kw1281test: A Free VDS-Pro / VagTacho Alternative

mjydrafter

Veteran Member
Joined
Jul 12, 2015
Location
dsm, ia
TDI
2004 Jetta Wagon
That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.
Oops my bad, only having ALHs, I didn't realize that the BEW used the EDC16. Learn something new every day...
Wait, I was trying to get up the gumption to do this... on my BEW. So, it won't work?:cry:

That is a bummer.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Wait, I was trying to get up the gumption to do this... on my BEW. So, it won't work?:cry:
You should be able to use this to pull the SKC from the cluster in your BEW. I was just saying that it probably won't talk to an EDC16 Engine Control Unit. Give it a try and let me know if it works.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.
Maybe I misunderstood what you were asking (because it is possible with some tools - just not mine - to pull the SKC from the ECU instead of the cluster). You should be able to pull the SKC from the cluster as long as it's a MKIV. Try it and let me know if it works.
 

mjydrafter

Veteran Member
Joined
Jul 12, 2015
Location
dsm, ia
TDI
2004 Jetta Wagon
You should be able to use this to pull the SKC from the cluster in your BEW. I was just saying that it probably won't talk to an EDC16 Engine Control Unit. Give it a try and let me know if it works.
Ah, excellent, I will give it a whirl! Thanks!
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I think a BEW cluster has the SKC at a different address so try something like this:
Code:
.\kw1281test.exe COM1 10400 17 dumpeeprom 266 6
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
I just successfully programmed a new key for my sister's 1999 Jetta tdi! I'm so stoked!
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
Then I was so stoked that I decided to see if I could do it on my Passat. Sure enough, I could! The skc is stored in the same place as a BEW code, in the 266 6 position or whatever that's called. 😂
 

03TDICommuter

Veteran Member
Joined
Dec 8, 2016
Location
So. Cal
TDI
01' NB, 5spd
Way cool! And great timing! I just bought an 01' Beetle and the previous owner only had 1 key and 1 dead/inoperative remote. Cheapest place to get a key cut is my local Ace Hardware at $30/each, but I'll still need to program it and the fob.

BTW, can I use my Ross-Tech HEX-V2 cable to get the SKC? I see other posts successfully using older cables, but not specifically the HEX-V2

Edit: Answering my own question - no VCP capabilities with the HEX-V2 cable per Ross-Tech. Time for me to buy that Amazon cable.

It does NOT apply to our current HEX-V2 or HEX-NET interfaces. These new interfaces do not use a USB UART chip and cannot be be used for "dumb K-line pass-through"!
Edit 2: The guy I bought the Beetle from included the original data package when he bought it as a CPO in 2004. I was looking through it tonight and found the SKC code on a scratch off tag in the binder! Now I can program new keys without needing to extract the SKC from the cluster.
 
Last edited:

03TDICommuter

Veteran Member
Joined
Dec 8, 2016
Location
So. Cal
TDI
01' NB, 5spd
Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.


kw1281test COM2 10400 17 DumpEeprom 0 2048
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $95
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity)
at BitFab.KW1281Test.Program.Run(String[] args)
at BitFab.KW1281Test.Program.Main(String[] args)
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
At least some, if not all of the earlier (pre-2002) clusters didn't have a full 2KB EEPROM; I think it was 512bytes (?) instead.

So maybe try:
Code:
kw1281test COM2 10400 17 DumpEeprom 0 512
Edit: Ok, cancel that. I just found an EEPROM from my (departed) 2000 NB (an IMMO2 cluster), and it's just shy of 5KB in size. And pretty sure that NB had a Motometer brand cluster (this tool is aimed at VDO clusters, IMMO3 in particular). @gmenounos will have to chime in here as this is quickly getting well beyond my pay grade.
 
