kw1281test: A Free VDS-Pro / VagTacho Alternative

[Nuje]

I've had some fobs that people have brought me to program that just didn't work - little red LED on the fob blinked when you pushed buttons, so it wasn't battery, but the fob just wouldn't pair with the car. I'm guessing they bought it somewhere (cheap off Amazon) and it was the wrong frequency.

 

[Nuje]

The first "1" is the channel number. That stays the same. The second "1" is the value (in this case, the number of fobs) that you're saving to the channel.

Great - thanks, Greg.

 

[Jwolrab]

Hello, im new to posting here but have found this thread very helpful so far. I got here because I accidently broke the tranponder chip while replacing my key fob... I have now succsesfully found my SKC code through using this tool and have ordered and put a new transpoder chip into the key fob. However im having some trouble trying to progam the new chip using the adaptation feature. I have a 2001 ALH TDI (ECU: 1J0920905L) I tried programming the new chip using the adaptation feature with no succsess. Am i doing somthing wrong? I have also read that I might have a immo2 car which is only capable of reading chips, if so what would my next step be?

 

[Nuje]

Just took a look at a car that had a CCM I've never seen before: 1C0962258P, at address 35 (2001 Golf with 06/2000 manufacture date, manual windows.
We were trying to set the hatch to unlock with the doors, but all of the usual addresses (043xx) had nothing closely resembling what I usually see at address 46.

Any ideas where the hatch unlock bits/bytes might be located?

 

[kennethsime]

Ok guys, got my cable in.

Are there step-by-step instructions posted anywhere for enabling remote windows? I'm going to try to figure it out today.

So far, I think the basic steps are:

1. Read EEPROM to verify the values at the intended address
2. Dump EEPROM to make a backup before changing anything
3. Write EEPROM to replace the values with the correct offset to enable the features I want.

Is that about right? And I can find the correct values and addresses in the VDSPro thread?

Edit: and just to post it here for other folks' benefit, here are the values I'm going to try.

1C0 959 799 A (any index) and 1C0 959 799 B (any index) for Variant/Wagon
Code:

Memory Address / old value / new value
04361 / 75 / 67
04362 / 75 / 67
04363 / 75 / 67

 

[Nuje]

75 is binary 01001011
So, looking at the table below...

...I'd say you have then proper addresses, and you'd want to change bit 3 (01001011), which would give you 01000011 - which indeed is 67.

While you're there, you probably want to go to addresses 4370,1, 2 and (I think?) flip bit1 (so that if the doors are unlocked, so is the hatch - aka "suitcase"). Most Golfs are at the 4352, 3, 4 addresses, but I recall Jetta wagons being different.
Just write down what original values are so you can always go back to where you started and see how you make out.

 

[gmenounos]

Just took a look at a car that had a CCM I've never seen before: 1C0962258P, at address 35 (2001 Golf with 06/2000 manufacture date, manual windows.
We were trying to set the hatch to unlock with the doors, but all of the usual addresses (043xx) had nothing closely resembling what I usually see at address 46.

Any ideas where the hatch unlock bits/bytes might be located?

I could only find that part number mentioned here and it may not even be possible to write to the EEPROM:
https://forums.tdiclub.com/index.ph...nfigurations-with-vds-pro.160960/post-5399808
Not sure if that CCM doesn't support writing or if it needs maybe a different password.

 

[kennethsime]

You definitely need to make sure that the KKL cable has an FTDI chip in it (as opposed to the more common CH340 chip). On a PC you can use either but the CH340 Mac drivers don't allow the precise timing that is needed to wake up the cluster.

gmenounos, can I ask a tech support question? I'm trying to get this working from a MacBook Pro.

I got the cable plugged in, downloaded & installed the VCP drivers from the ftdichip website, but I do not see anything new when I run

ls /dev/{tty,cu}.*

I'd planned on checking /dev/tty to identify the correct com port for the cable in order to run the kw1281 program. Am I missing a step? Would you be able to point me in the right direction?

