kw1281test: A Free VDS-Pro / VagTacho Alternative

[mjydrafter]

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.

Oops my bad, only having ALHs, I didn't realize that the BEW used the EDC16. Learn something new every day...

Wait, I was trying to get up the gumption to do this... on my BEW. So, it won't work?

That is a bummer.

 

[gmenounos]

Wait, I was trying to get up the gumption to do this... on my BEW. So, it won't work?

You should be able to use this to pull the SKC from the cluster in your BEW. I was just saying that it probably won't talk to an EDC16 Engine Control Unit. Give it a try and let me know if it works.

 

[gmenounos]

That's a bummer! I only have MKIV cars as well, but they all have EDC16s since they're '04s with the BEW engine.

Maybe I misunderstood what you were asking (because it is possible with some tools - just not mine - to pull the SKC from the ECU instead of the cluster). You should be able to pull the SKC from the cluster as long as it's a MKIV. Try it and let me know if it works.

 

[mjydrafter]

You should be able to use this to pull the SKC from the cluster in your BEW. I was just saying that it probably won't talk to an EDC16 Engine Control Unit. Give it a try and let me know if it works.

Ah, excellent, I will give it a whirl! Thanks!

 

[gmenounos]

I think a BEW cluster has the SKC at a different address so try something like this:

.\kw1281test.exe COM1 10400 17 dumpeeprom 266 6

 

[Mozambiquer]

I just successfully programmed a new key for my sister's 1999 Jetta tdi! I'm so stoked!

 

[Mozambiquer]

Then I was so stoked that I decided to see if I could do it on my Passat. Sure enough, I could! The skc is stored in the same place as a BEW code, in the 266 6 position or whatever that's called.

 

[KrashDH]

I just successfully programmed a new key for my sister's 1999 Jetta tdi! I'm so stoked!

Yeah @gmenounos did something pretty awesome here...this thread should be stickied...

 

[Mozambiquer]

Yeah @gmenounos did something pretty awesome here...this thread should be stickied...

I second that!

 

[AndyBees]

Subscribed ..... quite interesting!

 

[03TDICommuter]

Way cool! And great timing! I just bought an 01' Beetle and the previous owner only had 1 key and 1 dead/inoperative remote. Cheapest place to get a key cut is my local Ace Hardware at $30/each, but I'll still need to program it and the fob.

BTW, can I use my Ross-Tech HEX-V2 cable to get the SKC? I see other posts successfully using older cables, but not specifically the HEX-V2

Edit: Answering my own question - no VCP capabilities with the HEX-V2 cable per Ross-Tech. Time for me to buy that Amazon cable.

It does NOT apply to our current HEX-V2 or HEX-NET interfaces. These new interfaces do not use a USB UART chip and cannot be be used for "dumb K-line pass-through"!

Edit 2: The guy I bought the Beetle from included the original data package when he bought it as a CPO in 2004. I was looking through it tonight and found the SKC code on a scratch off tag in the binder! Now I can program new keys without needing to extract the SKC from the cluster.

 

[03TDICommuter]

Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.


kw1281test COM2 10400 17 DumpEeprom 0 2048

KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Unhandled exception: System.InvalidOperationException: Unexpected sync byte: Expected $55, Actual $95
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity)
at BitFab.KW1281Test.Program.Run(String[] args)
at BitFab.KW1281Test.Program.Main(String[] args)

 

[Nuje]

At least some, if not all of the earlier (pre-2002) clusters didn't have a full 2KB EEPROM; I think it was 512bytes (?) instead.

So maybe try:

kw1281test COM2 10400 17 DumpEeprom 0 512

Edit: Ok, cancel that. I just found an EEPROM from my (departed) 2000 NB (an IMMO2 cluster), and it's just shy of 5KB in size. And pretty sure that NB had a Motometer brand cluster (this tool is aimed at VDO clusters, IMMO3 in particular). @gmenounos will have to chime in here as this is quickly getting well beyond my pay grade.

