kw1281test: A Free VDS-Pro / VagTacho Alternative

[krstecd]

Q: What is kw1281test?
A: It's a program I wrote in 2020 to help TDI VW VAG owners retrieve their vehicle's SKC and program their CCMs using a generic KKL cable that you can probably pick up for $20 or so. It runs on Windows 10/11, macOS and Linux. It's open source so you can copy it, modify it or just read through the source code to understand how it works. But it's a command line program and only works with cars that support diagnostics via the K-Line. For VWs, this means only MKIV cars are supported.

Can i somehow get my SKC code on my Golf 5 1.9TDI Goal 2006? Is this gonna work?
I tried to run vag can commander on my HEX USB cable with tmega162 IC that i bought from aliexpress but i cant get it to work.

 

[gmenounos]

Can i somehow get my SKC code on my Golf 5 1.9TDI Goal 2006? Is this gonna work?
I tried to run vag can commander on my HEX USB cable with tmega162 IC that i bought from aliexpress but i cant get it to work.

Sorry, it won't work with the Golf 5 or any other car that uses the CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

 

[krstecd]

Sorry, it won't work with the Golf 5 or any other car that uses the CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

Any other solution to retrieve my SKC code without buying other cables?
i also can borrow a Delphi DS150E cable from my neighbour, any way that i can use it to get the SKC?

 

[gmenounos]

Any other solution to retrieve my SKC code without buying other cables?

Not that I know of. I only have MK4 cars so I don't know how to add support for anything newer (which would also require a different cable).

 

[gmenounos]

New release: https://github.com/gmenounos/kw1281test/releases/tag/v0.81-beta

• Added support for Beetle 1C0920941LX M73 V03 cluster.
• Increased read/write timeout to 8 seconds as some controllers take longer than 2 seconds to respond.

 

[Dynobeetle]

I have an old cable that I think was home made. It's a serial cable and it works with Vag-Com on a windows 11 desktop pc with a serial port. I am hoping your program will work with it and guess no drivers required. Have a 2001 Beetle 1.8T automatic build date Dec. 2000. Not sure if Cluster is supported 1C0920806G.

 

[gmenounos]

I have an old cable that I think was home made. It's a serial cable and it works with Vag-Com on a windows 11 desktop pc with a serial port. I am hoping your program will work with it and guess no drivers required. Have a 2001 Beetle 1.8T automatic build date Dec. 2000. Not sure if Cluster is supported 1C0920806G.

Try this (replace "COM1" with the serial port that your cable is connected to):

.\KW1281Test COM1 9600 17 DumpMarelliMem 3072 1024

 

[Dynobeetle]

Thank you so very much for reply. Just picked up a HP Probook 650 G2, 6th gen i5 running Win 11 pro. One of a very few modern laptops I could find with a serial port. Will give it a try on that, see if Vag Com still works and then try your program. Really an amazed by the ingenuity of the DIY community out there! I'm 76 and grew up in the Muscle Car era, when tuning was point gap and dist. advance.

 

[Dynobeetle]

I just need my SKC so I can program another key. How do I get SKC from the dump, or is there another command. Have read through a few times and an still a bit confused at this point. Thanks.

 

[gmenounos]

I just need my SKC so I can program another key. How do I get SKC from the dump, or is there another command. Have read through a few times and an still a bit confused at this point. Thanks.

Did it work and create a dump? Can you attach kw1281test.log? If you can attach the dump, I can probably tell you your SKC, or by looking at the log I can probably tell you how to determine it with a hex editor.

 

[Dynobeetle]

I think it worked. l got this back. marelli_mem_$0C00.bin. How do I send?

 

[gmenounos]

I think it worked. l got this back. marelli_mem_$0C00.bin. How do I send?

Glad you got it working and were able to retrieve your SKC from the dump. The next version will support your cluster so that you'd just be able to use the GetSKC command to retrieve it.

 

[Rodrigo_Cruz]

Glad you got it working and were able to retrieve your SKC from the dump. The next version will support your cluster so that you'd just be able to use the GetSKC command to retrieve it.

