kw1281test: A Free VDS-Pro / VagTacho Alternative

[gmenounos]

Seems like RB8 isn't quite the same as RB4

Is there anything else you want me to try?

When you have a chance, could you try a few more times and verify that this command always returns "Controller did not wake up"
.\kw1281test COM6 10400 17 DumpRBxMem 66560 1024

and this one wakes up the controller and says "Protocol is KW 2027 (8N1)"?
.\kw1281test COM6 10400 17 ReadIdent

Thanks.

 

[tr7]

When you have a chance, could you try a few more times and verify that this command always returns "Controller did not wake up"
.\kw1281test COM6 10400 17 DumpRBxMem 66560 1024

and this one wakes up the controller and says "Protocol is KW 2027 (8N1)"?
.\kw1281test COM6 10400 17 ReadIdent

Thanks.

Nps,

I've tried it now a number of times and in a number of different cars. TDI and TFSI it doesn't matter the same responses

I tried it with ignition on, ignition off, tried it immediately after clocked light up and also giving it a minute to have fully 'woken up'.

The same responses each time below.

Does it waking up at all with ReadIdent give you any indication of what to try next?

Regards,
Tim

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 DumpRBxMem 66560 1024
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Retrying wakeup message...
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 63
   at BitFab.KW1281Test.Tester.Kwp2000Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 48
   at BitFab.KW1281Test.Tester.DumpRBxMem(UInt32, UInt32, String) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 426
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 238
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

Version 0.81-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.4
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Caught: System.InvalidOperationException Received complement $68 but expected $E8
Unhandled exception: System.InvalidOperationException: Received complement $68 but expected $E8
   at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 117
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 95
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[dpspc]

Hey guys I own a Golf MK4 3-door from '01 with the CCM '1J0 959 799 AH'. I'm trying to get the windows to open/close with the fob and I've been having some trouble working with the kw1281test. I've managed to find which adresses and values I need to change and when I try to read the eeprom in those values most of the times it doesn't work. First time it worked like it was suppose to:

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 46 ReadEeprom 04295
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.0
Culture: pt-PT
Opening serial port COM3
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799AH 2K Zentral-SG Komf. 0001
Software Coding 00256, Workshop Code: 01317
Sending Login block
Sending ReadEeprom block (Address: $10C7, Count: $01)
Received "Read EEPROM Response" block: 48
Address 4295 ($10C7): Value 72 ($48)
Sending EndCommunication block

Right after, I try the same command and it doesn't work anymore, just returns this instead:

Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 46 ReadEeprom 04295
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.0
Culture: pt-PT
Opening serial port COM3
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Received block end $0F but expected $03
Unhandled exception: System.InvalidOperationException: Received block end $0F but expected $03
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 392
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 351
at BitFab.KW1281Test.KW1281Dialog.Connect() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 91
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 39
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 256
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

EDIT: I've found out that unplugging the usb cable and plugging it back in between commands would make it work.
I've already changed all of the values for :

1J0 959 799 AH 046 Sedan
Address Old New Remark
04295 138 64 This memory address added to keep the rear trunk handle from locking the car
04283 138 64
04289 138 2
08628 242 246 driver side front window
12724 250 254 passenger side front window

and the windows still don't open/close with a long press

 

[gmenounos]

Nps,
I've tried it now a number of times and in a number of different cars. TDI and TFSI it doesn't matter the same responses

I tried it with ignition on, ignition off, tried it immediately after clocked light up and also giving it a minute to have fully 'woken up'.

The same responses each time below.

