kw1281test: A Free VDS-Pro / VagTacho Alternative

[Mozambiquer]

Ok, so I'm no geek, but I'm thinking of trying this with the vcp and my old hex-can interface. I've got a Jetta that needs a key programmed, and I thought about buying vag-tacho, since I know of several times I could have used it, and I want to make extra keys for my cars. Does it work with windows 7?

 

[gmenounos]

Definitely give it a try. It shouldn't hurt anything if you're just reading the SKC from the clutster.
It should work on Windows 7 though you may be the first to try it. Follow these instructions to switch your Hex-CAN driver into VCP mode: https://www.ross-tech.com/vag-com/usb/virtual-com-port.php
You'll also need to run VCDS and uncheck the "Boot in intelligent mode" box: https://www.ross-tech.com/vcds/tour/option_screen.php#:~:text=Boot in intelligent mode allows,mode then run another Test.
I don't quite understand why that's required but my program won't talk to the cluster unless you uncheck that box.

Let me know what issues you run into and I'll try to help.

 

[Faiber]

Well done. Great Job! Thank you for this. Need no more my old vds-pro laptop for ccm mods. I tried some time ago do similar software but never finished it. This would be better if read data will be written directly to file. Not at the end. Wrong ack kills software and already read data is lost.

 

[Mozambiquer]

Definitely give it a try. It shouldn't hurt anything if you're just reading the SKC from the clutster.
It should work on Windows 7 though you may be the first to try it. Follow these instructions to switch your Hex-CAN driver into VCP mode: https://www.ross-tech.com/vag-com/usb/virtual-com-port.php
You'll also need to run VCDS and uncheck the "Boot in intelligent mode" box: https://www.ross-tech.com/vcds/tour/option_screen.php#:~:text=Boot in intelligent mode allows,mode then run another Test.
I don't quite understand why that's required but my program won't talk to the cluster unless you uncheck that box.

Let me know what issues you run into and I'll try to help.

Okay, so I have finally gotten to sit down and try to figure this out. I realized I am way less computer literate that I thought.
So, as I understand, I need to open up command prompt after downloading the kw1281test.exe, then introduce the command into the command prompt "kw1281test.exe COM3 10400 17 DumpEeprom 204 6" then it should talk to the controller? or am I doing it all wrong? That is what I tried to do and it gave me the message "kw1281test.exe is not recognized as an internal or external command, operable program or batch file. I then tried to go with the XP version to see if it would talk, but nothing. I have access to a windows 10 laptop, which I guess i could use, if that is the problem.
Is there a specific instructions on how to use the application?
I am also using my Hex+Can interface with the VCP drivers installed.

 

[Nuje]

I'm a Mac guy, so my Windows is a bit rusty, but pretty sure you have to make sure the C:\ prompt is in the same window as your executable.
So, if kw1281test.exe is in C:\Downloads, then from a bare C:\ prompt, you'd have to enter cd Downloads, which should then change the C:\ to C:\Downloads. If you then type dir, you should see kw1281text.exe listed as one of the files; if you don't you're in the wrong directory. If you do, then the command should now work.

There's another way involving the "path" command, but I don't remember details on that and just do it the no-shortcuts way.

 

[KrashDH]

@Nuje is right, there's a couple ways to do it. You can either find the directory by starting out by opening a command prompt then drilling down, but the easier way to do it is to click Shift + Right-Click the folder that you downloaded it to and there should be an option in the list to "open Powershell window here". Then you should be able to run it as you typed as long as that .exe file is in the folder you opened the cmd prompt on

 

[Mozambiquer]

@Nuje is right, there's a couple ways to do it. You can either find the directory by starting out by opening a command prompt then drilling down, but the easier way to do it is to click Shift + Right-Click the folder that you downloaded it to and there should be an option in the list to "open Powershell window here". Then you should be able to run it as you typed as long as that .exe file is in the folder you opened the cmd prompt on

Great! Thanks! I did that and it opened the command prompt correctly. I'll have to try the retrieval later after work.

