kw1281test: A Free VDS-Pro / VagTacho Alternative

[cowboy_]

logfile

this link is to the logfile.

 

[gmenounos]

Looks like you're using the wrong baud rate. Clusters are usually 10400. So try:

kw1281test com2 10400 17 ReadIdent

Just to see if it can connect to the cluster and read the identification info.

 

[cowboy_]

Progress?


Version 0.71-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 ReadIdent
OSVersion: Microsoft Windows NT 10.0.22543.0
.NET Version: 6.0.0
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32 timeout)
at System.IO.Ports.SerialStream.ReadByte()
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 33
at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte b) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 110
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 91
at BitFab.KW1281Test.Program.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Program.cs:line 364
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 325
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 30

 

[gmenounos]

It looks like that cluster is speaking KW 2000 protocol instead of KW 1281, like most MKIV clusters. kw1281test mostly understands KW 1281 (hence the name ). I searched for your cluster part number on eBay and the sticker on the back says RB8. Now kw1281test can read the EEPROM of some Bosch RB8 clusters, but I have no idea how different the Phaeton clusters are.

You can try the following and maybe it will dump the EEPROM:

kw1281test com2 10400 17 DumpRB8Eeprom 66560 1024

But as always, trying this on an untested cluster is at your own risk. RB8 clusters are a lot more finicky than VDO clusters. If the cluster misbehaves after, you may need to disconnect your battery for a minute.

 

[cowboy_]

Gotcha. I might give it a try anyway as I need to get the SKC from the cluster as it is almost useless as it is. On Phaetons the cluster is the CAN Gateway so if this doesn't work correctly you need a new one, and a new one costs $1000 and the dealership cost to program it. Trying DESPERATELY to avoid this so even if this behaves incorrectly I have no other choice than bitting the bullet and getting a new one.

Thank you SO much for your time and help on this matter!!!!

 

[gmenounos]

I just did enough reading about C# to sort out how to publish linux binaries instead of me only running "dotnet run" in the source directory up until now.

---

Finally, that raises a question about the hidden but still there DumpClusterNecRom command I have:

I know it's meant for the full FIS daughterboard ROM that the W8 Passat cluster has, but, is this command suitable for the Half-FIS clusters that also have daughterboards? If that's not known, I've 2 or 3 clusters are out of their housings, if there's chips to be identified, to say yea or nay.

I'm happy to start including non-RaspberryPi Linux binaries with kw1281test releases. Up until now, I didn't think anyone was interested.

Supposedly DumpClusterNecRom will dump the entire ROM on half-FIS (aka MFA) clusters, but only half the ROM on FIS clusters. There's supposed to be a way to get the other half of the FIS ROM by writing something to the NEC daughterboard RAM, but I don't have enough info to do it yet.

I have in my notes that the NEC microcontroller might be a µPD784036. Not sure where I got that info from.

 

[ChrstphrR]

I'm happy to start including non-RaspberryPi Linux binaries with kw1281test releases. Up until now, I didn't think anyone was interested.

Supposedly DumpClusterNecRom will dump the entire ROM on half-FIS (aka MFA) clusters, but only half the ROM on FIS clusters. There's supposed to be a way to get the other half of the FIS ROM by writing something to the NEC daughterboard RAM, but I don't have enough info to do it yet.

I have in my notes that the NEC microcontroller might be a µPD784036. Not sure where I got that info from.

A) If you want to include linux x64 binaries, go ahead. Maybe it'll help snag another user or two!

Myself, I am pulling sources off github using git. Up until I replied with a write-up on how to find the serial number, I didn't know how to compile linux binaries. I just dug and read a little, so I could assure that running the proper serial number using the binary was identical to the behaviour I had running from the source directory with "dotnet run".

B) Ah, that's useful info about the NEC dump command. I'll note that for my W8 cluster now, that it's not the full monty for the display ROM.
The half-rom I dumped then was 64 kb. Sure seems like a lot of data for what little the FIS does display...

Tomorrow I'll dig out the few Half FIS clusters to test. I'll try dumping, and I'll do my best to note down what each cluster is (part number, serial number, NEC chip info etched on it, logs, etc.)