Thanks for doing all that testing. I've published a new release: https://github.com/gmenounos/kw1281test/releases/tag/v0.82-beta

Can you download it and try this new command:

.\kw1281test COM6 10400 17 DumpRBxMemOdd 66560 1024

 

[tr7]

Thanks for doing all that testing. I've published a new release: https://github.com/gmenounos/kw1281test/releases/tag/v0.82-beta

Can you download it and try this new command:

.\kw1281test COM6 10400 17 DumpRBxMemOdd 66560 1024

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 17 DumpRBxMemOdd 66560 1024
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.5
Culture: en-GB
Opening serial port COM6
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 17 F1 1A 94 38 (readEcuIdentification)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
   at System.IO.Ports.SerialStream.ReadByte(Int32)
   at System.IO.Ports.SerialStream.ReadByte()
   at System.IO.Ports.SerialPort.ReadByte()
   at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 36
   at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 104
   at BitFab.KW1281Test.KW2000Dialog.ReceiveMessage() in C:\Users\gmeno\src\kw1281test\Kwp2000\KW2000Dialog.cs:line 199
   at BitFab.KW1281Test.KW2000Dialog.SendReceive(DiagnosticService, Byte[], Boolean ) in C:\Users\gmeno\src\kw1281test\Kwp2000\KW2000Dialog.cs:line 122
   at BitFab.KW1281Test.Cluster.BoschRBxCluster.SecurityAccess(Byte) in C:\Users\gmeno\src\kw1281test\Cluster\BoschRBxCluster.cs:line 32
   at BitFab.KW1281Test.Cluster.BoschRBxCluster.UnlockForEepromReadWrite() in C:\Users\gmeno\src\kw1281test\Cluster\BoschRBxCluster.cs:line 14
   at BitFab.KW1281Test.Tester.DumpRBxMem(UInt32, UInt32, String, Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 433
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 244
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

This is what I got. It definitely took the longest out of anything so far so it seems to be doing something

 

[dhangejr]

First THANKS! This is GREAT! No more Russian software and no more vag taco ! You sir are genius!

I have one question regarding the RF ID programing into the immobilizer: do you have to reprogram old RFID chips when programming a new one ?

I thought IMMO3 chips could only be programmed once , I know whenever you program a new remote all the remotes must be present.

I’m just trying to decide how many RFID chips I need

 

[caffeine]

First THANKS! This is GREAT! No more Russian software and no more vag taco ! You sir are genius!

I have one question regarding the RF ID programing into the immobilizer: do you have to reprogram old RFID chips when programming a new one ?

I thought IMMO3 chips could only be programmed once , I know whenever you program a new remote all the remotes must be present.

I’m just trying to decide how many RFID chips I need

My understanding is that any key that has been previously programmed to either the ECU or cluster can be re-used when programming a new key. However, when programming keys to the immobilizer system, all have to be programmed (or reprogrammed) at once.

Also, most IMMO2 keys I've come across can be reused with IMMO3. Being previously used with an IMMO2 system will not count towards the initial IMMO3 programming.

 

[Nuje]

The above from @caffeine has been my experience as well.

The "write once" pairing of the RFID, though, relates to being good on just that one car to which the key was initially paired/programmed.

So, if you find a key sitting in a wreck at the scrapyard and think you're going to just replace the key blade and then pair the key to IMMO - won't work.
You can still re-use that key body, but it would require removing and replacing the little grain-of-rice-sized RFID glass vial that's embedded in the key body.

You can get a 5-pack of those RFID things at Aliexpress for like $10, and it's not brain surgery to replace one (I've done a couple), but you'll probably want to check out a couple YT videos so you know exactly where you're going to get at it.

 

[dhangejr]

The above from @caffeine has been my experience as well.

The "write once" pairing of the RFID, though, relates to being good on just that one car to which the key was initially paired/programmed.

So, if you find a key sitting in a wreck at the scrapyard and think you're going to just replace the key blade and then pair the key to IMMO - won't work.
You can still re-use that key body, but it would require removing and replacing the little grain-of-rice-sized RFID glass vial that's embedded in the key body.

You can get a 5-pack of those RFID things at Aliexpress for like $10, and it's not brain surgery to replace one (I've done a couple), but you'll probably want to check out a couple YT videos so you know exactly where you're going to get at it.

My question is simpler said : “if I make a new rfid chip will my old one still work?

 

[gmenounos]

My question is simpler said : “if I make a new rfid chip will my old one still work?

Your old ones will still work but you have to match all of them to the car as explained here: http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Cluster)

 

[dhangejr]

Ok so I is just like matching the remote. This is great news !

