kw1281test: A Free VDS-Pro / VagTacho Alternative

[kennethsime]

With 6 as the value in those bytes, try 4.

So, the third bit?

With 6 (00000110) as the value in those bytes, try 4 (00000100).

That worked! I definitely didn't quite understand how the chart works - the whole thing makes more sense now!

One strange thing: Since enabling remote windows the other day, my alarm goes off about half the time I open my car. Will have to do some testing this weekend when I have an hour or so to devote to it. I'm keeping records of my changes, so should be easy to revert everything if necessary.

 

[kennethsime]

Referencing the chart:

What is the difference between the Tailgate and Suitcase? I haven't messed with 4352,3,4 yet.

 

[Nuje]

Haha.
I've just interpreted "suitcase" as "hatch" or (more likely) "trunk"; the chart isn't mine - can't remember where I found it - but I'm guessing whoever devised it maybe didn't have English as a first language and the translate app/service they used at the time gave them "suitcase" when they were looking for "trunk" opening.

 

[Nuje]

So, the third bit?

It's actually bit1 (count starting from the right-most with bit0).

 

[kennethsime]

It's actually bit1 (count starting from the right-most with bit0).

Ahhhh that makes sense. Man, binary is a trip.

 

[kennethsime]

Well, I took another stab at coding tonight.

I did a bit of testing, and it seemed I was able to reproduce the alarm issue by opening + closing the hatch, then immediately opening the driver's door. I reverted to original settings, and the issue seemed to be gone. I then re-coded 4361,2,3 from 202 to 195 (using the excel sheet as a reference, now that I kind of understand it), which re-enabled remote windows. While the alarm issue seemed to be gone at first, I think it was just dumb luck - the issue was back by the end of the night.

I've read that it may be an issue with a door latch - I have a pre-existing issue with my rear passenger-side door, and maybe that's upsetting things. Oh well!

I did notice that some of the numbers in the spreadsheet seem to be off on my car - it's possible some of this was changed by the previous owner, although I kind of doubt it. A couple of bits were set to "RoW" values, rather than US values.

 

[Nuje]

In my acquired list of codings I have a record of both 194 and 195 being the adjusted value for OEM 202. So... ¯\_(ツ)_/¯

If it works at first but then triggers the alarm...I gotta think something else besides the coding is getting in the way. But electronics are not my forté, so....have fun!

 

[Nuje]

Update (found buried in another note I have):
"I've successfully added windows via remote control (changed addresses 04361-04363 from 202 to 194), and found a way to have the tailgate be 'unlocked' when all doors are unlocked (changed 04352-04354 from 41 to 105, and 04370-04372 from 6 to 4.)"

and (for a B5.5 Passat, which who knows - might be the trick):
"So, to put all of the B5.5 Passat wagon (NAR) bits in one single post....

• 04352-04354, change bit 6 from 0 to 1, and
• 04370-04372, change bit 1 from 1 to 0.

These changes will give you a tailgate that is "unlocked" with the rear doors (just like a RoW B5.5 wagon.)"

 

[kennethsime]

In my acquired list of codings I have a record of both 194 and 195 being the adjusted value for OEM 202. So... ¯\_(ツ)_/¯

If it works at first but then triggers the alarm...I gotta think something else besides the coding is getting in the way. But electronics are not my forté, so....have fun!

The key, according to the chart, is that wagons should have bit 0 set to 1 (195), where all others have it set to 0 (194).

 

[Nuje]

I use that chart more as a guide, not as the definitive authority.

 

[Nuje]

As an additional data point: It just so happens that I had a 2003 Jetta wagon here today; changed 4361,2,3 from 202 to 195, and 4370,1,2 from 6 to 4 - and I have hatch unlock and fob window-open/close working perfectly.

 

[kennethsime]

Played around some more today - this is so fun!

So far, my changelog includes:

• Remote Windows
• Suitcase/Rear hatch open with rear doors
• Horn Beep on unlock
• Auto Unlock at key off

These are some really convenient features.