 

[gmenounos]

Hello, im new to posting here but have found this thread very helpful so far. I got here because I accidently broke the tranponder chip while replacing my key fob... I have now succsesfully found my SKC code through using this tool and have ordered and put a new transpoder chip into the key fob. However im having some trouble trying to progam the new chip using the adaptation feature. I have a 2001 ALH TDI (ECU: 1J0920905L) I tried programming the new chip using the adaptation feature with no succsess. Am i doing somthing wrong? I have also read that I might have a immo2 car which is only capable of reading chips, if so what would my next step be?

Seems to be the same procedure as Immo3: https://forums.tdiclub.com/index.php?threads/free-vds-pro-vagtacho-alternative.509151/post-5680841
Just make sure you use the correct COM port and your own SKC

If that doesn't work, then please copy all the output from kw1281test (the same output is also in the kw1281test.log file) and post it here.

 

[gmenounos]

gmenounos, can I ask a tech support question? I'm trying to get this working from a MacBook Pro.

I got the cable plugged in, downloaded & installed the VCP drivers from the ftdichip website, but I do not see anything new when I run

ls /dev/{tty,cu}.*

I'd planned on checking /dev/tty to identify the correct com port for the cable in order to run the kw1281 program. Am I missing a step? Would you be able to point me in the right direction?

I think you need the D2XX drivers, not the VCP drivers. Installation instructions are here:

https://www.ftdichip.com/Support/Documents/InstallGuides/Mac_OS_X_Installation_Guide.pdf

 

[kennethsime]

I think you need the D2XX drivers, not the VCP drivers. Installation instructions are here:

https://www.ftdichip.com/Support/Documents/InstallGuides/Mac_OS_X_Installation_Guide.pdf

Ok, that helped, and I was able to identify my cable as

/dev/tty.usbserial-A9GBLUMW

, however I keep getting an access denied message:

Opening serial port /dev/tty.usbserial-A9GBLUMW


Caught: System.UnauthorizedAccessException Access to the port '/dev/tty.usbserial-A9GBLUMW' is denied.


Unhandled exception: System.UnauthorizedAccessException: Access to the port '/dev/tty.usbserial-A9GBLUMW' is denied.

Any further ideas? I'm running the executable as sudo, tried both baud rates, trying to identify my road block.

 

[gmenounos]

Can you include the actual output from kw1281test? That'll show what command line parameters you're using as well as other helpful info.

 

[gmenounos]

So on a Mac, you have to run it like this:

./kw1281test AG0JT9DF 10400 17 ReadIdent

(i.e. just A9GBLUMW instead of /dev/tty.usbserial-A9GBLUMW)

You may also need to install D2xxHelper as described here https://ftdichip.com/drivers/d2xx-drivers/

"If using a device with standard FTDI vendor
and product identifiers, install
D2xxHelper
to prevent mac OS from
claiming the device as a serial port (locking out D2XX programs).
This will prevent the device being used
with the VCP driver as a standard COM port."

 

[kennethsime]

Absolutely.

Here's my latest.

kenneth@Kenneths-MBP JettaWagon % sudo ./kw1281test /dev/tty.usbserial-A9GBLUMW 9600 46 ReadFaultCodes
KW1281Test: Yesterday's diagnostics...Today.
Version 0.65-beta (https://github.com/gmenounos/kw1281test/releases)
Args: /dev/tty.usbserial-A9GBLUMW 9600 46 ReadFaultCodes
OSVersion: Unix 11.0.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port /dev/tty.usbserial-A9GBLUMW
Caught: System.UnauthorizedAccessException Access to the port '/dev/tty.usbserial-A9GBLUMW' is denied.
Unhandled exception: System.UnauthorizedAccessException: Access to the port '/dev/tty.usbserial-A9GBLUMW' is denied.
---> System.IO.IOException: Resource busy
   --- End of inner exception stack trace ---
   at System.IO.Ports.SafeSerialDeviceHandle.Open(String portName)
   at System.IO.Ports.SerialStream..ctor(String portName, Int32 baudRate, Parity parity, Int32 dataBits, StopBits stopBits, Int32 readTimeout, Int32 writeTimeout, Handshake handshake, Boolean dtrEnable, Boolean rtsEnable, Boolean discardNull, Byte parityReplace)
   at System.IO.Ports.SerialPort.Open()
   at BitFab.KW1281Test.Interface.GenericInterface..ctor(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 23
   at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 386
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 198
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 25

I'll try the helper next.