Offhand, I know one's from a Passat, and the other two are from Mk4 City Golf or Jetta automatics.


Also, thank you for pointing out my error about only the FTDI cable being an option - I edited my prior post so I don't lead people astray. I'll have to test the CH340 chipped cables on my win10 laptop, in case I have to mess with a cluster in car while the desktop is busy with another on the bench.

 

[pkhoury]

Question - what's the purpose of the EDC15 dump portion of the program? I tried using it, and the best I get is 512 bytes, not 512kbytes. I ended up buying an MPPS device to get a full dump of my EDC15, anyways, but is this functionality that might be incorporated into kw1281test in the future?

 

[caffeine]

Question - what's the purpose of the EDC15 dump portion of the program? I tried using it, and the best I get is 512 bytes, not 512kbytes. I ended up buying an MPPS device to get a full dump of my EDC15, anyways, but is this functionality that might be incorporated into kw1281test in the future?

It dumps the EEPROM from the ECU, which contains the SKC (if IMMO 3), immobilizer status, and vehicle mileage, among other things. MPPS is not able to dump the EEPROM.

 

[caffeine]

I don't suppose it would be possible to add support for Audi C5 A6 clusters? I just picked up a project ('03 Allroad that's going to get a BHW and 02X) and it would be nice if I could just convert the stock cluster to TDI-spec.

 

[gmenounos]

I don't suppose it would be possible to add support for Audi C5 A6 clusters? I just picked up a project ('03 Allroad that's going to get a BHW and 02X) and it would be nice if I could just convert the stock cluster to TDI-spec.

I don't own any Audi clusters, so I don't have any easy way to add support for them. I have added support for some cluster part numbers that I don't own, but those have been ones that were very similar to ones that I do own (e.g., MKIV VDO clusters with different ROM versions than what I have here). You're welcome to try it with an Audi cluster and see what happens. If it doesn't work, there's a chance I can figure out why.

 

[gmenounos]

New version: https://github.com/gmenounos/kw1281test/releases/tag/v0.72-beta

• Added GetSKC support for (at least some) BOO clusters. If you have a Motometer BOO cluster, I'd appreciate it if you could test out the GetSKC command on your cluster.
• I'm now including a pre-built Linux-x64 binary. Please let me know if it works.
• I'm (at least temporarily) dropping the pre-built Raspberry Pi (Linux Arm64) binary since I doubt anyone was using it.
• Improved support for Bosch RB8 clusters. It should be able to unlock the cluster on the first try every time now.

 

[ChrstphrR]

• I'm now including a pre-built Linux-x64 binary. Please let me know if it works

Tested the linux-x64 binary - works fine that I can tell - no different from what I did, except it's one large monolithic file versus the many files and dependent directories the way I naively compiled up.

 

[cristian7477]

Everything worked successfully with the VAG K+CAN Commander cable on my Brazilian 2003 Polo 9N HB, it had a factory value of 04361 04362 04363 at 138 and I changed it to 130 and now i can control the windows from outside

What other changes do you recommend?

C:\Users\crist\Desktop>kw1281test.exe COM1 9600 46 WriteEeprom 04361 130
KW1281Test: Yesterday's diagnostics...Today.

Version 0.72-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 9600 46 WriteEeprom 04361 130
OSVersion: Microsoft Windows NT 10.0.19043.0
.NET Version: 6.0.2
Culture: es-CL
Opening serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Q0959433E  2D Komfortgerat     0001
Software Coding 00258, Workshop Code: 11111
Sending Login block
Sending WriteEeprom block (Address: $1109, Values: $82
Received "Write EEPROM Response" block: 01 11 09 82
Sending EndCommunication block

 

[Nuje]

Look at addresses 4352, 4353, 4354 - you can edit those so that the hatch unlocks and stays unlocked whenever you unlock the doors.

 

[punkassjim]

I apologize for the brief tangent, but I keep reading about this "trunk locks/unlocks with doors" mod, and I can't wrap my head around how that even works, physically. The solenoid that lives in my trunk is a two-wire, one function motor: apply current, and it pulls for a second, then it releases. My solenoid came from a Jetta, but from what I've seen, I thought the Golf used the same kind of solenoid: two wires, one direction of pull. Does anyone know where I can find a diagram or detailed explanation? I've searched, and I'm coming up empty.

