kw1281test: A Free VDS-Pro / VagTacho Alternative

[Mozambiquer]

Vcds isn't only for pairing keys, it's also the ultimate diagnostic software for
Volkswagen. And when you compare the price to other software, it's actually very inexpensive. Though it would be kinda awesome if Greg can put the key programming into the software.

 

[Peacetilence]

@gmenounos -- from my 2000 Jetta VR6:

Unlock code for software version V599LLA  $00 $03  is  38 3F 40 35
Please report this to the program maintainer.

More detail:

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 ReadSoftwareVersion
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920900J  A4-KOMBIINSTR. VDO V60 
Software Coding 07262, Workshop Code: 00066
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: V599LLA  $00 $03 
01: $56 $35 $39 $39 $4C $4C $41 $20 $00 $03 
02: $56 $35 $39 $39 $4C $4C $41 $20 $00 $03 
03: V599LLA  $00 $03 
Sending EndCommunication block

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 ReadIdent
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920900J  A4-KOMBIINSTR. VDO V60 
Software Coding 07262, Workshop Code: 00066
Sending ReadIdent block
Ident: IMMO-IDENTNR: VWZ7Z0Y2371016       
Sending EndCommunication block

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 DumpEeprom 204 6
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920900J  A4-KOMBIINSTR. VDO V60 
Software Coding 07262, Workshop Code: 00066
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: V599LLA  $00 $03 
01: $56 $35 $39 $39 $4C $4C $41 $20 $00 $03 
02: $56 $35 $39 $39 $4C $4C $41 $20 $00 $03 
03: V599LLA  $00 $03 
Sending Custom "Unlock partial EEPROM read" block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Unlock code for software version V599LLA  $00 $03  is  38 3F 40 35
Please report this to the program maintainer.
Sending Custom "Need Seed/Key?" block
Received NAK block
Sending Custom "Seed request" block
Received NAK block
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2371016________$00CC_eeprom.bin
Sending ReadEeprom block (Address: $00CC, Count: $06)
Received "Read ROM/EEPROM Response" block: 56 57 5A 37 5A 30
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2371016________$00CC_eeprom.bin
Sending EndCommunication block

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 46 DumpEeprom 4352 24
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799AJ 61 Zentral-SG Komf. 0001
Software Coding 04096, Workshop Code: 00066
Sending Login block
Saving EEPROM dump to ccm_eeprom_$1100.bin
Sending ReadEeprom block (Address: $1100, Count: $0C)
Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF
Sending ReadEeprom block (Address: $110C, Count: $0C)
Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF
Saved EEPROM dump to ccm_eeprom_$1100.bin
Sending EndCommunication block

Pretty sure this is my bad:

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 1 DumpEdc15Eeprom ecu.bin
Opening serial port COM3
Sending wakeup message
Reading sync byte
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $A5
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 50
   at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 275
   at BitFab.KW1281Test.Program.DumpEdc15Eeprom() in C:\Users\gmeno\src\kw1281test\Program.cs:line 491
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 185
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28

 

[JohnTF]

I should not bother to ask almost no computer skills ;(
I have a KII-USB cable and have been using Ross-Tech software .
A few things on list ,
car new to me about 3 mths ago , came with about 4 extra keys , a couple of those remote unlock , only one is cut ?
Looking to swap auto & have bought most all parts for manual swap - so changing cars computer to work with man. ?
Put is a catch-can and would like to reduce EGR on time ?
The list will grow as I get more time .

Thanks for all the work you folks are doing here .

