kw1281test: A Free VDS-Pro / VagTacho Alternative

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
Finally got around to trying this out. I've had this KKL serial port cable for the longest time, was using it on an old laptop with DOS and a serial port to use VDS Pro. It does get a bit old to lug that ancient beast around on top of my regular laptop/tablet (nice, slim Windows Surface 7 Pro).
Dude, what took you so long? Even though it's all command prompt, SO much more intuitive than VDS Pro. I feel you though - my old laptop is about 6 pounds with rebuilt battery, and old laptops aren't really very visible in sunlight when trying to program the CCM.
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I don't know where the odometer is stored in Immo2 clusters. If I find out, I'll let you know.
Wouldn't it be in hex? So whatever the odometer mileage reports back via VCDS (which is probably kilometers), convert to hex and then search for that string in a hex editor? Or not that simple?
 

turbodieseldyke

Top Post Dawg
Joined
Jun 6, 2010
Location
Free Mustache Rides
TDI
Big ol' honkin' tdis
Wouldn't it be in hex? So whatever the odometer mileage reports back via VCDS (which is probably kilometers), convert to hex and then search for that string in a hex editor? Or not that simple?
If you dump the eeprom before and after a drive, then wherever some bytes have changed, that's where your odo will be.
 

yuriy456

New member
Joined
Sep 26, 2023
Location
Toronto
TDI
BEW
Thanks for the report. kw1281test wasn't recognizing "1JE920827" as a cluster part number because it was expecting the 3rd character to be a digit. Should be fixed in version 0.85:

Awesome, appreciate all the work you put in for the community. Worked like a charm as usual when none of the other programs like vag k+can 1.4 or vageeprom would work. Thanks again!
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Even though that thread is for mk3 clusters, I presume mk4 clusters would follow the same algorithm?
At least some do. Some of the later clusters (VWK503 I think) have a checksum that needs to match the odometer block. Others (Bosch RB8) store the odometer using a different format.

I don't know all the EEPROM details of all the clusters that kw1281test supports, mostly just where the SKC is located.

I want to be the "Here's how to add a new key to your car and roll down your windows with the keyfob on the cheap" guy, not the "Here's how to roll back your odometer" guy.
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I want to be the "Here's how to add a new key to your car and roll down your windows with the keyfob on the cheap" guy, not the "Here's how to roll back your odometer" guy.
I totally get it. For moral and ethical reasons, I'd be in the same boat as you.

Now, I won't lie - it'd be funny to roll UP the odometer just for the purposes of claiming highest mileage on say the facebook TDI group (since I find that whole group a joke). Otherwise, I have zero desire to roll back the odometer or change what it reports and don't think others should be doing the same, either.
 

turbodieseldyke

Top Post Dawg
Joined
Jun 6, 2010
Location
Free Mustache Rides
TDI
Big ol' honkin' tdis
"Here's how to roll back your odometer"
Odo fraud is only prosecutable during the car's first 10 years, federally. If you're worried about potential mischief by crooks, the loss of an entire car to quick immo delete would be much worse than someone rolling the miles back 200k on an unsuspecting buyer. Other signs of wear and tear will be present.


Now, I won't lie - it'd be funny to roll UP the odometer just for the purposes of claiming highest mileage on say the facebook TDI group
You don't need to hack the cluster for that. Just turn the key on, and have your Arduino cycle the VSS input a million times.
 

yuriy456

New member
Joined
Sep 26, 2023
Location
Toronto
TDI
BEW
Odo fraud is only prosecutable during the car's first 10 years, federally. If you're worried about potential mischief by crooks, the loss of an entire car to quick immo delete would be much worse than someone rolling the miles back 200k on an unsuspecting buyer. Other signs of wear and tear will be present.
I'm by no means an expert on the subject but i dont think a "quick" immo delete is even possible. For their age, these cars have some great theft protection and im glad to see that it has stood the test of time.


You don't need to hack the cluster for that. Just turn the key on, and have your Arduino cycle the VSS input a million times.
There's easier ways than that lol.
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I'm by no means an expert on the subject but i dont think a "quick" immo delete is even possible. For their age, these cars have some great theft protection and im glad to see that it has stood the test of time.
On an ALH? immobilizer delete takes me about 5 minutes or less. Super easy. PD and CR require bench flashing, which would be easier if I had an Alienware K-Tag device.

There's easier ways than that lol.
True. Coincidentally, the last, or only Arduino I've bought was for a project here on TDIclub another member did for showing EGTs.
 

Matt-98AHU

Loose Nut Behind the Wheel Vendor
Joined
Apr 23, 2006
Location
Gresham, OR
TDI
2001 Golf TDI, 2005 Passat wagon, 2004 Touareg V10.
Dude, what took you so long? Even though it's all command prompt, SO much more intuitive than VDS Pro. I feel you though - my old laptop is about 6 pounds with rebuilt battery, and old laptops aren't really very visible in sunlight when trying to program the CCM.
I don't know about intuitive. You have to literally know com port, baud rate and the specific addresses for each individual hack you're doing.