Disclaimer: I drive a mk3 GTI with a full electronics swap from a mk4 Jetta. I'd love to recode my CCM to allow the trunk-unlock-with-doors thing, but in order to do that I'd need to rig up a dual-state lock/unlock mechanism in my hatch, but with only a single-pull solenoid to choose from. Is that impossible? Or more likely to result in a trunk that unlocks from the remote for one second, then re-locks?

EDIT: never mind, I think I figured it out. Pulled the hatch solenoid from a junkyard Golf today, and while it looks the same, it’s not. Two wires, but the pulling arm is not springloaded, whereas the Jetta one is. So I assume I’ll need to recode my CCM from Jetta to Golf. And, when I enable the “lock/unlock with doors” feature, it’ll somehow reverse the solenoid when I hit the lock button? That part is still unclear.

 

[Nuje]

Yes and yes.
The way a Golf normally works is that the solenoid pushes one way to unlock, then waits for a few seconds, before "firing" to move the plunger in the other direction to put it back into the locked position.

Recoding simply stops the CCM from automatically sending that second signal after a few seconds, and instead, only does so when you send the signal (key fob or interior lock buttons) to lock the doors.

 

[punkassjim]

Recoding simply stops the CCM from automatically sending that second signal after a few seconds, and instead, only does so when you send the signal (key fob or interior lock buttons) to lock the doors.

Awesome, thanks. Now I'll just need to figure out what coding to change so my car thinks it's a hatchback, rather than a sedan. I figure the wiring doesn't change, it just needs to send that reverse-polarity pulse for re-locking.

 

[punkassjim]

Alright, more on topic. I'm trying to run kw1281test (precompiled MacOS binary) on an M1 MacBook Air. When I run the ReadIdent command, I get the following:

jim@air SKC % ./kw1281test AB5P37BA 10400 17 ReadIdent
KW1281Test: Yesterday's diagnostics...Today.

Version 0.72-beta (https://github.com/gmenounos/kw1281test/releases)
Args: AB5P37BA 10400 17 ReadIdent
OSVersion: Unix 12.1.0
.NET Version: 6.0.2
Culture: en-US
Caught: System.ComponentModel.Win32Exception Permission denied
Unhandled exception: System.ComponentModel.Win32Exception (13): Permission denied
   at System.Diagnostics.Process.set_PriorityClassCore(ProcessPriorityClass )
   at System.Diagnostics.Process.set_PriorityClass(ProcessPriorityClass )
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 64
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 25
jim@air SKC %

I've got a KKL cable from eBay (the one that Greg confirmed works), the D2XX driver installed, and D2XX Helper. Not sure why it's throwing a Win32 exception on a Mac.

 

[gmenounos]

It's trying to bump up the process priority because the code used to wake up a module is very finicky about timing. If something else is running on the computer with the same or higher priority, kw1281test may get interrupted during the wake-up procedure and the wake-up could fail. Probably not much of an issue on newer, faster machines, but this did help my old Dell D630 laptop (Core 2 Duo) wake modules up more reliably. On Windows, if you don't have permissions to raise the process priority, the code will silently fail but kw1281test will continue running. It sounds like MacOS has different behavior. For now, you can try running it with sudo and see if that works around it. I'll add some code to the next release to ensure that it doesn't fail on MacOS when run with non-root privileges.

 

[punkassjim]

Nice. I restarted the machine (just in case), ran the command with sudo, and it worked a treat, SKC acquired. Thanks! Gonna do some mods tomorrow.

 

[Nuje]

I'm trying to run .... on an M1 MacBook Air

Off-topic, I know, but in addition to running kw1281test, (and much to my pleasant surprise), it's possible to run VCDS on an M1 Mac (both VMware Fusion and Parallels have means of installing Windows11-ARM, and then Win11-ARM has an emulation layer that can run x64 apps).
For whatever reason, I've always found it easier to run kw1281test in Windows, even though I'm a Mac person going back decades.