 

[gmenounos]

Just keep in mind that if your command prompt is PowerShell, you'll have to type

.\kw1281test.exe

instead of

kw1281test.exe

Also PowerShell will require you to escape dollar signs so you'll need to type

`$400

instead of

$400

I don't think the dollar sign thing will be an issue to most people - just know that you can type memory addresses in decimal or hex. If you use hex, you specify that with a dollar sign prefix:

.\kw1281test.exe COM3 10400 17 DumpEeprom `$CC 6

 

[gmenounos]

This would be better if read data will be written directly to file. Not at the end. Wrong ack kills software and already read data is lost.

This hasn't happened to me yet but it's a good idea. I'll fix it in the next version that I release.

 

[Mozambiquer]

So, after fighting with it for a while, I finally got my skc read. Now, as it would happen, that was just seconds before the battery went dead on my laptop. That was just before I got it converted to decimal. I'll be working on it again during lunch break tomorrow. I'm quite excited though!

 

[wonneber]

In the PowerShell window if you type CMD it should spawn the Command window.
The DOS commands should work.
If you type exit it will close the command window and return to the PowerShell window.

 

[Mozambiquer]

In the PowerShell window if you type CMD it should spawn the Command window.
The DOS commands should work.
If you type exit it will close the command window and return to the PowerShell window.

That's another language to me...
I've come a long way from my mechanical IDI rabbits, vag-com was enough of a learning curve, I'm daily stretching my brain learning how to do these computer things. . Sad thing is that I am a millennial and we're supposed to know these things.

 

[KrashDH]

That's another language to me...
I've come a long way from my mechanical IDI rabbits, vag-com was enough of a learning curve, I'm daily stretching my brain learning how to do these computer things. . Sad thing is that I am a millennial and we're supposed to know these things.

Hey I'm at the tail end of the millennial spectrum, and at 35, I think I've decided I want to switch careers from design engineering to computer sciences and programming. So I've jumped in with both feet first. Always loved computers, never have had the time to get to know them like I should. I'm about 6 weeks into a 26 week bootcamp right now and loving it. Kind of like yourself, I feel very confident with them but feel like I don't know them like I should. I purchased a new laptop and already went to town on it and upgraded the hardware already. Learning a lot!

 

[Mozambiquer]

Ok, I spoke too soon... I have been fighting with it again. I can get a response, but not the bits with the skc, and it's not reading the eeprom. Then it puts an error saying that kw1281test has stopped working.
I found that avg was blocking it for a while, but then I got that take care of, and now it has this problem. I'm wondering if I should try a different laptop. Mine is ancient and very slow, but it's tough.

 

[wonneber]

That's another language to me...
I've come a long way from my mechanical IDI rabbits, vag-com was enough of a learning curve, I'm daily stretching my brain learning how to do these computer things. . Sad thing is that I am a millennial and we're supposed to know these things.

30+ years in the IT field taught me many things.
I started diesels in the 1.5 / 1.6 generation.

 

[KrashDH]

30+ years in the IT field taught me many things.

Dang, a true ambassador. If you haven't seen it all, you're pretty close to have seen it all.

 

[gmenounos]

Ok, I spoke too soon... I have been fighting with it again. I can get a response, but not the bits with the skc, and it's not reading the eeprom. Then it puts an error saying that kw1281test has stopped working.

If you can send me a photo of the error message screen, I'll try to help.

 

[Mozambiquer]

If you can send me a photo of the error message screen, I'll try to help.

I'll do that. The car is at work. I'll get it Monday.

 

[Mozambiquer]

IMG_20201114_095931.jpg

• Mozambiquer
• Nov 14, 2020

IMG_20201114_095915.jpg

• Mozambiquer
• Nov 14, 2020

1605370438806-672027873.jpg

• Mozambiquer
• Nov 14, 2020

Ccm attempt

Here's the messages I get when trying to access either the ccm or the cluster. This was on my 2001 golf TDI. I was previously working on my 2002 Jetta wagon with the 2.0 gasser. My golf might have an immobilizer delete, but that would be in the ecm, not the cluster and shouldn't make a difference, correct? Would this read a b5.5 Passat? 2005 year? That's my other car. Also have access to a 1999 Jetta.
Something seems to be blocking the command, since it's receiving the ack block message?

