kw1281test: A Free VDS-Pro / VagTacho Alternative

[Silver12]

Used to be three keys, but now only two...have the keys been used on a different car before?
You have to use a "never paired to a car before" key (there's a "write-once" little RFID thingy in the key-blade portion of the key). If a key was previously paired to that car, though, it should work.

Interesting. The key I’m starting the process with was one of the three keys previously coded. But as I mentioned, the car is not holding the new number (2), but just dropping it down to 1 after I perform the save. And it is annoyed with something because the immobilizer light keeps flashing though the car will run with that key.

Can I start the whole process with a virgin key and assume the key I’ve been using is restricting the number to 1? I’ve been avoiding this because that process would make my one remaining key useless.

Or must I start the process with a key that’s already coded?

Thank you again. I’ve done this before with no issues, not sure why this is going on.

 

[Nuje]

Immobilizer II Key Matching (Cluster) - Ross-Tech Wiki

wiki.ross-tech.com

(Assuming the car in question is the "2000 VR6" listed under your username; if not, look at the IMMO3 instructions.)

 

[Silver12]

Thank you for sharing that. According to that page I’m following the correct procedure.

What is not explained on that page, is whether I can start the adaptation with a virgin (unauthorized) key, instead of the one that runs the car right now and I’ve been trying to use for the adaptation. The idea here is that there may be something about the key I am using that’s causing the controller to force the number of authorized keys down to 1 all the time.

The SKC I’ve been entering seems to be working fine.

 

[Silver12]

Those last couple questions were a bit off-topic, sorry.

On-topic though, trying to rule out possibilities, is there a possibility the 4-digit code retrieved with the kw1381test is NOT actually the correct code that would have been on my black plastic tag which was accidentally thrown away? Or is the fact that the code I retrieved by this software being accepted and allowing access to at least changing the number of keys (albeit with the car or software dropping it to “1”) by indication that it must be the one and only SKC, and the problem lies elsewhere?

Thank you again for your work on this software!

 

[arp]

On-topic though, trying to rule out possibilities, is there a possibility the 4-digit code retrieved with the kw1381test is NOT actually the correct code that would have been on my black plastic tag which was accidentally thrown away?

The SKC should be 5 digits. If you only have 4, try putting a leading "0." That said, kw1281test should spit out the full 5 digits, so I guess there's a chance it's wrong. I think that happened in a post maybe 30 pages ago but has since been resolved. Unfortunately, we're at the limits of my knowledge here.

What is not explained on that page, is whether I can start the adaptation with a virgin (unauthorized) key, instead of the one that runs the car right now and I’ve been trying to use for the adaptation.

I did an adaptation starting with a virgin transponder I bought off Amazon and then coded my original key. AFAIK, order shouldn't matter.

 

[Silver12]

Thanks, yeah if you put the obligatory “0” on the front, then yeah, 5-digits. For whatever reason people seem to call the MK4 SKC a 4-digit code. Maybe I’ll pull the code again and see what is says. I should add that the first couple tries didn’t work, but the third did. I do recall seeing an “error” in the log readout above it though. I can probably pull that and send it to you if you’re interested.

 

[arp]

I should add that the first couple tries didn’t work, but the third did. I do recall seeing an “error” in the log readout above it though. I can probably pull that and send it to you if you’re interested.

Pulling the SKC has been perfectly reliable for me, but adaptation was another story. It didn't work the first few times I tried and then, magically, it worked on my this-is-the-last-attempt-before-I-go-to-bed try.

 

[gmenounos]

Thanks so much. Unfortunately, I haven't been able to get it to work and I'm not sure why. Running the command reads the block and outputs it to the terminal, but I don't I see any other feedback about the test itself. It appears to do *something* because it locks the engine RPMs to idle until I quit, but the monitors still aren't ready. Are there logs I can check to see if running the test succeeded or failed? Maybe a more verbose mode?

You could email me your kw1281test.log file and I can take a look and see if I can figure out what's going on. You can find my email here.

 

[arp]

You could email me your kw1281test.log file and I can take a look and see if I can figure out what's going on. You can find my email here.

Sent! Thank you so much.

 

[gmenounos]

Interesting. The key I’m starting the process with was one of the three keys previously coded. But as I mentioned, the car is not holding the new number (2), but just dropping it down to 1 after I perform the save. And it is annoyed with something because the immobilizer light keeps flashing though the car will run with that key.

Can I start the whole process with a virgin key and assume the key I’ve been using is restricting the number to 1? I’ve been avoiding this because that process would make my one remaining key useless.

Or must I start the process with a key that’s already coded?

Thank you again. I’ve done this before with no issues, not sure why this is going on.

