kw1281test: A Free VDS-Pro / VagTacho Alternative

BoostedOne

Well-known member
Joined
Feb 5, 2013
Location
Fl
TDI
82 Caddy, 02 Jetta Wagon TDI Converted
Well, I guess my cluster has some faults is the reason it keeps losing the login. Whole reason for this is I am swapping from a 2.0 auto to ALH 5 speed, and my immobilizer is tripping because of a "low key signal" code. Yes I swapped the cluster, ECM and key from the donor. Figured I would go in and try to just delete and re-add the key i n the TDI cluster.
Then I plugged the 2.0 auto cluster in for grins. Of course a bunch of codes, but no "low key signal code". Couldnt pair my key to the TDI cluster b/c I guess they can only be paired one time, but I did stay logged into the cluster long enough to knock my programmed key code count to zero. Oops.

Well then I logged into the 2.0 auto cluster and did the Immobilizer Learn thing and put the SKC for the malfunctioning TDI cluster in, did that adaptation then deleted the key and readded the key. So now I have the 2.0 auto cluster in the TDI, and finally no immobilizer light and the only codes I have are for saying it doesnt have a trans control module. Id call that progress.

I do plan to get a manual trans cluster, but is there some reason that downloading the whole TDI manual cluster EEprom data and uploading it into the 2.0 auto cluster didnt change the configuration to a manual? I guess that configuration data is coded in somewhere else on the cluster?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Yep, the GetSKC command gave me the same output as I got from a kex conversion, 03109.
Now I am trying to figure out why after I log in, when I click to go to adaptation I immediately get an error that says login lost due to interruption in connection or something like that
It wouldn't hurt to switch back to the non-VCP (i.e. regular VCDS) driver before running VCDS. I don't know if it'll fix it, but it's worth a try.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I do plan to get a manual trans cluster, but is there some reason that downloading the whole TDI manual cluster EEprom data and uploading it into the 2.0 auto cluster didnt change the configuration to a manual? I guess that configuration data is coded in somewhere else on the cluster?
It doesn't sound like you download the whole EEPROM from one cluster and loaded it into the other. From what you posted, it sounds like you just pulled the SKC from the old cluster and used it to match the new cluster to your ECU. That just copies the immobilizer info from your ECU to the nerw cluster. It's generally pretty dangerous to copy the whole EEPROM from one cluster to another unless they are exactly the same VW part number (and even that's not safe as there are VDO clusters and Bosch (Motometer) clusters with exactly the same part number that have totally different EEPROMs).

To fix the no-TCM error, use VCDS (or kw1281test using the SetSoftwareCoding command) and connect to the CAN Gateway (address 19) and enter the proper soft coding for manual transmission. The CAN gateway is inside the cluster and it talks to the automatic transmission control module, the airbag controller and the ABS brake module. It needs to be coded to know what modules are expected to be in your car. If you think about it, it makes sense: how should the cluster know what modules are supposed to be in your car? Not every MKIV has an automatic transmission. Possibly some did not have ABS or airbags. You have to tell the cluster what modules to look for so that it can flag an error if one day it wakes up and can't talk to one of those modules. See here for more info: https://www.ross-tech.com/vag-com/cars/vwmkIV.html

A good practice (not sure where I learned it) is, whenever you install a new cluster into your car, run VCDS, connect to the CAN Gateway and then set the soft coding to whatever value is correct for your car. Even if the coding is correct, save it anyway as it causes the CAN Gateway to scan the CAN bus for any modules it can find and so it learns what's installed in your car. That generally clears a few error codes in the cluster and CAN gateway.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
Happy birthday to kw1281test! Didn't think there'd be 663+ posts a year later, but here we are.
Hey guys, I'm so excited to see people still interested in and developing stuff for these cars. Thank you so much for doing this!

Unless I'm mistaken I should be able to use kw1281test to pull my radios security code? I tried messing around with it but was unsuccessful.

Can I at least dump the radios EEProm? I've seen websites and programs that offer retrieving the code from a dump.