 

[IJskonijn]

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 DumpEeprom 0 2048
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 7M3920820H  KOMBIINSTRUMENT VDO V57
Software Coding 09111, Workshop Code: 00010
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: MPV501MH $00 $01
01: $73 $18
02: $1D $0A $01 $0D $38 $05
03: MPV MH Serie/Maske 
Sending Custom "Unlock partial EEPROM read" block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Unlock code for software version MPV501MH $00 $01  is  38 47 34 3A
Please report this to the program maintainer.
Sending Custom "Need Seed/Key?" block
Cluster is unlocked for EEPROM access. Skipping Seed/Key login.
Saving EEPROM dump to 7M3920820H__KOMBIINSTRUMENT_VDO_V57
Software_Coding_09111,_Workshop_Code_00010_$0000_eeprom.bin
Unhandled exception: System.IO.IOException: De syntaxis van de bestandsnaam, mapnaam of volumenaam is onjuist. : 'D:\Users\Gerben\Downloads\vag\kw1281test\7M3920820H__KOMBIINSTRUMENT_VDO_V57
Software_Coding_09111,_Workshop_Code_00010_$0000_eeprom.bin'
   at System.IO.FileStream.ValidateFileHandle(SafeFileHandle fileHandle)
   at System.IO.FileStream.CreateFileOpenHandle(FileMode mode, FileShare share, FileOptions options)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
   at System.IO.File.Create(String path, Int32 bufferSize, FileOptions options)
   at BitFab.KW1281Test.Program.DumpEeprom(IKW1281Dialog kwp1281, UInt16 startAddr, UInt16 length, Byte maxReadLength, String fileName) in C:\Users\gmeno\src\kw1281test\Program.cs:line 780
   at BitFab.KW1281Test.Program.DumpClusterEeprom(IKW1281Dialog kwp1281, UInt16 startAddress, UInt16 length) in C:\Users\gmeno\src\kw1281test\Program.cs:line 837
   at BitFab.KW1281Test.Program.DumpEeprom(IKW1281Dialog kwp1281, UInt32 address, UInt32 length) in C:\Users\gmeno\src\kw1281test\Program.cs:line 517
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 190
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28

I also found a new unlock code
The error is about the file path length I believe. When I run it with a custom name, it runs fine

 

[csstevej]

I have a KII-USB cable and have been using Ross-Tech software .

Looking to swap auto & have bought most all parts for manual swap - so changing cars computer to work with man. ?

Thanks for all the work you folks are doing here .

JohnTF......you do not need to change the engine ecm, you just need to recode your existing one to a manual using VCDS.
It will still run fine but you will have a cel with the code about not seeing the trans or something like that.

 

[JohnTF]

I did not intend to mean swap ecm , but changing what the computer thinks
Which I thought would include keeping from - not turning on the cel ?

Left this out
Would this software work with the KII-USB cable ?

 

[gmenounos]

@gmenounos -- from my 2000 Jetta VR6:

Unlock code for software version V599LLA  $00 $03  is  38 3F 40 35
Please report this to the program maintainer.

Thanks! I'll add that to the next version.

Pretty sure this is my bad:

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 1 DumpEdc15Eeprom ecu.bin
Opening serial port COM3
Sending wakeup message
Reading sync byte
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $A5
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 50
   at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 275
   at BitFab.KW1281Test.Program.DumpEdc15Eeprom() in C:\Users\gmeno\src\kw1281test\Program.cs:line 491
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 185
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28

I would give it a few more tries. I've seen people get that same error before and then later it works fine. Could be electrical noise on the K-line or maybe some other module is trying to use the line at the same time that kw1281test is trying to talk to the ECU.

 

[gmenounos]

I also found a new unlock code
The error is about the file path length I believe. When I run it with a custom name, it runs fine

Thanks for the new unlock code. I'll add it to the next version.

Sorry about the long filename. I'll investigate shortening the default name.

 

[xandie]

OK, So I have been following this thread for a while. I have a 2004 Golf 2.0l manual. I have this program running for most modules on OS11 and Windows 10 with a blue amazon FTDI KKL USB cable. My issue is that whenever I try to access the CCM I get an error after the sync byte. Also VCDS lite gives the error cant sync baud rate; both programs can access all the other obd2 modules fine. Also, all the CCM features in the car such as locks and remotes work fine, and the windows roll up and down with the key. VCDS lite shows the module in a module finder run through as

Address 46: Central Conv.
Protocol: KW1281
Controller: 1C0 959 799 C
Component: 8C Komfortgerát HLO 0003
Coding: 00258
Shop #: WSC 00000
Note: Can't Synch Baud Rate

Thanks for all your work on this program and hopefully someone has some idea what might be happening.