 

[Mozambiquer]

Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.


kw1281test COM2 10400 17 DumpEeprom 0 2048

Try this: kw1281test.exe COM2 10400 17 DumpEeprom 186 6
The location is different on some of the clusters, I guess. This worked for my 2001 Jetta and golf and 1999 Jetta. All of which are immo 2.
The code you get should be something like this: 64 84 64 84 64 84 (that was the one on my 2001 Jetta)
You'll take the second number and put it in front of the first one and then add a zero to the front for your skc. So, mine was 08464

 

[gmenounos]

Received my Amazon generic cable today and tried to extract the SKC from the cluster to see if it matches the keytags. The cable came up fine on my Win7 laptop as COM2, but when I run the application, I get the following error. Any idea where my problem is? This is a 2001 Beetle.

kw1281test COM2 10400 17 DumpEeprom 0 2048

That "Unexpected sync byte: Expected $55, Actual $95" error is happening during the initial handshake with the cluster. Basically, KW1281Test wakes up the cluster by sending the cluster's address ($17) over the K-Line at 5 baud and then the cluster is supposed to send back $55 at some higher baud rate as an acknowledgement that it has woken up and is ready to communicate. More sophisticated tools can auto detect the baud rate that the cluster responds with. KW1281Test requires that you know the baud rate and specify it on the command line. The baud rate of MKIV Jetta/Golf clusters is 10400. The "Unexpected sync byte" error could be caused by the cluster responding at a different baud rate than 10400. 9600 seems to be another popular baud rate for MKIV VW modules so you might try that.

However, I don't know anything about Beetle clusters, especially whether they'd work with KW1281Test. If they're made by VDO then they might work. If they're Bosch/Motometer then possibly, but less likely than VDO. Highly unlikely it'd work if they're made by any other manufacturer.

 

[Nuje]

You'll take the second number and put it in front of the first one and then add a zero to the front for your skc. So, mine was 08464

You'd actually have to convert that "8464" from hexadecimal to decimal (would would you do if those bytes were 0E C4? )
Anyway, in this example, 0x8464 = 33892, which is too large a number, but the point stands.

Anyway, at least in my 2000 NB, there was nothing I could find that looked like repeating two-byte "words".

 

[03TDICommuter]

The "Unexpected sync byte" error could be caused by the cluster responding at a different baud rate than 10400. 9600 seems to be another popular baud rate for MKIV VW modules so you might try that.

9600 baud was met with more success. Here's what was returned for "ReadIdent"

KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending ReadIdent block
Ident: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending EndCommunication block

Dumping FW version resulted in an error

KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending Custom "Read Software Version" blocks
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Sending EndCommunication block

Dumping any of the eeprom resulted in errors. Here's trying to dump 2048 bytes starting at address 0

KW1281Test v0.26-beta (https://github.com/gmenounos/kw1281test/releases)
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901AX KOMBI+WEGFAHRS. M73 V07
Sending Custom "Unlock Additional Commands" block
Received NAK block
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Received NAK block
Received NAK block
Received NAK block
Received NAK block
Sending Custom "Unlock partial EEPROM read" block
Unhandled exception: System.Collections.Generic.KeyNotFoundException: The given key '0' was not present in the dictionary.
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at BitFab.KW1281Test.Program.UnlockCluster(IKW1281Dialog kwp1281)
at BitFab.KW1281Test.Program.UnlockControllerForEepromReadWrite(IKW1281Dialog kwp1281, ControllerAddress controllerAddress)
at BitFab.KW1281Test.Program.DumpClusterEeprom(IKW1281Dialog kwp1281, UInt16 startAddress, UInt16 length)
at BitFab.KW1281Test.Program.Run(String[] args)
at BitFab.KW1281Test.Program.Main(String[] args)

I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?

However, I don't know anything about Beetle clusters, especially whether they'd work with KW1281Test. If they're made by VDO then they might work. If they're Bosch/Motometer then possibly, but less likely than VDO. Highly unlikely it'd work if they're made by any other manufacturer.

 

[Nuje]

I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?

I was able to get the SKC out of my 2000 NB with VAG TACHO, and successfully program a second key using VCDS using their IMMO2 guidance. So...yes and yes.

 

[gmenounos]

9600 baud was met with more success. Here's what was returned for "ReadIdent"

Dumping FW version resulted in an error

Dumping any of the eeprom resulted in errors. Here's trying to dump 2048 bytes starting at address 0

I guess I'm out of luck for now. Would VagTacho even work on my car then? Also, I have the SKC from the original owner who saved that scratch off tag. Is using VCDS the same even with my cluster to program the new keys?

Searching for "1C0920901AX KOMBI+WEGFAHRS. M73 V07" led me to this: https://www.ttforum.co.uk/forum/viewtopic.php?f=2&t=1895675&start=45
so I think the Beetle clusters are made by Magneti Marelli.
If someone wants to send me a Beetle cluster, there's a possibility I could get it working, but no promises and it might take a while...