Hi, I am having a problem trying to program new keys.

does not connect to the cluster. The model is: 1j0 920 800 j

 

[wolfforlunch]

Hi, this is probably a real dumb question, but can I do TBA with this tool? If so, would you kindly guide me on this? Appreciate any response in advance.

 

[gmenounos]

Hi, I am having a problem trying to program new keys.

does not connect to the cluster. The model is: 1j0 920 800 j

What kind of cable are you using? Can you attach kw1281test.log ? It contains a log of useful info that helps me figure out why it's not working.

 

[gmenounos]

Hi, this is probably a real dumb question, but can I do TBA with this tool? If so, would you kindly guide me on this? Appreciate any response in advance.

Throttle Body Alignment? You might be able to use it for that. I only have TDIs so I can't test it myself.

First try to connect to your ECU and make sure that your cable is working and that kw1281test can communicate with your ECU. So if your cable is on COM1, then this is what you'd do:

.\kw1281test.exe COM1 9600 1 ReadIdent

Assuming that works, I think this is what would do a TBA:

.\kw1281test.exe COM1 9600 1 BasicSetting 60

It should run for about 30 seconds and then you can quit.

 

[wolfforlunch]

Throttle Body Alignment? You might be able to use it for that. I only have TDIs so I can't test it myself.

First try to connect to your ECU and make sure that your cable is working and that kw1281test can communicate with your ECU. So if your cable is on COM1, then this is what you'd do:

.\kw1281test.exe COM1 9600 1 ReadIdent

Assuming that works, I think this is what would do a TBA:

.\kw1281test.exe COM1 9600 1 BasicSetting 60

It should run for about 30 seconds and then you can quit.

Hey man, I just wanted to let you know that your instructions worked for me. I just had to change the baudrate to 10400. In any case, believe it or not, I’ve been looking to do a TBA on my car for the past 9 years, and I had periodically done countless hours of research to find a free or cheap solution. Finally, I’ve been able to find that with your help and I couldn’t express enough how much I appreciate the time and effort you’ve put into this. It means a lot to me and you’ve made my day. Thank you.

 

[bronny]

hello i have a problem with my ccm bellow i paste the code on my cmd console.

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com1 9600 46 ReadEeprom 04358
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 7.0.4
Culture: pl-PL
Opening serial port com1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Received block end $F0 but expected $03
Unhandled exception: System.InvalidOperationException: Received block end $F0 but expected $03
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 392
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 351
at BitFab.KW1281Test.KW1281Dialog.Connect() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 91
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 39
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

C:\Users\micha\kw\kw1281test-master>

 

[Rodrigo_Cruz]

Hi, I am having a problem trying to program new keys.

does not connect to the cluster. The model is: 1j0 920 800 j

Hello, I already managed to have a connection with the cluster, I just had to change the baud rate to 10400.

 

[tr7]

Has anyone got this to work with Audi B7 Instrument Clusters?

I've tried a couple of cables I already owned and number of drivers but the "best" response I got was

Caught: System.InvalidOperationException Controller did not wake up

Every other variation of what I tried returned Could not find COM#


So is this fantastic project not compatible with B7 Clusters or do I need to get the specific cable listed? (I've just ordered it but am curious if this was a waste of time)

Love the effort keeping it open source. Thanks, T

 

[AustinZimmy]

04 Audi TT 225 BEA here. I got my bin using the second command referenced on page 20.
kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048
It successfully saved the Bin. I then used the following command to convert to txt
certutil -encodehex marelli_mem_$3800.bin marelli_mem_$3800.txt

However now I do not know which line to read for the SKC. People say that is the 2 bytes before AUZ5 well there are 3 and the bytes before all of them to me look different. The formatting is a little messed up but this is what i got.