Code:
Args: COM2 9600 56 ReadIdent
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 5.0.7
Culture: en-US
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0035180D   RADIO 3CP         0002
Software Coding 02401, Workshop Code: 00066
Sending ReadIdent block
Ident: 1J0035180D   RADIO 3CP         0002
Software Coding 02401, Workshop Code: 00066
Sending EndCommunication block
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Unless I'm mistaken I should be able to use kw1281test to pull my radios security code? I tried messing around with it but was unsuccessful.

ECU: 1J0035180D RADIO 3CP 0002
kw1281test currently only supports the Delco Premium V radio (because other than Euro Delta VI double-DIN radios, that's all I have to test with). Your radio appears to be a Clarion Premium IV. However, Mike Naberezny (https://github.com/mnaberez/vwradio/) has already reverse engineered that radio so I should be able to add support for it. If you're willing to be the guinea pig, give me a day or two and I'll try to add it.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
Oh yes please. If there's anything I can do to help please let me know.

I just bought this radio like a week ago and found vwradio and your project yesterday. I guess I'll need to buy a premium V radio soon since it can actually be programmed and I hope to do some freaky **** with my radio going forward. Specifically I'm gonna try to integrate my Yatour bluetooth module into one of the dash CD players so I can hit select and use a trunk mounted 6cd changer. I'm also in the process of importing one of those Japanese market Minidisc decks right now. Hopefully the time its all said and done I'll have a *****in stock+ setup.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
I just gave it a go and unfortunately something seem to be off. The first 1-2 tries I had the ignition in the On position (engine off) which resulted in the unhandled exceptions. On the first try the radio was off, on the second the radio was on and asking for a code.

With the engine running it seemed to log in no problem and retrieved the code 4992, after inputting that and holding the right seek button the radio just said SAFE and rebooted asking for the code. I tried it twice but the radio just incremented that small letter to a 2 which I assume is it telling me I'm on my last try before getting locked out for an hour.

The final scan was my old radio (same model#) but with a broken faceplate input, so I cant test that code. I never got a radio code for my car, while its displayed SAFE a few times over the years of me tinkering with it, it has always recovered without me having to use a dealership.

Code:
KW1281Test 0.60-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 9600 56 ClarionVWPremium4SafeCode
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 5.0.7
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
   at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
   at System.IO.Ports.SerialStream.ReadByte()
   at System.IO.Ports.SerialPort.ReadByte()
   at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 33
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 47
   at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 286
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 167
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

KW1281Test 0.60-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 9600 56 ClarionVWPremium4SafeCode
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 5.0.7
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Wrote 0xFE to port but echo was 0x8A
Unhandled exception: System.InvalidOperationException: Wrote 0xFE to port but echo was 0x8A
   at BitFab.KW1281Test.KwpCommon.WriteByteAndDiscardEcho(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 172
   at BitFab.KW1281Test.KwpCommon.WriteComplement(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 105
   at BitFab.KW1281Test.KwpCommon.ReadAndAckByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 87
   at BitFab.KW1281Test.KW1281Dialog.ReadBlockCounter() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 531
   at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 487
   at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 462
   at BitFab.KW1281Test.KW1281Dialog.ReadEcuInfo() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 81
   at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 295
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 167
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

KW1281Test 0.60-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 9600 56 ClarionVWPremium4SafeCode
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 5.0.7
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0035180D   RADIO 3CP         0002
Software Coding 02401, Workshop Code: 00066
Received unknown block: 0x05 0x40 0xF0 0x13 0x80 0x03
Safe code: 4992
Sending EndCommunication block

KW1281Test 0.60-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 9600 56 ClarionVWPremium4SafeCode
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 5.0.7
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0035180D   RADIO 3CP         0002
Software Coding 01402, Workshop Code: 12345
Received unknown block: 0x05 0x0E 0xF0 0x10 0x11 0x03
Safe code: 4113
Sending EndCommunication block
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
With the engine running it seemed to log in no problem and retrieved the code 4992, after inputting that and holding the right seek button the radio just said SAFE and rebooted asking for the code. I tried it twice but the radio just incremented that small letter to a 2 which I assume is it telling me I'm on my last try before getting locked out for an hour.

