kw1281test: A Free VDS-Pro / VagTacho Alternative

[buiced]

Thanks, good to know. I wish there was more consistency between the various MKIV clusters. It would save me time...

In case anyone else runs into this;
2001 Golf ALH made in Brazil.

Protocol is KW 1281 (8N1)
ECU: 1J0920905L A4-KOMBIINSTR. VDO V01
Software Coding 07232, Workshop Code: 00000

C:\VW>kw1281test.exe COM9 10400 17 DumpEeprom 186 6
yields 23 43 23 43 23 43 skc is 4323

damn autocorrect

 

[Nuje]

When I ran those 3 commands against an Immo2 cluster, each one included the following output:
Received "Read ROM/EEPROM Response" block: 02 21

The SKC is stored in reverse order, so the SKC for this cluster is 2102.

Was there an update you made so that your program is now reporting DECIMAL output?

Back on page 1 of this thread, where you first explain SKC locations, the example you provide is like 07 0B - which is obviously hex (which needs to be flipped and converted to decimal to derive SKC).

Just curious if I missed or misunderstood something.

 

[03TDICommuter]

New release v0.40-beta:

• Improved actuator test help message.
• Changed to automatically quit at end of actuator test.
• DumpEeprom/DumpMem/DumpRB8Eeprom can accept an optional filename.
• Added secret, barely tested DumpBeetleEeprom command. Only tested on a single cluster (1C0920901CX KOMBI+WEGFAHRS. M73 V07) so use at your own risk!
• Changed to only unlock the additional custom cluster commands when it's actually needed.

I picked up a fairly cheap Beetle cluster from eBay and reverse engineered how one of the other tools reads the EEPROM. However, it's very different from how the VDO and Bosch/Motometer clusters are read and I don't quite understand how it works. So if someone with a Beetle cluster wants to take a chance, please give it a try and let me know if it worked. Or if someone wants to donate or lend me Beetle cluster, that would be very helpful.

Gmenounos, I pulled the PIN from my cluster using a rental VagTacho cable and their software, but can pull my cluster's eeprom dump with your software if you'd like. My only concern would be is if there are any risks. Thoughts?

 

[gmenounos]

Was there an update you made so that your program is now reporting DECIMAL output?

Back on page 1 of this thread, where you first explain SKC locations, the example you provide is like 07 0B - which is obviously hex (which needs to be flipped and converted to decimal to derive SKC).

Just curious if I missed or misunderstood something.

The output has always been (and still is) in hex. Immo2 clusters just encode the SKC in a more human-readable way.

For example, if the SKC was 1234, you could convert that to hex (04D2) and store that as 2 hex values, typically in reverse order: D2 04
That's how Immo3 works.

Immo2 would instead use the hex values: 12 34, stored reversed in the cluster as 34 12.

The Immo2 approach is limited to 4-digit SKCs (0000-9999). The way that Immo3 stores the SKCs, would allow SKCs to have values from 0 (0000 hex) to 65535 (FFFF hex) but I'm pretty sure that there's always a leading 0, so there's really no need to store them in the cluster the way Immo3 does, other than it's a tiny bit easier for the cluster to calculate and it makes it slightly harder for people to discover it just by looking at an EEPROM dump.

 

[gmenounos]

Gmenounos, I pulled the PIN from my cluster using a rental VagTacho cable and their software, but can pull my cluster's eeprom dump with your software if you'd like. My only concern would be is if there are any risks. Thoughts?

I think the risk is pretty low, but I'm not 100% confident so I'd recommend not trying this out on your daily driver.

 

[gmenounos]

I think the risk is pretty low, but I'm not 100% confident so I'd recommend not trying this out on your daily driver.

I did a lot more research last night and now I understand how the Beetle cluster dump works.
@03TDICommuter and @lijetta18t : You should both be fine to read your EEPROM because you're both running the same cluster software (M73 V07) as my eBay cluster (1C0 920 901 AX).

 

[gmenounos]

If I have time and make it to the junkyard today, I'll see about pulling one for you with harness so you can test that out.