I want to mess around with the alarm sounds also to try the German and UK sounds, but I'm afraid my neighbors won't approve of my trial and error process.

 

[gmenounos]

New release: https://github.com/gmenounos/kw1281test/releases/tag/v0.67-beta
Added BasicSetting and GroupRead commands. BasicSetting 0 should be sufficient to set the start of injection using the graph and instructions from the Bentley manual.

 

[2002_auto_tdi]

Hi,

Am I correct in my earlier reading that I can use my VCDS "HEX-V2 Dual-K & CAN USB interface for VCDS" cable so long as I follow the additional instructions provided for use or was that for some other similarly named cable?

If I am right, then will that disrupt future use of VCDS functionality? I don't want to get in the weeds with this app. I just want to make the hatch unlock with the doors and never use it again.

Thanks for all of your hard work!!

 

[gmenounos]

Am I correct in my earlier reading that I can use my VCDS "HEX-V2 Dual-K & CAN USB interface for VCDS" cable so long as I follow the additional instructions provided for use or was that for some other similarly named cable?

Unfortunately, HEX-V2 will not work with kw1281test as it doesn't support running as a Virtual COM Port (VCP):

https://www.ross-tech.com/vag-com/usb/virtual-com-port.php

"NOTE: The following applies to our legacy USB interfaces (HEX-USB, KII-USB and HEX-USB+CAN). It does NOT apply to our current HEX-V2 or HEX-NET interfaces. These new interfaces do not use a USB UART chip and cannot be be used for "dumb K-line pass-through"! "

 

[2002_auto_tdi]

Unfortunately, HEX-V2 will not work with kw1281test as it doesn't support running as a Virtual COM Port (VCP):

https://www.ross-tech.com/vag-com/usb/virtual-com-port.php

"NOTE: The following applies to our legacy USB interfaces (HEX-USB, KII-USB and HEX-USB+CAN). It does NOT apply to our current HEX-V2 or HEX-NET interfaces. These new interfaces do not use a USB UART chip and cannot be be used for "dumb K-line pass-through"! "

Thank you for this. Learning.

 

[cristian7477]

Works with Vag Can Pro (translucid cable) and Galletto 1260 ?

 

[2002_auto_tdi]

Hi,

I purchased the cable mentioned in the 14th post of the thread from Amazon. I am trying to run this on my W10 machine on Port 5. Device Manager sees the cable on Port 5. The Baud Rate is 9600.

Any idea what may be wrong when trying to run a basic query from DOS as an administrator?

Thanks.

C:\>kw1281test.exe COM5 9600 46 ReadEeprom 04352
KW1281Test: Yesterday's diagnostics...Today.

Version 0.69-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 9600 46 ReadEeprom 04352
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Wrote 0xAA to port but echo was 0x01
Unhandled exception: System.InvalidOperationException: Wrote 0xAA to port but echo was 0x01
at BitFab.KW1281Test.KwpCommon.WriteByteAndDiscardEcho(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 193
at BitFab.KW1281Test.KwpCommon.WriteComplement(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 126
at BitFab.KW1281Test.KwpCommon.ReadAndAckByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 108
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 307
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 285
at BitFab.KW1281Test.KW1281Dialog..ctor(IKwpCommon kwpCommon, ControllerInfo& ecuInfo) in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 719
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 371
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 315
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 30

 

[2002_auto_tdi]

I tried the syntax by 03TDICommuter in post 132 that didn't work for him and I am getting the below...too long to post all of it. Any ideas? At the moment all I'd like to do is to get my hatch to open with the doors and run away for a while, lol.