So, can you try the following steps exactly and let us know if it worked or not?
(Substitute the appropriate COM port and SKC)

1. Insert key #1 in the ignition, turned to "on" with the engine off. The immobilizer light is on.
2. Run "AdaptationSave" command:
   kw1281test.exe com1 10400 17 AdaptationSave 21 2 01234
   (Immobilizer light turns off when adapted)
3. Remove Key
4. Insert key #2 (existing key) in the ignition and turn to "on".
   (The immobilizer light should be on. Being the last key, the light should blink once then turn off.)
5. Remove key from ignition
6. Remove Cable
   (All keys should now start the car)

 

[Juliencesar02]

Hello, can you check my log ?
I can't dump the .bin

https://www.swisstransfer.com/d/20be894b-b516-4ce0-8935-927b782d2beb

 

[gmenounos]

Hello, can you check my log ?
I can't dump the .bin

ECU: 1J0920826C KOMBI+WEGFAHRS. BPV V06

I've never seen a BPV cluster before. I did some searching and I think it's a Bosch/Motometer cluster instead of the usual VDO. You can try the following and see if it works better:

kw1281test.exe COM2 10400 17 DumpRBxMem 66560 1024

 

[Juliencesar02]

it's worked thanks

https://www.swisstransfer.com/d/f6db821d-aa16-404d-976c-d279e6a9a5ed

 

[Juliencesar02]

do you know how to do the needle sweep on it? I can't find any info

 

[gmenounos]

do you know how to do the needle sweep on it? I can't find any info

As far as I know, MKIV needle sweep is only possible on VDO clusters.

 

[gmenounos]

it's worked thanks

https://www.swisstransfer.com/d/f6db821d-aa16-404d-976c-d279e6a9a5ed

Can you share the .bin file that was saved?

 

[gmenounos]

it's worked thanks

https://www.swisstransfer.com/d/f6db821d-aa16-404d-976c-d279e6a9a5ed

I think your SKC is 05722. Can you verify?

 

[gmenounos]

As far as I know, MKIV needle sweep is only possible on VDO clusters.

Here is the only needle sweep info that I'm aware of:

• http://www.graeme86.com/sweep501mh/sweep501mh.html
• http://www.graeme86.com/sweep503mh/sweep503mh.html

 

[RandoV]

I tried today to get my SKC and run into Windows problem..
I have Windows 10 2H22, and as I run command, popup came about App and Browser control has blocked a download of file.

I will install Win 7 on virtual machine and try one more time.
Or maybe someone know how to bypass it?
Btw how realistic it is that SKC is only 1 digit long (I got nr 7),ising CarProg on ECU?

 

[themazman]

does anyone have an idea of what i did wrong or what i need to change? Vehicle is 01 beetle. Originally i sent it at 10400 then changed to 9600.


Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com1 10400 17 getskc
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.5
Culture: en-US
Opening serial port com1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Caught: System.InvalidOperationException Unexpected sync byte: Expected $55, Actual $95
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $95
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in C:\Users\gmeno\src\kw1281test\KwpCommon.cs:line 75
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in C:\Users\gmeno\src\kw1281test\Tester.cs:line 32
at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 484
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

Version 0.82-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com1 9600 17 getskc
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.5
Culture: en-US
Opening serial port com1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920906A KOMBI+WEGFAHRS. M73 V03
Software Coding 03232, Workshop Code: 02104
Caught: System.InvalidOperationException Unsupported cluster version.
Unhandled exception: System.InvalidOperationException: Unsupported cluster version.
at BitFab.KW1281Test.Cluster.MarelliCluster.GetDefaultAddress() in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 38
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in C:\Users\gmeno\src\kw1281test\Cluster\MarelliCluster.cs:line 18
at BitFab.KW1281Test.Tester.GetSkc() in C:\Users\gmeno\src\kw1281test\Tester.cs:line 571
at BitFab.KW1281Test.Program.Run(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 249
at BitFab.KW1281Test.Program.Main(String[]) in C:\Users\gmeno\src\kw1281test\Program.cs:line 26

 

[gmenounos]

does anyone have an idea of what i did wrong or what i need to change? Vehicle is 01 beetle. Originally i sent it at 10400 then changed to 9600.
...
ECU: 1C0920906A KOMBI+WEGFAHRS. M73 V03
...

Try this and see if it downloads the EEPROM from the cluster:
kw1281test com1 9600 17 DumpMarelliMem 3072 1024

 

[gmenounos]

Try this and see if it downloads the EEPROM from the cluster:
kw1281test com1 9600 17 DumpMarelliMem 3072 1024

Actually, just download this new release and see if the GetSKC command works for your cluster (make sure to use 9600 baud since it's a Beetle):

Release v0.83-beta · gmenounos/kw1281test

Added support for 1C0920906 Beetle clusters Added DumpRam command

github.com

 

[themazman]

I downloaded the new release worked like a charm! i had tried the memory dump, but i was too dumb to figure out how to read the bin file. Thank you for your labor of love for the community!

