kw1281test: A Free VDS-Pro / VagTacho Alternative

[ekincaid]

Maybe try 4800 then.

I probably won't have time to try the different baud rate for a few days. I do have a question though... Where are these error codes being stored?

If I understand correctly when I use the command

kw1281test.exe COM1 9600 15 ReadFaultCodes

I am requesting from controller address 15. The help doesn't mention this location

ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)

I don't mean to be a pain. Just trying to understand as best I can

 

[gmenounos]

Every control module in the car has a unique address. A diagnostic tool, such as kw1281test, needs to send out a wakeup command to the module's address to wake it up and start communicating with it. This page lists some of the most common module addresses: https://github.com/gmenounos/kw1281test/wiki

 

[Troyboy163]

thank you gmenounos! I got my new key working using kw1281test to retrieve the SKC. That was very easy to use. I'm not used to github things being straight forward

I used this cable with drivers found on the internet and windows 11

Amazon.com: VIMVIP VAG-COM KKL 409.1 OBD2 USB Cable Auto Scanner Scan Tool Compatible with Audi VW SEAT Volkswagen : Automotive

Buy VIMVIP VAG-COM KKL 409.1 OBD2 USB Cable Auto Scanner Scan Tool Compatible with Audi VW SEAT Volkswagen: Code Readers & Scan Tools - Amazon.com ✓ FREE DELIVERY possible on eligible purchases

www.amazon.com

semi off topic but if the SKC does not work in VCDS, its not the wrong code. You have to clear the fault codes in the cluster with VCDS prior to inputting the SKC and it will work fine. My case it was a aftermarket head unit. The cluster throws a code because its not communicating with the stock radio.

 

[gmenounos]

New version: https://github.com/gmenounos/kw1281test/releases/tag/v0.79-beta

• Added GetClusterId command to get the cluster Id (used by the radio to determine if it's been installed in a new vehicle).
• Some 1J0919 clusters have an SKC so added code to work with them.

GetClusterId, which doesn't appear in the official list of commands and doesn't have much use unless you're a VW radio , is used to retrieve the 16-bit cluster Id. Usage (note "3F" address instead of "17") :

.\kw1281test.exe COM1 10400 3F GetClusterId

More info here: https://github.com/mnaberez/vwradio/blob/main/reverse_engineering/delco/vw_premium_5/kwp1281_0x3f.md

 

[touaregv10tdi]

I did everything I could using vag commander I cant retrieve my SKC key. When I connect to the car , select engine then read EEPROM
I get response saying cannot connect to device.

 

[gmenounos]

I did everything I could using vag commander I cant retrieve my SKC key. When I connect to the car , select engine then read EEPROM
I get response saying cannot connect to device.

Ah, which car in your fleet are you talking about? Also, this thread is mostly about kw1281test, not VAG Commander, so it might be worth creating a new thread for the issue you're having.

 

[touaregv10tdi]

This is about my 2000 Beetle tdi. I need to get the KSC cluster pin code.

 

[BobnOH]

You've come to the right place. To read the SKC (now called Secret Code) go back to Post #1.

 

[silverfox64]

Hello cordial greeting, I wish, first thank for this great program, and second please if you could put support for Immobox, 377 953 257 A, with memory 93c56, VW Pointer, (in Mexico) in Brazil, Parathi, and Valeo Immobox, (Vag PN: 6x0953257) With Memory 24C04, Derby, for thanksgiving, a hug from Mexico. And it worked very well in a Clasico 2013 VDO V75, to retrive Pin code (Mexico).

 

[gmenounos]

Hello cordial greeting, I wish, first thank for this great program, and second please if you could put support for Immobox, 377 953 257 A, with memory 93c56, VW Pointer, (in Mexico) in Brazil, Parathi, and Valeo Immobox, (Vag PN: 6x0953257) With Memory 24C04, Derby, for thanksgiving, a hug from Mexico. And it worked very well in a Clasico 2013 VDO V75, to retrive Pin code (Mexico).

As far as I know, there isn't a known way to retrieve the SKC from dedicated immobilizer boxes via a KKL cable. You have to open the box and read the EEPROM with a hardware device. If someone knows differently, let me know.

 

[gmenounos]

Since this thread is now sticky, I added a small FAQ to the first post.

 

[silverfox64]

As far as I know, there isn't a known way to retrieve the SKC from dedicated immobilizer boxes via a KKL cable. You have to open the box and read the EEPROM with a hardware device. If someone knows differently, let me know.

