kw1281test: A Free VDS-Pro / VagTacho Alternative

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Hi, yes the behaviour is exactly the same. I was using AdaptationTest I wanted to test it a few times and didn't want to cause any issues.

I've tried reading the SKC a few times and that works every time, although I've not tried anything else.
So it seems that on some Polo clusters, you need to do the adaptation on the immobilizer (Address 25) and not the cluster (Address 17) even though the immobilizer is built into the cluster and not a separate unit.

With VCDS, the instructions would be something like this: http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Separate)
The service manual should give similar instructions.

With kw1281test, you can check the immobilizer status like this:

kw1281test.exe com1 10400 25 GroupRead 1 (you can use the up arrow key to go to the group 003 values)

You can check the number of keys matched like this:

kw1281test.exe com1 10400 25 AdaptationRead 1 sssss (where "sssss" is the SKC)

You can match additional keys like this:

kw1281test.exe com1 10400 25 AdaptationSave 1 n sssss (where "n" is the total number of keys including all old and any new ones, and "sssss" is the SKC)

You'll have to place each key (both old and new) in the ignition and switch it off and on as described in the service manual.
 

gw0udm

New member
Joined
May 11, 2024
Location
Birmingham, UK
TDI
VW Polo
So it seems that on some Polo clusters, you need to do the adaptation on the immobilizer (Address 25) and not the cluster (Address 17) even though the immobilizer is built into the cluster and not a separate unit.
Thanks! This worked great, and now I have my new key matched!

What I found though was that if I started with the new, blank key in the ignition then I couldn't start the adaptation (came back with a NAK error). However if I put the original key in, then the adaptation worked. After taking that key out and putting the blank one in, the immobiliser light went out after a few seconds and then both of the keys worked.

So now everything is working well - thank you so much!

James
 

trewart

New member
Joined
May 15, 2024
Location
Portland
TDI
MKIV
I am working with a 2000 NB. I have pulled the same SKC using both GetSKC and DumpMarelliMem. Sadly VCDS does not accept the SKC. I have had great succes in the past with other vehicles but this one has me stumped. Not sure if the SKC is correct and I am having some other issue not related to the SKC itself? Any suggestions?

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10200 17 GetSkC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.0
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901F KOMBI+WEGFAHRS. M73 V02
Software Coding 07202, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Saved memory dump to marelli_mem_$0C00.bin
Done
SKC: 03639

Thanks TODD
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I am working with a 2000 NB. I have pulled the same SKC using both GetSKC and DumpMarelliMem. Sadly VCDS does not accept the SKC. I have had great succes in the past with other vehicles but this one has me stumped. Not sure if the SKC is correct and I am having some other issue not related to the SKC itself? Any suggestions?
Can you attach the dump file (marelli_mem_$0C00.bin)?
 

trewart

New member
Joined
May 15, 2024
Location
Portland
TDI
MKIV
The SKC looks correct. What are you seeing in VCDS that tells you that SKC isn't correct?
It rejects the code. I just borrowed a legit VagTacho got the same code. Tried to program within VagTacho and it also rejected the code too. Very odd. Will try a different laptop and see if I get the same results. Stumped at this point
 

nagwych

New member
Joined
Nov 21, 2023
Location
France
TDI
TT Mk1
It rejects the code. I just borrowed a legit VagTacho got the same code. Tried to program within VagTacho and it also rejected the code too. Very odd. Will try a different laptop and see if I get the same results. Stumped at this point
Todd, how well do you know the vehicle history ?
Could it be that the dashpod is from a different vehicle of similar vintage, with the immobilizer functionality disabled?
 

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
Hey guys,

First, I want to congratulate you on the tool, and secondly, ask for help.

I have a Polo 9N3 2006/2007. I need to extract SKC, but I can't. I have 2 cables, the blue KKL (CH340) and the VAG K+CAN, but without success in both.
I tried with the VAG K CAN COMMANDER program, VAG EEPRROM programmer and now with kw1281test. They all only read the beginning and end of the ECU, the middle is blocked.

Below is the log and attached the dump.

Version 0.94.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.0
Culture: pt-BR
Opening serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
01: $69 $26
02: $0D $0C $05 $0F $1E $1A
03: PQ24_7 LM CDVZ Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ07LM 09.00' is 34 3F 43 39
Sending Custom "Get Access Level" block
Access level is 4.
Sending Custom "Seed request" block
Block: D4 3D A4 46 E6 35 51 A7 09 00
Access level 7 secret: $98 $E1 $56 $5F
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 4.
Failed to unlock cluster.
Saving EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $0C)

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block

Thank you.

6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I have a Polo 9N3 2006/2007. I need to extract SKC, but I can't. I have 2 cables, the blue KKL (CH340) and the VAG K+CAN, but without success in both.
I tried with the VAG K CAN COMMANDER program, VAG EEPRROM programmer and now with kw1281test. They all only read the beginning and end of the ECU, the middle is blocked.