Code:
ECU: 1J0035180D   RADIO 3CP         0002
Software Coding 02401, Workshop Code: 00066
Received unknown block: 0x05 0x40 0xF0 0x13 0x80 0x03
Can you try 1380 for the SAFE code?

It that doesn't work, try 8013.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
I would except the working radio is still stuck on SAFE. I made sure to plug it back in after scanning my old broken radio so the timer would decay, but here I am well over an hour later and its still on 2 SAFE. I just drove the car on a short grocery trip and I've left the key in the ignition in the On position, hopefully that will be enough to get the timer to count down.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
Just went out to the car and it's still stuck on SAFE. It has to have had power for (collectively) over an hour now. Does it have to be continuous or something?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Just went out to the car and it's still stuck on SAFE. It has to have had power for (collectively) over an hour now. Does it have to be continuous or something?
Supposedly it just needs to be powered on in the car for an hour and then it will revert from "2 SAFE" mode to regular SAFE mode, at which point you can try to enter the code again: https://www.vwcodes.org/blog/157
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
Well nuts I powered it off and on hoping that would shake it out of its mode. Probably restarted the timer. Just went out to check and its still on 2 SAFE. Hopefully another half hour will cross the threshold of 1 continuous hour being powered on.

Edit: That did it. 1380 was the code. Thanks for that! I'm curious what went wrong and how did you know to guess those other codes?
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Well nuts I powered it off and on hoping that would shake it out of its mode. Probably restarted the timer. Just went out to check and its still on 2 SAFE. Hopefully another half hour will cross the threshold of 1 continuous hour being powered on.

Edit: That did it. 1380 was the code. Thanks for that! I'm curious what went wrong and how did you know to guess those other codes?
Great! I'll build another release with the corrected code.

When kw1281test was sending the secret command to retrieve the SAFE code, the radio was sending back the following bytes:

0x05 0x40 0xF0 0x13 0x80 0x03

The SAFE code is encoded in the 0x13 0x80 bytes. There are at least 4 different ways you could interpret those:
  • 16-bit hex number: 0x1380, which converted to decimal is 4992 (my first attempt, which was wrong).
  • 16-bit hex number in reverse order: 0x8013, which converted to decimal is 32787, and obviously too many digits.
  • 16-bit hex number, 0x1380, but don't convert to decimal: 1380 (this is the correct way)
  • 16-bit hex number in reverse order: 0x8013 and don't convert to decimal: 8013 (also wrong)
This is similar to how we decode the SKC codes from MKIV cluster EEPROM dumps. Different clusters store the SKC in different ways, but it's usually one of the 4 ways shown here.
 

kiloran

Member
Joined
Aug 9, 2021
Location
UK
TDI
Mk4 Golf PD 130
Great tool, thanks. Thought it might be useful to post my results/experience with this tool as I've got a relatively uncommon 1.6 16v '02 petrol Mk4 Golf with the AZD engine and Magneti Marelli ECU (but Bosch/MM cluster). After a bit of head scratching getting the SKC worked as follows:

