceases to amaze me how many variable there are in electronics on cars, even with identical part numbers with identical sub letters too!!

I don't own an TT clusters, so I can't speak for what's inside them. The 2 Beetle clusters I have are different internally:

• The 2002-2003 Beetle cluster (part number 1C0920921G, software M73 V08) uses a Motorola MC912DG128ACPV processor and has a 2K EEPROM.
• The 1998-2001 Beetle cluster (part number 1C0920901C, software M73 V07" uses a Motorola 68HC912D60 processor and has a 1K EEPROM.

Both processors run the same instruction set but the EEPROM, RAM and register bank are at different addresses (hence the need to specify "3072 1024" for one cluster and "14336 2048" for the other).

The Audi TT 8N2920980A cluster with software M73 D14 seems to be similar enough internally to the 2002-2003 Beetle cluster that EEPROM can be dumped with the same command.

The M73 D09 version of that Audi cluster must have something different enough about it that kw1281test can't dump the EEPROM. If you can ever find an inexpensive one at a scrap yard and send it to me, I can take a look. Or if you can take one apart, share a photo of the biggest chip on the board. It would look something like this: https://photos.app.goo.gl/Px9MxAfgkmGMwSWE8

 

[gmenounos]

And VW sells cluster with exactly the same part number, but made by different suppliers with different internals. The MFA clusters with part number 1J0920926C are made mostly by VDO, but a few are made by Bosch and those are completely different inside.

 

[70chips]

Ha.. nothing's easy. I thought nissanswere bad At mixing part suppliers!
Trying to remember how deep the chip is in the cluster.. had one to bits years ago!
Is it on the back side of the board e.g. opposite from the LCD? That would be too easy though..

 

[70chips]

I'd have to convince him it's worth me taking it out!

 

[gmenounos]

Trying to remember how deep the chip is in the cluster.. had one to bits years ago!
Is it on the back side of the board e.g. opposite from the LCD? That would be too easy though..

In the Beetle clusters, the chip is visible as soon as you remove the rear of the case. Looks like it's the same in the TT:

I'll have to watch that video in slow motion and see if I can make out the numbers on the chips.

 

[70chips]

Ahh, even the 09 version.. I've tried 30 odd screen shots of this in various positions, but I can't quite read it..

 

[70chips]

Okay.. achieved the impossible..

20210319_111422.jpg

• 70chips
• Mar 19, 2021

20210319_111513.jpg

• 70chips
• Mar 19, 2021

20210319_111436.jpg

• 70chips
• Mar 19, 2021

20210319_111511.jpg

• 70chips
• Mar 19, 2021

20210319_111513 (1).jpg

• 70chips
• Mar 19, 2021

20210319_111409.jpg

• 70chips
• Mar 19, 2021

Thats the largest chip on the board!!

 

[gmenounos]

I think the processor might actually be the slightly smaller chip just to the left of the largest one. Do you have any close-up photos of that one?

 

[70chips]

Well..... I have now!1

Screenshot_20210319-152837_Gallery.jpg

• 70chips
• Mar 19, 2021

Screenshot_20210319-152820_Gallery.jpg

• 70chips
• Mar 19, 2021

Screenshot_20210319-152730_Gallery.jpg

• 70chips
• Mar 19, 2021

still hard to see as its been melt stamped on top!

 

[gmenounos]

Actually, I was wrong. It's the biggest chip after all. I think it might be part number MC68HC912DG128ACPV, which corresponds pretty closely to the processor in the 2003 Beetle cluster. So I still don't understand why kw1281test isn't able to dump the EEPROM. Thanks for all the effort and photos!

 

[70chips]

Hey.. no problem... if it helped you out , it's all good... !v

 

[gmenounos]

Added the ability to dump the EEPROM from EDC15 ECUs. This will allow retrieving the SKC from Immo3 ECUs without needing to get it from the cluster. Once this gets a bit of testing, it will not be much work to add an Immobilizer delete/undelete command as that just involves changing a couple of bytes in the EEPROM and writing them back to the ECU.

Note: The ECU is pretty picky about the exact timing of the commands needed to wake it up and dump the EEPROM, so this feature may not work for everyone just yet.

Release v0.51-beta · gmenounos/kw1281test

Added DumpEdc15EEProm command. Only tested on 038906012BD (2000 ALH) and 038906012GN (2003 ALH) ECUs. Added support for more KWP2000 message formats (length > 63) and source/destination omission. A...

