kw1281test: A Free VDS-Pro / VagTacho Alternative

[punkassjim]

An Immo3 cluster will work fine with an Immo2 ECU (but not the other way around).

Ok thanks, so if I do this, and in the future I need to swap my ECU (with another immo-2 ECU), will I still use the ECU swap procedure for immo-2? Or will something about the procedure change?

To get the door open indicator, you'll also need a 1C0 CCM and the 'comfort CAN' wiring to the cluster. Besides that, it should be more-or-less plug and play. I have an IMMO 3 FIS cluster in my '00 along with a 1C0 CCM, but stock IMMO2 ECU. B5.5 Passat clusters are also compatible if you flash them with a Mk4 cluster dump and swap the Mk4 lens/gauge faces over (they're a bit cheaper to source usually).

Ok, sounds reasonable. And yeah, I figured Passat GLX would be my best bet. What’s the best way to acquire a compatible mk4 cluster dump? Would it need to be from a certain part number range? I assume most B5.5 Passats with FIS will be running VWK503MH, no? Is that a good thing, or would finding one with VWK501MH software be better for any reason?

Oh, a few other things:

• for the DSG swap, I’ll need to recode the cluster (0x065 changes from 80 to 81) to take vehicle speed signal from the ABS data on the CAN bus. Greg, I think I’ve seen that this can be done with kw1281test…am I remembering correctly?
• My ECU and cluster each need a bit flipped to enable auto transmission, correct? Quote from someone who’s done it: “Address 1B6 orginal value in my clocks was 15. If you plan to do a AWD conversion then you need to change the 1 to a 9 to see the AWD module in the CAN Gateway. If not, leave 1 for FWD. To change from manual to DSG then change the 5 to a 7.”

Thanks y’all for even taking the time to read this. I know it’s a challenge.

 

[caffeine]

Ok thanks, so if I do this, and in the future I need to swap my ECU (with another immo-2 ECU), will I still use the ECU swap procedure for immo-2? Or will something about the procedure change?


Ok, sounds reasonable. And yeah, I figured Passat GLX would be my best bet. What’s the best way to acquire a compatible mk4 cluster dump? Would it need to be from a certain part number range? I assume most B5.5 Passats with FIS will be running VWK503MH, no? Is that a good thing, or would finding one with VWK501MH software be better for any reason?

Oh, a few other things:

• for the DSG swap, I’ll need to recode the cluster (0x065 changes from 80 to 81) to take vehicle speed signal from the ABS data on the CAN bus. Greg, I think I’ve seen that this can be done with kw1281test…am I remembering correctly?
• My ECU and cluster each need a bit flipped to enable auto transmission, correct? Quote from someone who’s done it: “Address 1B6 orginal value in my clocks was 15. If you plan to do a AWD conversion then you need to change the 1 to a 9 to see the AWD module in the CAN Gateway. If not, leave 1 for FWD. To change from manual to DSG then change the 5 to a 7.”

Thanks y’all for even taking the time to read this. I know it’s a challenge.

VWK501MH FIS clusters are much more common than VWK503MH FIS clusters. There's LED sweep code out there that sweeps the warning lights with the needles on startup that's available for VWK503MH clusters only, but other than that, there's no real advantage IMO.

IIRC if you want cruise control to work, there's also a bit in the ECU that needs to be changed to get the vehicle speed from CAN (in addition to the cluster bit).

I think with an IMMO2 cluster and IMMO2 ECU, you can swap out the ECU for another one without any other changes, but I'm not sure if that's the same with an IMMO3 cluster. Either way it's not difficult; just enter the SKC and reprogram your keys.