Hello cordial greeting, precisely with the vagtacho, you can extract the pin code, attached a PDF, Vagtacho pin code Pointer, from how to extract it with the vagtacho, for the attention thank you.

 

[gmenounos]

Hello cordial greeting, precisely with the vagtacho, you can extract the pin code, attached a PDF, Vagtacho pin code Pointer, from how to extract it with the vagtacho, for the attention thank you.

That's good to know, but it's for a Kostal immo box, which I don't have and can't even find here in the US.

 

[silverfox64]

That's good to know, but it's for a Kostal immo box, which I don't have and can't even find here in the US.

Thank you very much for answering, but it is also for immobox "Megamos", transponder (ID48), but if you can't, i appreciate the attention anyway, a hug from Mexico.

 

[ekincaid]

I think so. The following command will read the airbag fault codes (Replace "COM1" with your actual COM port):

.\kw1281test.exe COM1 9600 15 ReadFaultCodes

The following command should clear the airbag fault codes:

.\kw1281test.exe COM1 9600 15 ClearFaultCodes

The current version (0.76-beta) of kw1281test has a bug so it'll give you this error:

Sending ClearFaultCodes block
Caught: System.InvalidOperationException ClearFaultCodes returned 2 blocks instead of 1

But it should still clear the fault codes and hopefully reset your airbag light.

@gmenounos It took me a lot longer to get back to this than I hoped. Everything worked great. Had to use a baud rate of 10400. Thanks.

 

[locarno]

It is possible to read and write MagnetiMarelli IAW4 ECU with this tool? Part number 036906034bb

 

[gmenounos]

It is possible to read and write MagnetiMarelli IAW4 ECU with this tool? Part number 036906034bb

You should be able to connect, read the identification info and read/clear DTCs, but that's about it. kw1281test only supports reading the EEPROM and getting the SKC from EDC15 ECUs. It doesn't currently support writing to any ECUs other than clearing DTCs and changing adaptation/coding.

 

[scooter133uk]

Reading lots and trying lots but getting these errors, any ideas?

Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920905F KOMBI+WEGFAHRS. M73 V03
Software Coding 05412, Workshop Code: 00000
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
AdaptationRead CHANNEL [LOGIN]
CHANNEL = Channel number (0-99)
LOGIN = Optional login (0-65535)
AdaptationSave CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
AdaptationTest CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
BasicSetting GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
ClarionVWPremium4SafeCode
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpEdc15Eeprom [FILENAME]
FILENAME = Optional filename
DumpEeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRBxMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
FindLogins LOGIN
LOGIN = Known good login (0-65535)
GetSKC
GroupRead GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadRAM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadROM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
ToogleRB4Mode
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)
Sending EndCommunication block
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Caught: System.UnauthorizedAccessException Access to the path 'COM2' is denied.
Unhandled exception: System.UnauthorizedAccessException: Access to the path 'COM2' is denied.
at System.IO.Ports.SerialStream..ctor(String , Int32 , Parity , Int32 , StopBits , Int32 , Int32 , Handshake , Boolean , Boolean , Boolean , Byte )
at System.IO.Ports.SerialPort.Open()
at BitFab.KW1281Test.Interface.GenericInterface..ctor(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 23
at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 399
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 232
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Caught: System.UnauthorizedAccessException Access to the path 'COM2' is denied.
Unhandled exception: System.UnauthorizedAccessException: Access to the path 'COM2' is denied.
at System.IO.Ports.SerialStream..ctor(String , Int32 , Parity , Int32 , StopBits , Int32 , Int32 , Handshake , Boolean , Boolean , Boolean , Byte )
at System.IO.Ports.SerialPort.Open()
at BitFab.KW1281Test.Interface.GenericInterface..ctor(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 23
at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 399
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 232
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Caught: System.UnauthorizedAccessException Access to the path 'COM2' is denied.
Unhandled exception: System.UnauthorizedAccessException: Access to the path 'COM2' is denied.
at System.IO.Ports.SerialStream..ctor(String , Int32 , Parity , Int32 , StopBits , Int32 , Int32 , Handshake , Boolean , Boolean , Boolean , Byte )
at System.IO.Ports.SerialPort.Open()
at BitFab.KW1281Test.Interface.GenericInterface..ctor(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 23
at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 399
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 232
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Caught: System.UnauthorizedAccessException Access to the path 'COM2' is denied.
Unhandled exception: System.UnauthorizedAccessException: Access to the path 'COM2' is denied.
at System.IO.Ports.SerialStream..ctor(String , Int32 , Parity , Int32 , StopBits , Int32 , Int32 , Handshake , Boolean , Boolean , Boolean , Byte )
at System.IO.Ports.SerialPort.Open()
at BitFab.KW1281Test.Interface.GenericInterface..ctor(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 23
at BitFab.KW1281Test.Program.OpenPort(String portName, Int32 baudRate) in C:\Users\gmeno\src\kw1281test\Program.cs:line 399
at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 232
at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920905F KOMBI+WEGFAHRS. M73 V03
Software Coding 05412, Workshop Code: 00000
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
AdaptationRead CHANNEL [LOGIN]
CHANNEL = Channel number (0-99)
LOGIN = Optional login (0-65535)
AdaptationSave CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
AdaptationTest CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
BasicSetting GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
ClarionVWPremium4SafeCode
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpEdc15Eeprom [FILENAME]
FILENAME = Optional filename
DumpEeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRBxMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
FindLogins LOGIN
LOGIN = Known good login (0-65535)
GetSKC
GroupRead GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadRAM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadROM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
ToogleRB4Mode
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)
Sending EndCommunication block