github.com

KW1281Test 0.51-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 1 dumpedc15eeprom 038906012GN.bin
Opening serial port COM1
Sending wakeup message
Sent: 81 01 F1 81 F4 (startCommunication)
Sent: 81 01 F1 3E B1 (testerPresent)
Received: 83 B1 01 7F 00 13 C7 (0 NAK 19)
Sent: 82 01 F1 10 85 09 (startDiagnosticSession)
Received: 83 F1 01 7F 10 78 7C (startDiagnosticSession NAK reqCorrectlyRcvdRspPending)
Received: 83 F1 01 50 85 2F 79 (startDiagnosticSession ACK)
Sent: 82 01 F1 27 41 DC (securityAccess)
Received: 84 F1 01 67 41 00 00 1E (securityAccess ACK)
Sent: 82 01 F1 27 42 DD (securityAccess)
Received: 83 F1 01 67 42 34 52 (securityAccess ACK)
Sent: 08 34 40 E0 00 00 00 03 B0 0F (requestDownload)
Received: 02 74 FF 75 (requestDownload ACK)
Sent: 00 FF 36 A5 ...
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 B9 ...
Received: 01 76 77 (transferData ACK)
Sent: 00 FF 36 8F ...
Received: 01 76 77 (transferData ACK)
Sent: 00 B7 36 00 ...
Received: 01 76 77 (transferData ACK)
Sent: 02 31 02 35 (startRoutineByLocalIdentifier)
Received: 03 7F 31 22 D5 (startRoutineByLocalIdentifier NAK conditionsNotCorrectOrRequestSequenceError)
Sent: 01 A6 A7 (166)
Received: 01 76 77 (transferData ACK)
Saved EEPROM to 038906012GN.bin
Received: 01 76 77 (transferData ACK)
Sent: 01 A2 A3 (162)
Received: 01 76 77 (transferData ACK)
Reboot successful!

 

[caffeine]

Do you know anything about the 07+ Mk4.5 Jetta City/Golf City clusters sold in Canada? I picked one up the other day from an 09; it's made by VDO and on the outside it looks identical to any other Mk4 MFA sport cluster, but with R32-style gauge faces and silver-center needles. I couldn't get kw1281test to dump the EEPROM though.

Also, tried dumping the ECU EEPROM from an 02 ALH Golf but was unsuccessful. It has an aftermarket tune on it so I'm not sure if that's a factor as to why. I'll test it on my 00 ALH Jetta at some point as well which has an unmodified ECU.

 

[gmenounos]

Do you know anything about the 07+ Mk4.5 Jetta City/Golf City clusters sold in Canada? I picked one up the other day from an 09; it's made by VDO and on the outside it looks identical to any other Mk4 MFA sport cluster, but with R32-style gauge faces and silver-center needles. I couldn't get kw1281test to dump the EEPROM though.

Also, tried dumping the ECU EEPROM from an 02 ALH Golf but was unsuccessful. It has an aftermarket tune on it so I'm not sure if that's a factor as to why. I'll test it on my 00 ALH Jetta at some point as well which has an unmodified ECU.

Unfortunately I don't own any City clusters so I can't say why it didn't work. If you can send me kw1281test.log, I can investigate both of those issues.

 

[caffeine]

Here's some pics of the Jetta City board

City Jetta Cluster

• caffeine
• Mar 24, 2021
• 0

Pics of the board

Here's a link to a log of me attempting to read the EEPROM and then doing an actuator test:
CityCluster.log
Here's a link to me attempting to read an EDC15 EEPROM a couple times:
ECUFail.log

 

[gmenounos]

Thanks for the logs and the photos. It's definitely the same processor (Micronas) as the earlier VDO MKIV clusters and probably runs similar software. VDO clusters have a 4-byte unlock code that must be sent to the cluster before it will allow dumping the EEPROM. kw1281test has a few common ones that it tries. I've added some more in the latest version: https://github.com/gmenounos/kw1281test/releases/tag/v0.52-beta
Give it a try again when you get a chance and let me know if it works. It may take a while as it chews through all the codes, but if it finds one that works, it will log a message like "Unlock code for software version VMMJ08MH $00 $09 is $01 $02 $03 $04. Please report this to the program maintainer."
If you see that message, please report it to me and I'll enhance kw1281test so it uses that unlock code immediately the next time it sees that same cluster version.

As for the ECU, it's trying to wake up the EDC15 a special way so that it talks KW2000 protocol instead of KW1281, which is needed to dump the EEPROM. The exact timing of the wakeup seems to be pretty finicky and if it isn't just right, the ECU won't wake up. I've just added this feature this week and only tested it with one of my three cables. I'll see what I can do to improve things.

 

[caffeine]

Thanks for the logs and the photos. It's definitely the same processor (Micronas) as the earlier VDO MKIV clusters and probably runs similar software. VDO clusters have a 4-byte unlock code that must be sent to the cluster before it will allow dumping the EEPROM. kw1281test has a few common ones that it tries. I've added some more in the latest version: https://github.com/gmenounos/kw1281test/releases/tag/v0.52-beta
Give it a try again when you get a chance and let me know if it works. It may take a while as it chews through all the codes, but if it finds one that works, it will log a message like "Unlock code for software version VMMJ08MH $00 $09 is $01 $02 $03 $04. Please report this to the program maintainer."
If you see that message, please report it to me and I'll enhance kw1281test so it uses that unlock code immediately the next time it sees that same cluster version.