VDS Pro you can use as you would VCDS almost, except instead of a full on GUI with mouse support, you just type the numbers of the module address or function you wish to enter. Still does read codes, adaptations, basic settings, live data/measured values etc. just like a normal VAG scan tool.

Though, it is nice I don't need to know any login code. It just does it for the eeprom reading and hacking.

Speaking of, I do have a new co-worker who's got a crank window Jetta sedan. Obviously it's got a trunk setup that doesn't support being put on central locking, but it would be good if I could find a way to help the creator find out what login code might work to allow us to flip bits in those modules.

I know I could read addresses with VDS pro on the central lock modules, but could never write to them. The 19283 login didn't seem to work there. But maybe that login is stored somewhere in the eeprom?
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I don't know about intuitive. You have to literally know com port, baud rate and the specific addresses for each individual hack you're doing.
It takes some practice, but you get the hang of it after a while. For the most part, the COM port my keyspan gets assigned doesn't change. I think all modules are 9600 baud except the instrument cluster, which is 10400. I guess I'm biased, because I've used it a few times, so I remember some, though I don't use it daily. In Windows, it also helped to enable quickedit, so you can double click on options or highlight to copy to the clipboard, to avoid misspelling flags (like ReadEeprom, which I've done by typing manually and forgetting an E).

VDS Pro you can use as you would VCDS almost, except instead of a full on GUI with mouse support, you just type the numbers of the module address or function you wish to enter. Still does read codes, adaptations, basic settings, live data/measured values etc. just like a normal VAG scan tool.
I've used it before on a 486-based ThinkPad I have, which I've rebuilt the battery on. It works, but I still find kw1281test more intuitive, especially when I'm going to open a file in a hex editor or clone the EEPROM to another cluster (in case of an upgrade).
Though, it is nice I don't need to know any login code. It just does it for the eeprom reading and hacking.
That it is. @gmenounos did a fine job on this program. And I was being sarcastic giving you crap in not having used this earlier, btw.
 

lpmlpm

New member
Joined
Oct 4, 2023
Location
Oregon
TDI
Golf 2001
Hey @gmenounos one thing that pleasantly surprised me is that even though I got the dreaded "Failed to unlock cluster.", your tool still outputted the correct SKC (06004 in this case). Isn't this odd? I have a 2001 Golf GTI GLX VR6 (MK4)


Version 0.85-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 getskc
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 7.0.11
Culture: en-US
Opening serial port COM1
Sending wakeup message
Wakeup duration: 2 seconds
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920925D A4-KOMBIINSTR. VDO V09
Software Coding 07232, Workshop Code: 00001
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VAT500MH $01
01: $91 $17
02: $11 $04 $00 $0C $12 $03
03: VW A4/T4 5/01 Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VAT500MH 01.20' is 01 04 3D 35
Sending Custom "Need Seed/Key?" block
Sending Custom "Seed request" block
Sending Custom "Need Seed/Key?" block
Failed to unlock cluster.
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2988264________$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Received "Read ROM/EEPROM Response" block: 56 57 5A 37 5A 30 59 32 39 38 38 32 36 34 56 57
Sending ReadEeprom block (Address: $00A0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 37 5A 30 59 32 39 38 38 32 36 34 56 57 5A 37
Sending ReadEeprom block (Address: $00B0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 30 59 32 39 38 38 32 36 34 04 60 04 60 04 60
Sending ReadEeprom block (Address: $00C0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00D0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 FF 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00E0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 FF FF FF FF FF FF FF 3F E3 3F E3 3F E3
Sending ReadEeprom block (Address: $00F0, Count: $10)
Received "Read ROM/EEPROM Response" block: 3F E3 3F E3 40 E3 40 E3 40 E3 00 00 00 00 08 00
Sending ReadEeprom block (Address: $0100, Count: $0C)
Received "Read ROM/EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 FF FF
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0Y2988264________$0090_eeprom.bin
SKC: 06004
Sending EndCommunication block

 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Hey @gmenounos one thing that pleasantly surprised me is that even though I got the dreaded "Failed to unlock cluster.", your tool still outputted the correct SKC (06004 in this case). Isn't this odd? I have a 2001 Golf GTI GLX VR6 (MK4)
Yeah, the newer VDO clusters have this seed/key thing where, in order to unlock it fully so that the EEPROM can be dumped, you have to ask the cluster to send you a 4 byte random value (the seed), then you take that seed and do a calculation with it using a secret algorithm to compute a 4 byte value (the key) that you send back to the cluster. The cluster then verifies that you sent back the right result and lets you access the EEPROM.