 

[gmenounos]

OK, So I have been following this thread for a while. I have a 2004 Golf 2.0l manual. I have this program running for most modules on OS11 and Windows 10 with a blue amazon FTDI KKL USB cable. My issue is that whenever I try to access the CCM I get an error after the sync byte. Also VCDS lite gives the error cant sync baud rate; both programs can access all the other obd2 modules fine. Also, all the CCM features in the car such as locks and remotes work fine, and the windows roll up and down with the key. VCDS lite shows the module in a module finder run through as

Address 46: Central Conv.
Protocol: KW1281
Controller: 1C0 959 799 C
Component: 8C Komfortgerát HLO 0003
Coding: 00258
Shop #: WSC 00000
Note: Can't Synch Baud Rate

Thanks for all your work on this program and hopefully someone has some idea what might be happening.

I'm not sure what might be going wrong. Can you post the log file or a screenshot of kw1281test trying to connect to the CCM?

As for the "Can't sync baud rate" error in VCDS, I found this on the Ross-Tech site:

• If when you try to connect to a control module, you get the error message "Can't Synch Baud Rate", go to the Options Screen and try setting the Start Baud to 9600. If 9600 doesn't work, also try 4800 and 1200. Turn the car's ignition OFF and back ON after each failed attempt to connect!

 

[xandie]

ok here is the log from the CCM attempts


Unhandled exception: System.TimeoutException: Read timed out
at BitFab.KW1281Test.Interface.FtdiInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\FtdiInterface.cs:line 76
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 47
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 275
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 236
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28
KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: A50285BI 9600 46 ReadIdent
Opening FTDI serial port A50285BI
Sending wakeup message
Reading sync byte
Unhandled exception: System.TimeoutException: Read timed out
at BitFab.KW1281Test.Interface.FtdiInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\FtdiInterface.cs:line 76
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 47
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 275
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 236
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28
KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: A50285BI 4800 46 ReadIdent
Opening FTDI serial port A50285BI
Sending wakeup message
Reading sync byte
Unhandled exception: System.TimeoutException: Read timed out
at BitFab.KW1281Test.Interface.FtdiInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\FtdiInterface.cs:line 76
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 47
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 275
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 236
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 28

 

[gmenounos]

Looks like the CCM just isn't waking up when kw1281test sends the 5-baud wakeup byte. My only suggestion would be going into the FTDI serial port settings and try setting "Receive (Bytes)" to 64, "Transmit (Bytes)" to 64, and "Latency Timer (msec)" to 1 as described here:

Optimizing USB to serial port settings | Digi International

www.digi.com

Also, how did you get the "windows roll up and down with the key" to work if you can't communicate with the CCM? Did you use a device like this: https://www.ecstuning.com/News/Volk...ad_module_1999_2000_2001_2002_2003_2004_2005/

If so, maybe that did something to the CCM that's preventing kw1281test and VCDS from talking to it.

 

[xandie]

Ill try the settings alteration later tonight or tomorrow and let you know. as for the windows with the key, I meant the key in the door, not with the key fob. As far as I know, that's standard.

 

[Mozambiquer]

Maybe I can add that this weekend. But first, can you try reading the ECU's EEPROM and send it to me? You'd use a command like this (but replace COM5 with the actual COM port that your cable is configured for)

.\kw1281test COM5 9600 1 dumpedc15eeprom ecu.bin

Send me ecu.bin as an email attachment. My email address is on this page: https://github.com/gmenounos

I finally got the BIN file, had to put the computer in the golf to connect. I emailed it to you.

 

[hicklehoff]

Hi I chanced accross your very wonderful thing when trying to code a spare key for my 2001 Audi TT having no Audi Dealers on the Isle of Wight.

I am pretty sure my cable is on COM3 so I typed in.