 

[Nuje]

Yes - current key + add new (new) key(s) = no problem. Just need to do all at the same time. Follow Ross-Tech instructions.

Current key + new (to you; previously matched to different car) key with new blade = no go (until you replace the IMMO chip with one of these).

 

[Edgey]

Hey guys.

Just discovered this forum and software, and hoping it might be the answer to my problems!

So long story short, I bought a VW T4 2.5TDI with a fault code of "engine start blocked by immobiliser". I think they may have initially disabled the immobiliser on the ECU, and it's has somehow reset to being active again. Not 100% as there seems to be quite a bit of dodgy wiring in the van.

Having run VCDS lite, it confirms the fault and with the key in the ignition, it says it's not an authorised key. My hope is that I can just re-program the key using VCDS once I've pulled the SKC.

My ECU is a 7D0920902EX T4-KOMBIINSTR. VDO V01.

Having briefly flicked through some of the pages on this thread, I found something that said this software won't work on a VDO ECU. Is that right? Does this mean I can't pull the SKC from it using this?

Any help you can offer would be massive appreciated!

Thanks.

 

[gmenounos]

So long story short, I bought a VW T4 2.5TDI with a fault code of "engine start blocked by immobiliser". I think they may have initially disabled the immobiliser on the ECU, and it's has somehow reset to being active again. Not 100% as there seems to be quite a bit of dodgy wiring in the van.

Having run VCDS lite, it confirms the fault and with the key in the ignition, it says it's not an authorised key. My hope is that I can just re-program the key using VCDS once I've pulled the SKC.

My ECU is a 7D0920902EX T4-KOMBIINSTR. VDO V01.

I'm pretty sure the T4 uses an external immobilizer box which kw1281test doesn't support. I don't have access to a T4 which makes it hard/impossible to support. Sorry.

 

[Edgey]

I'm pretty sure the T4 uses an external immobilizer box which kw1281test doesn't support. I don't have access to a T4 which makes it hard/impossible to support. Sorry.

Ok thanks man. Might give it a try anyway. What are the test codes for the various known locations, or is there a generic dump which will look in all locations?

 

[gmenounos]

Ok thanks man. Might give it a try anyway. What are the test codes for the various known locations, or is there a generic dump which will look in all locations?

Sorry but I don't have any info about T4 clusters.

 

[Edgey]

Sorry but I don't have any info about T4 clusters.

No worries bud. It's a great bit of software/coding, just a shame it doesn't seem to work on mine. I've just done a complete dump (0 2048). If it's there, would it just be the pattern of 3 repeating pairs do you think?

Edit: assuming not, as I've just started looking and already found a few lines which have the 3 repeating pairs.

 

[Kermit123]

Hi - I just discovered kw1281test and am really impressed with Gmenounos' ingenuity and passion. I am new to VW as well - I just bought my daughter a 2004 convertible beetle 2L. I need more keys. Do I understand correctly that kw1281test lets me pull the SKC, but I will still need to purchase Ross-Tech's VCDS to program the new keys? Sorry about being dense. Clearly I can pull the SKC, I just can figure out from the thread if kw1281test allows programming new keys. Thank you.

 

[Edgey]

Hi - I just discovered kw1281test and am really impressed with Gmenounos' ingenuity and passion. I am new to VW as well - I just bought my daughter a 2004 convertible beetle 2L. I need more keys. Do I understand correctly that kw1281test lets me pull the SKC, but I will still need to purchase Ross-Tech's VCDS to program the new keys? Sorry about being dense. Clearly I can pull the SKC, I just can figure out from the thread if kw1281test allows programming new keys. Thank you.

Hi Kermit. My understanding is once you've pulled the SKC, you can then use VCDS lite which is free to program additional keys. Take a look over the website, see which set up you have and how to do it.

Immobilizer II Key Matching (Separate) - Ross-Tech Wiki

wiki.ross-tech.com

 

[Kermit123]

Edgey - thanks for the direction. Looks like VCDS lite should work with the cable recommended for use with kw1281test at the beginning of this string as well. https://www.amazon.com/dp/B00K6498D...42GA4C2U&psc=1&ref_=list_c_wl_lv_ov_lig_dp_it
I appreciate the help. I pick up the car this weekend and wanted to get a head start.