 

[HH65AM1]

I've been trying to get my SKC from a 2008 EOS Lux. I don't seem to be getting any binary data. Am I missing a step?
Here is what I get:
Version 0.77-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com7 9600 getskc
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 6.0.8
Culture: en-US
Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc.
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
AdaptationRead CHANNEL [LOGIN]
CHANNEL = Channel number (0-99)
LOGIN = Optional login (0-65535)
AdaptationSave CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
AdaptationTest CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
BasicSetting GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
ClarionVWPremium4SafeCode
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpEdc15Eeprom [FILENAME]
FILENAME = Optional filename
DumpEeprom START LENGTH [FILENAME]
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRBxMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
FindLogins LOGIN
LOGIN = Known good login (0-65535)
GetSKC
GroupRead GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadRAM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadROM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
ToogleRB4Mode
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)

 

[gmenounos]

I've been trying to get my SKC from a 2008 EOS Lux. I don't seem to be getting any binary data. Am I missing a step?
Here is what I get:
Version 0.77-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com7 9600 getskc

You're missing the module address immediately after the baud rate, like this:

kw1281test com7 9600 1 getskc

But unfortunately, kw1281test isn't compatible with your EOS because the EOS uses the CAN Bus for diagnostics. kw1281test only supports K-Line diagnostics. Here's a list of many cars that use CAN Bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

 

[WPhH]

Hello everybody! I am new here. I have been trying to code the 'keyfob window operation' with
gmenounos's great software tool, but I am running into a problem.

This is about my 2000 year VW Passat B5 wagon. I have only front electric windows. My CCM is 1J0 959 799 S 03B. I am trying to code as follows:

04283 8 2
04289 8 2
08628 242 246
12724 250 254

I have no problem coding 04283 and 04289, but when writing to addresses 08628 and 12724 the action returns:

Passat\kw1281\kw1281test>kw1281test.exe com3 9600 46 WriteEeprom 08628 246
KW1281Test: Yesterday's diagnostics...Today.

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com3 9600 46 WriteEeprom 08628 246
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 7.0.0
Culture: en-IE
Opening serial port com3
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799S 3B Zentral-SG Komf. 0001
Software Coding 00257, Workshop Code: 11111
Sending Login block
Sending WriteEeprom block (Address: $21B4, Values: $F6
Received "Write EEPROM Response" block: 01 20 B4 F6
WriteEepromResponseBlock body does not match WriteEepromBlock
Sending EndCommunication block

The new value however is stored when afterwards doing ReadEeprom. I have no other error messages at all.

BUT: it does not work. What am I doing wrong?

Thanks in advance for your help!

 

[HH65AM1]

You're missing the module address immediately after the baud rate, like this:

kw1281test com7 9600 1 getskc

But unfortunately, kw1281test isn't compatible with your EOS because the EOS uses the CAN Bus for diagnostics. kw1281test only supports K-Line diagnostics. Here's a list of many cars that use CAN Bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

Thanks for the quick response and too bad this is not compatible. Great job on your program anyways!

 

[punkassjim]

Is there any additional info to be gleaned from this error message beyond "Could not connect?"

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: AB5P37BA 10400 1 ReadFaultCodes
OSVersion: Unix 12.4.0
.NET Version: 7.0.0
Culture: en-US
Opening FTDI serial port AB5P37BA
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

I was working on some wiring repair under the hood this weekend, and using kw1281test for occasional checks of the DTCs. At one point, this error kept happening. Ignition was on. I tried turning the ignition off and on, tried unplugging and replugging…and eventually communication resumed, but it wasn't clear which thing helped.

I took my car to a CA smog station today for my test, and the guy couldn't get his machine to communicate with my OBD-!! port. I put a fresh fuse in the location for the DLC, but no dice. Guy said he was getting 12v at the port, but communication was just not happening. I brought the car home, scanned codes with kw1281test, and success.

But now I'm reminded that, a month or so ago, my copy of VCDS-Lite — which used to work with this same cable on my car — suddenly stopped working. I wasn't sure why, but urgency led me to just set it aside and work with kw1281test.

So, my questions: Does kw1281test only use the K line? Does it make sense that VCDS — along with the smog technician's equipment — cannot communicate with this cable, but kw1281 can?

And, bonus question: does this all point to an obvious culprit I'm not seeing? I'll of course inspect the plug itself, and its wiring, tomorrow.