Thanks! See if you can find a 2002 or 2003 - and no harness needed, it turns out to be the same basic wiring and connectors as the MKIV Golf/Jetta.

 

[gmenounos]

New mini-release: https://github.com/gmenounos/kw1281test/releases/tag/v0.41-beta

Added DumpBeetleMem command (replaces previously secret DumpBeetleEeprom command). Only tested on a 2001 cluster: "1C0920901CX KOMBI+WEGFAHRS. M73 V07" but should work on other M73 V07 Beetle clusters. Possible other cluster versions, too, but I have only one cluster so am unable to personally test on others.

Assuming that a KKL cable is connected as COM4, here is how to dump the entire cluster EEPROM:

.\kw1281test.exe COM4 9600 17 DumpBeetleMem 3072 1024

 

[03TDICommuter]

New mini-release: https://github.com/gmenounos/kw1281test/releases/tag/v0.41-beta

Added DumpBeetleMem command (replaces previously secret DumpBeetleEeprom command). Only tested on a 2001 cluster: "1C0920901CX KOMBI+WEGFAHRS. M73 V07" but should work on other M73 V07 Beetle clusters. Possible other cluster versions, too, but I have only one cluster so am unable to personally test on others.

Ran it, then power cycled my ignition. Freaked out because I no longer saw the IMMO light light up. Started my beetle and it started and immediately died. Then totally freaked out, power cycled again, still no immo light. I then hoped that I could recover the Immo2 with VCDS or the the VagTacho cable I rented but a moment later I heard a whirr, the cluster rebooted itself and then I saw the immo light light up. I power cycled the ignition, the immo light turned on, then off, and I could start my car fine.

However the trip meter reset to 0.0, and the airbag light is now on, just like when I used VagTacho to pull the PIN. Whew!

I hooked up my VCDS cable, cleared the airbag code, and for good measure I logged into the cluster using the PIN I extracted the day before and I got in! Double sigh of relief! Exited, cycled the ignition power, and now have a solid IMMO light. Darn! I remember having this problem yesterday too when I wanted to verify how many keys were memorized. Seems just logging into the cluster, or seeing how many keys are available causes one to have to repeat the pairing process.

So back to VCDS, re-paired my 3 keys, airbag light is off, everything seems back to normal, and my adrenaline is tapering off.

I have a bin file for you but need to figure out how to send it to you.

 

[gmenounos]

Ran it, then power cycled my ignition. Freaked out because I no longer saw the IMMO light light up. Started my beetle and it started and immediately died. Then totally freaked out, power cycled again, still no immo light. I then hoped that I could recover the Immo2 with VCDS or the the VagTacho cable I rented but a moment later I heard a whirr, the cluster rebooted itself and then I saw the immo light light up. I power cycled the ignition, the immo light turned on, then off, and I could start my car fine.

However the trip meter reset to 0.0, and the airbag light is now on, just like when I used VagTacho to pull the PIN. Whew!

I hooked up my VCDS cable, cleared the airbag code, and for good measure I logged into the cluster using the PIN I extracted the day before and I got in! Double sigh of relief! Exited, cycled the ignition power, and now have a solid IMMO light. Darn! I remember having this problem yesterday too when I wanted to verify how many keys were memorized. Seems just logging into the cluster, or seeing how many keys are available causes one to have to repeat the pairing process.

So back to VCDS, re-paired my 3 keys, airbag light is off, everything seems back to normal, and my adrenaline is tapering off.

I have a bin file for you but need to figure out how to send it to you.

You can email it to me, which you can find here: https://bitfab.com/Contact
Thanks for being willing to test and sorry for all the excitement. It looks like these Magneti Marelli clusters are pretty delicate. I do all my testing on the bench so the cluster always has a handful of warning lights on. Dumping the EEPROM from one of these clusters always ends with the cluster rebooting shortly after, so that's expected. Not sure about the Immobilizer light issue. I wonder if disconnecting the battery briefly after the cluster reboots would make it go away. Maybe worth a try next time.

 

[03TDICommuter]

Dumping the EEPROM from one of these clusters always ends with the cluster rebooting shortly after, so that's expected. Not sure about the Immobilizer light issue. I wonder if disconnecting the battery briefly after the cluster reboots would make it go away. Maybe worth a try next time.

