kw1281test: A Free VDS-Pro / VagTacho Alternative

[mur3633]

Thank you for this bro! Remote windows activated with brand new Acer Win10 laptop, VAG Commander 1.4 Chinese cable and 1J0 CCM in Mk4 Golf MY2001

 

[gmenounos]

Awesome. You're the first person I've heard successfully using it. Glad it worked for you!

 

[Nuje]

For a 2002 cluster, you want to do something like (assuming your port is COM4):

kw1281test.exe COM4 10400 17 DumpEeprom 204 6

You should get 3 identical pairs of values back. Here's a sample:

Received "Read EEPROM Response" block: 07 0B 07 0B 07 0B

Multiply the second number by 256 and add the first number, keeping in mind that 0A = 10, 0B = 11, 0C = 12, 0D = 13, 0E = 14, 0F = 15. So for the example here, (11 x 256) + 7 = 2823 so SKC = 02823

Would the process be any different on a 2003 cluster? Specifically, a Bosch RB8 (not the VDO that I'm used to dealing with)?>

 

[gmenounos]

Would the process be any different on a 2003 cluster? Specifically, a Bosch RB8 (not the VDO that I'm used to dealing with)?>

It's highly unlikely that my program will even work with a Bosch RB8. The commands it uses to unlock the cluster for reading/writing the EEPROM probably only work on VDO clusters. And even if they worked, the EEPROM is much smaller and the SKC is almost certainly in a different location.

 

[Nuje]

I got a read off the cluster that I thought was erroneous because it was only 1KB.

Does that .bin I linked above look about right for an RB8?

 

[KrashDH]

hey @Nuje , I was able to set up my COM port, but when I go into VCDS to test COM2 it says it's not available...Do I need to keep the USB port active in VCDS? Or should I be linked to COM2 if I did it correct?

 

[gmenounos]

I got a read off the cluster that I thought was erroneous because it was only 1KB.

Does that .bin I linked above look about right for an RB8?

Did you read it with my program or something else? But, yes it looks right.

 

[KrashDH]

For a 2002 cluster, you want to do something like (assuming your port is COM4):

kw1281test.exe COM4 10400 17 DumpEeprom 204 6

You should get 3 identical pairs of values back. Here's a sample:

Received "Read EEPROM Response" block: 07 0B 07 0B 07 0B

Multiply the second number by 256 and add the first number, keeping in mind that 0A = 10, 0B = 11, 0C = 12, 0D = 13, 0E = 14, 0F = 15. So for the example here, (11 x 256) + 7 = 2823 so SKC = 02823

So it shows my cable under COM2, but VCDS doesn't recognize that COM (which I think is ok, it still recognizes the USB interface).

So for my Powershell code, I would run it like this, correct?


kw1281test.exe COM2 10400 17 DumpEeprom 204 6


What are these numbers referring to "10400", "17" and "204 6"?

My CCOM2 setting has a b/s rate of 9600....do I need to use that instead of the 10400? Where are the other 2 cluster of numbers gotten from?

 

[gmenounos]

10400 is the baud rate (basically the speed that it talks to the control module). It doesn't matter what speed your COM2 port is set to, my program will change the speed to whatever value you specify on the command line when you run it. MKIV clusters seem to only work at 10400 baud. CCMs only work at 9600.

17 is the address of the cluster.

204 is the first location in the cluster's EEPROM to read and 6 is the number of locations to read (so it would read locations 204, 205, 206, 207, 208 and 209).

If you want to dump the whole EEPROM to a file, you'd specify "0 2048" instead of "204 6".
"204 6" just limits you to the area where the SKC is stored for most MKIV VDO Immo3 clusters.

If you run the program and don't give it any command line parameters, it'll print out some basic help:

kw1281test.exe
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
       PORT    = COM1|COM2|etc.
       BAUD    = 10400|9600|etc.
       ADDRESS = The controller address, e.g. 17 (cluster), 46 (CCM), 56 (radio)
       COMMAND = ReadIdent
                 ReadSoftwareVersion
                 ReadEeprom ADDRESS
                            ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                 WriteEeprom ADDRESS VALUE
                             ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                             VALUE   = Value in decimal (e.g. 138) or hex (e.g. $8A)
                 DumpEeprom START LENGTH
                            START  = Start address in decimal (e.g. 0) or hex (e.g. $0)
                            LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
                 LoadEeprom START FILENAME
                            START  = Start address in decimal (e.g. 0) or hex (e.g. $0)
                            FILENAME = Name of file containing binary data to load into EEPROM
                 DumpMem START LENGTH
                         START  = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
                         LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
                 MapEeprom
                 Reset
                 DelcoVWPremium5SafeCode

 

[KrashDH]

10400 is the baud rate (basically the speed that it talks to the control module). It doesn't matter what speed your COM2 port is set to, my program will change the speed to whatever value you specify on the command line when you run it. MKIV clusters seem to only work at 10400 baud. CCMs only work at 9600.