 

[gmenounos]

Is there any additional info to be gleaned from this error message beyond "Could not connect?"

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: AB5P37BA 10400 1 ReadFaultCodes
...
Caught: System.InvalidOperationException Controller did not wake up.
...

...
So, my questions: Does kw1281test only use the K line? Does it make sense that VCDS — along with the smog technician's equipment — cannot communicate with this cable, but kw1281 can?

And, bonus question: does this all point to an obvious culprit I'm not seeing? I'll of course inspect the plug itself, and its wiring, tomorrow.

Yes, kw1281test only uses the K line. When this happens, can kw1281test talk to any other modules in the car? If it can, then that would tend to implicate the ECU or the K line that connects to it. If it can't connect to any other modules, then that would make you suspect your OBD port or the wiring to it.

I can't think of anything that might leave your ECU in a state where it won't wake up for diagnostics. If you used kw1281test to retrieve the SKC from the ECU or dump the ECU's EEPROM, that can sometimes leave the ECU in a weird state that requires you to disconnect the battery to talk to it again. But when that happens, you wouldn't get the "Controller did not wake up" error, you'd get an error that says "Unexpected byte received" or something like that.

 

[punkassjim]

Oh! I realized my problem: when I replaced my ECU a couple months ago, I never re-coded it to match my vehicle’s VIN. Since it’s IMMO2, I didn’t think I’d need to. The smog station was likely unable to match VIN, hence the communication error. Figured this out because I took the car to AutoZone to see if they could successfully scan it, and they could…but the VIN that came up on their screen does not match the VIN of my engine donor vehicle.

Can kw1281test do the VIN reassignment on the swapped ECU? Or will I need a VAG-Com?

 

[gmenounos]

I corrected the VIN in my TDI-swapped 2001 Jetta wagon by:

1. Dumping the cluster EEPROM to a file (with VAG Tacho at the time)
2. Editing the file with a hex editor to correct the VIN
3. Uploading the EEPROM file back to the cluster
4. Re-pairing the ECU to the cluster so that the VIN gets copied from the cluster to the ECU. (At the time I used VCDS: http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_ECU_Swapping )

I think you should be able to do all this with kw1281test. You didn't share any info about what year your car is, but assuming it's Immo3 with a VDO cluster:

If the VIN in the cluster is correct and just the ECU VIN is wrong, skip all the crossed out steps. I had to do every step because both the cluster and ECU had the VIN from the donor car.

Dump the cluster EEPROM:
kw1281test AB5P37BA 10400 17 DumpEeprom 0 2048 oldvin.bin

Edit oldvin.bin
If you don't have a hex editor, you can do it in your browser: https://hexed.it/
Save it to a new file: newvin.bin

Load the EEPROM back into the cluster:
kw1281test AB5P37BA 10400 17 LoadEeprom 0 newvin.bin

Reset the cluster so that it reads the new EEPROM:
kw1281test AB5P37BA 10400 17 Reset

Get your SKC:
kw1281test AB5P37BA 10400 17 GetSKC

(For the next step, assume your SKC is 01234)

Re-pair the ECU to the cluster. (If this doesn't work right in kw1281test, then you may have to use VCDS)
kw1281test AB5P37BA 10400 1 AdaptationSave 50 01234 01234

Turn off ignition for 1 minute and then turn back on

Connect to the ECU and verify that it has the new VIN:
kw1281test AB5P37BA 10400 1 ReadIdent

Let me know if that works.

 

[gmenounos]

The previous post assumes that the cluster SKC and ECU SKC are the same. If you installed an Immobilizer-deleted ECU and never paired it with your cluster, then you'll have to also get the SKC from your ECU:

kw1281test AB5P37BA 10400 1 GetSKC

Then, assuming your cluster SKC is 01234 and your ECU SKC is 05678, you would do:

kw1281test AB5P37BA 10400 1 AdaptationSave 50 01234 05678

Assuming the above even works with an Immo-deleted ECU. If any of the above wrecks your car, not my fault, just trying to help.