 

[Kermit123]

I read the VCDS Lite information and went through the videos - net is that you need to register the Lite version for $99 in order to have the "save" button active on the Adaptation function to save the key configuration for the IMMO3. Anyone know of a "freeware" version that enables applying the IMMO to new keys? thank you.

 

[gmenounos]

I read the VCDS Lite information and went through the videos - net is that you need to register the Lite version for $99 in order to have the "save" button active on the Adaptation function to save the key configuration for the IMMO3. Anyone know of a "freeware" version that enables applying the IMMO to new keys? thank you.

kw1281test can do adaptation save.

 

[Kermit123]

Thank you ! That's terrific! sorry, I could not figure that out from the thread.

 

[gmenounos]

All the commands are listed here: https://github.com/gmenounos/kw1281test
There's also a Wiki here that anyone is allowed to edit: https://github.com/gmenounos/kw1281test/wiki

 

[AndyBees]

Subscribed ...

 

[PabloS]

I have a 180 PS Audi TT FWD build in 2000. Engine Code APP. I need the PIN of the immobilizer to learn the old keys again. According to VCDS, 4 keys are learned, but I only received 3 when I bought it.
I have two OBD cables and both work very well. Unfortunately I could not find a pin code in the hex files and the automatic search with the tools does not work. Maybe someone can help me find the pin, I don't know how to continue.

RS232 VAG-COM 409.1 Cable with FTDI Adapter to USB
VCDS Dual K + CAN USB with RossTech VCP Drivers

Speedometer 8N1 920 860 C | M73 D08 | AUZ5Z0Y7072163 + Engine 8N0 906 018 Q

- kw1281test 0.82 could read the speedometer. (kw1281test.exe COM1 9600 17 DumpMarelliMem 14336 2048)
- me7_95040 v1.31 could read the engine control unit. (me7_95040.exe --OBD -r -p 1 95040.bin)
- VAG K CAN COMMANDER v1.4 could only read the speedometer in direct mode.