 

[gmenounos]

Here's the messages I get when trying to access either the ccm or the cluster. This was on my 2001 golf TDI. I was previously working on my 2002 Jetta wagon with the 2.0 gasser. My golf might have an immobilizer delete, but that would be in the ecm, not the cluster and shouldn't make a difference, correct? Would this read a b5.5 Passat? 2005 year? That's my other car. Also have access to a 1999 Jetta.
Something seems to be blocking the command, since it's receiving the ack block message?

There's a 4-byte secret code that is needed to unlock VDO clusters before reading the EEPROM and it varies based on the exact version of the cluster ROM. I just released a new version that should work with your 2001 Golf cluster (VAT500LL ROM): https://github.com/gmenounos/kw1281test/releases/download/v0.25-beta/kw1281test.zip
Please give it a try and let me know if it works for you.

For the CCM, I think you're trying to read a forbidden or nonexistent memory location (0436). Try 04283, which seems to be one of the good locations for a 799AJ CCM as shown here: https://forums.vwvortex.com/showthread.php?4822256-DIY-Windows-Roll-Up-and-Down-with-Remote

It probably can read a B5.5 Passat and 1999 Jetta. Please give it a try and let me know. If it doesn't work, I can most likely release a new version soon that will. Even though I have a lot of clusters to test with, most are MFA and FIS, so I haven't done a lot of testing with the various lowline clusters. The new version of KW1281Test creates a log file (KW1281Test.log) that you can send to me so you won't have to post any more screenshots.

 

[gmenounos]

Well done. Great Job! Thank you for this. Need no more my old vds-pro laptop for ccm mods. I tried some time ago do similar software but never finished it. This would be better if read data will be written directly to file. Not at the end. Wrong ack kills software and already read data is lost.

I just released a new version that writes data to the file as soon as it's received from the cluster: https://github.com/gmenounos/kw1281test/releases/download/v0.25-beta/kw1281test.zip

 

[gmenounos]

Oh wow - that'd be great, Greg! Not my car (with the RB8 cluster), so I'll have to wait until the owner brings it by again (he has a shopping list of things to get done in the next few months).

I've enhanced KW1281Test to add support for dumping RB8 cluster EEPROMs. Please give it a try and let me know if it works: https://github.com/gmenounos/kw1281test/releases/download/v0.25-beta/kw1281test.zip

KW1281Test.exe COM1 10400 17 DumpRB8Eeprom $10400 $400

Just make sure for an RB8 to always use $10400 for the address and $400 for the length. Other values tend to lock up the cluster until you power it down.

 

[Mozambiquer]

There's a 4-byte secret code that is needed to unlock VDO clusters before reading the EEPROM and it varies based on the exact version of the cluster ROM. I just released a new version that should work with your 2001 Golf cluster (VAT500LL ROM): https://github.com/gmenounos/kw1281test/releases/download/v0.25-beta/kw1281test.zip
Please give it a try and let me know if it works for you.

For the CCM, I think you're trying to read a forbidden or nonexistent memory location (0436). Try 04283, which seems to be one of the good locations for a 799AJ CCM as shown here: https://forums.vwvortex.com/showthread.php?4822256-DIY-Windows-Roll-Up-and-Down-with-Remote

It probably can read a B5.5 Passat and 1999 Jetta. Please give it a try and let me know. If it doesn't work, I can most likely release a new version soon that will. Even though I have a lot of clusters to test with, most are MFA and FIS, so I haven't done a lot of testing with the various lowline clusters. The new version of KW1281Test creates a log file (KW1281Test.log) that you can send to me so you won't have to post any more screenshots.

Sweet! Thanks a bunch! I'll try that tomorrow.

 

[arcking]

What are the chances of using this tool to recover an SKC/pin from an EDC16 ECU?

 

[gmenounos]

What are the chances of using this tool to recover an SKC/pin from an EDC16 ECU?

Unfortunately, no chance as I only have MKIV cars. But that reminds me, I should see if this thing can talk to a MKIV ECU.

 

[arcking]

Unfortunately, no chance as I only have MKIV cars. But that reminds me, I should see if this thing can talk to a MKIV ECU.