 

[Matt-98AHU]

Finally got around to trying this out. I've had this KKL serial port cable for the longest time, was using it on an old laptop with DOS and a serial port to use VDS Pro. It does get a bit old to lug that ancient beast around on top of my regular laptop/tablet (nice, slim Windows Surface 7 Pro).

Got an FTDI Serial->USB converter for the old cable and it absolutely worked. Was trying to experiment with turning my 2001 Golf's cluster to pickup VSS via CAN. Sadly, the hack didn't work, but the downloading the cluster eeprom as well as reading and writing to individual bytes worked perfect. Pretty awesome.

Seems there's support to do that hack for VWK501 and 503 clusters, mine's a weirdo VAT500LL. I didn't find any information on my specific cluster, so I was just tried changing address 0x0065 to a couple different values.

Some people reported their newer clusters as having value $80 and changing it to $81 or $82 did the trick.

Mine was $8C to start with, so using a hex->binary converter, seeing what that translated too as well as what $80 and $81 and $82 translated to, tried flipping those bits and convert back to hex. So, tried changing the $8C to $8D, no luck. Tried $8F, still no luck. So, plugged my VSS back in and put it back to the original $8C value, seemingly no harm no foul.

The first attempt at changing the individual byte, I dumped the EEPROM all over again just to be sure I did infact change the right address (using a free hex editor to view) and it did exactly as I expected it to, so, at least verification that the program changed the byte I requested to the requested value, no problem.

I'll be helping someone do some auto to manual swap wiring this weekend with a 09A, the biggest pain in the butt was the VSS wiring. Fortunately, vast majority of 09A-equipped cars have later clusters, so I should be able to hack this customer's cluster without issue. I was just using my Golf as a test vehicle, proof-of-concept if you will. And towards that end, at least, the program did what it was supposed to. Will try it for CCM hacks later. Very familiar with doing those in VDS pro, I've got addresses and values in decimal memorized for a lot of vehicles at this point. heh.

Good work!

 

[Matt-98AHU]

Successfully hacked a Jetta wagon CCM for comfort window operation via remote plus hatch on central locking today.

The usual 1C0959799C module. Addresses 04361, 04362 and 04363 started off at 202, all got changed to 195.

This was a 1.8T wagon which also had a manual swap done to it. 09As were always a giant pain in the butt to rewire because of the lack of VSS wiring to the cluster. Manual transmission setups and 01Ms wire the G22 VSS to T32/28 at the cluster, then the cluster repeats the VSS, outputting the signal on T32/3 and sending it to the ECU from there.

09As, they just have the VSS going to the TCM, then the TCM repeats the signal to the ECU and cluster separately from there, so the cluster no longer uses t32/3 for anything since the TCM is already taking care of the signal to the ECU.

This cluster was from a 2003, software version VWK501LL instead of the VWK500LL my 2001 has. Value at address 0x0065 was $80 like people report other later clusters as being. Changing it to $81 or $83 did infact get the cluster to register a vehicle speed signal when one wheel was rotated, I could see it in measured values. But, measured value 66 in the address 01 engine did not register a signal.

I do have the output wire from t32/3 wired to the correct pin at the ECU, assuming that even if the cluster is picking up VSS via CAN that maybe it would still send a VSS output signal on t32/3 to the ECU, but it appears that might not be the case. I tried changing 0x0065 to both $81, then tried, and then $83. Both times I could see VSS in 17 instruments MVBs, but not 01 engine.

If anyone has additional resources on how to enable VSS out on T32/3 even when picking up VSS to the cluster by CAN or what bits could be flipped at what address(es) in the ECU to have it directly pick up the signal from CAN as well, that would be super helpful. ECU part no 06A906032HS

 

[Rxracer]

Alright. New member here. Bought my 1999.5 golf about 2 months ago.
learing now how much 1999.5 suck lol. My car has the 919 pre can clusterand I had read you can upgrade to a 920 cluster immo2 or immo3 to get half mfi display working for outside temp but not miles to empty which is fine with me.
after a bit of looking I found a 2001 immo2 tdi sport manual cluster half mfi over the pond and purchased it. Now when it comes I’d love to correct the mileage and from what I’ve read I have to code out the air bag light.
Anyone have a guide for dummies or pointers?
Thanks

 

[gmenounos]

Alright. New member here. Bought my 1999.5 golf about 2 months ago.
learing now how much 1999.5 suck lol. My car has the 919 pre can clusterand I had read you can upgrade to a 920 cluster immo2 or immo3 to get half mfi display working for outside temp but not miles to empty which is fine with me.
after a bit of looking I found a 2001 immo2 tdi sport manual cluster half mfi over the pond and purchased it. Now when it comes I’d love to correct the mileage and from what I’ve read I have to code out the air bag light.
Anyone have a guide for dummies or pointers?
Thanks

I have a 99.5 Golf that I upgraded to an Immo3 cluster a few years ago. You can change the soft coding of the CAN Gateway (address 19) to tell the cluster that your car has no airbags. Just subtract 4 from whatever the current value is.