The older VDO clusters don't require the seed/key, but I don't know exactly which clusters require it and which don't, so if it's a VDO cluster, kw1281test always tries to do the seed/key thing. I'll try to find a better message than "Failed to unlock cluster."
 

locarno

Well-known member
Joined
Jul 10, 2018
Location
Poland
TDI
1.6 16V
Hello. Can I read and write ECU flash nad eeprom using this tool? ECU is IAW 4 Magneti Marelli.
 
Last edited:

Arn34203

New member
Joined
Oct 8, 2023
Location
US
TDI
2012 Passat
Not sure what I doing wrong. I have a VAG KKL cable, software installed and running the command it connects to the COM port without issue sends the wake up, says its reading the sync byte but does not connect. Goes back to sending wake up message.

Trying on a 2018 Passat in order to get SKC to add a new FOB in VCDS.

Any help from anyone is much appreciated.

Laptop is an HP ELitebook 2560p. Drivers are installed fine. Previously tried other applications on Windows 10 but similar results. Thought it was maybe the APP itself or that it would not run under Windows10.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Not sure what I doing wrong. I have a VAG KKL cable, software installed and running the command it connects to the COM port without issue sends the wake up, says its reading the sync byte but does not connect. Goes back to sending wake up message.

Trying on a 2018 Passat in order to get SKC to add a new FOB in VCDS.
Read the first post of this thread: "Q: Will it work with my car?"
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
Hello. Can I read and write ECU flash nad eeprom using this tool? ECU is IAW 4 Magneti Marelli.
I can't speak for your ECU, but I know Bosch ECUs can be read/written to with an MPPS cable. EEPROM usually requires another cable and software (EEPROM modification is used when you want to delete the immobilizer, for instance). But it still also depends on the generation of car, too. Some ECUs need to be opened up and flashed on the bench.
 

Mhughes216

Member
Joined
Oct 10, 2023
Location
USA
TDI
2008 VW Beetle
I have 2008 VW Beetle I'm trying to program keys for. I'm not having any luck following the directions you posted.
I have the cable, COM4 and this in the command prompt C:\Users\Matthew J Hughes\Desktop\kw1281test-0.85-beta and I just keep getting error. I'm not real familiar with this stuff, so any help would be greatly appreciated.
 

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I have 2008 VW Beetle I'm trying to program keys for. I'm not having any luck following the directions you posted.
I have the cable, COM4 and this in the command prompt C:\Users\Matthew J Hughes\Desktop\kw1281test-0.85-beta and I just keep getting error. I'm not real familiar with this stuff, so any help would be greatly appreciated.
Can you send us a screenshot, or copy/paste the error you get on your command prompt? You should be able to highlight everything with your left mouse button, then right click to save to the clipboard. Then, you could paste it on your next reply.
 

Mhughes216

Member
Joined
Oct 10, 2023
Location
USA
TDI
2008 VW Beetle
Your 2008 is most likely CAN Bus, and not compatible with this program.
Found it, don't completely understand it.
* The New Beetle continued to use the older k-line diagnostics only incorporating CAN for Generic OBD-2 in 2008 as mandated by the EPA. Other holdover models such as the 7V Seat Alhambra, 6L Seat Ibiza/Cordoba, 6Y/5J Skoda Fabia, 1U Skoda Octavia, 5J Skoda Roomster, 3U Skoda Superb and others may have continued to use the older k-line diagnostics into and past 2008. In doubt, contact Ross-Tech via email
 

Mhughes216

Member
Joined
Oct 10, 2023
Location
USA
TDI
2008 VW Beetle
Can you send us a screenshot, or copy/paste the error you get on your command prompt? You should be able to highlight everything with your left mouse button, then right click to save to the clipboard. Then, you could paste it on your next reply.
Microsoft Windows [Version 10.0.19045.3448]
(c) Microsoft Corporation. All rights reserved.

C:\Users\Matthew J Hughes>CD\Desktop\kw1281test.exe COM4 10400 17 GetSKC
The system cannot find the path specified.

C:\Users\Matthew J Hughes>
 

Mhughes216

Member
Joined
Oct 10, 2023
Location
USA
TDI
2008 VW Beetle
Microsoft Windows [Version 10.0.19045.3448]
(c) Microsoft Corporation. All rights reserved.

C:\Users\Matthew J Hughes>CD\Desktop\kw1281test.exe COM4 10400 17 GetSKC
The system cannot find the path specified.

C:\Users\Matthew J Hughes>
I'm trying to get the SKC pin to add 2 spare keys. I want to add remote start and I have to leave key in it because there is no bypass. I've never had to do this much work to put a remote start on a car. This stuff is so complicated.
 

turbodieseldyke

Top Post Dawg
Joined
Jun 6, 2010
Location
Free Mustache Rides
TDI
Big ol' honkin' tdis
You seem a bit unfamiliar with using a command line. "cannot find path specified" means you typed something wrong to execute the program, meaning, it's not located in the path you typed.
 
Top