 

[punkassjim]

Any idea why I'm running into this issue? Whatever address I try to read in my CCM, I get $FF as the stored value. Doesn't seem like it's a communication issue. The mod spreadsheets I've seen in this thread seem to reference 1C0 CCM modules…is dealing with a 1J0 unit decidedly different?

Version 0.72-beta (https://github.com/gmenounos/kw1281test/releases)
Args: AB5P37BA 9600 46 DumpEeprom 4361 3
OSVersion: Unix 12.1.0
.NET Version: 6.0.2
Culture: en-US
Opening FTDI serial port AB5P37BA
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799AJ 61 Zentral-SG Komf. 0001
Software Coding 00257, Workshop Code: 00066
Sending Login block
Saving EEPROM dump to ccm_eeprom_$1109.bin
Sending ReadEeprom block (Address: $1109, Count: $03)
Received "Read EEPROM Response" block: FF FF FF
Saved EEPROM dump to ccm_eeprom_$1109.bin
Sending EndCommunication block

 

[Nuje]

Yes - different CCMs have different applicable memory addresses.
For 1J0959799, try 04280, 04286, and 04292.

 

[punkassjim]

Yes - different CCMs have different applicable memory addresses.
For 1J0959799, try 04280, 04286, and 04292.

Awesome, will do. Is there a reference chart somewhere for noteworthy 1J0 addresses? I reread this entire post history today in search of a relevant reference, and had no luck. See attached for the items I'm interested in modifying.

 

[Nuje]

Awesome, will do. Is there a reference chart somewhere for noteworthy 1J0 addresses? I reread this entire post history today in search of a relevant reference, and had no luck. See attached for the items I'm interested in modifying.

On that spreadsheet you screenshotted, look at the very bottom left - there's another tab on the spreadsheet for 1J0 CCMs.

 

[punkassjim]

On that spreadsheet you screenshotted, look at the very bottom left - there's another tab on the spreadsheet for 1J0 CCMs.

OH HEY! hahaha, thanks, I guess I just needed fresh eyes.

 

[punkassjim]

Thanks again, Nuje, I was able to get remote windows working. Now to see if anyone wants my old AlienWindow controller.

I was able to successfully recode for trunk unlock with doors, BUT, sadly, my unique situation made it a failure. The guts of my car are from a 2001 NA Jetta Wolfsburg (4dr), but the chassis it's in is a '97 NA GTI (2dr). I replaced my single-state Jetta trunk popper with a two-state mk4 Golf hatch solenoid, which should pull to unlock, and push to lock. But when I enabled unlock-hatch-with-doors, it doesn't behave as expected. Pressing unlock on the remote doesn't impact the hatch solenoid at all, while pressing lock makes the solenoid pull (not push). If it did something on unlock, I could at least work with that. But it doesn't. Guess I'll need to consult some wiring diagrams to see if there are differences between Golf and Jetta hatch solenoid wiring.

I did try flipping the bits — shown in the marked up spreadsheet I posted above — that (purportedly) are for car type, number of doors, and hatch unlock type. Didn't help. I didn't flip the bits for "wagon," but I may try that. And I was HOPING that this endeavor would fix a long-standing problem I've had: since the donor car was a 4dr, and my GTI is a 2dr, there's always been a 1-second delay between locking and the confirmation beep. Was hoping I could convince the CCM that this is a 2dr vehicle, so that problem would go away. I'll hold out hope for finding different bits to flip that just aren't documented yet.

Anyone know if there are any cool mods to do on an immo-2 cluster? From what I've read, needle sweep and lit needles are only an option on immo-3 clusters.

 

[caffeine]

Anyone know if there are any cool mods to do on an immo-2 cluster? From what I've read, needle sweep and lit needles are only an option on immo-3 clusters.

If you currently have an IMMO2 cluster, you should be able to install an IMMO3 cluster as they are backwards compatible.

 

[punkassjim]

Ah. Found it. Golf/Jetta have slightly different wiring to the trunk popper. That's an easy fix. I'm sure the new coding will work fine after I get that sorted.