Does the cluster not reboot with the ignition power cycle? The loss of the immo light was through a couple of ignition power cycles.

I'll email the file to you shortly. I converted my PIN (05146) to hex and did a search on the binary and found it at address 0x0313 and 0x0314. Is that what you got on your Ebay cluster?

 

[gmenounos]

Does the cluster not reboot with the ignition power cycle? The loss of the immo light was through a couple of ignition power cycles.

I'll email the file to you shortly. I converted my PIN (05146) to hex and did a search on the binary and found it at address 0x0313 and 0x0314. Is that what you got on your Ebay cluster?

The cluster has 2 power connections. One is always on and the other is on when the ignition is on. Just a theory that maybe disconnecting all power to the cluster and ECU might resynchronize everything.

And, yes, my SKC is at the same address in the dump from my eBay cluster. So if you just wanted to pull the SKC from the cluster and nothing else, this would do it:

.\kw1281test.exe COM4 9600 17 DumpBeetleMem 3859 2

 

[03TDICommuter]

And, yes, my SKC is at the same address in the dump from my eBay cluster. So if you just wanted to pull the SKC from the cluster and nothing else, this would do it:

.\kw1281test.exe COM4 9600 17 DumpBeetleMem 3859 2

Nice! Very cool. Thanks for doing this.

 

[delibury]

Hello, I've got a UK Golf 1.4 16V.

As it's got manual windows it's got a central locking module (35) rather than a CCM (46), I'm trying to retro fit remote locking using a Beetle Central locking module 1C0962258AB. I have the module in and nearly working but I need to recode it. I don't know the Eprom address so tried doing a DumpEeprom but get a "Only supported for cluster and CCM" error. is it possible to do a Eprom dump on a central locking module?
I'm assuming it should be as the modules share the same PCB the only difference is it has an extra relay for the front doors and the Eprom address is probably different.

 

[pkhoury]

Thanks! See if you can find a 2002 or 2003 - and no harness needed, it turns out to be the same basic wiring and connectors as the MKIV Golf/Jetta.

You're in luck - there are two 2003 Beetles that are recent arrivals. Both gassers, but still. Also, I think Beetles used mk4 hardware up until 2010, but I'm going to assume (but not be 100% sure) that the immo3 change on New Beetles happened around 2002.

I wonder if disconnecting the battery briefly after the cluster reboots would make it go away. Maybe worth a try next time.

I've found when I've enabled needle scaling on a cluster that didn't previously have it, that it doesn't take effect right away, even after issuing the Reset command. Unplugging either the cluster entirely, or the battery, solves this problem. So what I personally would do, in lieu of just forcing a reset/reboot, is unplugging and then plugging back in.

 

[gmenounos]

Hello, I've got a UK Golf 1.4 16V.

As it's got manual windows it's got a central locking module (35) rather than a CCM (46), I'm trying to retro fit remote locking using a Beetle Central locking module 1C0962258AB. I have the module in and nearly working but I need to recode it. I don't know the Eprom address so tried doing a DumpEeprom but get a "Only supported for cluster and CCM" error. is it possible to do a Eprom dump on a central locking module?
I'm assuming it should be as the modules share the same PCB the only difference is it has an extra relay for the front doors and the Eprom address is probably different.

Give this a try and let me know if it works: https://github.com/gmenounos/kw1281test/releases/tag/v0.42-beta

 

[pkhoury]

I found another quirk. Sometimes, I can get the cluster to do an EEPROM dump right away, so I've found if I do ReadSoftwareVersion first, it "wakes up" the cluster, allowing me to then pull or push an EEPROM.

 

[gmenounos]

I found another quirk. Sometimes, I can get the cluster to do an EEPROM dump right away, so I've found if I do ReadSoftwareVersion first, it "wakes up" the cluster, allowing me to then pull or push an EEPROM.

