kw1281test: A Free VDS-Pro / VagTacho Alternative

[GoAzBox]

As long as you're digging in, the ability to change the speed scale on the speedometer, to facilitate easy swapping of overlays would be nice.
I've seen the 0-240km/h
linear 0-240km/h
linear 0-260km/h
even the 0-300km/h of the R32
0-260km/h with 100km/h at top

I have made a mappack for this in Tunerpro. Built in patches. For a couple of different software versions like VWK501MH and VWK503MH of the VDO clusters. I will encorporate them in the program.

 

[GoAzBox]

T4 Tankmeter coding also btw

 

[KrashDH]

Okay, I'll think about that. I do it manually in an excel now, or in VAG EEPROM PROGRAMMER and since i sell and install lots of clusters, this one solution for a lot of different programs would save me lots of time.

As long as it's somewhere "given" to the user or included in the software package they have to read it before they use it. A popup maybe?
I had to swap clusters in my truck (The actual LED's that showed the mileage were burning out and they are part of a chip soldered into the board ) which meant transferring the mileage over to the new cluster.
The company has a business doing this and there were all sorts of signatures and things required by me before they would do it.

 

[KrashDH]

I have made a mappack for this in Tunerpro. Built in patches. For a couple of different software versions like VWK501MH and VWK503MH of the VDO clusters. I will encorporate them in the program.

Def ability to change the speedo based on tire size. That's a must IMO then you can really dial in to your true speed.

 

[caffeine]

As long as it's somewhere "given" to the user or included in the software package they have to read it before they use it. A popup maybe?
I had to swap clusters in my truck (The actual LED's that showed the mileage were burning out and they are part of a chip soldered into the board ) which meant transferring the mileage over to the new cluster.
The company has a business doing this and there were all sorts of signatures and things required by me before they would do it.

I mean at the end of the day, the resources are already freely available that are required to change the odometer reading. I think if anyone is REALLY wanting to misrepresent their mileage for a sale, they will find a way anyway. I don't know how it is in other places, but in my province the mileage is recorded on paperwork every time a used car is sold, so presumably something would be flagged in their system if someone tried to claim a car had ridiculously low mileage. Enough of a deterrent to prevent the majority of people from bothering.

 

[pkhoury]

I mean at the end of the day, the resources are already freely available that are required to change the odometer reading. I think if anyone is REALLY wanting to misrepresent their mileage for a sale, they will find a way anyway. I don't know how it is in other places, but in my province the mileage is recorded on paperwork every time a used car is sold, so presumably something would be flagged in their system if someone tried to claim a car had ridiculously low mileage. Enough of a deterrent to prevent the majority of people from bothering.

CARFAX and the CCC-One report flagged my 2004 Golf as having a potential odometer rollback, but the deal was that I switched the cluster from kilometers to US miles. It's never been a problem for me (three total losses later), and I doubt it'll be an issue selling the car when I get it all put back together, either.

 

[Mozambiquer]

Hey There. Just used your software for the first time tonight on my cousins 2004 GLI 24v VR and was able to write the comfort windows via keyfob coding to his 1C0 CCM. I still have to try pulling his SKU from his cluster (since he needs another key).

As for your requested 1J0 addresses for unlock hatch with doors, I believe it is located at:

J: 04283, 04288, 04293: Bit 7 (1=Off, 0=On)
AJ/AH: 04280, 04286, 04292: Bit 7 (1=Off, 0=On)

Neither are confirmed but might be a good start. I've been building a large excel file with known bits but I have not been able to confirm anything.

Anything else you want me to share with you that you can use to confirm on your 1J0 CCMs?