 

[punkassjim]

Thank you! I’ll read this more in-depth after dinner, but to clarify: it’s a 2001 donor vehicle, immo2, and all immobilizer components have been matched and enabled all along. I matched the replacement ECU to the cluster, and re-paired the keys, with kw1281test a couple months ago. So the SKC in the ECU should match that of the cluster at this point, I believe.

 

[gmenounos]

I don't think Immo2 knows your VIN so I don't think you need to do anything besides figure out why your ECU sometimes doesn't want to communicate. https://www.ross-tech.com/vag-com/cars/immobilizer2.html

 

[punkassjim]

I don't think Immo2 knows your VIN

I was surprised too, but somehow the scanner at AutoZone pulled an unfamiliar VIN from my car today. And if this 2001 “DL” ECU were somehow an immo3 device, it wouldn’t have swapped in so cleanly last month via the immo2 procedure.

 

[gmenounos]

Is your car a TDI or not? It it's a TDI, you can dump the ECU EEPROM to a file and verify that the VIN is in there:

kw1281test AB5P37BA 10400 1 DumpEdc15Eeprom ecu.bin

If it's not a TDI, I don't think there's anything kw1281test nor VCDS can do to change the VIN. (Actually kw1281test doesn't currently support writing to the ECU EEPROM, but I'm working on that, for TDIs only though).

 

[punkassjim]

Ok thanks. It’s a 1.8T. I’ll get a replacement for my sadly-stolen VAG-Com, and see what I can do with that.

 

[caffeine]

Ok thanks. It’s a 1.8T. I’ll get a replacement for my sadly-stolen VAG-Com, and see what I can do with that.

IIRC the nefmoto forums have a utility that can read/write the ME7x ECU EEPROMs.

 

[Jesterking]

This has been a fun thread to read!!
I have a 05 Jetta TDI that I recently disconnected the battery to. It was disconnected about 90 minutes. Reconnected, and all was well....until driving to work one morning,when I decided to listen to the radio...no good!! SAFE showed up on the radio display...the rest has been a rabbit hole I fell into, which landed me here. I bought the car a few years back...didn't know anything about a CODE needed for the radio in case the battery was disconnected for a while...I do now... wasn't too thrilled with what the dealer wanted to charge me to " look for the code with their scanner"...
So..I've downloaded the drivers for the cable I ordered...and will install the KW1281TEST later tonight..am hoping that discovering the secret code to make my radio work is relatively easy, and that I don't make a brick out of it..
Thank you to all who have contributed to this...it has been enlightening!

 

[Jesterking]

I'm in....
Here's my radio info.... just need to figure how to look at the security code.. or decipher which one it is...

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com4 10400 56 ReadFaultCodes
OSVersion: Microsoft Windows NT 10.0.22000.0
.NET Version: 7.0.0
Culture: en-US
Opening serial port com4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3B7035180G RADIO 3CP 0007
Software Coding 04031, Workshop Code: 00028
Sending ReadFaultCodes block
Fault codes:
00856 - 36-00
Sending EndCommunication block

** Edited.... Radio code will hve to be found elsewhare...mine is a Clarion VI... oh well...**

***Edited again... removed the radio to retrieve serial number... radio came out of the dash seemly ok..went to put it back in, and thought the power connector was mounted back inside the dash area...started to slide the radio in...wiggled it around...pulled it back out, and noticed the connector was pushed down...grabbed on to connector...pulled out on it, and found there was enough slack to get it out of the dash. I noticed it had a cam type connector, and the cam was unlocked...placed connector into radio and locked into position. Placed radio back into the console..turned radio on...no safe code needed...works fine... ???? ***

 

[grandetontsa]

Hi. I tried find skc my -07 seat ibiza, there is magneti marelli cluster. I try dumpmarellimem 3072 1024 and also 14336 2048 but not succeed. There is code, any ideas what can try next? I opened cluster and there is MC9S12 prosessor so there is no external EEPROM what can read with external prommer?