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.

 

[gmenounos]

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.

Oops my bad, only having ALHs, I didn't realize that the BEW used the EDC16. Learn something new every day...

 

[Mozambiquer]

KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM7
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920905K A4-KOMBIINSTR. VDO V09 8 2
Sending Custom "Unlock Additional Commands" block
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
00: VAT500LL $01
01: $90 $17
02: $11 $04 $00 $10 $33 $07
03: VW A4 Lowline Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VAT500LL $01 is 01 04 3D 35
Sending Custom "Need Seed/Key?" block
Received NAK block
Sending Custom "Seed request" block
Received NAK block
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3603421________$00CC_eeprom.bin
Sending ReadEeprom block (Address: $00CC, Count: $06)
Received "Read ROM/EEPROM Response" block: 58 58 58 58 58 FF
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3603421________$00CC_eeprom.bin
Sending EndCommunication block


Looks like I got something. it doesn't look quite right though.

 

[gmenounos]

It can definitely ready your EEPROM. 1J0920905K is an Immobilizer 2 cluster so the SKC is stored starting at address $BA so try this:

.\kw1281test.exe COM7 10400 17 DumpEeprom $BA 6

or for PowerShell:

.\kw1281test.exe COM7 10400 17 DumpEeprom `$BA 6

or without having to put that backtick character before the dollar sign, you can specify the address in decimal:

.\kw1281test.exe COM7 10400 17 DumpEeprom 186 6

You should see something like this:

PS C:\> .\kw1281test.exe com1 10400 17 dumpeeprom 186 6
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port com1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920925D  A4-KOMBIINSTR. VDO V06 8♦→
Sending Custom "Unlock Additional Commands" block
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
00: VAT500MH $10 $01
01: $73 $17
02: $19 $02 $00 $0F $0E $39
03: VW A4/T4 5/01 Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VAT500MH $10 $01  is  01 04 3D 35
Sending Custom "Need Seed/Key?" block
Received NAK block
Sending Custom "Seed request" block
Received NAK block
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2522742________$00BA_eeprom.bin
Sending ReadEeprom block (Address: $00BA, Count: $06)
Received "Read ROM/EEPROM Response" block: 32 47 32 47 32 47
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2522742________$00BA_eeprom.bin
Sending EndCommunication block

The 3rd from the last line should show 3 pairs of identical numbers. Here it's "32 47 32 47 32 47", which for an Immo 2 cluster means that the SKC is 4732.

 

[Mozambiquer]

It can definitely ready your EEPROM. 1J0920905K is an Immobilizer 2 cluster so the SKC is stored starting at address $BA so try this:

.\kw1281test.exe COM7 10400 17 DumpEeprom $BA 6

or for PowerShell:

.\kw1281test.exe COM7 10400 17 DumpEeprom `$BA 6

or without having to put that backtick character before the dollar sign, you can specify the address in decimal:

.\kw1281test.exe COM7 10400 17 DumpEeprom 186 6

You should see something like this:

PS C:\> .\kw1281test.exe com1 10400 17 dumpeeprom 186 6
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port com1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920925D  A4-KOMBIINSTR. VDO V06 8♦→
Sending Custom "Unlock Additional Commands" block
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
00: VAT500MH $10 $01
01: $73 $17
02: $19 $02 $00 $0F $0E $39
03: VW A4/T4 5/01 Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version VAT500MH $10 $01  is  01 04 3D 35
Sending Custom "Need Seed/Key?" block
Received NAK block
Sending Custom "Seed request" block
Received NAK block
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2522742________$00BA_eeprom.bin
Sending ReadEeprom block (Address: $00BA, Count: $06)
Received "Read ROM/EEPROM Response" block: 32 47 32 47 32 47
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2522742________$00BA_eeprom.bin
Sending EndCommunication block

The 3rd from the last line should show 3 pairs of identical numbers. Here it's "32 47 32 47 32 47", which for an Immo 2 cluster means that the SKC is 4732.

Yay!!! It worked! I was then able to reprogram the keys and to find out that wasn't the problem on my car...
But thanks so much Greg and all you other helpful guys! I couldn't have done it without your help and support!