I finally got around to playing with this again... Yes, mine is a 1J0 CCM, I tried those addresses, but it didn't seem to be the right addresses. Here's what I got as values for those ones. J: 04283 Value 138, 04288 Value 82, 04293 value 4
The 04280,04286 and 04292 showed 204 on all three, which would be binary 11001100 which then bit 7 would already be 0, unless as with the other ones, it should be bit 1 that is zero? UPDATE I changed bit one on addresses 04280,04286 and 04292 to zero, going from 204 to 76 and now it works! YAY!!! Thanks for having patience with me! =D

 

[Nuje]

I finally got around to playing with this again... Yes, mine is a 1J0 CCM, I tried those addresses, but it didn't seem to be the right addresses. Here's what I got as values for those ones. J: 04283 Value 138, 04288 Value 82, 04293 value 4
The 04280,04286 and 04292 showed 204 on all three, which would be binary 11001100 which then bit 7 would already be 0, unless as with the other ones, it should be bit 1 that is zero? UPDATE I changed bit one (edit: he meant bit7) on addresses 04280,04286 and 04292 to zero, going from 204 to 76 and now it works! YAY!!! Thanks for having patience with me! =D

Remember that binary numbers are read right to left, so that bit0 is always in the same position; bit1 is always in the same position, regardless of whether you have a 2-bit byte, a 8-bit binary number, or bigger.
I was going to say...pretty sure I've seen 204 as a value before, and turning bit7 (11001100) "off" (01001100), which is decimal 76, gave me the results I was looking.

 

[Mozambiquer]

Remember that binary numbers are read right to left, so that bit0 is always in the same position; bit1 is always in the same position, regardless of whether you have a 2-bit byte, a 8-bit binary number, or bigger.
I was going to say...pretty sure I've seen 204 as a value before, and turning bit7 (11001100) "off" (01001100), which is decimal 76, gave me the results I was looking.

Oh, so it's my head thinking like normal, thinking that bit 7 would be the 7th number in the row, but binary is different? I never learned any programming or computer lingo, I'm just now learning about some of this stuff.

 

[gmenounos]

Oh, so it's my head thinking like normal, thinking that bit 7 would be the 7th number in the row, but binary is different? I never learned any programming or computer lingo, I'm just now learning about some of this stuff.

It's called bit 0 because it's worth 2^0 (2 to the 0th power = 1). The second bit from the right is called bit 1 because it's worth 2^1 (2 to the 1st power = 2). The leftmost bit is called bit 7 because it's worth 2^7 (2 to the 7th power = 2x2x2x2x2x2x2 = 128).

11001100 = (1 x 2^7) + (1 x 2^6) + (0 x 2^5) + (0 x 2^4) + (1 x 2^3) + (1 x 2^2) + (0 x 2^1) + (0 x 2^0) = 128 + 64 + 8 + 4 = 204

We use base 10 in everyday life and it's calculated the same way, just using 10s instead of 2s:

405 = (4 x 10^2) + (0 x 10^1) + (5 x 10^0) = 400 + 5

 

[Nuje]

It's called bit 0 because it's worth 2^0 (2 to the 0th power = 1). The second bit from the right is called bit 1 because it's worth 2^1 (2 to the 1st power = 2). The leftmost bit is called bit 7 because it's worth 2^7 (2 to the 7th power = 2x2x2x2x2x2x2 = 128).

11001100 = (1 x 2^7) + (1 x 2^6) + (0 x 2^5) + (0 x 2^4) + (1 x 2^3) + (1 x 2^2) + (0 x 2^1) + (0 x 2^0) = 128 + 64 + 8 + 4 = 204

We use base 10 in everyday life and it's calculated the same way, just using 10s instead of 2s:

405 = (4 x 10^2) + (0 x 10^1) + (5 x 10^0) = 400 + 5

Wow - that's the best freakin' explanation of how/why binary works I've ever seen. Thanks, Greg!

 

[Mozambiquer]

It's called bit 0 because it's worth 2^0 (2 to the 0th power = 1). The second bit from the right is called bit 1 because it's worth 2^1 (2 to the 1st power = 2). The leftmost bit is called bit 7 because it's worth 2^7 (2 to the 7th power = 2x2x2x2x2x2x2 = 128).