Thanks...


kw1281test67 COM5 10400 17 DumpEeprom 0 2048 <----executable renamed to 67 since windows is giving me a hard time with running 6.9

Version 0.67-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 10400 17 DumpEeprom 0 2048
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920906L KOMBI+WEGFAHRSP VDO V11
Software Coding 06232, Workshop Code: 01120
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VWK501LL $00 $01
01: $75 $18
02: $09 $05 $01 $0A $0F $37
03: VW/Sk LL Serie Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VWK501LL 01.00 is 36 3D 3E 47
Sending Custom "Need Seed/Key?" block
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Saving EEPROM dump to WVWSP61J63W462238_____VWZ7Z0B6627486_$0000_eeprom.bin
Sending ReadEeprom block (Address: $0000, Count: $10)
Received "Read EEPROM Response" block: 00 02 04 60 00 00 00 00 00 00 00 00 00 00 00 00
Sending ReadEeprom block (Address: $0010, Count: $10)

 

[Nuje]

Args: COM5 10400 17 DumpEeprom 0 2048

Looks like you've saved your 2KB eeprom (that'd be the "DumpEeprom 0 2048") part of your command; do a search on your computer for VWZ7Z0B6627486_$0000_eeprom.bin - probably in the same folder as where kw1281test resides.

If you find it, then you know everything works as it should. Then you can start to edit the appropriate bytes.
Note that hatch unlock is done on Module 46 (not 17 - which is the instrument cluster). Edits in the instrument cluster are typically for getting around immobilizer issues, fuel economy readings, making the temp gauge read more linearly if you want to get really fancy.

 

[ekincaid]

The log looks like it worked. Confirm the file like Nuje suggests. Then try...

kw1281test COM5 9600 46 ReadEeprom 04352

It should return a value. Mine was 200

kw1281test COM5 9600 46 ReadEeprom 04353 and kw1281test COM5 9600 46 ReadEeprom 04354

should also return that value.

If so you are almost there....

Let us know what you get

 

[gmenounos]

Works with Vag Can Pro (translucid cable) and Galletto 1260 ?

Probably not. If I had that cable, I'd try it, but I don't have one.

 

[gmenounos]

I tried the syntax by 03TDICommuter in post 132 that didn't work for him and I am getting the below...too long to post all of it. Any ideas? At the moment all I'd like to do is to get my hatch to open with the doors and run away for a while, lol.

In your first post, it showed you running version 0.69-beta and then in your second post it showed you running version 0.67-beta. (not that it matters - they both should work).

I just tried it myself running 0.69-beta with a CCM on the bench and it worked, so not sure why it's not working for you. You could try disconnecting the battery for a minute and then try again just to see if that fixes it.

Version 0.69-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 46 ReadEeprom 04352
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0959799C 8A Komfortgerat HLO 0003
Software Coding 00258, Workshop Code: 01266
Sending Login block
Sending ReadEeprom block (Address: $1100, Count: $01)
Received "Read EEPROM Response" block: 29
Address 4352 ($1100): Value 41 ($29)
Sending EndCommunication block

 

[2002_auto_tdi]

Looks like you've saved your 2KB eeprom (that'd be the "DumpEeprom 0 2048") part of your command; do a search on your computer for VWZ7Z0B6627486_$0000_eeprom.bin - probably in the same folder as where kw1281test resides.

If you find it, then you know everything works as it should. Then you can start to edit the appropriate bytes.
Note that hatch unlock is done on Module 46 (not 17 - which is the instrument cluster). Edits in the instrument cluster are typically for getting around immobilizer issues, fuel economy readings, making the temp gauge read more linearly if you want to get really fancy.

Thanks, it did save the file. Is this file a backup of my settings in case I screw up?

 

[2002_auto_tdi]

The log looks like it worked. Confirm the file like Nuje suggests. Then try...

kw1281test COM5 9600 46 ReadEeprom 04352

It should return a value. Mine was 200

kw1281test COM5 9600 46 ReadEeprom 04353 and kw1281test COM5 9600 46 ReadEeprom 04354

should also return that value.

If so you are almost there....

Let us know what you get

It won't return a value.

C:\>kw1281test67 COM5 9600 46 ReadEeprom 04352
KW1281Test: Yesterday's diagnostics...Today.