17 is the address of the cluster.

If you run the program and don't give it any command line parameters, it'll print out some basic help:

kw1281test.exe
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 17 (cluster), 46 (CCM), 56 (radio)
COMMAND = ReadIdent
ReadSoftwareVersion
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)
DumpEeprom START LENGTH
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
DumpMem START LENGTH
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
MapEeprom
Reset
DelcoVWPremium5SafeCode

Ok that makes more sense...what about the "204 6"...is that space supposed to be in there? Edit, looks like you answered that up above

Sorry, trying to collect all the information I can before I have to go out in the rain and do this, I'm going to lose internet service in my driveway

 

[gmenounos]

Ok that makes more sense...what about the "204 6"...is that space supposed to be in there?

Yes, start 204, length 6

 

[KrashDH]

Add another person to the list that successfully ran this program.
2002 VW Golf
Key-USB Dual K Ross-Tech Cable
Converted cable to a VCP (virtual COM port)

To convert the hexadecimal value to decimal: https://decimaltobinary.pro/_hexadecimal

One thing to note, let's say your dump looks like this:

2D 10 2D 10 2D 10

You would enter this from hex--->dec per the website as:
HEX: 102D.....that should give a decimal of 4141
So your SKC, for example, would be 04141

I tested this out on Instrument-17 in VCDS.
You go to the Login-11 button once you're in the controller. It will ask you for the 5 digit code.
When you select "Do It", if you watch your cluster while you click, the Immobilizer symbol (car with a little key) should light up ( if the SKC works). When you exit out of that controller, the light will go off on the cluster.

I tried a random SKC and got no immobilizer symbol on the cluster when I clicked "Do It"

I want to thank @gmenounos for all the hard work and support making this happen for those that want to use it. There's a lot of valuable information that can come out of all of this!

I really hope someday after I finish my schooling that I can understand more of what's going on and even give it a try to write programs like this in the future!!

 

[wonneber]

If anyone needs it the calculator in Windows 10 has a programmer setting that displays a number in hex, decimal, oct, and bin.
I've used it for the binary option.

 

[KrashDH]

If anyone needs it the calculator in Windows 10 has a programmer setting that displays a number in hex, decimal, oct, and bin.
I've used it for the binary option.

That's cool I didn't even think to check that out.
I need to update my tech game.
But I did just buy a new laptop and am upgrading new parts with newer better parts haha. I have moditis in all aspects of life

 

[Rrusse11]

A tip of the hat gents! Don't claim to understand what y'all are sayin', but results are coming in!

 

[turbotec]

this worked for me to get my SKC. thank you so much for your work! amazing

 

[Nuje]

If anyone needs it the calculator in Windows 10 has a programmer setting that displays a number in hex, decimal, oct, and bin.
I've used it for the binary option.

Same thing with the built-in calculator app in macOS. Just discovered that feature a couple days ago - definitely quicker and easier when converting multiple values, compared with having to go out to a website.

Thanks again to gmenounos for all the work on this; I just played around with it quickly once I got my SKC (had to use VAG-COMMANDER to do so with that bizarro Bosch / Motometer RB8 cluster), but for doing quick-hit edits and look-ups....very cool!!

 

[KrashDH]

Want to verify that I was able to successfully re-program my original 2 keys (fob, valet) and one new flip fob with the SKC I pulled from this program. Absolutely awesome. Now my old OE key fob is my backup and the new crisp version is my main squeeze!

 

[ekincaid]

Just tried this on my 03 Golf. Got to admit, I really didn't understand much of what you were talking about. But decided what the hell.

Bought this same cable from Amazon.

I just received my $17 generic USB->KKL cable and can confirm that it works with the this software to dump the cluster EEPROM to a file: https://www.amazon.com/gp/product/B00K6498D0

Did some reading here...

Additional CCM coding and configurations with VDS Pro

I tried this on my Golf PD130 that was built in feb 2003. It has the 1C0 959 799 B but when i enter the 04361 address code it says error, wont accept so i gather its different, on the passat 2002 i just done also has the B module but the address 04361 worked perfect. Any ideas? Also anyone know...

forums.tdiclub.com

Wanted to accomplish three things
1.) Windows by Remote
2.) Trunk unlock with doors
3.) Unlock Doors with Key removal

Put me a list together in case I screwed something up. Everything worked great! Thought I would attach the file I used in case it is useful for someone else. Thanks alot!

kw1281 Guide

 

[Nuje]

That's a great little summary sheet you put together, ekincaid!