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 dumpmarellimem 3072 1024
OSVersion: Microsoft Windows NT 10.0.18363.0
.NET Version: 7.0.0
Culture: fi-FI
Opening serial port com2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6L0920823 KOMBIINSTRUMENT AGD V03
Software Coding 00105, Workshop Code: 00000
Untested cluster version! You may need to disconnect your battery if this fails.
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Caught: System.IO.IOException Toiminto palautui aikakatkaisun johdosta. : 'com2'
Unhandled exception: System.IO.IOException: Toiminto palautui aikakatkaisun johdosta. : 'com2'
at System.IO.Ports.SerialStream.EndRead(IAsyncResult)
at System.IO.Ports.SerialStream.ReadByte(Int32)
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 103
at BitFab.KW1281Test.Cluster.MarelliCluster.WriteMarelliBlockAndReadAck(Byte[]) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 233
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 122
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.DumpMarelliMem(UInt32, UInt32, ControllerInfo, String ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 399
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 309
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26


Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 dumpmarellimem 14336 2048
OSVersion: Microsoft Windows NT 10.0.18363.0
.NET Version: 7.0.0
Culture: fi-FI
Opening serial port com2
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6L0920823 KOMBIINSTRUMENT AGD V03
Software Coding 00105, Workshop Code: 00000
Untested cluster version! You may need to disconnect your battery if this fails.
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Caught: System.IO.IOException Toiminto palautui aikakatkaisun johdosta. : 'com2'
Unhandled exception: System.IO.IOException: Toiminto palautui aikakatkaisun johdosta. : 'com2'
at System.IO.Ports.SerialStream.EndRead(IAsyncResult)
at System.IO.Ports.SerialStream.ReadByte(Int32)
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 103
at BitFab.KW1281Test.Cluster.MarelliCluster.WriteMarelliBlockAndReadAck(Byte[]) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 233
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 122
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.DumpMarelliMem(UInt32, UInt32, ControllerInfo, String ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 399
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 309
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[gmenounos]

Hi. I tried find skc my -07 seat ibiza, there is magneti marelli cluster. I try dumpmarellimem 3072 1024 and also 14336 2048 but not succeed. There is code, any ideas what can try next? I opened cluster and there is MC9S12 prosessor so there is no external EEPROM what can read with external prommer?

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 dumpmarellimem 3072 1024
...
ECU: 6L0920823 KOMBIINSTRUMENT AGD V03

Unfortunately, I've never seen a cluster like that so I don't know how to add support for it. :-(

 

[DeppzGTI]

Hi

New to this forum, sorry if this has already been answered but ive been at this for a few days without luck so would like some advice now!
Using VAG K CAN Commander Full cable, got this reading, but surely the code i have isnt just 0000?

C:\Users\Jordan>C:\Users\Jordan\Desktop\kw1281test.exe COM3 10400 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 GetSKC
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 7.0.0
Culture: en-GB
Opening serial port COM3
Sending wakeup message
Wakeup duration: 2.0000001 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6N0920904K KOMBIINSTRUMENT BOO V12
Software Coding 00444, Workshop Code: 00001
Sending 0x43 block
Received $FF block: 0x0D 0x0B 0xFF 0x76 0x39 0x32 0x33 0x30 0x5F 0x30 0x38 0x2E
0x32 0x03
v9230_08.2
Sending Login block
Sending Custom $08 $15 block
Sending ReadIdent block
Saving EEPROM dump to 6N0920904K__KOMBIINSTRUMENT_BOO_V12_$0000_eeprom.bin
Sending ReadEeprom block (Address: $0000, Count: $10)
Received "Read EEPROM Response" block: 08 15 00 00 73 A8 00 00 00 00 00 00 00 00
00 00
Saved EEPROM dump to 6N0920904K__KOMBIINSTRUMENT_BOO_V12_$0000_eeprom.bin
SKC: 00000
Sending EndCommunication block

Any advice would be great, thanks!