 

[kennethsime]

Ok, the helper did it! Well, almost. Next step: controller not waking up.

kenneth@Kenneths-MBP JettaWagon % sudo ./kw1281test /dev/tty.usbserial-A9GBLUMW 9600 46 ReadFaultCodes
KW1281Test: Yesterday's diagnostics...Today.
Version 0.65-beta (https://github.com/gmenounos/kw1281test/releases)
Args: /dev/tty.usbserial-A9GBLUMW 9600 46 ReadFaultCodes
OSVersion: Unix 11.0.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port /dev/tty.usbserial-A9GBLUMW
Sending wakeup message
Reading sync byte
Retrying wakeup message...
Reading sync byte
Retrying wakeup message...
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 59
   at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 336
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 292
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 25

I did try some other controllers, with the same result.

I tried the 10440 baud rate, and that gave a different error

Caught: System.ArgumentException Value does not fall within the expected range.

 

[gmenounos]

Can you try running it with just A9GBLUMW for the port name, not /dev/tty.usbserial-A9GBLUMW?

 

[kennethsime]

Can you try running it with just A9GBLUMW for the port name, not /dev/tty.usbserial-A9GBLUMW?

Interesting, new roadblock. Perhaps it has something to do with permissions on the directory libftd2xx.dylib was installed?

kenneth@Kenneths-MBP JettaWagon % sudo ./kw1281test A9GBLUMW 9600 46 ReadIdent 
Password:
KW1281Test: Yesterday's diagnostics...Today.
Version 0.65-beta (https://github.com/gmenounos/kw1281test/releases)
Args: A9GBLUMW 9600 46 ReadIdent
OSVersion: Unix 11.0.0
.NET Version: 5.0.8
Culture: en-US
Opening FTDI serial port A9GBLUMW
Caught: System.DllNotFoundException Unable to load shared library 'libftd2xx.dylib' or one of its dependencies. In order to help diagnose loading problems, consider setting the DYLD_PRINT_LIBRARIES environment variable: dlopen(liblibftd2xx.dylib, 1): image not found
Unhandled exception: System.DllNotFoundException: Unable to load shared library 'libftd2xx.dylib' or one of its dependencies. In order to help diagnose loading problems, consider setting the DYLD_PRINT_LIBRARIES environment variable: dlopen(liblibftd2xx.dylib, 1): image not found
   at System.Runtime.InteropServices.NativeLibrary.LoadByName(String , QCallAssembly , Boolean , UInt32 , Boolean )
   at System.Runtime.InteropServices.NativeLibrary.LoadLibraryByName(String , Assembly , Nullable`1 , Boolean )
   at System.Runtime.InteropServices.NativeLibrary.Load(String , Assembly , Nullable`1 )
   at BitFab.KW1281Test.Interface.FT..ctor() in C:\Users\gmeno\src\kw1281test\Interface\FtdiInterface.cs:line 173
   at BitFab.KW1281Test.Interface.FtdiInterface..ctor(String serialNumber, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\FtdiInterface.cs:line 16
   at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 381
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 198
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 25

 

[kennethsime]

Tried to chmod every relevant directory, no changes.

Tried searching my Mac, and each file in the INCLUDE folder for "DYLD_PRINT_LIBRARIES" to no avail.