11001100 = (1 x 2^7) + (1 x 2^6) + (0 x 2^5) + (0 x 2^4) + (1 x 2^3) + (1 x 2^2) + (0 x 2^1) + (0 x 2^0) = 128 + 64 + 8 + 4 = 204

We use base 10 in everyday life and it's calculated the same way, just using 10s instead of 2s:

405 = (4 x 10^2) + (0 x 10^1) + (5 x 10^0) = 400 + 5

Wow, I've never seen that explained like that. I'm learning a lot. Now, I understand that the reason binary is used for computer systems is because of it being easier to measure off and on, so 1 being current on and 0 being current off, which obviously happens quite fast, especially on some of the newer computer systems, which is why you can read the messages a module sends with an oscilloscope (one of my favorite tools for diagnostics! We have a pico-scope at the shop, which is so fun!)
I'm trying to learn all I can about some of this stuff...

 

[Nero Morg]

Well tried messing around with this finally, it definitely works. However I have literally no idea how to use it.... Anyone want to make a guide on how to dump the CCM rom, edit stuff, and flash it back?

 

[lijetta18t]

Well tried messing around with this finally, it definitely works. However I have literally no idea how to use it.... Anyone want to make a guide on how to dump the CCM rom, edit stuff, and flash it back?

Probably easiest to perform a read off each of the 3 memory addresses to confirm they are the same, take the numbers and use a programing calculator to modify the bits, and write the modified numbers back to the 3 addresses. Repeat for the rest of the memory address.

What I did when I coded my cousins GLI and my friends R32 was this (both 1C0 CCMs but different memory addresses will be used for 1J0 CCMs):

Comfort Windows via Keyfob:

1. Read addresses (replace com# with your serial cables com number):

"kw1281test.exe com# 9600 46 ReadEeprom 04361"
"kw1281test.exe com# 9600 46 ReadEeprom 04362"
"kw1281test.exe com# 9600 46 ReadEeprom 04363"

Output for all 3 addresses was 138 which is binary 1000 1010.

2. Math:

Since you want comfort windows via keyfob active, you change bit 3 from 1 to 0. As the post explains in awesome detail above, you always count starting with 0 right to left. So, 1000 1 010 changes to 1000 0 010. You then either use the math provided above or use a programmer calc to convert binary 1000 0010 to decimal base 10 which gives you 130.

3. Write addresses back (replace com# with your serial cables com number):

"kw1281test.exe com# 9600 46 WriteEeprom 04361 130"
"kw1281test.exe com# 9600 46 WriteEeprom 04362 130"
"kw1281test.exe com# 9600 46 WriteEeprom 04363 130"

This would write your changes back to the EEPRom. If successful, the window operation should work just fine.

You could also do a dump the CCM config memory locations to a file by running this command:

1C0 CCMs:
"kw1281test.exe com# 9600 46 DumpEeprom 04352 21"

1J0 CCMs:
"kw1281test.exe com# 9600 46 DumpEeprom 04280 18"

This will dump all memory addresses on the 1C0 CCM from 04352 to 04372 which has all of the configuration addresses. This should output as hex which you can use the calculator as mentioned before to switch between binary or decimal. Each 2 number pair is one memory address starting with address 04352. I don't suggest writing a dump back if you are just changing a few channels as it may not start from the correct location and write incorrect values where they shouldn't be.

Memory addresses for CCMs:

1C0 (All):

Byte 0: 04352, 04353, 04354
Byte 1: 04355, 04356, 04357
Byte 2: 04358, 04359, 04360
Byte 3: 04361, 04362, 04363
Byte 4: 04364, 04365, 04366
Byte 5: 04367, 04368, 04369
Byte 6: 04370, 04371, 04372

1J0 (All):

Byte 0: 04280, 04286, 04292
Byte 1: 04281, 04287, 04293
Byte 2: 04282, 04288, 04294
Byte 3: 04283, 04289, 04295
Byte 4: 04284, 04290, 04296
Byte 5: 04285, 04291, 04297

As I have mentioned before, I am working on a full blown spreadsheet with as much detail as I can find/confirm. Here is a dropbox link to my current file: Dropbox Mk4 CCM EEPROM Config

It is being updated all of the time and there are a lot of unknowns but let me know if anyone finds out anything else or confirms something with an asterisks (* or star). Also, if anyone can use the info above and let me know the output of their stock coding, car type, trim, and options, that would help as I am also making a list of known cars/options as a reference and a way to figure out additional bits/usage.