KW1281Test COM3 9600 17 DumpClusterNecRom

In an attempt to get the pin to type into VCDS and sort out the immo coding...I have a feeling I am hopelessly wide of the mark and woudl appreciate any advice you or anyone following the thread could give.

This is what I got back...


Args: COM3 9600 17 DumpClusterNecRom
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920930C KOMBI+WEGFAHRS. M73 D55
Software Coding 05444, Workshop Code: 00953
Saving cluster NEC ROM to cluster_nec_rom_dump.bin
Sending Custom "Read NEC ROM" block (Address: $0000, Count: $10)
Sending Custom "Unlock Additional Commands" block
Received NAK block
Received NAK block
Unhandled exception: System.InvalidOperationException: Custom "Read NEC ROM" returned 0 blocks instead of 1
at BitFab.KW1281Test.KW1281Dialog.CustomReadNecRom(UInt16 address, Byte count) in F:\Downloads\kw1281test-0.55-beta\kw1281test-0.55-beta\KW1281Dialog.cs:line 305
at BitFab.KW1281Test.Program.DumpClusterNecRom(IKW1281Dialog kwp1281) in F:\Downloads\kw1281test-0.55-beta\kw1281test-0.55-beta\Program.cs:line 461
at BitFab.KW1281Test.Program.Run(String[] args) in F:\Downloads\kw1281test-0.55-beta\kw1281test-0.55-beta\Program.cs:line 181
at BitFab.KW1281Test.Program.Main(String[] args) in F:\Downloads\kw1281test-0.55-beta\kw1281test-0.55-beta\Program.cs:line 28


Many thanks in advance.

Dom

 

[xandie]

Hi again I still can't access the ccm but can access everything else. Could a bad door lock module make me not be able to access it? Also if like to edit the seat belt alert and the cruise light is that in the CCM or in the cluster?

 

[gmenounos]

Hi again I still can't access the ccm but can access everything else. Could a bad door lock module make me not be able to access it? Also if like to edit the seat belt alert and the cruise light is that in the CCM or in the cluster?

Cruise control light behavior is something you can change by editing the cluster EEPROM: http://www.users.on.net/~graeme86/clusterprog/clusterprog.html
Seatbelt warning can be disabled via cluster soft coding with VCDS or kw1281test: https://www.ross-tech.com/vag-com/cars/vwmkIV.html

 

[gmenounos]

Hi I chanced accross your very wonderful thing when trying to code a spare key for my 2001 Audi TT having no Audi Dealers on the Isle of Wight.

I am pretty sure my cable is on COM3 so I typed in.

KW1281Test COM3 9600 17 DumpClusterNecRom

The DumpClusterNecRom command is not the right command for dumping the cluster EEPROM. In fact, I should probably hide it as it's not really useful to 99.9% of the people that use kw1281test. It's a specialized command for dumping the ROM from the daughterboard that controls the red display on VDO MFA/FIS clusters.

For a TT cluster (which is made by Magneti Marelli and is similar internally to the MKIV Beetle clusters), you should try the following commands and report back if either one worked:

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048

 

[gmenounos]

Hi again I still can't access the ccm but can access everything else. Could a bad door lock module make me not be able to access it?

I wouldn't think so, but not 100% sure. The door lock modules connect to the CCM and cluster via a CAN bus, but kw1281test and VCDS (MKIV cars) talk to the CCM via the K Line, so I don't think a bad door lock module would interfere with diagnostics.

You might try looking for someone in your area with a genuine VCDS cable on the off chance that it's something related to the cable. You could also try swapping in an identical CCM, but that's tricky as you can't just go by the external part number, there's a color code (08C for yours) that also needs to match.

 

[hicklehoff]

The DumpClusterNecRom command is not the right command for dumping the cluster EEPROM. In fact, I should probably hide it as it's not really useful to 99.9% of the people that use kw1281test. It's a specialized command for dumping the ROM from the daughterboard that controls the red display on VDO MFA/FIS clusters.