The other issue that you're going to run into is the Immobilizer light / beep. Your 99.5 ECU has no immobilizer but the cluster doesn't know that so it'll bug you every time you start the car (and maybe also while you're driving around). The way around that is to pull the immobilizer coil off a 2000-2003 ignition lock cylinder, connect it to the cluster with a twisted pair of wires, buy a glass immobilizer pill, tape it to the coil and match it to the cluster as if it's an actual key. I did all that and it worked. Here's more info about installing a newer cluster in a 99.5 car (including photos of the immobilizer coil):

How to: Immo 3 cluster MFA in 99.5 car

So, you want to put an IMMO 3 cluster with half-height display in your 99.5 jetta? I can’t do it for you, (well, actually I could if you’re willing to pay me) but I can try and help you do it yourself. SOURCING PARTS/WIRES/EVERYTHING YOU NEED: You’ll need to start with an IMMO 3 cluster. The...

forums.tdiclub.com

I don't know where the odometer is stored in Immo2 clusters. If I find out, I'll let you know.

 

[Rxracer]

I have a 99.5 Golf that I upgraded to an Immo3 cluster a few years ago. You can change the soft coding of the CAN Gateway (address 19) to tell the cluster that your car has no airbags. Just subtract 4 from whatever the current value is.

The other issue that you're going to run into is the Immobilizer light / beep. Your 99.5 ECU has no immobilizer but the cluster doesn't know that so it'll bug you every time you start the car (and maybe also while you're driving around). The way around that is to pull the immobilizer coil off a 2000-2003 ignition lock cylinder, connect it to the cluster with a twisted pair of wires, buy a glass immobilizer pill, tape it to the coil and match it to the cluster as if it's an actual key. I did all that and it worked. Here's more info about installing a newer cluster in a 99.5 car (including photos of the immobilizer coil):

How to: Immo 3 cluster MFA in 99.5 car

So, you want to put an IMMO 3 cluster with half-height display in your 99.5 jetta? I can’t do it for you, (well, actually I could if you’re willing to pay me) but I can try and help you do it yourself. SOURCING PARTS/WIRES/EVERYTHING YOU NEED: You’ll need to start with an IMMO 3 cluster. The...

forums.tdiclub.com

I don't know where the odometer is stored in Immo2 clusters. If I find out, I'll let you know.

So I have a 2004 golf I could steal the immobilizer stuff from. I’ve been tinkering and have dumped the rom on mine trying to figure it out.
The new cluster is a immo2. I tried to use vag eeprom 1.9g to edit the mileage on a immo2 but it seems that program will not talk to a immo2 cluster it seems.
My new cluster should be here next week. I’m not sure if there is much more to do since it is a tdi cluster.

The main thing I was curious on was the air bag light and the immobilizer and correcting the mileage. I’ll wire in an outside temp sensor as well.

 

[yuriy456]

Hey, bit of a lurker here. I have used your program for numerous mk4 platforms with great results. I have tried to use it today to get the SKC from a 2008 Golf City, which is basically a facelift mk4 that we received here in Canada. Immo 3, however I'm not having any success here. Do you know anything about the clusters that came in this car?

Version 0.84-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com4 10400 17 getskc
OSVersion: Microsoft Windows NT 10.0.18363.0
.NET Version: 7.0.11
Culture: en-CA
Opening serial port com4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1JE920827   KOMBI+WEGFAHRSP VDO V01
Software Coding 09334, Workshop Code: 93076
Sending EndCommunication block

That's as far as it goes for me.

 

[gmenounos]

Hey, bit of a lurker here. I have used your program for numerous mk4 platforms with great results. I have tried to use it today to get the SKC from a 2008 Golf City, which is basically a facelift mk4 that we received here in Canada. Immo 3, however I'm not having any success here. Do you know anything about the clusters that came in this car?

Version 0.84-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com4 10400 17 getskc
OSVersion: Microsoft Windows NT 10.0.18363.0
.NET Version: 7.0.11
Culture: en-CA
Opening serial port com4
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1JE920827   KOMBI+WEGFAHRSP VDO V01
Software Coding 09334, Workshop Code: 93076
Sending EndCommunication block

That's as far as it goes for me.

Thanks for the report. kw1281test wasn't recognizing "1JE920827" as a cluster part number because it was expecting the 3rd character to be a digit. Should be fixed in version 0.85:

Release v0.85-beta · gmenounos/kw1281test

Fixed an issue where it was failing to identify "1JE920827" as a cluster part number because it was expecting the 3rd character to be a digit. Added a unit test project.

github.com