Possibly there's a timing quirk in some clusters or some laptops. Or noise on the K-Line? I get pretty good success rates on the bench. I do see timeouts occasionally, maybe every 20-30 times, maybe even less than that, I haven't been keeping track. I think the KWP1281 protocol, which isn't really publicly documented, has some timing delays you're supposed to use, but since I don't know what they are, I just send everything to the cluster as fast as possible. This almost always works, and the dump comes back faster than with the other tools - at least the ones I have. In the future I may add an option for a configurable delay and that may improve things.

 

[delibury]

Thank you. Gmenounos,
That works!! I've not fully tested yet but it looks like the coding for a central locking unit 1C0 962 258 AB is the same as a CCM 1C0 595 799 A.

 

[pkhoury]

Possibly there's a timing quirk in some clusters or some laptops. Or noise on the K-Line? I get pretty good success rates on the bench. I do see timeouts occasionally, maybe every 20-30 times, maybe even less than that, I haven't been keeping track. I think the KWP1281 protocol, which isn't really publicly documented, has some timing delays you're supposed to use, but since I don't know what they are, I just send everything to the cluster as fast as possible. This almost always works, and the dump comes back faster than with the other tools - at least the ones I have. In the future I may add an option for a configurable delay and that may improve things.

I'm using this exclusively with a Panasonic ToughPad FZ-G1 running Win 10. I've encountered the problem in both ALH and BEW vehicles (all immo3). So who knows - could be a timing quirk in both. It's not a deal breaker by any means, but I'll keep you up to date on other quirks I encounter, if any.

 

[lijetta18t]

New mini-release: https://github.com/gmenounos/kw1281test/releases/tag/v0.41-beta

Added DumpBeetleMem command (replaces previously secret DumpBeetleEeprom command). Only tested on a 2001 cluster: "1C0920901CX KOMBI+WEGFAHRS. M73 V07" but should work on other M73 V07 Beetle clusters. Possible other cluster versions, too, but I have only one cluster so am unable to personally test on others.

Assuming that a KKL cable is connected as COM4, here is how to dump the entire cluster EEPROM:

.\kw1281test.exe COM4 9600 17 DumpBeetleMem 3072 1024

I should be seeing my friends beetle Sunday. Anything you would like me to test?

 

[03TDICommuter]

I should be seeing my friends beetle Sunday. Anything you would like me to test?

Make sure you have vcds to clear the airbag error if it gets tripped.

 

[lijetta18t]

Make sure you have vcds to clear the airbag error if it gets tripped.

Does this code get tripped in the cluster or the ABS module? Just curious.

 

[03TDICommuter]

Does this code get tripped in the cluster or the ABS module? Just curious.

I connect to the AirBag module and clear the code from there.

 

[pkhoury]

Thanks! See if you can find a 2002 or 2003 - and no harness needed, it turns out to be the same basic wiring and connectors as the MKIV Golf/Jetta.

I noticed the same when I pulled one today. I'll mail it to you on Monday (our rural post office is closed on Saturdays). It came from a 2003 NB, here:

 

[Maxritmo]

hi at all... (sorry for my poor english... i'm italian)

i try this prg into pc portable... with win7ultimate 32bit...
this error appears...

Failed to load the dll from [C:\Users\mio\AppData\Local\Temp\.net\kw1281test\rxyqjyal.hw0\coreclr.dll], HRESULT: 0x80070057

the dll file are present

any idea,for solve it?

 

[pkhoury]

hi at all... (sorry for my poor english... i'm italian)

i try this prg into pc portable... with win7ultimate 32bit...
this error appears...

Failed to load the dll from [C:\Users\mio\AppData\Local\Temp\.net\kw1281test\rxyqjyal.hw0\coreclr.dll], HRESULT: 0x80070057


any idea,for solve it?

It appears, just with a quick google search, related to how it was compiled. You don't have a 64 bit machine to try it on?
https://github.com/dotnet/runtime/issues/4965

 

[Maxritmo]

no... only 32

 

[pkhoury]

That's weird, because the author tested it out first on an old Dell running 32 bit Windows 10. Second question, and I don't know if it's entirely relevant or not - do you have the latest version of dot net libraries installed? I think he said it wrote this on dotnet 5.0 somewhere...

 

[Maxritmo]

can you find a link please?