Helpful Dropbox tip: If you change the end of the Dropbox URL from dl=0 to raw=1, you get a direct link instead of all of that Dropbox crap.
(The "raw=1" thing also works for pasting / linking Dropbox photo or image links, using the INSERT IMAGE button on the toolbar here.)

So, kw1281 Guide with raw=1 (url: https://www.dropbox.com/s/2n5khdafwibu6ou/kw1281.pdf?raw=1) opens as a .pdf right in the browser.

 

[ekincaid]

That's a great little summary sheet you put together, ekincaid!

Helpful Dropbox tip: If you change the end of the Dropbox URL from dl=0 to raw=1, you get a direct link instead of all of that Dropbox crap.
(The "raw=1" thing also works for pasting / linking Dropbox photo or image links, using the INSERT IMAGE button on the toolbar here.)

So, kw1281 Guide with raw=1 (url: https://www.dropbox.com/s/2n5khdafwibu6ou/kw1281.pdf?raw=1) opens as a .pdf right in the browser.

Nice Tip! I made the edit...

 

[ekincaid]

Hey @Nuje. I do owe you a thankyou. I was really lost about what was going on with the binary numbers until I run into the chart you converted to English and an explanation you made. Things started clicking for me then with what @gmenounos was saying above. This little program is pretty sweet. I decided to post the spreadsheet so if anyone wanted to use it. Definitely easier if you want to edit anything.

kw1281 Guide in Excel

 

[KrashDH]

As a heads up, the "...multiply 2nd value by 256 and add to first value..." instruction to convert the hex code did not work for me. I had to enter my hex values into an online converter to pull my SKC. So it might be worth linking a calculator on your spreadsheet. Many available online

 

[ekincaid]

As a heads up, the "...multiply 2nd value by 256 and add to first value..." instruction to convert the hex code did not work for me. I had to enter my hex values into an online converter to pull my SKC. So it might be worth linking a calculator on your spreadsheet. Many available online

I'll add that. What was your second value that didn't work? Was it a whole number such as 10 instead of like 0A? A hex of 10 would convert to 16 in decimal. Just want to make it as simple to follow as possible.

 

[KrashDH]

Ah yeah that makes sense, that's probably where I went wrong
(I think my second number was 12)

 

[ekincaid]

I think I may have found a error in my calculation of the SKC. I believe both values may have to be converted to decimal from hex first. @gmenounos Can you confirm this?

 

[Nuje]

Hey @Nuje. I do owe you a thankyou. I was really lost about what was going on with the binary numbers until I run into the chart you converted to English and an explanation you made.

Glad it helped you out.

For anyone else who wants my "understands just enough hex / binary to be dangerous to himself" explanation of working with that linked summary sheet from ekincaid, there's this post of mine from the "Additional CCM coding" thread.

 

[ekincaid]

Glad it helped you out.

For anyone else who wants my "understands just enough hex / binary to be dangerous to himself" explanation of working with that linked summary sheet from ekincaid, there's this post of mine from the "Additional CCM coding" thread.

Yeah. I noticed you read the binary the wrong direction. But it worked and you can't argue with results.

 

[Nuje]

I think I may have found a error in my calculation of the SKC. I believe both values may have to be converted to decimal from hex first. @gmenounos Can you confirm this?

Probably the better way to get the SKC is to stay in a hex calculator (the built-in calculator app in both Windows10 and macOS have a "programmer" display where you can work in base16 = hex mode).

So, in one of my clusters: the three pairs bytes starting at 204 (0xCC in hex) are D3 1F D3 1F D3 1F.

Decimal 256 = 0x100 (hex)

So in a hex calculator, simply enter 1F*100+D3 = 0x1FD3 = 8147
This was confirmed by what I got out of VAG-TACHO.

And in case you didn't notice the pattern there, you can actually skip the whole calculator thing: Just flip the two bytes (D3 1F becomes 1FD3) and enter that as a hex number into a HEX2DEC converter (=HEX2DEC(cell) in Excel does the trick, too) and convert to decimal. Done and done!

Mac example:
(Under VIEW menu, choose PROGRAMMER to get this calculator layout):

 

[Nuje]

Yeah. I noticed you read the binary the wrong direction. But it worked and you can't argue with results.

Now fixed - thanks for pointing out that I'd mixed them up.