Code:
KW1281Test 0.60-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.18363.0
.NET Version: 5.0.7
Culture: en-GB
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920926A  KOMBI+WEGFAHRS. RB8 V11
Software Coding 01413, Workshop Code: 00000
Sending EndCommunication block
Sending wakeup message
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 17 F1 1A 94 38 (readEcuIdentification)
Received: 94 F1 17 5A 94 5F 56 57 33 34 30 5F 4D 4A 30 32 20 56 30 37 2E 30 38 F8 (readEcuIdentification ACK)
_VW340_MJ02 V07.08
Sent: 82 17 F1 27 FB AC (securityAccess)
Received: 86 F1 17 67 FB 23 27 04 15 53 (securityAccess ACK)
Sent: 86 17 F1 27 FC DE 27 CF C4 49 (securityAccess)
Received: 83 F1 17 7F 27 35 66 (securityAccess NAK invalidKey)
Trying again.
Sent: 82 17 F1 27 FB AC (securityAccess)
Received: 86 F1 17 67 FB B5 AF 1A C3 31 (securityAccess ACK)
Sent: 86 17 F1 27 FC 50 AF B5 F6 5B (securityAccess)
Received: 83 F1 17 7F 27 35 66 (securityAccess NAK invalidKey)
Trying again.
Sent: 82 17 F1 27 FB AC (securityAccess)
Received: 86 F1 17 67 FB 4B 8F C4 2E BC (securityAccess ACK)
Sent: 86 17 F1 27 FC B6 CE 8F DB 9F (securityAccess)
Received: 83 F1 17 7F 27 35 66 (securityAccess NAK invalidKey)
Trying again.
Sent: 82 17 F1 27 FB AC (securityAccess)
Received: 86 F1 17 67 FB DF 75 AA CA B8 (securityAccess ACK)
Sent: 86 17 F1 27 FC 2A 75 25 FF 74 (securityAccess)
Received: 83 F1 17 67 FC 34 22 (securityAccess ACK)
Success!!!
Sent: 83 17 F1 10 84 14 33 (startDiagnosticSession)
Received: 82 F1 17 50 84 5E (startDiagnosticSession ACK)
Saving EEPROM dump to RB8_$01040E_eeprom.bin
Sent: 85 17 F1 23 01 04 0E 02 C5 (readMemoryByAddress)
Received: 83 F1 17 63 4E 03 3F (readMemoryByAddress ACK)
Saved EEPROM dump to RB8_$01040E_eeprom.bin
Sent: 82 17 F1 11 01 9C (ecuReset)
Received: 81 F1 17 51 DA (ecuReset ACK)
SKC: 00xxx
Whilst running the cluster flashed warning lights a couple of times, the warning buzzer went off, and it sounded like something actuated somewhere in the car (a servo/solenoid type sound - reminded me of Climatronic flap actuators). It reset the clock and MFA counters (1 and 2) and I had a minor panic, wondering if the car would start. Fortunately all good, and SKC extracted & verified. Posting this here for info for any other AZD owners (which will include Leon Mk1 & Toledo owners). The key requirement for connecting was setting the baud rate to 10400, without that I got an "Unexpected Sync Byte" error.

As a new owner I haven't followed this thread over the past few months, is what I reported expected behaviour?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Whilst running the cluster flashed warning lights a couple of times, the warning buzzer went off, and it sounded like something actuated somewhere in the car (a servo/solenoid type sound - reminded me of Climatronic flap actuators). It reset the clock and MFA counters (1 and 2) and I had a minor panic, wondering if the car would start. Fortunately all good, and SKC extracted & verified. Posting this here for info for any other AZD owners (which will include Leon Mk1 & Toledo owners). The key requirement for connecting was setting the baud rate to 10400, without that I got an "Unexpected Sync Byte" error.

As a new owner I haven't followed this thread over the past few months, is what I reported expected behaviour?
Thanks for the report!

After reading the EEPROM, the Bosch/MM cluster needs to be reset or else it won't be able to communicate with regular diagnostic tools such as VCDS. Apparently resetting it causes the clock and MFA counters to be cleared. When I get a chance, I'll see if there's some other way to reset it that doesn't clear everything.
 

kiloran

Member
Joined
Aug 9, 2021
Location
UK
TDI
Mk4 Golf PD 130
Thanks for confirming it did what it was supposed to do. Means I can replace a broken fob and get an extra key for the new wheels. Which, when it only cost £500 is a big deal. Keys and coding from a locksmith over here would be a quarter of the price of the car otherwise.
 