Last edited:

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.


kw1281test COM2 10400 17 DumpEeprom 0 2048
Try this: kw1281test.exe COM2 10400 17 DumpEeprom 186 6
The location is different on some of the clusters, I guess. This worked for my 2001 Jetta and golf and 1999 Jetta. All of which are immo 2.
The code you get should be something like this: 64 84 64 84 64 84 (that was the one on my 2001 Jetta)
You'll take the second number and put it in front of the first one and then add a zero to the front for your skc. So, mine was 08464
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.

kw1281test COM2 10400 17 DumpEeprom 0 2048
That "Unexpected sync byte: Expected $55, Actual $95" error is happening during the initial handshake with the cluster. Basically, KW1281Test wakes up the cluster by sending the cluster's address ($17) over the K-Line at 5 baud and then the cluster is supposed to send back $55 at some higher baud rate as an acknowledgement that it has woken up and is ready to communicate. More sophisticated tools can auto detect the baud rate that the cluster responds with. KW1281Test requires that you know the baud rate and specify it on the command line. The baud rate of MKIV Jetta/Golf clusters is 10400. The "Unexpected sync byte" error could be caused by the cluster responding at a different baud rate than 10400. 9600 seems to be another popular baud rate for MKIV VW modules so you might try that.

However, I don't know anything about Beetle clusters, especially whether they'd work with KW1281Test. If they're made by VDO then they might work. If they're Bosch/Motometer then possibly, but less likely than VDO. Highly unlikely it'd work if they're made by any other manufacturer.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
You'll take the second number and put it in front of the first one and then add a zero to the front for your skc. So, mine was 08464
You'd actually have to convert that "8464" from hexadecimal to decimal (would would you do if those bytes were 0E C4? ;))
Anyway, in this example, 0x8464 = 33892, which is too large a number, but the point stands.

Anyway, at least in my 2000 NB, there was nothing I could find that looked like repeating two-byte "words".
 

03TDICommuter

Veteran Member
Joined
Dec 8, 2016
Location
So. Cal
TDI
01' NB, 5spd
The "Unexpected sync byte" error could be caused by the cluster responding at a different baud rate than 10400. 9600 seems to be another popular baud rate for MKIV VW modules so you might try that.
9600 baud was met with more success. Here's what was returned for "ReadIdent"
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending ReadIdent block
Ident: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending EndCommunication block
Dumping FW version resulted in an error
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending Custom "Read Software Version" blocks
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Sending EndCommunication block
Dumping any of the eeprom resulted in errors. Here's trying to dump 2048 bytes starting at address 0
KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Sending Custom "Unlock partial EEPROM read" block
Unhandled exception: System.Collections.Generic.KeyNotFoundException: The given key '0' was not present in the dictionary.
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at BitFab.KW1281Test.Program.UnlockCluster(IKW1281Dialog kwp1281)
at BitFab.KW1281Test.Program.UnlockControllerForEepromReadWrite(IKW1281Dialog kwp1281, ControllerAddress controllerAddress)
at BitFab.KW1281Test.Program.DumpClusterEeprom(IKW1281Dialog kwp1281, UInt16 startAddress, UInt16 length)
at BitFab.KW1281Test.Program.Run(String[] args)
at BitFab.KW1281Test.Program.Main(String[] args)
I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?


However, I don't know anything about Beetle clusters, especially whether they'd work with KW1281Test. If they're made by VDO then they might work. If they're Bosch/Motometer then possibly, but less likely than VDO. Highly unlikely it'd work if they're made by any other manufacturer.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?
I was able to get the SKC out of my 2000 NB with VAG TACHO, and successfully program a second key using VCDS using their IMMO2 guidance. So...yes and yes. :D
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
9600 baud was met with more success. Here's what was returned for "ReadIdent"

Dumping FW version resulted in an error

Dumping any of the eeprom resulted in errors. Here's trying to dump 2048 bytes starting at address 0

I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?
Searching for "1C0920901AX KOMBI+WEGFAHRS. M73 V07" led me to this: https://www.ttforum.co.uk/forum/viewtopic.php?f=2&t=1895675&start=45
so I think the Beetle clusters are made by Magneti Marelli. :(
If someone wants to send me a Beetle cluster, there's a possibility I could get it working, but no promises and it might take a while...
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
You'd actually have to convert that "8464" from hexadecimal to decimal (would would you do if those bytes were 0E C4? ;))
Anyway, in this example, 0x8464 = 33892, which is too large a number, but the point stands.