 

[gmenounos]

Reading lots and trying lots but getting these errors, any ideas?

Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
...
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 9600 17 DumpBeetleMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: en-GB
Opening serial port COM2
Caught: System.UnauthorizedAccessException Access to the path 'COM2' is denied.

There is no DumpBeetleMem command. Well there used to be, but it's now named DumpMarelliMem because there are other cars such as Audi TT that use the same command. So you should try:

.\kw1281test.exe COM2 9600 17 DumpMarelliMem 3072 1024

.\kw1281test.exe COM2 9600 17 DumpMarelliMem 14336 2048

and see if either of those commands work. Please report back if either one does.

Not sure what's causing the "System.UnauthorizedAccessException Access to the path 'COM2' is denied." error. Any chance you had the 2 programs trying to access COM2 at the same time? Or maybe ran kw1281test when the cable wasn't plugged in?

 

[scooter133uk]

There is no DumpBeetleMem command. Well there used to be, but it's now named DumpMarelliMem because there are other cars such as Audi TT that use the same command. So you should try:

.\kw1281test.exe COM2 9600 17 DumpMarelliMem 3072 1024

.\kw1281test.exe COM2 9600 17 DumpMarelliMem 14336 2048

and see if either of those commands work. Please report back if either one does.

Not sure what's causing the "System.UnauthorizedAccessException Access to the path 'COM2' is denied." error. Any chance you had the 2 programs trying to access COM2 at the same time? Or maybe ran kw1281test when the cable wasn't plugged in?

Cheers for fast reply. I got a bin file, how do I get the SKC now pls? I have loaded it into Hxd but not sure where I'm looking now.

bin file
V03905F ÿ ÿÿÿÿÿÿ04 ÿÿ*H Bx{ÿÿÿÿÿÿÿÿÿÿÿ - % %ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿhÿÿÿÿÿÿÿÿÿÿÿÿ‡ÿÿÿ2 Bÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¼ ÿÿ ³ÿ
8\yžÙ)YxšÁÞ 5Dÿÿÿÿÿÿ «5Îi0ÜÓ‡LG ¾ ¾ ¾ÿÿÿÿÿÿ 55ÿÿ ´~#¸(Š–¼ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ10//231102110.-/-00,.,,+1ÿÿÿ#ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ* $"9$ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿh †+X þ°
ò A – ï0ÿyþÔþ§ÿïÿÿÿÿOÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿèÿÿÿÿÿÿÿÿ ƒ¥ƒ«ìƒ²Ðƒ¹´ƒÀ˜ƒÇ|ƒÎ`ƒÕDƒÜ(ƒãƒéðƒðÔƒ÷¸ƒþœ„€„d„H„,„!„'ô„.Ø„5¼„< „C„„Jh„QL„X0„_„eø„lÜ„sÀ„z¤„ˆ„ˆl„P„–4ƒ—@ƒž$÷|Z÷÷|T÷|M/÷|FK÷|?g÷|8ƒ÷|1Ÿ÷|*»÷|#×÷|ó÷|÷|+÷|G÷|c÷{ú÷{ó›÷{ì·÷{åÓ÷{Þï÷{Ø÷{Ñ'÷{ÊC÷{Ã_÷{¼{÷{µ—÷{®³÷{§Ï÷{ ë÷{š÷{“#÷{Œ?÷{…[÷{~w÷{w“÷{p¯÷{iË÷|h¿÷|aÛÿ]ÿÿÿX¬§S¹ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿZ3262386ÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