Below is the log and attached the dump.
...
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
@AndradeArt You need to download the newest version. That's the first version to support VQMJ07 clusters.
https://github.com/gmenounos/kw1281test/releases/tag/v0.97-beta
 

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
@AndradeArt You need to download the newest version. That's the first version to support VQMJ07 clusters.
https://github.com/gmenounos/kw1281test/releases/tag/v0.97-beta
Hello, I had already tried with this version too and with some others, but the error is the same:

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.0
Culture: pt-BR
Opening serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
01: $69 $26
02: $0D $0C $05 $0F $1E $1A
03: PQ24_7 LM CDVZ Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ07LM 09.00' is 34 3F 43 39
Sending Custom "Get Access Level" block
Access level is 4.
Sending Custom "Seed request" block
Block: 1C 47 8E A6 4F 93 8B D1 09 00
Access level 7 secret: $FD $8E $31 $96
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 4.
Failed to unlock cluster.
Saving EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $0C)

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Hello, I had already tried with this version too and with some others, but the error is the same:
Well 0.97 is the only version that would have worked. I own one Polo cluster with a different part number (6Q0920804) but with exactly the same software version (VQMJ07LM 09.00), but apparently it's different enough from yours that the seed/key authentication doesn't work.

One final possibility is that maybe using the other version of kw1281test and the other software tools may have caused the cluster to lock you out for a certain number of minutes (similar to trying to log in with the wrong SKC multiple times). There are some measuring blocks that can tell you if you're locked out: https://www.ross-tech.com/vag-com/cars/Immo3-measuring-blocks.html
If you're locked out then you need to leave the key in the ignition for long enough that the lockout time decreases to 0. kw1281test has a "GroupRead" command that can read the measuring blocks.

If the above doesn't work then you're probably out of luck unless you have access to an EEPROM reader (e.g. https://www.aliexpress.us/item/3256804708233344.html) and are willing to disassemble the cluster to read the EEPROM directly. It will most likely be encrypted but I know how to decrypt it.
 
Last edited:

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
Well 0.97 is the only version that would have worked. I own one Polo cluster with a different part number (6Q0920804) but with exactly the same software version (VQMJ07LM 09.00), but apparently it's different enough from yours that the seed/key authentication doesn't work.

One final possibility is that maybe using the other version of kw1281test and the other software tools may have caused the cluster to lock you out for a certain number of minutes (similar to trying to log in with the wrong SKC multiple times). There are some measuring blocks that can tell you if you're locked out: https://www.ross-tech.com/vag-com/cars/Immo3-measuring-blocks.html
If you're locked out then you need to leave the key in the ignition for long enough that the lockout time decreases to 0. kw1281test has a "GroupRead" command that can read the measuring blocks.

If the above doesn't work then you're probably out of luck unless you have access to an EEPROM reader (e.g. https://www.aliexpress.us/item/3256804708233344.html) and are willing to disassembly the cluster to read the EEPROM directly. It will most likely be encrypted but I know how to decrypt it.
All block times are 0. Unfortunately I don't have an EEprom reader.

I've made some progress here. Follow the procedure at this link https://sites.google.com/site/imnuts/ where I can get an ECU PIN number. How he managed to log in to "25 - Immobilizer" in VCDS, but couldn't log in to "17 - Instruments". Shouldn't it be the same number since this panel is original?
Modules 17 and 25 have blocks 21 and 50 in common, can I configure a new key directly from module 25 instead of 17?

My intention is to exchange this cluster for a model that has an onboard computer 6QE920827 (Polo 2014). Connecting the new cluster and repeating the procedure above, will it return the same PIN as before, or the new one contained in the new cluster's immobilizer?
If not, how do I get the PIN for the new cluster?
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I've made some progress here. Follow the procedure at this link https://sites.google.com/site/imnuts/ where I can get an ECU PIN number. How he managed to log in to "25 - Immobilizer" in VCDS, but couldn't log in to "17 - Instruments". Shouldn't it be the same number since this panel is original?
Modules 17 and 25 have blocks 21 and 50 in common, can I configure a new key directly from module 25 instead of 17?
Some vehicles do all immobilizer adaptation through address 17 (e.g. VW MKIV Jetta/Golf). If you try to connect to address 25, the cluster will answer and give you a message in German telling you to please use address 17.

Some vehicles have a dedicated immobilizer box that listens on address 25 (e.g. VW T4).

Some vehicles (e.g. your Polo) don't have a dedicated immobilizer box, but you connect to the cluster using address 17 for cluster functions and using address 25 for immobilizer functions. You need to adapt new keys using address 25.

My intention is to exchange this cluster for a model that has an onboard computer 6QE920827 (Polo 2014). Connecting the new cluster and repeating the procedure above, will it return the same PIN as before, or the new one contained in the new cluster's immobilizer?
If not, how do I get the PIN for the new cluster?
Immobilizer 3 key adaptation requires the immobilizer/cluster SKC and the Engine ECU SKC. Assuming that the Polo 2014 cluster is even compatible with your vehicle, you'll need to know its SKC and then pair it with the ECU before you can match your keys.
 