JDub8

Veteran Member
Joined
Mar 22, 2009
Location
Vienna, VA
TDI
2001 Golf 2.0 AVH
Thanks for confirming it did what it was supposed to do. Means I can replace a broken fob and get an extra key for the new wheels. Which, when it only cost £500 is a big deal. Keys and coding from a locksmith over here would be a quarter of the price of the car otherwise.
Reading your post it just occurred to me how this ties in to right-to-repair.
 

kiloran

Member
Joined
Aug 9, 2021
Location
UK
TDI
Mk4 Golf PD 130
Reading your post it just occurred to me how this ties in to right-to-repair.
Absolutely. I'd love to see a lawsuit over here in the EU on stuff like this, leveraging subject access rights under privacy laws. It's an interesting area to test in law - is the data gathered by the car your own personal data? VW are actually pretty good at providing repair coverage - ELSAWin's available to everyone for a relatively small fee. I understand why they think they need the system to protect the SKC but it's a component of the car which the customer owns rather than licenses and so should be freely available. Particularly because it's essential to operate/repair the car. Same applies to coding modules.
 

kiloran

Member
Joined
Aug 9, 2021
Location
UK
TDI
Mk4 Golf PD 130
Wondering, could this also get the SKC/PIN from a used ECM/ECU? Or is it just clusters? Thinking of that scenario where you've gently washed your ECU due to VW being crap about where they locate them and you've replaced it with a cheap used one off eBay/from a scrappy. For IMMO3 cars you need to code it to match the cluster SKC but you can only do that if you've got the SKC of the old ECU
 

caffeine

Veteran Member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
03 Allroad w/04 BHW/02X conversion, 00 ALH Jetta
Wondering, could this also get the SKC/PIN from a used ECM/ECU? Or is it just clusters? Thinking of that scenario where you've gently washed your ECU due to VW being crap about where they locate them and you've replaced it with a cheap used one off eBay/from a scrappy. For IMMO3 cars you need to code it to match the cluster SKC but you can only do that if you've got the SKC of the old ECU
Yes it can already do this, at least if it's an 00+ ALH TDI ECU. You have to extract the SKC yourself though after dumping the ECU EEPROM.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Yes it can already do this, at least if it's an 00+ ALH TDI ECU. You have to extract the SKC yourself though after dumping the ECU EEPROM.
It's on my list to display the SKC automatically like it does from the cluster. But only so many hours in a day...
 

mfavero

New member
Joined
Aug 11, 2021
Location
Brazil
TDI
Passat 1.8t 2001 - Manual
So I've been a happy VCDS user since buying my Golf in 2003 (it had 65000 miles on it so it conveniently needed an immediate timing belt replacement, hence needing VCDS - though it was named VAG-COM way back then).

However there are things that VCDS doesn't do, such as pulling the SKC from an instrument cluster, changing the odometer of a used cluster, reading/writing bytes in the CCM, retrieving a used radio's Safe code, etc.

Since I have a part-time "business" (really more like a hobby at this point) involving fixing up MKIV instrument clusters and reselling them, VagTacho or similar (VAG Commander, VAGdashCOM, VAG EEPROM Programmer, etc.) is a necessity. The problem is that legitimate copies of these tools cost hundreds of dollars and require special dedicated cables. You can find cheap pirated copies of many of these, but some still require special cables and you never know what malware might be lurking on the plain white mini-CDs that the software comes on. (I eventually did by a real copy of VAGdashCOM after having lots of trouble with flaky eBay VagTacho cables). And it's not only me that needs these tools. If I sell a cluster to someone, they need to know their SKC in order to install it. If I set the odometer to 0, they can adjust it to the correct value with VCDS, but no VagTacho, no SKC, no start.

I've also always wanted to use VDS-PRO to enable the "Roll windows up/down with key fob" CCM feature and other options, but it only runs on DOS and hasn't been maintained in many years. I've had lots of trouble getting it to run at all on newer computers.

Fast forward to a couple of months ago: I bumped into Mike Naberezny's GitHub page: https://github.com/mnaberez/vwradio
Mike has done the amazing job of reverse engineering 8 (so far) VW/Seat/Skoda radios and has found various hidden commands and discovered ways to retrieve the Safe code from most of them via the K-Line and some open-source hardware/software that he created. He's made all the info available for free. The only downside is that his software runs on a custom circuit board and that's a barrier to most people.