Version 0.67-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 9600 46 ReadEeprom 04352
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Wrote 0xAA to port but echo was 0x01
Unhandled exception: System.InvalidOperationException: Wrote 0xAA to port but echo was 0x01
at BitFab.KW1281Test.KwpCommon.WriteByteAndDiscardEcho(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 193
at BitFab.KW1281Test.KwpCommon.WriteComplement(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 126
at BitFab.KW1281Test.KwpCommon.ReadAndAckByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 108
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 306
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 284
at BitFab.KW1281Test.KW1281Dialog..ctor(IKwpCommon kwpCommon, ControllerInfo& ecuInfo) in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 698
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 371
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 315
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 30

I did get close accidentally by specifying 0352 accidentally but could never duplicate it again:

Version 0.67-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 9600 46 ReadEeprom 0352
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0959799C 8A Komfortgerat HLO 0003
Software Coding 00258, Workshop Code: 01266
Sending Login block
Sending ReadEeprom block (Address: $0160, Count: $01)
EEPROM read failed
Sending EndCommunication block

 

[gmenounos]

Thanks, it did save the file. Is this file a backup of my settings in case I screw up?

That's a backup of your cluster (17) settings, which won't help you if you screw up your CCM (46) settings. But I think as long as you use ReadEeprom on the CCM and read each address and write down the result before you write to it, you should be able to put things back the way they were if necessary.

I'm thinking maybe I should enhance kw1281test to read and log the old value stored at the address before writing a new value to it so that you have an automatic backup (assuming you keep your kw1281test.log).

 

[2002_auto_tdi]

In your first post, it showed you running version 0.69-beta and then in your second post it showed you running version 0.67-beta. (not that it matters - they both should work).

I just tried it myself running 0.69-beta with a CCM on the bench and it worked, so not sure why it's not working for you. You could try disconnecting the battery for a minute and then try again just to see if that fixes it.

Version 0.69-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 46 ReadEeprom 04352
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0959799C 8A Komfortgerat HLO 0003
Software Coding 00258, Workshop Code: 01266
Sending Login block
Sending ReadEeprom block (Address: $1100, Count: $01)
Received "Read EEPROM Response" block: 29
Address 4352 ($1100): Value 41 ($29)
Sending EndCommunication block

Thanks, I will disconnect the battery for a minute and see what happens. Could use a trickle charge by now I am sure as well. I am running 6.7 because Windows suddenly decided to block 6.9.

 

[2002_auto_tdi]

That's a backup of your cluster (17) settings, which won't help you if you screw up your CCM (46) settings. But I think as long as you use ReadEeprom on the CCM and read each address and write down the result before you write to it, you should be able to put things back the way they were if necessary.

I'm thinking maybe I should enhance kw1281test to read and log the old value stored at the address before writing a new value to it so that you have an automatic backup (assuming you keep your kw1281test.log).

Thanks and valid points. I tried the same with 46 (just changed the 17) and cryptic error messages.

Just thought I would mention that before I disturb this rats nest on my lap to disconnect the battery. I wonder if there is something wrong with the CCM? Is there another number that I could try?


C:\>kw1281test67 COM5 10400 46 DumpEeprom 0 2048
KW1281Test: Yesterday's diagnostics...Today.

Version 0.67-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 10400 46 DumpEeprom 0 2048
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Caught: System.InvalidOperationException Unexpected sync byte: Expected $55, Actual $D5
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $D5
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 71
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 364
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 277
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 30

 

[2002_auto_tdi]

The error persists on 46 after disconnecting and reconnecting the battery.

Version 0.67-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM5 10400 46 DumpEeprom 0 2048
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port COM5
Sending wakeup message
Reading sync byte
Caught: System.InvalidOperationException Unexpected sync byte: Expected $55, Actual $D5
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $D5
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 71
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 364
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 277
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 30

 

[2002_auto_tdi]

Works fine for 56 (Radio). I wonder if VCDS can see 46.