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
Immobilizer 3 key adaptation requires the immobilizer/cluster SKC and the Engine ECU SKC. Assuming that the Polo 2014 cluster is even compatible with your vehicle, you'll need to know its SKC and then pair it with the ECU before you can match your keys.
Well, I only got the SKC from the ECU/IMMO (address 01/25), but that didn't work on the current cluster (address 17). My fear is that I will buy this new cluster and also not be able to extract the SKC from it.
Do you know if kw1281test works on cluster 6QE920827 (Polo 2014)?
 

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.
Hello. I bought the cluster, but without success extracting the PIN either, same message as before ("Unable to determine SKC."). The software version is different "VQMJ09HH".
At first I will try to disable IMMO to be able to start the car with this panel.

It is suggested for future versions to include this software.

Thank you very much for your attention.
 

Astrolopiteco

New member
Joined
May 26, 2024
Location
Italia
TDI
1.9 TDI 2003
Hi, nice to have just signed up. I have a 2003 Golf IV. I would like to enable the closing and opening of the windows by remote control, but I don't understand how to do it. it only does it if I insert the key into the door and keep it turned to open or close. With vcds I don't have any adaptive function in the comfort control unit, reading online I read that vds pro was needed to modify the bios.... but I didn't understand anything. Then I got here and read this post. Can you help me add this functionality? Thank you
 

cgentil

Member
Joined
Sep 30, 2015
Location
Lisbon
TDI
Golf 7
Hello @gmenounos,

Thank you for tool, first of all.

This one can work on Passat B6 cluster VDO for SKC code retrieval?

Best Regards.
 
Last edited:

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
Some vehicles (e.g. your Polo) don't have a dedicated immobilizer box, but you connect to the cluster using address 17 for cluster functions and using address 25 for immobilizer functions. You need to adapt new keys using address 25.
Hello gmenounos Sorry to bother you again, I would like to ask a question.

I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Hi, nice to have just signed up. I have a 2003 Golf IV. I would like to enable the closing and opening of the windows by remote control, but I don't understand how to do it. it only does it if I insert the key into the door and keep it turned to open or close. With vcds I don't have any adaptive function in the comfort control unit, reading online I read that vds pro was needed to modify the bios.... but I didn't understand anything. Then I got here and read this post. Can you help me add this functionality? Thank you
The following thread discusses how to do this using VDS-Pro:

Assuming your car is compatible, kw1281test can do the equivalent using the ReadEeprom and WriteEeprom commands.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Hello gmenounos
I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?
It should already be supported. Did you try it?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Yes. The program informs that it only supports addresses 1 and 17.

GetSKC only supports addresses 1 and 17. You asked about "blocks 21 and 50", but I think you meant adaptation channels. Measuring blocks are available via the GroupRead command and adaptation channels are available via the AdaptationRead/AdaptationSave/AdaptationTest commands, all of which should be available for address 25.
 

boneskid1

Member
Joined
Jun 26, 2024
Location
Kansas
TDI
Non TDI 2000 Passat ATQ, 2004 mk4 GTI
I have a quick question for my future use of kw1281 test. Hoping to use it this weekend...

My issue is with a 2000 B5 passat wagon. Had the unfortunate dead CCM (corroded like crazy inside!) from the water leak into the floorboard.... We could not read the CCM from what I remember. Managed to find a similarly matched CCM out of a 2000 Passat Sedan at the junkyard and after fixing some wires I can read it with VCDS. The problem I am realizing is that the sedan ccm is not going to allow for the correct function of the rear hatch when locking and unlocking the car.

With the background information over with... is there any lists or resources for the factory CCM EEPROM information for any B5 Passat models? If I am remembering right the CCM is a 1J0 model, which seems to match from what I have read in this thread.

If there is not I will do a read on the Sedan CCM, Try to read the broken CCM and then go from there. Goal would be working rear hatch and then the usual key fob windows and maybe the hatch unlocking with all the doors cause thats annoying me on my GTI at the moment.

I will add anymore information I gather. May check a few things tonight if I have time. If not I will update with some findings this weekend I hope!

Thanks!
 

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.
I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin
I made a web page ( https://bitfab.com/Decrypt93C86 ) that can decrypt some of the 93C86 encrypted dumps. I uploaded your M93C86.bin dump and it was able to decrypt the dump and it says that the SKC is 01070. Can you try that and let me know if it is correct? Also, can you let me know the exact number of km on the odometer for that cluster? The odometer is encrypted differently from the rest of the dump and it varies from cluster to cluster, but if you let me know the exact odometer value then I can add support for decrypting the odometer for that type of cluster.

The ST93C86.bin dump doesn't seem to be a good dump.
 
Top