 

[gmenounos]

Cheers for fast reply. I got a bin file, how do I get the SKC now pls? I have loaded it into Hxd but not sure where I'm looking now.

bin file
V03905F ÿ ÿÿÿÿÿÿ04 ÿÿ*H Bx{ÿÿÿÿÿÿÿÿÿÿÿ - % %ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿhÿÿÿÿÿÿÿÿÿÿÿÿ‡ÿÿÿ2 Bÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¼ ÿÿ ³ÿ
8\yžÙ)YxšÁÞ 5Dÿÿÿÿÿÿ «5Îi0ÜÓ‡LG ¾ ¾ ¾ÿÿÿÿÿÿ 55ÿÿ ´~#¸(Š–¼ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ10//231102110.-/-00,.,,+1ÿÿÿ#ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ* $"9$ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿh †+X þ°
ò A – ï0ÿyþÔþ§ÿïÿÿÿÿOÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿèÿÿÿÿÿÿÿÿ ƒ¥ƒ«ìƒ²Ðƒ¹´ƒÀ˜ƒÇ|ƒÎ`ƒÕDƒÜ(ƒãƒéðƒðÔƒ÷¸ƒþœ„€„d„H„,„!„'ô„.Ø„5¼„< „C„„Jh„QL„X0„_„eø„lÜ„sÀ„z¤„ˆ„ˆl„P„–4ƒ—@ƒž$÷|Z÷÷|T÷|M/÷|FK÷|?g÷|8ƒ÷|1Ÿ÷|*»÷|#×÷|ó÷|÷|+÷|G÷|c÷{ú÷{ó›÷{ì·÷{åÓ÷{Þï÷{Ø÷{Ñ'÷{ÊC÷{Ã_÷{¼{÷{µ—÷{®³÷{§Ï÷{ ë÷{š÷{“#÷{Œ?÷{…[÷{~w÷{w“÷{p¯÷{iË÷|h¿÷|aÛÿ]ÿÿÿX¬§S¹ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿZ3262386ÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ1#A`v”¶KÕ]KŒìeKŽ²ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Can you upload the .bin file as an attachment? (use the "Attach files" button)

 

[scooter133uk]

Can you upload the .bin file as an attachment? (use the "Attach files" button)

I don't have an attach files button....mmmm

I noticed in the bin files I couldn't search for AUZ5Z either.

 

[gmenounos]

I don't have an attach files button....mmmm

I noticed in the bin files I couldn't search for AUZ5Z either.

You can email it to me. You can find my email on this page: https://github.com/gmenounos

 

[scooter133uk]

You can email it to me. You can find my email on this page: https://github.com/gmenounos

email sent

 

[gmenounos]

I think your SKC is 07353

 

[scooter133uk]

I think your SKC is 07353

View attachment 127427

Cheers, it didn't work. Will give up for now. Thanks for all your time. S

 

[krook]

Hey! I have a new-to-me Audi A4 that has a rather rare 920 white background cluster. As far as I know, it's a VDO make. My problem is that it does not light up when I twist the ignition, only when I turn the lights on. I know this can be fixed by AudiDashEdit, but I can't seem to read (let alone write) the EEPROM of the cluster. I tried VAG Eeprom programmer 1.19 and kw1281test 0.79 but none of those can seem to read the cluster. Can you help me? I tried 8400, 9600 speeds as well, but they crashed even earlier. The only way I got a response was by using 10400. I also tried DumpMarelliMem, but that doesn't work either.

Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0
OSVersion: Microsoft Windows NT 10.0.22000.0
.NET Version: 6.0.9
Culture: en-US
Opening serial port COM2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8D0920932C B5-KOMBIINSTR. VDO D12
Software Coding 00140, Workshop Code: 50311
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
Cluster did not return software version.
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.
Sending ReadEeprom block (Address: $0000, Count: $01)
EEPROM read failed
Sending EndCommunication block

Thanks in advance!