For a TT cluster (which is made by Magneti Marelli and is similar internally to the MKIV Beetle clusters), you should try the following commands and report back if either one worked:

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048

Hi,

Firstly, thank you so much for your time. These were my results. It says unsupporeted software version, not sure if it's too old or too new.

Dom


Args: COM3 9600 17 DumpMarelliMem 3072 1024
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920930C KOMBI+WEGFAHRS. M73 D55
Software Coding 05444, Workshop Code: 00953
Unsupported cluster software version

KW1281Test 0.55-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 17 DumpMarelliMem 14336 2048
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920930C KOMBI+WEGFAHRS. M73 D55
Software Coding 05444, Workshop Code: 00953
Unsupported cluster software version

Would it be dangerous to add M75 D55 into the following or statement?


else if (
ecuInfo.Text.Contains("M73 V08") || // Beetle 1C0920921G
ecuInfo.Text.Contains("M73 D09") || // Audi TT 8N2920980A
ecuInfo.Text.Contains("M73 D14")) // Audi TT 8N2920980A
{
entryH = 0x18;
regBlockH = 0x20;
}

Dom

 

[gmenounos]

Firstly, thank you so much for your time. These were my results. It says unsupporeted software version, not sure if it's too old or too new.

I just published a new version: https://github.com/gmenounos/kw1281test/releases/tag/v0.56-beta

You can download it and try each the following commands again and hopefully one will work. (But read the warning below first!)

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048

Warning: Either command may cause your cluster to lock up (or worse) and you may need to disconnect/reconnect the battery to fix it. The way that kw1281test dumps Marelli clusters is by downloading a small program into the cluster and running it. Your cluster is running software that kw1281test has not been tested with, so it's impossible to predict what might happen if we send a program to the cluster and it's not correct for that cluster. The cluster might reject it, the cluster might lock up, or (very extremely unlikely I think), it might permanently damage the cluster. I wish I could offer more of a guarantee, but I have no TT clusters to test with, just a couple of Marelli Beetle clusters.

 

[hicklehoff]

I just published a new version: https://github.com/gmenounos/kw1281test/releases/tag/v0.56-beta

You can download it and try each the following commands again and hopefully one will work. (But read the warning below first!)

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048

Warning: Either command may cause your cluster to lock up (or worse) and you may need to disconnect/reconnect the battery to fix it. The way that kw1281test dumps Marelli clusters is by downloading a small program into the cluster and running it. Your cluster is running software that kw1281test has not been tested with, so it's impossible to predict what might happen if we send a program to the cluster and it's not correct for that cluster. The cluster might reject it, the cluster might lock up, or (very extremely unlikely I think), it might permanently damage the cluster. I wish I could offer more of a guarantee, but I have no TT clusters to test with, just a couple of Marelli Beetle clusters.

A new ver, thank you!

Looks like we connected and got a dump with:

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

Deciphering the binary is a little beyond me but maybe you could/ it is possible to do the next step?

cluster-dump.png

• hicklehoff
• Jun 23, 2021

Here's the debug log.


KW1281Test 0.56-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 17 DumpMarelliMem 3072 1024
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920930C KOMBI+WEGFAHRS. M73 D55
Software Coding 05444, Workshop Code: 00953
Untested cluster version! You may need to disconnect your battery if this fails.
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
Receiving ACK
Receiving memory dump
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in F:\OneDrive\Documents\My Documents\audi TT\FreeKeyReadSoftware\kw1281test-0.56-beta\Interface\GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in F:\OneDrive\Documents\My Documents\audi TT\FreeKeyReadSoftware\kw1281test-0.56-beta\KwpCommon.cs:line 76
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(IKW1281Dialog kwp1281, ControllerInfo ecuInfo, String filename, UInt16 address, UInt16 count) in F:\OneDrive\Documents\My Documents\audi TT\FreeKeyReadSoftware\kw1281test-0.56-beta\Cluster\MarelliCluster.cs:line 132
at BitFab.KW1281Test.Program.Run(String[] args) in F:\OneDrive\Documents\My Documents\audi TT\FreeKeyReadSoftware\kw1281test-0.56-beta\Program.cs:line 199
at BitFab.KW1281Test.Program.Main(String[] args) in F:\OneDrive\Documents\My Documents\audi TT\FreeKeyReadSoftware\kw1281test-0.56-beta\Program.cs:line 26
KW1281Test 0.56-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 17 DumpMarelliMem 14336 2048
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N2920930C KOMBI+WEGFAHRS. M73 D55
Software Coding 05444, Workshop Code: 00953
Untested cluster version! You may need to disconnect your battery if this fails.
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
Receiving ACK
Receiving memory dump
Saved memory dump to marelli_mem_$3800.bin
Done