So that got me thinking that maybe I could do something similar in software that runs on a PC and a generic cable. I was able to find a good bit of info about VW's proprietary KW1281 K-Line protocol here and learned some more by reading Mike's code. I bought a Saleae logic analyzer and was able to use it to spy on the K-Line while using various cluster tools and VDS-PRO in order to figure out which KW1281 commands were being used to read/write the EEPROM, reboot the cluster, etc.

I was then able to write a program that could wake up a module and send simple commands over the K-Line. Eventually I got it to the point where it could read/write bytes in the CCM EEPROM like VDS-PRO and retrieve the Safe code from a VW Premium V radio like Mike's tool. The big thing missing was the ability to read/write the cluster EEPROM. That required performing a successful challenge/response with the cluster. The commercial tools all know how to do that but it's not documented anywhere that I could find. Finally with some pointers from Mike, I was able to partially disassemble the cluster ROM in order to find how the challenge/response works and am now able to dump the entire cluster EEPROM to a file for editing. I only just got this working yesterday so I haven't tried writing the EEPROM back yet but that should be pretty straightforward to get working.

I uploaded all the source code to GitHub: https://github.com/gmenounos/kw1281test

You can download the source code and build it yourself or there's a .zip file containing a precompiled version that runs on Windows 10 here:
https://github.com/gmenounos/kw1281test/releases/

Currently it just runs from the command line but that might be just fine for now. It requires a dumb KKL cable, basically something with an OBD connector on one end and that looks like a serial port to the PC. I've successfully used a KKL cable I bought 7 years ago that connects to an actual serial port on my really old laptop. I've also used a genuine VCDS cable configured to run in VCP (Virtual COM Port mode). I've only run it on an old Dell laptop that runs 32-bit Windows 10. It should work fine on 64-bit Windows 10 but I haven't actually tried that yet. It's written in C# for .NET Core, which is cross-platform, so it might also run on Macs and Linux but I haven't tried either. You're welcome to give it a shot and let me know.

To run the tool, you have to know what COM port your cable is using, what baud rate to use, what controller address to connect to and what command you want to send. A fancier tool like VCDS will automatically detect the baud rate of the controller but I was too lazy to figure out how to do that so you must know the baud rate. I can tell you that the cluster uses 10400.

Here's the tool reading a cluster's software version:

Code:
PS C:\> .\kw1281test.exe com4 10400 17 ReadSoftwareVersion
Opening serial port com4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3B7920946E  KOMBI+WEGFAHRSP VDO V095
Sending Custom "Unlock Additional Commands" block
Sending Custom "Read Software Version" blocks
00: VWK501MH $10 $01
01: $81 $19
02: $18 $08 $01 $0B $1C $09
03: VW/Sk MH Serie/Flash
Sending EndCommunication block
Maybe not too exciting, but here's it dumping the cluster EEPROM to a file:

Code:
PS C:\> .\kw1281test.exe com4 10400 17 DumpEeprom 0 2048
Opening serial port com4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3B7920946E  KOMBI+WEGFAHRSP VDO V095
Sending Custom "Unlock Additional Commands" block
Sending ReadIdent block
Sending Custom "Unlock partial EEPROM read" block
Sending Custom "Are you unlocked?" block
Sending Custom "Seed request" block
Block:  7A 42 2A DE 80 28 6F 45 01 00
Sending Custom "Key response" block
Sending ReadEeprom block (Address: $0000, Count: $10)
Received "Read EEPROM Response" block: 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
Sending ReadEeprom block (Address: $07F0, Count: $10)
Received "Read EEPROM Response" block: FF 4C 00 00 00 00 00 FF FF FF 08 0E 08 0E 08 0E
Saving EEPROM dump to WVWUK63B33P247312_____VWZ7Z0B6069175_$0000_eeprom.bin
Sending EndCommunication block
Here's a full list of commands. You'll see that same info if you just run the program and don't specify any parameters.