Unfortunately it seems that none of the new lock codes worked

 

[gmenounos]

Well, if you have even more free time, you can try to dump a portion of the cluster ROM and send it to me and I may be able to figure it out from that.

.\kw1281test.exe COM2 10400 17 DumpMem 163840 32768

Beware: It could take 30-40 minutes.

 

[caffeine]

Well, if you have even more free time, you can try to dump a portion of the cluster ROM and send it to me and I may be able to figure it out from that.

.\kw1281test.exe COM2 10400 17 DumpMem 163840 32768

Beware: It could take 30-40 minutes.

Here you go:
CityJettaClusterROM.bin

 

[gmenounos]

Thanks for taking the time to dump that portion of the ROM. I was able to find the unlock code and have re-released v0.52-beta:

Release v0.52-beta · gmenounos/kw1281test

Added more VDO cluster unlock codes including the one needed to support the City Golf/Jetta (software VMMJ08MH $00 $09).

github.com

Please download it and let me know if it works.

 

[caffeine]

Thanks for taking the time to dump that portion of the ROM. I was able to find the unlock code and have re-released v0.52-beta:

Release v0.52-beta · gmenounos/kw1281test

Added more VDO cluster unlock codes including the one needed to support the City Golf/Jetta (software VMMJ08MH $00 $09).

github.com

Please download it and let me know if it works.

Success!

 

[caffeine]

Side note: The VMMJ08MH EEPROM seems to be in the same format as VWK503HM EEPROMs.

 

[pkhoury]

The M73 D09 version of that Audi cluster must have something different enough about it that kw1281test can't dump the EEPROM. If you can ever find an inexpensive one at a scrap yard and send it to me, I can take a look. Or if you can take one apart, share a photo of the biggest chip on the board. It would look something like this: https://photos.app.goo.gl/Px9MxAfgkmGMwSWE8

I've maybe seen *two* Audi TT's at the junkyard, ever. There might still be one now, but I somehow doubt it has an instrument cluster, but if it does, consider it yours.

 

[gmenounos]

I've maybe seen *two* Audi TT's at the junkyard, ever. There might still be one now, but I somehow doubt it has an instrument cluster, but if it does, consider it yours.

Thanks! But I would suggest holding out for a D09 cluster - or at least don't bother with a D14 cluster as we know it already works with that version. The TT clusters that I've seen on eBay seem to be pretty well marked on the back as to what software version is inside.

 

[gmenounos]

Here's a link to me attempting to read an EDC15 EEPROM a couple times:
ECUFail.log

Can you give the EDC15 another try with the newest version? I've changed the method used to wake up the ECU so hopefully it will work this time.

Release v0.55-beta · gmenounos/kw1281test

Changed method used to wake up EDC15 in KW2000 mode. Should improve chances of dumping EDC15 EEPROM with various cables.

github.com

 

[caffeine]

Can you give the EDC15 another try with the newest version? I've changed the method used to wake up the ECU so hopefully it will work this time.

Release v0.55-beta · gmenounos/kw1281test

Changed method used to wake up EDC15 in KW2000 mode. Should improve chances of dumping EDC15 EEPROM with various cables.

github.com

I don't have access to the same car I tested on before, but I just tested on my 00 ALH car and after "Reading sync byte" I get "Unhandled exception... Unexpected sync byte: Expected $55, Actual $B5

 

[caffeine]

Hold on, I tried with 9600 baud rate instead of 10400 just now, and it seems to have dumped the binary successfully...

 

[caffeine]

I spoke too soon... it definitely dumped SOMETHING, but it's only 512 bytes in size (and a ECU dump with MPPS produced a 512kb file) so it would seem it only got a very small amount of data. Here's a copy of the log, first with the attempt at 10400 baud rate and then at 9600, and a copy of both the file that kw1281test produced and the 512kb dump that MPPS gave me.
ECURead.zip

 

[gmenounos]

I spoke too soon... it definitely dumped SOMETHING, but it's only 512 bytes in size (and a ECU dump with MPPS produced a 512kb file) so it would seem it only got a very small amount of data. Here's a copy of the log, first with the attempt at 10400 baud rate and then at 9600, and a copy of both the file that kw1281test produced and the 512kb dump that MPPS gave me.

No, it's working the way it's supposed to. The ECU has both a 512-byte EEPROM like the clusters do, and a 512KB flash ROM. The DumpEDC15EEPROM command only dumps the EEPROM. That's useful because on Immo3 cars, the ECU's EEPROM has the same SKC as the cluster, so it's an alternative way to determine your SKC. It also contains a secondary odometer reading, so you can double-check against the cluster's odometer if you're concerned that it might be fraudulent. Finally, there are a couple of bytes in the EEPROM that are used to enable/disable the Immobilizer.

It's good to see that the DumpEDC15EEPROM is working for you (sorry I forgot to mention that you need to use 9600 baud, but you figured it out). Next I'll work on commands to modify the EEPROM and to dump the flash ROM.