 

[gmenounos]

And you did all these steps? (which can be found here: https://ftdichip.com/wp-content/upl..._Drivers_Installation_Guide_for_MAC_OSX-1.pdf

Download the D2XX disk image as per section 2.2 of this document. Click the dmg item in the
Downloads area to mount the disk image, then drag the D2XX folder to your desktop.
Start a Terminal session (Go > Applications > Utilities > Terminal)
Change directory to /usr/local/lib:
cd /usr/local/lib
Note: if /usr/local/lib does not already exist, try again after creating it with:
sudo mkdir –p /usr/local/lib
Copy the libftd2xx dynamic library to /usr/local/lib (note the final space and dot are essential):
sudo cp ~/Desktop/D2XX/bin/10.5-10.7/libftd2xx.1.2.2.dylib .
Create a version-independent symbolic link to the library:
sudo ln -sf libftd2xx.1.2.2.dylib libftd2xx.dylib
The driver is now installed. You may link to it by specifying –lftd2xx in your build command.

 

[gmenounos]

Not sure if it matters, but is your Mac an M1 or Intel? When I first got this working on a Mac, I had access to an Intel MacBook Pro. Never tried it on an M1 yet.

 

[kennethsime]

And you did all these steps? (which can be found here: https://ftdichip.com/wp-content/upl..._Drivers_Installation_Guide_for_MAC_OSX-1.pdf

Download the D2XX disk image as per section 2.2 of this document. Click the dmg item in the
Downloads area to mount the disk image, then drag the D2XX folder to your desktop.
Start a Terminal session (Go > Applications > Utilities > Terminal)
Change directory to /usr/local/lib:
cd /usr/local/lib
Note: if /usr/local/lib does not already exist, try again after creating it with:
sudo mkdir –p /usr/local/lib
Copy the libftd2xx dynamic library to /usr/local/lib (note the final space and dot are essential):
sudo cp ~/Desktop/D2XX/bin/10.5-10.7/libftd2xx.1.2.2.dylib .
Create a version-independent symbolic link to the library:
sudo ln -sf libftd2xx.1.2.2.dylib libftd2xx.dylib
The driver is now installed. You may link to it by specifying –lftd2xx in your build command.

Ahah! I was following the readme that came with the driver install. Version-independent is a very important distinction!

Edit: this didn't change anything. Going to go back over the install.
Edit 2: Ok, found the problem. I had the library in the include subdirectory, folder, rather than in the lib directory. Holy smokes! This is so cool!

Thanks very much u/gmenounos for all of your work here.

Not sure if it matters, but is your Mac an M1 or Intel? When I first got this working on a Mac, I had access to an Intel MacBook Pro. Never tried it on an M1 yet.

Intel, from 2017.

 

[kennethsime]

...I'd say you have then proper addresses, and you'd want to change bit 3 (01001011), which would give you 01000011 - which indeed is 67.

While you're there, you probably want to go to addresses 4370,1, 2 and (I think?) flip bit1 (so that if the doors are unlocked, so is the hatch - aka "suitcase"). Most Golfs are at the 4352, 3, 4 addresses, but I recall Jetta wagons being different.
Just write down what original values are so you can always go back to where you started and see how you make out.

Ok, so I had to scroll further into the VDSPro thread when I realized my 4361,2,3 were 202, not 75. 194 was correct adjustment, pulled from the thread. Remote windows work! Woo!

Next up, I read my 4370,1,2 as 6, which is 0110. I tried flipping the first bit to 1110 (14), but that didn't work. I also tried flipping the second bit just for fun (2), but that also didn't work. I'll have to come back to this one tomorrow, but I'm pretty stoked to have enabled remote windows at least!

 

[Nuje]

Next up, I read my 4370,1,2 as 6, which is 0110. I tried flipping the first bit to 1110 (14), but that didn't work. I also tried flipping the second bit just for fun (2), but that also didn't work. I'll have to come back to this one tomorrow, but I'm pretty stoked to have enabled remote windows at least!

With 6 (00000110) as the value in those bytes, try 4 (00000100).