Code:
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
       PORT    = COM1|COM2|etc.
       BAUD    = 10400|9600|etc.
       ADDRESS = The controller address, e.g. 17 (cluster), 46 (CCM), 56 (radio)
       COMMAND = ReadIdent
                 ReadSoftwareVersion
                 ReadEeprom ADDRESS
                            ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                 WriteEeprom ADDRESS VALUE
                             ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
                             VALUE   = Value in decimal (e.g. 138) or hex (e.g. $8A)
                 DumpEeprom START LENGTH
                            START  = Start address in decimal (e.g. 0) or hex (e.g. $0)
                            LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
                 DumpRom START LENGTH
                         START  = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
                         LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
                 MapEeprom
                 Reset
                 DelcoVWPremium5SafeCode
So if this sounds useful, please give it a try and let me know if it works for you. I'm interested in hearing what cables it works with, which controllers it can talk to and which is has trouble with, bug reports and suggestions for new features.
@gmenounos

Hello!

I would like to thank you for your passing on knowledge and time with everyone.

I just finished coding my CCM 1C0 959 799 B (Sedan) 1.8T manual.

A few years ago I needed to change the CCM and since then I haven't been able to make Windows Roll Up and Down with Remote work and change it to horn alarm.

Today I am very happy that I finally got it with a simple command.

thanks a lot.

Ps.: I'm from Brazil and I will definitely pass this knowledge on to other people.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
It's on my list to display the SKC automatically like it does from the cluster. But only so many hours in a day...
Luckily the night has extra hours!

New release: https://github.com/gmenounos/kw1281test/releases/tag/v0.62-beta

You can now use the GetSKC command to read the SKC from the ECU (EDC15 only). It will also tell you if your Immo is on or off.

Code:
.\kw1281test.exe COM4 9600 1 GetSKC
Version 0.62-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 1 GetSKC
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 038906012GN 1,9l R4 EDC G000SG  4308
Software Coding 00002, Workshop Code: 00066
Sending EndCommunication block
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 01 F1 10 89 0D (startDiagnosticSession)
...
Reboot successful!
SKC: 03165
Immo is On ($33, $33)
There are some caveats:
  1. If you get a timeout while communicating with the ECU, you may have to disconnect the battery (or pull the appropriate fuse) to reboot the ECU.
  2. Only Immo3 ECUs contain the SKC. Immo2 vehicles just store the SKC in the cluster.
 

kiloran

Member
Joined
Aug 9, 2021
Location
UK
TDI
Mk4 Golf PD 130
Luckily the night has extra hours!

New release: https://github.com/gmenounos/kw1281test/releases/tag/v0.62-beta

You can now use the GetSKC command to read the SKC from the ECU (EDC15 only). It will also tell you if your Immo is on or off.

Code:
.\kw1281test.exe COM4 9600 1 GetSKC
Version 0.62-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 1 GetSKC
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 038906012GN 1,9l R4 EDC G000SG  4308
Software Coding 00002, Workshop Code: 00066
Sending EndCommunication block
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 01 F1 10 89 0D (startDiagnosticSession)
...
Reboot successful!
SKC: 03165
Immo is On ($33, $33)
There are some caveats:
  1. If you get a timeout while communicating with the ECU, you may have to disconnect the battery (or pull the appropriate fuse) to reboot the ECU.
  2. Only Immo3 ECUs contain the SKC. Immo2 vehicles just store the SKC in the cluster.
Cool! Any risks with this? I'm guessing it's just reading rather than writing anything so should be OK? I've got a Magneti Marelli ECU (1.6 16v AZD engine) which I don't think made it to your side of the Pond. I've no need to get my ECU SKC as I know it's the same as my cluster (IMMO3 car) but thought it would be useful to test it.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Cool! Any risks with this? I'm guessing it's just reading rather than writing anything so should be OK? I've got a Magneti Marelli ECU (1.6 16v AZD engine) which I don't think made it to your side of the Pond. I've no need to get my ECU SKC as I know it's the same as my cluster (IMMO3 car) but thought it would be useful to test it.
It's not going to work unless you have a Bosch EDC15 ECU. Maybe try the ReadIdent command and post the results but I'm pretty sure that's going to show that it's not an EDC15.
 
Top