0340 00 00 ff ff ff ff ff ff 01 a9 ff ff ff ff ff 02 ................
0350 ed ff ff ff ff 00 01 ff 27 1a 02 08 09 41 55 5a ........'....AUZ
0360 35 5a 30 43 36 32 39 35 31 30 35 13 23 3c 60 7b 5Z0C6295105.#<`{
0370 92 b3 20 00 00 65 61 ba d5 dc b9 90 7e ff ff ff .. ..ea.....~...
0380 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0390 ff ff ff ff ff 02 08 09 41 55 5a 35 5a 30 43 36 ........AUZ5Z0C6
03a0 32 39 35 31 30 35 13 23 3c 60 7b 92 b3 20 00 00 295105.#<`{.. ..
03b0 65 61 ba d5 dc b9 90 7e ff ff ff ff ff ff ff ff ea.....~........
03c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
03d0 02 08 09 41 55 5a 35 5a 30 43 36 32 39 35 31 30 ...AUZ5Z0C629510
03e0 35 13 23 3c 60 7b 92 b3 20 00 00 65 61 ba d5 dc 5.#<`{.. ..ea...
03f0 b9 90 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ..~.............

Files are in my Google Drive:
.bin file
.txt file

 

[gmenounos]

Has anyone got this to work with Audi B7 Instrument Clusters?

I've tried a couple of cables I already owned and number of drivers but the "best" response I got was

Caught: System.InvalidOperationException Controller did not wake up

Every other variation of what I tried returned Could not find COM#


So is this fantastic project not compatible with B7 Clusters or do I need to get the specific cable listed? (I've just ordered it but am curious if this was a waste of time)

Love the effort keeping it open source. Thanks, T

I think you're probably out of luck. The best way that I know of to determine if kw1281test supports your car is to look at this page: https://www.ross-tech.com/vcds/canbus.php
If your car is one of the ones listed, then kw1281test does not support it. The cables that kw1281test supports are all generic K-line cables, so not only can't those cables connect to the CAN bus in a car, I don't own any cars that use CAN bus for diagnostics, so I wouldn't be able to do any testing. In the case of the B7 cluster, there's a small chance it might work because the above page says "some control modules" use CAN bus for diagnostics. So when your cable arrives, you can try connecting to the cluster with the ReadIdent command and see if it works. Of course connecting to a module is one thing, but being able to retrieve the SKC is a lot more complicated and varies from cluster to cluster, so you still may be out of luck.

 

[gmenounos]

04 Audi TT 225 BEA here. I got my bin using the second command referenced on page 20.
kw1281test.exe COM3 9600 17 DumpMarelliMem 14336 2048
It successfully saved the Bin. I then used the following command to convert to txt
certutil -encodehex marelli_mem_$3800.bin marelli_mem_$3800.txt

However now I do not know which line to read for the SKC. People say that is the 2 bytes before AUZ5 well there are 3 and the bytes before all of them to me look different. The formatting is a little messed up but this is what i got.

0340 00 00 ff ff ff ff ff ff 01 a9 ff ff ff ff ff 02 ................
0350 ed ff ff ff ff 00 01 ff 27 1a 02 [B]08 09[/B] 41 55 5a ........'....AUZ
0360 35 5a 30 43 36 32 39 35 31 30 35 13 23 3c 60 7b 5Z0C6295105.#<`{
0370 92 b3 20 00 00 65 61 ba d5 dc b9 90 7e ff ff ff .. ..ea.....~...
0380 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0390 ff ff ff ff ff 02 [B]08 09[/B] 41 55 5a 35 5a 30 43 36 ........AUZ5Z0C6
03a0 32 39 35 31 30 35 13 23 3c 60 7b 92 b3 20 00 00 295105.#<`{.. ..
03b0 65 61 ba d5 dc b9 90 7e ff ff ff ff ff ff ff ff ea.....~........
03c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
03d0 02 [B]08 09[/B] 41 55 5a 35 5a 30 43 36 32 39 35 31 30 ...AUZ5Z0C629510
03e0 35 13 23 3c 60 7b 92 b3 20 00 00 65 61 ba d5 dc 5.#<`{.. ..ea...
03f0 b9 90 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ..~.............

Files are in my Google Drive:
.bin file
.txt file

It's consistently 0809 in that dump. 0809 in hexadecimal is 2057 in decimal so you can try 02057 for your SKC. However I was trying to help another person recently who sent me a TT dump and the SKC, calculated in the same way didn't work, so please let me know if it works for you.

 

[Ascenity]

I ran the dump through AudiDashEdit & it shows "02057" so I'll second that, that should be correct - each Audi TT MK1 SKC dump I have pulled with kw1281test has always given me the correct SKC.