Polo 6n2 GTI AVY 2001

 

[Faiber]

Saved EEPROM dump to 6N0920904K__KOMBIINSTRUMENT_BOO_V12_$0000_eeprom.bin
SKC: 00000
Sending EndCommunication block

Any advice would be great, thanks!

Polo 6n2 GTI AVY 2001

It is bosch cluster and automatic skc calculation won't work. Upload that .bin here and someone will figure it out manually.

 

[93wolfsburg]

Hello, I've been playing around with the kw1281test software its really great thanks to the Dev. I've been reading through this thread and i think ive run into a road block with a clarion premium VI headunit i have in a new (to me) Mk4 is the radio code obtainable from EEPROM dump or is it just not possible to get from these units?

 

[pini08]

Hi Guys,
Thanks for support from those who will

I'm trying to connect my Skoda Roomster 2010 for getting my SKU (lost plastic card) to adopt new key.
Did all the instructions regard the installation: VCP drivers, Intelligent mode boot unchecked, swapped BAUD rates, COM port number verified - but the cluster won't communicate.
attaching the log.

can someone guide me thru this?

Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: he-IL
Opening serial port COM4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2.0000002 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 482
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 243
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: he-IL
Opening serial port COM4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 482
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 243
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26
Version 0.79-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 6.0.9
Culture: he-IL
Opening serial port COM4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean evenParityWakeup) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 482
   at BitFab.KW1281Test.Program.Run(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 243
   at BitFab.KW1281Test.Program.Main(String[] args) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[imaginifer]

Hello, and many thanks for the work. Here is my report on the failure of retreaving SKC from Škoda Fabia I 1.4 TDI. Any possibility of fixing it?

.\kw1281test.exe COM4 10400 17 GetSKC

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.0
Culture: cs-CZ
Opening serial port COM4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Y0920880E KOMBI+WEGFAHRSP VDO V07
Software Coding 00101, Workshop Code: 13765
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VSQX01LM $10 $01
01: $69 $19 
02: $07 $0B $01 $0B $1B $15 
03: PQ24_2 LM KW18/02   
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VSQX01LM 01.10' is 43 43 3D 37
Please report this to the program maintainer.
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Block:  30 40 35 64 02 12 65 42 03 00
Unexpected seed suffix: $03 $00, (Expected $01 $00)
Sending Custom "Key response" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.
Saving EEPROM dump to TMBPZ46Y444086291_____SKZ7Z0D2394701_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $0C)

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to TMBPZ46Y444086291_____SKZ7Z0D2394701_$0090_eeprom.bin
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block

 

[ChronoX]

Hello, and many thanks for the work. Here is my report on the failure of retreaving SKC from Škoda Fabia I 1.4 TDI. Any possibility of fixing it?

.\kw1281test.exe COM4 10400 17 GetSKC

---
Opening serial port COM4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Y0920880E KOMBI+WEGFAHRSP VDO V07
Software Coding 00101, Workshop Code: 13765
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VSQX01LM $10 $01
01: $69 $19
02: $07 $0B $01 $0B $1B $15
03: PQ24_2 LM KW18/02  
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VSQX01LM 01.10' is 43 43 3D 37
Please report this to the program maintainer.
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Block:  30 40 35 64 02 12 65 42 03 00
Unexpected seed suffix: $03 $00, (Expected $01 $00)
Sending Custom "Key response" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.
---
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block

I've registered to this forum as I've got the exact same problem extracting the SKC for this clustertype. In my case, the cluster of my gf's VW Polo is having serious issues and I need to replace it. (Got memory issues):

ECU: 
Software Coding 00000, Workshop Code: 00000 KOMBIINSTRUMENT VDO    
Software Coding 00000, Workshop Code: 00000
Sending ReadFaultCodes block
Fault codes:
    65535 - 00-00
    00771 - 30-00
Sending EndCommunication block