 

[Mozambiquer]

You'd actually have to convert that "8464" from hexadecimal to decimal (would would you do if those bytes were 0E C4? )
Anyway, in this example, 0x8464 = 33892, which is too large a number, but the point stands.

Anyway, at least in my 2000 NB, there was nothing I could find that looked like repeating two-byte "words".

Somehow, not sure how, but I guess it was in decimal... 8464 was the skc for that car, and that's what worked to log it in. Same on the 99 Jetta and my 2005 Passat. I was able to log in and program keys with no problems.

 

[Nuje]

If 8464 is the SKC for the car, then the repeating bytes would've been (according to my understanding):

10 21

 

[Mozambiquer]

If 8464 is the SKC for the car, then the repeating bytes would've been (according to my understanding):

10 21

I don't claim to understand it, but that's what Greg had told me, and it was 64 84 as the response. I thought it had to be converted too, but maybe it's because it's immo 2?

 

[gmenounos]

Different clusters store the SKC in different formats/locations in the EEPROM. When I get a chance I'll write up what I know.

 

[Nuje]

If you can, I'd appreciate knowing where the speed scale coding is kept in these clusters as well; I've done compares of linear and non-linear (0-260km/h, with 100km/h at 12o'clock) EEPROMs, but can't suss out anything.

 

[03TDICommuter]

Searching for "1C0920901AX KOMBI+WEGFAHRS. M73 V07" led me to this: https://www.ttforum.co.uk/forum/viewtopic.php?f=2&t=1895675&start=45
so I think the Beetle clusters are made by Magneti Marelli.
If someone wants to send me a Beetle cluster, there's a possibility I could get it working, but no promises and it might take a while...

Someday I hope you're able to support the Beetle non-VDO cluster. Meanwhile, I'm keeping my fingers crossed that the SKC number on that scratch off I found in the owner's booklet is correct. Once I get my Ebay keys in, I'll use VCDS + the SKC, and hope VCDS works fine for my cluster and pairs the keys.

Question for the group - I see mentioned in older threads that Vag-Tacho version 2.5 is not locked to a cable. Is there any benefit to having that software in my toolbox or is it too limited/buggy?

 

[gmenounos]

If you can, I'd appreciate knowing where the speed scale coding is kept in these clusters as well; I've done compares of linear and non-linear (0-260km/h, with 100km/h at 12o'clock) EEPROMs, but can't suss out anything.

Check out DashDumpEdit for editing a zillion cluster options in the EEPROM: https://www.drive2.com/l/471768829593126099/
(Don't worry, it has an English mode)

Here are some locations I've gathered for VWK501MH Immo3 clusters:

FuelTankSize = 0x207;
SpeedometerMap = 0x220;
TachometerMap = 0x240;
FuelGaugeMap = 0x280;
CoolantTempMap = 0x2D4;

I'm pretty sure the speedometer map is protected by a checksum somewhere in the EEPROM so the cluster may display an error if you try to modify it. I've only ever changed the coolant temp map to linearize it as described here: https://forums.tdiclub.com/index.php?threads/cluster-mods.184867/#post-1799962

 

[Nuje]

Great info - thanks!

 

[gmenounos]

Great info - thanks!

Here is some info about editing the various maps in the cluster using WinOLS:

Tuning instrument cluster gauges for Audi/VW/Seat/Skoda

Tuning instrument cluster gauges for Audi/VW/Seat/Skoda

nefariousmotorsports.com

Note: You need to create an account and login or you won't see any of the forum attachments/photos.

 

[pkhoury]

I'll confess Greg, I need to read all five pages. I skimmed through the first. So with your program, does that mean I can or should leave my 486 at home, that I normally use VDS-Pro with? Yes, it does have a working (rebuilt) battery, so I can use it portably.

Reading up on your program is super cool though, and I'm hoping I can use it when I pick up this new (to me) 2003 Golf tomorrow evening.

 

[Nuje]

In theory, I'm gonna say "yes". I got it to work and was able to read 17 - Instruments just fine on a car I was playing with recently.

I tried to make some changes to the CCM, though (hatch opening and remote control for the windows) and couldn't get that working. Not sure if I was mis-typing or not; and I couldn't get copy/paste working at the command line (is there some trick for that in Windows?). And granted, this is running a Win10 VM on a MacBook, but like I said, it did establish communication, so I know the basic hardware / drivers are making contact.

After futzing for a bit, I went and grabbed ye ol' Thinkpad T23 and had everything done in a few minutes.

I do want to get it working, though - just so I don't have to rely on a laptop from the Clinton administration era to make these types of changes. Will try it again next time I'm out there with.