----

Edit: I lost my MK4's radio code (Blaupunkt - Gamma 4) and my TT never came a code (Blaupunkt - Concert) - are you aware of any development aimed towards these radios that could be implemented into kw1281test? Unfortunately, mnaberez's vwradio doesn't support those units & looks like you need to pull the eeprom and dump it, just to get the code (or pay a "radio code" company).

Edit#2: Seems I've answered my own question: looks like mnaberez was looking into European radios, but can't find much else online.

 

[AustinZimmy]

That worked! Thanks guys, I was over here scratching my head. Did a few tests and was able to get into Instruments, Engine, and Central Lock Controllers via VCDS with that pin.

 

[tr7]

I think you're probably out of luck. The best way that I know of to determine if kw1281test supports your car is to look at this page: https://www.ross-tech.com/vcds/canbus.php
If your car is one of the ones listed, then kw1281test does not support it. The cables that kw1281test supports are all generic K-line cables, so not only can't those cables connect to the CAN bus in a car, I don't own any cars that use CAN bus for diagnostics, so I wouldn't be able to do any testing. In the case of the B7 cluster, there's a small chance it might work because the above page says "some control modules" use CAN bus for diagnostics. So when your cable arrives, you can try connecting to the cluster with the ReadIdent command and see if it works. Of course connecting to a module is one thing, but being able to retrieve the SKC is a lot more complicated and varies from cluster to cluster, so you still may be out of luck.

Thank you for the great response @gmenounos

Cable arrived today (thank the Amazon Prime gods)

Here are a couple attempts from the log

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Caught: System.InvalidOperationException Received complement $68 but expected $E8
Unhandled exception: System.InvalidOperationException: Received complement $68 but expected $E8
   at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 117
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 95
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 9600 17 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Unexpected sync byte: Expected $55, Actual $AD
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $AD
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 75
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 1 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

It seems that the Cluster has a response and not the ECU. So it's clearly doing something

Do you think there is any thing that could be done because it's actually waking up the module?

It seems 10400 gets a better return than 9600 as there were couple additional lines

I couldn't get it to DumpEeprom or any other command I tried


I'm fairly sure they're all Bosch Clusters in the B7, including a set I have in front of me from a S4. But there is a mix of ECU's (certainly in the TDI's) of Bosch and Siemens if I'm not mistaken.

I have a number of A4 B7's both TDI and TFSI from 2005 through to 2008. I can test any number of them. I also would love to help in any way I can and contribute to the project. I don't know #C, I mainly learnt PHP back in the day so can very much appreciate the work and making it open source is really commendable

Any further help or even if you need a cluster, I'd be very happy to help
Tim

 

[gmenounos]

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)

Looks like this is probably a Bosch RB4 cluster. Try the instructions in this post (but using COM6 instead of COM1) and see if you have any luck:
https://forums.tdiclub.com/index.ph...tacho-alternative.509151/page-35#post-5752784

 

[tr7]

Looks like this is probably a Bosch RB4 cluster. Try the instructions in this post (but using COM6 instead of COM1) and see if you have any luck:
https://forums.tdiclub.com/index.ph...tacho-alternative.509151/page-35#post-5752784

It's 2008 B7 and I believe they are RB8. Is the difference significant?

 

[gmenounos]

It's 2008 B7 and I believe they are RB8. Is the difference significant?

Can you try this command and see what happens?

.\kw1281test COM6 10400 17 DumpRBxMem 66560 1024

 

[tr7]

Can you try this command and see what happens?

.\kw1281test COM6 10400 17 DumpRBxMem 66560 1024

Ok apologies I took my time, I wanted to make sure I did a full ECU read (save) if somehow running into an issue. I know the ECU isn't the Cluster but I have the ability to read it so it made me feel better in case something did get bricked

Yes, these aren't TDI's but I didn't want to chance bricking my daily driver which is TDI

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 DumpRBxMem 66560 1024
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp2000Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 48
   at BitFab.KW1281Test.Tester.DumpRBxMem(UInt32, UInt32, String) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 426
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 238
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

Seems like RB8 isn't quite the same as RB4

Is there anything else you want me to try?

I can send you my ECU read file if that would be of any use

Tim