0000    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0010    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0020    ff ff ff ff ff ff ff ff  e0 00 01 20 00 00 ff ff   ........... ....
0030    ff e2 d5 9b ff f9 ff ff  ff ff ff ff ff ff ff ff   ................
0040    ff ff 06 06 f9 ff ff ff  10 00 47 41 30 4a 57 5a   ..........GA0JWZ
0050    37 30 30 30 33 10 ff ff  ff ff ff ff ff ff ff ff   70003...........
0060    87 ff 00 00 00 00 ff ff  ff ff ff ff ff ff ff ff   ................
0070    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0080    ff 0c 1d 00 04 0f 14 ff  00 00 04 00 ff ff ff ff   ................
0090    ff ff ff ff 03 69 ff ff  ff ff fc 72 6f ff fc 72   .....i.....ro..r
00a0    6d ff fc 72 6b ff fc 72  69 ff fc 72 67 ff fc 72   m..rk..ri..rg..r
00b0    65 ff fc 72 63 ff fc 72  61 ff fc 72 5f ff fc 72   e..rc..ra..r_..r
00c0    5d ff fc 72 5b ff fc 72  59 ff fc 72 57 ff fc 72   ]..r[..rY..rW..r
00d0    55 ff fc 72 9b ff fc 72  99 ff fc 72 97 ff fc 72   U..r...r...r...r
00e0    95 ff fc 72 93 ff fc 72  91 ff fc 72 8f ff fc 72   ...r...r...r...r
00f0    8d ff fc 72 8b ff fc 72  89 ff fc 72 87 ff fc 72   ...r...r...r...r
0100    85 ff fc 72 83 ff fc 72  81 ff fc 72 7f ff fc 72   ...r...r...r...r
0110    7d ff fc 72 7b ff fc 72  79 ff fc 72 77 ff fc 72   }..r{..ry..rw..r
0120    75 ff fc 72 73 ff fc 72  71 00 03 8d 90 00 03 8d   u..rs..rq.......
0130    92 00 03 8d 94 00 03 8d  96 00 03 8d 98 00 03 8d   ................
0140    9a 00 03 8d 9c 00 03 8d  9e 00 03 8d a0 00 03 8d   ................
0150    a2 00 03 8d a4 00 03 8d  a6 00 03 8d a8 00 03 8d   ................
0160    aa 00 03 8d 64 00 03 8d  66 00 03 8d 68 00 03 8d   ....d...f...h...
0170    6a 00 03 8d 6c 00 03 8d  6e 00 03 8d 70 00 03 8d   j...l...n...p...
0180    72 00 03 8d 74 00 03 8d  76 00 03 8d 78 00 03 8d   r...t...v...x...
0190    7a 00 03 8d 7c 00 03 8d  7e 00 03 8d 80 00 03 8d   z...|...~.......
01a0    82 00 03 8d 84 00 03 8d  86 00 03 8d 88 00 03 8d   ................
01b0    8a 00 03 8d 8c 00 03 8d  8e ff ff ff ff ff ff ff   ................
01c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
01d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
01e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
01f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0200    ff ff ff ff ff ff ff ff  00 01 01 6d 00 0f 00 0f   ...........m....
0210    0b 7e 0b 7e 05 55 03 fa  01 2f 80 95 ff ff ff ff   .~.~.U.../......
0220    ff ff ff 15 6d ff ff ff  ff 38 4e 31 39 32 30 38   ....m....8N19208
0230    36 30 43 20 20 44 30 38  02 bc 29 24 3a 5e 79 93   60C  D08..)$:^y.
0240    b4 cf 43 fa de 1d 44 60  04 cf 44 60 06 9e 34 7b   ..C...D`..D`..4{
0250    b2 6d ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   .m..............
0260    ff ff 04 29 24 3a 5e 79  93 b4 cf 43 fa de 1d 44   ...)$:^y...C...D
0270    60 04 cf 44 60 06 9e 34  7b b2 6d ff ff ff ff ff   `..D`..4{.m.....
0280    ff ff ff ff ff ff ff ff  ff ff ff 04 29 24 3a 5e   ............)$:^
0290    79 93 b4 cf 43 fa de 1d  44 60 04 cf 44 60 06 9e   y...C...D`..D`..
02a0    34 7b b2 6d ff ff ff ff  ff ff ff ff ff ff ff ff   4{.m............
02b0    ff ff ff ff 04 ff 00 01  e6 01 f0 01 54 01 e9 ff   ............T...
02c0    fe ff f7 ff f5 ff 69 ff  ff ff ff 28 59 ff fe ff   ......i....(Y...
02d0    f8 ff f5 ff 69 ff ff ff  ff 28 58 00 01 00 08 00   ....i....(X.....
02e0    0a 00 96 00 00 00 00 d7  a6 00 01 00 07 00 0a 00   ................
02f0    96 00 00 00 00 d7 a7 ff  ff ff ff 00 ff ff 00 ff   ................
0300    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0310    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0320    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0330    3b 7c c4 83 59 37 30 37  32 31 36 33 ff ff ff ff   ;|..Y7072163....
0340    ff 00 00 ff ff ff ff ff  ff 00 0b ff ff ff ff ff   ................
0350    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0360    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0370    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0380    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0390    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03a0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03b0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
03f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0400    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0410    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0420    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0430    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0440    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0450    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0460    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0470    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0480    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0490    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04a0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04b0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
04f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0500    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0510    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0520    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0530    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0540    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0550    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0560    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0570    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0580    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0590    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05a0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05b0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
05f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0600    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0610    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0620    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0630    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0640    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0650    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0660    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0670    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0680    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0690    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06a0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06b0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
06f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0700    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0710    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0720    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0730    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0740    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0750    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0760    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0770    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0780    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
0790    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07a0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07b0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07c0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07d0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07e0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................
07f0    ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ................