 

[lijetta18t]

I finally got around to playing with this again... Yes, mine is a 1J0 CCM, I tried those addresses, but it didn't seem to be the right addresses. Here's what I got as values for those ones. J: 04283 Value 138, 04288 Value 82, 04293 value 4
The 04280,04286 and 04292 showed 204 on all three, which would be binary 11001100 which then bit 7 would already be 0, unless as with the other ones, it should be bit 1 that is zero? UPDATE I changed bit one on addresses 04280,04286 and 04292 to zero, going from 204 to 76 and now it works! YAY!!! Thanks for having patience with me! =D

Question for you: I noticed that you said that address 04288 = 82. Can you confirm that 04282 and 04294 are the same? I am curious about something.

Also, while you are in there, if you can provide me all of the memory addresses listed above for your 1J0 CCM, your model, trim, equipment, etc so I can update my spreadsheet?

 

[Mozambiquer]

Question for you: I noticed that you said that address 04288 = 82. Can you confirm that 04282 and 04294 are the same? I am curious about something.

Also, while you are in there, if you can provide me all of the memory addresses listed above for your 1J0 CCM, your model, trim, equipment, etc so I can update my spreadsheet?

I'll try to get that info. I know I did check 04294 but I don't recall what the number was. I was trying to find something that made sense. My vehicle is a 2001 golf gls tdi. It has electric windows, sunroof, heated seats, heated mirrors, electric door locks, monsoon radio, it's a 5 speed... umm, I don't remember any of the other options.
How would I get all the memory addresses for my CCM using this software?

 

[pkhoury]

Now, I'd also like to transfer my mileage reading from my old cluster to the new one. What's the location to write the mileage code to? Donor cluster was from an 03 ALH Jetta. I'll probably be ordering an FIS cluster from Europe soon so I'll be doing the cluster swap again at some point.

Don't forget that the OP sells FIS clusters. I just bought one from him, which arrives any day this week. I previously purchased a ColorMFA retrofitted cluster from him, too.

How would I get all the memory addresses for my CCM using this software?

Probably a dump. I know on module 17 (instrument cluster), we would do 0 for the starting address and 2048, which is the length of the EEPROM. Perhaps Greg can shed some light on how large the CCM eeprom is, but I'd imagine it'd be:

kw1281test.exe com7 9600 46 DumpEeprom 0 2048

(we're assuming 2048, like the instrument cluster, for illustration purposes)

Then, you could manually go into the file say using xvi32 or similar hex editor, so you can edit each address manually if so desired. I'd imagine that uploading a modified file wouldn't be much different than uploading a ROM for the cluster, though I haven't yet tried it with a CCM...

**CORRECTION**
I just realized there's a flag in the program called DumpCCmRom. I guess that's your solution, though perhaps Greg can tell me if my idea works as well.

 

[Mozambiquer]

Don't forget that the OP sells FIS clusters. I just bought one from him, which arrives any day this week. I previously purchased a ColorMFA retrofitted cluster from him, too.



Probably a dump. I know on module 17 (instrument cluster), we would do 0 for the starting address and 2048, which is the length of the EEPROM. Perhaps Greg can shed some light on how large the CCM eeprom is, but I'd imagine it'd be:

kw1281test.exe com7 9600 46 DumpEeprom 0 2048

(we're assuming 2048, like the instrument cluster, for illustration purposes)

Then, you could manually go into the file say using xvi32 or similar hex editor, so you can edit each address manually if so desired. I'd imagine that uploading a modified file wouldn't be much different than uploading a ROM for the cluster, though I haven't yet tried it with a CCM...

**CORRECTION**
I just realized there's a flag in the program called DumpCCmRom. I guess that's your solution, though perhaps Greg can tell me if my idea works as well.