Anyway, at least in my 2000 NB, there was nothing I could find that looked like repeating two-byte "words".
Somehow, not sure how, but I guess it was in decimal... 🤔 8464 was the skc for that car, and that's what worked to log it in. Same on the 99 Jetta and my 2005 Passat. I was able to log in and program keys with no problems.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
If 8464 is the SKC for the car, then the repeating bytes would've been (according to my understanding):
Code:
10 21
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
If 8464 is the SKC for the car, then the repeating bytes would've been (according to my understanding):
Code:
10 21
I don't claim to understand it, but that's what Greg had told me, and it was 64 84 as the response. I thought it had to be converted too, but maybe it's because it's immo 2?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Different clusters store the SKC in different formats/locations in the EEPROM. When I get a chance I'll write up what I know.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
If you can, I'd appreciate knowing where the speed scale coding is kept in these clusters as well; I've done compares of linear and non-linear (0-260km/h, with 100km/h at 12o'clock) EEPROMs, but can't suss out anything.
 

03TDICommuter

Veteran Member
Joined
Dec 8, 2016
Location
So. Cal
TDI
01' NB, 5spd
Searching for "1C0920901AX KOMBI+WEGFAHRS. M73 V07" led me to this: https://www.ttforum.co.uk/forum/viewtopic.php?f=2&t=1895675&start=45
so I think the Beetle clusters are made by Magneti Marelli. :(
If someone wants to send me a Beetle cluster, there's a possibility I could get it working, but no promises and it might take a while...
Someday I hope you're able to support the Beetle non-VDO cluster. Meanwhile, I'm keeping my fingers crossed that the SKC number on that scratch off I found in the owner's booklet is correct. Once I get my Ebay keys in, I'll use VCDS + the SKC, and hope VCDS works fine for my cluster and pairs the keys.

Question for the group - I see mentioned in older threads that Vag-Tacho version 2.5 is not locked to a cable. Is there any benefit to having that software in my toolbox or is it too limited/buggy?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
If you can, I'd appreciate knowing where the speed scale coding is kept in these clusters as well; I've done compares of linear and non-linear (0-260km/h, with 100km/h at 12o'clock) EEPROMs, but can't suss out anything.
Check out DashDumpEdit for editing a zillion cluster options in the EEPROM: https://www.drive2.com/l/471768829593126099/
(Don't worry, it has an English mode)

Here are some locations I've gathered for VWK501MH Immo3 clusters:

FuelTankSize = 0x207;
SpeedometerMap = 0x220;
TachometerMap = 0x240;
FuelGaugeMap = 0x280;
CoolantTempMap = 0x2D4;

I'm pretty sure the speedometer map is protected by a checksum somewhere in the EEPROM so the cluster may display an error if you try to modify it. I've only ever changed the coolant temp map to linearize it as described here: https://forums.tdiclub.com/index.php?threads/cluster-mods.184867/#post-1799962
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)

pkhoury

That guy with the goats
Joined
Nov 30, 2010
Location
Medina, TX
TDI
2013 JSW, 2 x 2002 Golf, 1995 F450 7.3L
I'll confess Greg, I need to read all five pages. I skimmed through the first. So with your program, does that mean I can or should leave my 486 at home, that I normally use VDS-Pro with? Yes, it does have a working (rebuilt) battery, so I can use it portably.

Reading up on your program is super cool though, and I'm hoping I can use it when I pick up this new (to me) 2003 Golf tomorrow evening.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2016 A3 e-tron 6DSG
In theory, I'm gonna say "yes". I got it to work and was able to read 17 - Instruments just fine on a car I was playing with recently.

I tried to make some changes to the CCM, though (hatch opening and remote control for the windows) and couldn't get that working. Not sure if I was mis-typing or not; and I couldn't get copy/paste working at the command line (is there some trick for that in Windows?). And granted, this is running a Win10 VM on a MacBook, but like I said, it did establish communication, so I know the basic hardware / drivers are making contact.

After futzing for a bit, I went and grabbed ye ol' Thinkpad T23 and had everything done in a few minutes.

I do want to get it working, though - just so I don't have to rely on a laptop from the Clinton administration era to make these types of changes. Will try it again next time I'm out there with.
 
Top