As it's an old car bought 2nd hand, I'll need to retrieve the SKC out of the system. I have however issues with retrieving it just like the post above:

Protocol is KW 1281 (8N1)
ECU: 6Q0920800  KOMBI+WEGFAHRSP VDO V14
Software Coding 01141, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VSQX01LM $10 $01 
01: $69 $19 
02: $07 $0B $01 $0B $1B $15 
03: PQ24_2 LM KW18/02   
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VSQX01LM 01.10 is  43 43 3D 37
Please report this to the program maintainer.
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Block:  68 0F 17 91 67 A9 7B C0 03 00
Unexpected seed suffix: $03 $00, (Expected $01 $00)
Sending Custom "Key response" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.

The Eeprom dump comes out garbled (no logical/readable dump), so got no real luck getting it otherwise. I'm using an original VCDS cable in VCP mode to extract the data (which is working for most other stuff). Additional info regarding ECU + Instruments from VCDS:

Chassis Type: 6N - VW Polo (1995 > 2002)
Scan: 01 02 03 08 15 17 19 25 41 45 46 55 56
 
-------------------------------------------------------------------------------
Address 01: Engine        Labels: 036-906-034-APE.lbl
   Part No: 036 906 034 DD
   Component:  MARELLI 4MV       4555  
   Coding: 00071
   Shop #: WSC 31414  
   VCID: 57B7ACECB5D3AA3593-4B56
   WVWZZZ9NZ3D106989     VWZ7Z0B6009977

*scan while cluster is totally in error*
Address 17: Instruments        Labels: 6Q0-920-xxx-17.lbl
   Part No: 6Q0 920 800 
   Component: KOMBIINSTRUMENT VDO V14  
   Coding: 00000
   Shop #: WSC 00000  
   VCID: 6AD1E51816A127DD3C-5140

2 Faults Found:
65535 - Internal Control Module Memory Error 

*scan 1 day later, cluster actually works 'enough' to start car*
Address 17: Instruments        Labels: None
   Component: KOMBI+WEGFAHRSP VDO   
   Coding: 01141
   Shop #: WSC 00000  
   VCID: 55ABA6E4AFDF982581-515E

   Subsystem 1 - Part No: 06989
   Component: VWZ7Z0B6009977  
   06989     VWZ7Z0B6009977

2 Faults Found:
65535 - Internal Control Module Memory Error

I really hope you can help me retrieving the code so I can replace the broken cluster with a new one (once I found one lol).

 

[Mozambiquer]

20230108_170426.jpg

• Mozambiquer
• Jan 8, 2023

Just picked up a new w8 wagon and trying to do the ccm mods on it too, but keep getting this message. I can connect with vcds, but not with this.

 

[gmenounos]

20230108_170426.jpg

• Mozambiquer
• Jan 8, 2023

Just picked up a new w8 wagon and trying to do the ccm mods on it too, but keep getting this message. I can connect with vcds, but not with this.

• What kind of cable? If it's a VCDS cable, make sure it's an older one (e.g. KII-USB, Hex+CAN). Newer ones don't work with kw1281test.
• If it's a VCDS cable, make sure "Boot in Intelligent Mode" is disabled (not checked) in the VCDS settings. You need to unplug/replug the cable into your laptop after changing this setting.
• Try the latest version (yours is over a year old): https://github.com/gmenounos/kw1281test/releases/tag/v0.80-beta

 

[Mozambiquer]

• What kind of cable? If it's a VCDS cable, make sure it's an older one (e.g. KII-USB, Hex+CAN). Newer ones don't work with kw1281test.
• If it's a VCDS cable, make sure "Boot in Intelligent Mode" is disabled (not checked) in the VCDS settings. You need to unplug/replug the cable into your laptop after changing this setting.
• Try the latest version (yours is over a year old): https://github.com/gmenounos/kw1281test/releases/tag/v0.80-beta

Yes, its a Hex-Can one and set up with VCP I didn't unplug after changing the intelligent mode though... Also will try the latest version. Thanks!