I had tried the dump Eeprom 0 2048 command, but it didn't like that. I didn't see the dump CCM rom command. Maybe I'll try that one.

 

[gmenounos]

Don't forget that the OP sells FIS clusters. I just bought one from him, which arrives any day this week. I previously purchased a ColorMFA retrofitted cluster from him, too.

Yes, I have quite a few in the basement, both FIS and MFA. Many have faded displays, but I have replacement displays ready to be installed. I also have parts to build one more ColorMFA. PM me if interested in anything.

As for the DumpCcmRom command, that's for dumping the read-only ROM (Read Only Memory) in the CCM that stores the software program that runs in the CCM, and it doesn't currently work. I probably should hide it until I figure out what's wrong.

What you're really asking is to dump the CCM's EEPROM (Electrically Erasable Programmable Read Only Memory) which is where the CCM's configuration data (such as software coding and the bits that enable the various tweaks) is stored.

For the CCM, this is complicated, because there are also window motors that each have their own EEPROM. The CCM allows you to dump the window motor EEPROMS using different address ranges.

For 1C0 CCM/motors, I think these are the address ranges that are used:

• 4096 – 4607 (CCM)
• 8192 – 8703 (Front left window motor)
• 12288 – 12799 (Front right window motor)
• 16384 – 16895 (Rear left window motor)
• 20480 – 20991 (Rear right window motor)

.\kw1281test.exe COM1 9600 46 DumpEeprom 4096 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 8192 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 12288 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 16384 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 20480 512

 

[Mozambiquer]

Yes, I have quite a few in the basement, both FIS and MFA. Many have faded displays, but I have replacement displays ready to be installed. I also have parts to build one more ColorMFA. PM me if interested in anything.

As for the DumpCcmRom command, that's for dumping the read-only ROM (Read Only Memory) in the CCM that stores the software program that runs in the CCM, and it doesn't currently work. I probably should hide it until I figure out what's wrong.

What you're really asking is to dump the CCM's EEPROM (Electrically Erasable Programmable Read Only Memory) which is where the CCM's configuration data (such as software coding and the bits that enable the various tweaks) is stored.

For the CCM, this is complicated, because there are also window motors that each have their own EEPROM. The CCM allows you to dump the window motor EEPROMS using different address ranges.

For 1C0 CCM/motors, I think these are the address ranges that are used:

• 4096 – 4607 (CCM)
• 8192 – 8703 (Front left window motor)
• 12288 – 12799 (Front right window motor)
• 16384 – 16895 (Rear left window motor)
• 20480 – 20991 (Rear right window motor)

.\kw1281test.exe COM1 9600 46 DumpEeprom 4096 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 8192 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 12288 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 16384 512
.\kw1281test.exe COM1 9600 46 DumpEeprom 20480 512

Would that be different for a 1j0ccm?

 

[lijetta18t]

Would that be different for a 1j0ccm?

If I read that correctly, the config addresses should be well within the scope provided by @gmenounos, you'll just need to look at the addresses I listed above (at least for the CCM).

 

[buiced]

I dumped the cluster eeprom looking for the skc, the values I got were 58 58 58 58 58 ff. Does immo 2 store the skc in a different location. My cluster is in a 01 golf alh

 

[gmenounos]

I dumped the cluster eeprom looking for the skc, the values I got were 58 58 58 58 58 ff. Does immo 2 store the skc in a different location. My cluster is in a 01 golf alh

Yes, Immo2 is different. Try the location mentioned here:

kw1281test: A Free VDS-Pro / VagTacho Alternative

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine. Oops my bad, only having ALHs, I didn't realize that the BEW used the EDC16. Learn something new every day... Wait, I was trying to get up the gumption to do this... on my BEW...

forums.tdiclub.com

 

[buiced]

Yes, Immo2 is different. Try the location mentioned here:

kw1281test: A Free VDS-Pro / VagTacho Alternative

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine. Oops my bad, only having ALHs, I didn't realize that the BEW used the EDC16. Learn something new every day... Wait, I was trying to get up the gumption to do this... on my BEW...

forums.tdiclub.com

Thank you very much. Did you ever find out if the program would talk to the ecu?