 

[gmenounos]

Hey! I have a new-to-me Audi A4 that has a rather rare 920 white background cluster. As far as I know, it's a VDO make. My problem is that it does not light up when I twist the ignition, only when I turn the lights on. I know this can be fixed by AudiDashEdit, but I can't seem to read (let alone write) the EEPROM of the cluster. I tried VAG Eeprom programmer 1.19 and kw1281test 0.79 but none of those can seem to read the cluster. Can you help me? I tried 8400, 9600 speeds as well, but they crashed even earlier. The only way I got a response was by using 10400. I also tried DumpMarelliMem, but that doesn't work either.

Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0
OSVersion: Microsoft Windows NT 10.0.22000.0
.NET Version: 6.0.9
Culture: en-US
Opening serial port COM2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8D0920932C B5-KOMBIINSTR. VDO D12
Software Coding 00140, Workshop Code: 50311
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
Cluster did not return software version.
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.
Sending ReadEeprom block (Address: $0000, Count: $01)
EEPROM read failed
Sending EndCommunication block

Thanks in advance!

DumpMarelliMem won't work because your cluster is made by VDO: "ECU: 8D0920932C B5-KOMBIINSTR. VDO D12"

It's not likely that I can add support for that cluster because it seems different than any of the other ones that kw1281test supports. Maybe if someone sends me one, I could do it...

Your best bet might be to get an EEPROM programmer, take apart the cluster and physically read/write the EEPROM as described here: https://www.drive2.com/l/527235342923726903/

 

[krook]

DumpMarelliMem won't work because your cluster is made by VDO: "ECU: 8D0920932C B5-KOMBIINSTR. VDO D12"

It's not likely that I can add support for that cluster because it seems different than any of the other ones that kw1281test supports. Maybe if someone sends me one, I could do it...

Your best bet might be to get an EEPROM programmer, take apart the cluster and physically read/write the EEPROM as described here: https://www.drive2.com/l/527235342923726903/

Thanks! Since this amazing tool is open source and I am a programmer myself too, I might go ahead and try to add support for this cluster myself. Will definitely send a pull request if I succeed. Do you have some pointers on how you would get started if you had this cluster at your hand? In the meantime, I do have an eeprom writer and will try to get it done that way.

 

[gmenounos]

Do you have some pointers on how you would get started if you had this cluster at your hand?

I have a bench setup where I can connect the various control units to a battery. I also have a couple of old laptops and a logic analyzer ( https://usd.saleae.com/products/saleae-logic-pro-8 but something much cheaper like this would probably also work: https://www.sparkfun.com/products/18627 )
I then use some of the commercial tools to communicate with a control unit while recording what happens on the K-Line using the logic analyzer. Then based on what I see on the K-Line, I can often work out what commands to send to the control unit to retrieve the SKC.

You will need to understand the KWP1281 protocol (and also sometimes KWP2000) in order to understand what you're seeing on the K-Line. Here's a good reference: something like this might work: https://www.blafusel.de/obd/obd2_kw1281.html

Sometimes it's pretty easy. Reverse engineering how VDS-Pro talks to the CCM to change bytes in the EEPROM was straightforward as there's not much security.

Other times, such as unlocking VDO clusters, there's a cryptographic challenge/response. Just seeing the 4-byte challenge (which is random and changes every time) from the cluster and the 4-byte response from the tool doesn't give much insight on how to calculate the response from the challenge. To figure that one out, I had to download the ROM from a VDO cluster and then spend many hours disassembling it to figure that out.

I reverse engineered how to unlock the Bosch RB8 cluster challenge/response without access to the cluster ROM. For that one, I wrote a simulator that pretended to be an RB8 cluster. I then tried to unlock the cluster with a commercial tool by sending sequential challenges from the simulator while observing how the responses from the tool changed for each one. Eventually I had enough challenge/response pairs to work out how to calculate the response from the challenge. Luckily the algorithm was much simpler than the one used by VDO clusters. Otherwise it would have been too hard to figure out.

For Marelli clusters and Bosch EDC15 ECUs, I observed that the commercial tools sent a big block of binary data to the control units to unlock them. That turned out to be a small program that the control units execute. Since kw1281test is open source, I didn't want to have it sending obscure binary data with no source code, so I downloaded the data sheets for the processors used in those control units and disassembled the binary data to understand what the programs were doing. Then I made some improvements to the programs and built them into kw1281test. If you read the kw1281test source code, you can read the assembly code that is downloaded to the Marelli clusters and Bosch ECUs to in order to read the EEPROMS.