C:\Users\Paul\Desktop\VW>kw1281test COM1 9600 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 9600 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.5
Culture: de-DE
Opening serial port COM1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920860C  KOMBI+WEGFAHRS. M73 D08
Software Coding 00144, Workshop Code: 00000
Caught: System.InvalidOperationException Unsupported cluster version.
Unhandled exception: System.InvalidOperationException: Unsupported cluster version.
   at BitFab.KW1281Test.Cluster.MarelliCluster.GetDefaultAddress() in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 38
   at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 18
   at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 571
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

C:\Users\Paul\Desktop\VW>kw1281test COM1 10400 1 ReadIdent
KW1281Test: Yesterday's diagnostics...Today.

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 1 ReadIdent
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.5
Culture: de-DE
Opening serial port COM1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N0906018Q  1.8L R4/5VT         0004
Software Coding 05500, Workshop Code: 01236
Sending ReadIdent block
Ident: 8N0906018Q  1.8L R4/5VT         0004
Software Coding 05500, Workshop Code: 01236
Sending EndCommunication block

C:\Users\Paul\Desktop\VW>kw1281test COM1 10400 1 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 1 GetSKC
OSVersion: Microsoft Windows NT 10.0.19044.0
.NET Version: 7.0.5
Culture: de-DE
Opening serial port COM1
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
Caught: System.InvalidOperationException Unable to wake up ECU in KW2000 mode. KW version: 1281
Unhandled exception: System.InvalidOperationException: Unable to wake up ECU in KW2000 mode. KW version: 1281
   at BitFab.KW1281Test.Tester.DumpEdc15Eeprom(String ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 357
   at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 609
   at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
   at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[gmenounos]

0080 ff 0c 1d 00 04 0f 14 ff 00 00 04 00 ff ff ff ff

Your SKC might be 03101.

 

[PabloS]

Thank you gmenounos You are a genius! The control unit accepted the pin immediately. Thank you again for your support and this great project.

 

[Kermit123]

gmenounos - I am getting outsmarted with access to kw1281test. I bought the blue cable, downloaded the drivers, but get a timeout first and then when I run it again I get an unexpected sync byte. I thought it might be the cheap CH341 cable, but then I downloaded VCDS lite and that works just fine. Any pointers greatly appreciated. Its been 30 years since I did any command line stuff, but it coming back. Thank you. My immediate interest is in pulling the SKC and then programming another key.


C:\KW1281TEST>kw1281test_0.82-beta_Win10\kw1281test.exe COM3 10400 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19041.0
.NET Version: 7.0.5
Culture: en-US
Opening serial port COM3
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $0A
Protocol is KW 1281 (8N1)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialStream.ReadByte(Int32)
at System.IO.Ports.SerialStream.ReadByte()
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in C:\Users\gmeno\src\kw1281test\Interface\GenericInterface.cs:line 36
at BitFab.KW1281Test.KwpCommon.ReadByte() in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 104
at BitFab.KW1281Test.KW1281Dialog.ReadAndAckByte() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 442
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 384
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 351
at BitFab.KW1281Test.KW1281Dialog.Connect() in C:\Users\gmeno\src\kw1281test\KW1281Dialog.cs:line 91
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 39
at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 484
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

C:\KW1281TEST>kw1281test_0.82-beta_Win10\kw1281test.exe COM3 10400 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19041.0
.NET Version: 7.0.5
Culture: en-US
Opening serial port COM3
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Unexpected sync byte: Expected $55, Actual $95
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $95
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 75
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 484
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[gmenounos]

gmenounos - I am getting outsmarted with access to kw1281test. I bought the blue cable, downloaded the drivers, but get a timeout first and then when I run it again I get an unexpected sync byte. I thought it might be the cheap CH341 cable, but then I downloaded VCDS lite and that works just fine. Any pointers greatly appreciated. Its been 30 years since I did any command line stuff, but it coming back. Thank you. My immediate interest is in pulling the SKC and then programming another key.

C:\KW1281TEST>kw1281test_0.82-beta_Win10\kw1281test.exe COM3 10400 17 GetSKC

If the car is a Beetle, you need to use 9600 baud when communicating with the cluster, not 10400.