 

[gmenounos]

Thank you very much. Did you ever find out if the program would talk to the ecu?

It can connect to the ECU and read the part number, software coding and workshop code, modify the coding and read/clear fault codes. It can't yet do any special functions like read the EEPROM. Hopefully someday...

 

[gmenounos]

I dumped the cluster eeprom looking for the skc, the values I got were 58 58 58 58 58 ff. Does immo 2 store the skc in a different location. My cluster is in a 01 golf alh

Actually, the link I posted earlier is a little misleading. For Immo2 clusters, the SKC is stored as a pair of 2 bytes, in 3 separate locations (for redundancy I guess). The locations are 186, 202 and 218, so the following commands will dump all 3 locations and should produce the same values for an Immo2 cluster:

.\kw1281test.exe COM4 10400 17 DumpEeprom 186 2
.\kw1281test.exe COM4 10400 17 DumpEeprom 202 2
.\kw1281test.exe COM4 10400 17 DumpEeprom 218 2

When I ran those 3 commands against an Immo2 cluster, each one included the following output:
Received "Read ROM/EEPROM Response" block: 02 21

The SKC is stored in reverse order, so the SKC for this cluster is 2102.

 

[gmenounos]

New release v0.40-beta:

• Improved actuator test help message.
• Changed to automatically quit at end of actuator test.
• DumpEeprom/DumpMem/DumpRB8Eeprom can accept an optional filename.
• Added secret, barely tested DumpBeetleEeprom command. Only tested on a single cluster (1C0920901CX KOMBI+WEGFAHRS. M73 V07) so use at your own risk!
• Changed to only unlock the additional custom cluster commands when it's actually needed.

I picked up a fairly cheap Beetle cluster from eBay and reverse engineered how one of the other tools reads the EEPROM. However, it's very different from how the VDO and Bosch/Motometer clusters are read and I don't quite understand how it works. So if someone with a Beetle cluster wants to take a chance, please give it a try and let me know if it worked. Or if someone wants to donate or lend me Beetle cluster, that would be very helpful.

.\kw1281test.exe COM4 9600 17 dumpbeetleeeprom
KW1281Test 0.40-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 dumpbeetleeeprom
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901CX KOMBI+WEGFAHRS. M73 V07
Software Coding 03202, Workshop Code: 07209
Sending block 0x6C
Writing request 1
Receiving ACK
....Writing request 2
Receiving ACK
....Receiving EEPROM
Saved EEPROM dump to beetle_eeprom_$0000.bin
Done

 

[buiced]

Actually, the link I posted earlier is a little misleading. For Immo2 clusters, the SKC is stored as a pair of 2 bytes, in 3 separate locations (for redundancy I guess). The locations are 186, 202 and 218, so the following commands will dump all 3 locations and should produce the same values for an Immo2 cluster:

.\kw1281test.exe COM4 10400 17 DumpEeprom 186 2
.\kw1281test.exe COM4 10400 17 DumpEeprom 202 2
.\kw1281test.exe COM4 10400 17 DumpEeprom 218 2

When I ran those 3 commands against an Immo2 cluster, each one included the following output:
Received "Read ROM/EEPROM Response" block: 02 21

The SKC is stored in reverse order, so the SKC for this cluster is 2102.

Interesting. When I run at address 186 I get 23 43, but 202 and 218 both produce 58 58. 186 ended up being the correct skc and I was able to adapt my fobs myself. Thanks for all the help!

 

[gmenounos]

Interesting. When I run at address 186 I get 23 43, but 202 and 218 both produce 58 58. 186 ended up being the correct skc and I was able to adapt my fobs myself. Thanks for all the help!

Thanks, good to know. I wish there was more consistency between the various MKIV clusters. It would save me time...

 

[pkhoury]

Or if someone wants to donate or lend me Beetle cluster, that would be very helpful.

I'll try and pull one next time I'm at the junkyard.