Bits are encoded legibly but could there be some encode decode (rb4?!) missing for the data/pin? (getting out of my depth now!)

 

[Peacetilence]

Deciphering the binary is a little beyond me but maybe you could/ it is possible to do the next step?
[..]
Bits are encoded legibly but could there be some encode decode (rb4?!) missing for the data/pin? (getting out of my depth now!)

If you are on windows -- try the command line

certutil -encodehex marelli_mem_$3800.bin marelli_mem_$3800.txt

to convert the bin file to a hex-dump that can be used to take a closer look at the bits w/ notepad. The pin is scattered three times in there somewhere, either as 16bit binary or as 16bit BCD coded values (2 bytes, little endian), probably part of the data blocks that contains the AUSZ.. strings.

 

[hicklehoff]

I've downloaded an app called HxD hex editor...it does the same as above but you can play about a bit. From what I've read there are two bits you have to swap and convert to decimal and that gives you the pin? Is that right?

when converting to devimal the values must be < 99 I guess which may narrow the field a bit...

so in the AUZ bits after the second pipe, there 2 bytes 11 and 37 swapped is 37 11 which in dec 55 17 ... or am I tripping?!

Dom

In case anyone reads this, I was tripping, see below, the bits you need are the two before the immo id, in the right order, not swapped, and two bits hex = one number in decimal, preceded by a zero= pin!

 

[gmenounos]

I've downloaded an app called HxD hex editor...it does the same as above but you can play about a bit. From what I've read there are two bits you have to swap and convert to decimal and that gives you the pin? Is that right?

when converting to devimal the values must be < 99 I guess which may narrow the field a bit...

so in the AUZ bits after the second pipe, there 2 bytes 11 and 37 swapped is 37 11 which in dec 55 17 ... or am I tripping?!

Dom

In the similar Marelli Beetle clusters, it's the 2 bytes before the immobilizer id (AUZ5Z...).

 

[gmenounos]

If you are on windows -- try the command line

certutil -encodehex marelli_mem_$3800.bin marelli_mem_$3800.txt

to convert the bin file to a hex-dump that can be used to take a closer look at the bits w/ notepad. The pin is scattered three times in there somewhere, either as 16bit binary or as 16bit BCD coded values (2 bytes, little endian), probably part of the data blocks that contains the AUSZ.. strings.

In PowerShell, you can also do:

format-hex 'marelli_mem_$3800.bin'

(The filename needs to be in quotes because of the dollar sign ($)

 

[hicklehoff]

In the similar Marelli Beetle clusters, it's the 2 bytes before the immobilizer id (AUZ5Z...).

Thank you, I will try it!

 

[hicklehoff]

In the similar Marelli Beetle clusters, it's the 2 bytes before the immobilizer id (AUZ5Z...).

The pin calculated by converting the two bytes together to decimal works, you are a genius thank you!

 

[gmenounos]

I need to spend some time and write up all this info. I'm starting to lose track of where all the magic values are inside the various dumps.

 

[gmenounos]

Hey.. no problem... if it helped you out , it's all good... !v

If you still have access to that M73 D09 cluster, you might want to download the latest version and try both of these commands:

kw1281test.exe COM3 9600 17 DumpMarelliMem 3072 1024

kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048

Maybe the first one will work with that cluster. I know you already tried the second one, but might also be worth another try.