 

[Jwolrab]

Followed that procedure and the immo light never stops blinking and key wont work. Heres the outputs i got. It seems to succsefully get the SKC code however when trying to program the new chip it doesnt seem to acknowledge its there.

C:\Users\John\Downloads\kw1281test_0.65-beta_Win10>kw1281test.exe COM4 10400 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.65-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920905L A4-KOMBIINSTR. VDO V52
Software Coding 07232, Workshop Code: 00066
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VAT500LL $01
01: $90 $17
02: $11 $04 $00 $10 $33 $07
03: VW A4 Lowline Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VAT500LL 01.20 is 01 04 3D 35
Sending Custom "Need Seed/Key?" block
Received NAK block
Sending Custom "Seed request" block
Received NAK block
Sending Custom "Need Seed/Key?" block
Received NAK block
Failed to unlock cluster.
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2678068________$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Received "Read ROM/EEPROM Response" block: 56 57 5A 37 5A 30 59 32 36 37 38 30 36 38 56 57
Sending ReadEeprom block (Address: $00A0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 37 5A 30 59 32 36 37 38 30 36 38 56 57 5A 37
Sending ReadEeprom block (Address: $00B0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 30 59 32 36 37 38 30 36 38 82 10 82 10 82 10
Sending ReadEeprom block (Address: $00C0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00D0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 FF 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00E0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 FF FF FF FF FF FF FF A5 C9 A6 C9 A6 C9
Sending ReadEeprom block (Address: $00F0, Count: $10)
Received "Read ROM/EEPROM Response" block: A6 C9 A6 C9 A6 C9 A6 C9 A6 C9 00 00 00 40 08 00
Sending ReadEeprom block (Address: $0100, Count: $0C)
Received "Read ROM/EEPROM Response" block: 01 00 00 00 00 00 00 00 00 00 FF FF
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2678068________$0090_eeprom.bin
SKC: 04226
Sending EndCommunication block

C:\Users\John\Downloads\kw1281test_0.65-beta_Win10>kw1281test.exe COM4 10400 17 AdaptationSave 21 1 04226
KW1281Test: Yesterday's diagnostics...Today.

Version 0.65-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 AdaptationSave 21 1 04226
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 5.0.8
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920905L A4-KOMBIINSTR. VDO V52
Software Coding 07232, Workshop Code: 00066
Sending Login block
Received NAK block
Sending AdaptationTest block
Received NAK block
Received a NAK.
Sending EndCommunication block

 

[gmenounos]

Sending Login block
Received NAK block

That sounds like it didn't accept the login so maybe kw1281test calculated the SKC incorrectly. Can you dump the entire EEPROM?

 kw1281test.exe COM4 10400 17 DumpEEPROM 0 2048 eeprom.bin

My email address is on this page: https://bitfab.com/Contact
Just send me eeprom.bin as an attachment and I'll take a look.

 

[Nuje]

Just one other point: There are different frequencies of transponder chip (ask me how I learned this fun fact ).
Be sure that you have the proper frequency of new transponder chip for your year/model of car (and just in case you didn't know, the transponder chip from an old key cannot be re-purposed and paired to a different car).

 

[gmenounos]

I think the Immo2 chips are reusable in other cars based on what I read in this thread: https://forums.tdiclub.com/index.ph...r-systems-explained-immo2-immo3-immo4.436061/

 

[gmenounos]

I can confirm that the latest version of kw1281test doesn't implement the GetSKC command correctly for Immo2 clusters (stupid binary!).
@Jwolrab I think your SKC is actually 1082 so hopefully the following will work:

kw1281test.exe COM4 10400 17 AdaptationSave 21 1 01082

 

[gmenounos]

Just published a new release that fixes that Immo2 bug: https://github.com/gmenounos/kw1281test/releases/tag/v0.66-beta

 

[Jwolrab]

That worked! Cant thank you enough for your help. Very useful tool and I look forward to using it more in the future.