kw1281test: A Free VDS-Pro / VagTacho Alternative

[gmenounos]

Hi, yes the behaviour is exactly the same. I was using AdaptationTest I wanted to test it a few times and didn't want to cause any issues.

I've tried reading the SKC a few times and that works every time, although I've not tried anything else.

So it seems that on some Polo clusters, you need to do the adaptation on the immobilizer (Address 25) and not the cluster (Address 17) even though the immobilizer is built into the cluster and not a separate unit.

With VCDS, the instructions would be something like this: http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Separate)
The service manual should give similar instructions.

With kw1281test, you can check the immobilizer status like this:

kw1281test.exe com1 10400 25 GroupRead 1 (you can use the up arrow key to go to the group 003 values)

You can check the number of keys matched like this:

kw1281test.exe com1 10400 25 AdaptationRead 1 sssss (where "sssss" is the SKC)

You can match additional keys like this:

kw1281test.exe com1 10400 25 AdaptationSave 1 n sssss (where "n" is the total number of keys including all old and any new ones, and "sssss" is the SKC)

You'll have to place each key (both old and new) in the ignition and switch it off and on as described in the service manual.

 

[gw0udm]

So it seems that on some Polo clusters, you need to do the adaptation on the immobilizer (Address 25) and not the cluster (Address 17) even though the immobilizer is built into the cluster and not a separate unit.

Thanks! This worked great, and now I have my new key matched!

What I found though was that if I started with the new, blank key in the ignition then I couldn't start the adaptation (came back with a NAK error). However if I put the original key in, then the adaptation worked. After taking that key out and putting the blank one in, the immobiliser light went out after a few seconds and then both of the keys worked.

So now everything is working well - thank you so much!

James

 

[trewart]

I am working with a 2000 NB. I have pulled the same SKC using both GetSKC and DumpMarelliMem. Sadly VCDS does not accept the SKC. I have had great succes in the past with other vehicles but this one has me stumped. Not sure if the SKC is correct and I am having some other issue not related to the SKC itself? Any suggestions?

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10200 17 GetSkC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.0
Culture: en-US
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1C0920901F KOMBI+WEGFAHRS. M73 V02
Software Coding 07202, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Saved memory dump to marelli_mem_$0C00.bin
Done
SKC: 03639

Thanks TODD

 

[gmenounos]

I am working with a 2000 NB. I have pulled the same SKC using both GetSKC and DumpMarelliMem. Sadly VCDS does not accept the SKC. I have had great succes in the past with other vehicles but this one has me stumped. Not sure if the SKC is correct and I am having some other issue not related to the SKC itself? Any suggestions?

Can you attach the dump file (marelli_mem_$0C00.bin)?

 

[trewart]

Can you attach the dump file (marelli_mem_$0C00.bin)?

Here it is, marelli_mem_$0C00.bin

 

[gmenounos]

Here it is, marelli_mem_$0C00.bin

The SKC looks correct. What are you seeing in VCDS that tells you that SKC isn't correct?

 

[trewart]

The SKC looks correct. What are you seeing in VCDS that tells you that SKC isn't correct?

It rejects the code. I just borrowed a legit VagTacho got the same code. Tried to program within VagTacho and it also rejected the code too. Very odd. Will try a different laptop and see if I get the same results. Stumped at this point

 

[nagwych]

It rejects the code. I just borrowed a legit VagTacho got the same code. Tried to program within VagTacho and it also rejected the code too. Very odd. Will try a different laptop and see if I get the same results. Stumped at this point

Todd, how well do you know the vehicle history ?
Could it be that the dashpod is from a different vehicle of similar vintage, with the immobilizer functionality disabled?

 

[AndradeArt]

Hey guys,

First, I want to congratulate you on the tool, and secondly, ask for help.

I have a Polo 9N3 2006/2007. I need to extract SKC, but I can't. I have 2 cables, the blue KKL (CH340) and the VAG K+CAN, but without success in both.
I tried with the VAG K CAN COMMANDER program, VAG EEPRROM programmer and now with kw1281test. They all only read the beginning and end of the ECU, the middle is blocked.

Below is the log and attached the dump.

Version 0.94.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.0
Culture: pt-BR
Opening serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
01: $69 $26
02: $0D $0C $05 $0F $1E $1A
03: PQ24_7 LM CDVZ Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ07LM 09.00' is 34 3F 43 39
Sending Custom "Get Access Level" block
Access level is 4.
Sending Custom "Seed request" block
Block: D4 3D A4 46 E6 35 51 A7 09 00
Access level 7 secret: $98 $E1 $56 $5F
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 4.
Failed to unlock cluster.
Saving EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $0C)

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block

Thank you.

6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin

 

[gmenounos]

I have a Polo 9N3 2006/2007. I need to extract SKC, but I can't. I have 2 cables, the blue KKL (CH340) and the VAG K+CAN, but without success in both.
I tried with the VAG K CAN COMMANDER program, VAG EEPRROM programmer and now with kw1281test. They all only read the beginning and end of the ECU, the middle is blocked.

Below is the log and attached the dump.
...
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09

@AndradeArt You need to download the newest version. That's the first version to support VQMJ07 clusters.
https://github.com/gmenounos/kw1281test/releases/tag/v0.97-beta

 

[AndradeArt]

@AndradeArt You need to download the newest version. That's the first version to support VQMJ07 clusters.
https://github.com/gmenounos/kw1281test/releases/tag/v0.97-beta

Hello, I had already tried with this version too and with some others, but the error is the same:

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.0
Culture: pt-BR
Opening serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6Q0920823J KOMBIINSTRUMENT VDO V04
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
01: $69 $26
02: $0D $0C $05 $0F $1E $1A
03: PQ24_7 LM CDVZ Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ07LM 09.00' is 34 3F 43 39
Sending Custom "Get Access Level" block
Access level is 4.
Sending Custom "Seed request" block
Block: 1C 47 8E A6 4F 93 8B D1 09 00
Access level 7 secret: $FD $8E $31 $96
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 4.
Failed to unlock cluster.
Saving EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $0C)

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to 6Q0920823J__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin
GetSkc: Unable to find Immobilizer ID in cluster dump.
Unable to determine SKC.
Sending EndCommunication block

 

[gmenounos]

Hello, I had already tried with this version too and with some others, but the error is the same:

Well 0.97 is the only version that would have worked. I own one Polo cluster with a different part number (6Q0920804) but with exactly the same software version (VQMJ07LM 09.00), but apparently it's different enough from yours that the seed/key authentication doesn't work.

One final possibility is that maybe using the other version of kw1281test and the other software tools may have caused the cluster to lock you out for a certain number of minutes (similar to trying to log in with the wrong SKC multiple times). There are some measuring blocks that can tell you if you're locked out: https://www.ross-tech.com/vag-com/cars/Immo3-measuring-blocks.html
If you're locked out then you need to leave the key in the ignition for long enough that the lockout time decreases to 0. kw1281test has a "GroupRead" command that can read the measuring blocks.

If the above doesn't work then you're probably out of luck unless you have access to an EEPROM reader (e.g. https://www.aliexpress.us/item/3256804708233344.html) and are willing to disassemble the cluster to read the EEPROM directly. It will most likely be encrypted but I know how to decrypt it.

 

[AndradeArt]

Well 0.97 is the only version that would have worked. I own one Polo cluster with a different part number (6Q0920804) but with exactly the same software version (VQMJ07LM 09.00), but apparently it's different enough from yours that the seed/key authentication doesn't work.

One final possibility is that maybe using the other version of kw1281test and the other software tools may have caused the cluster to lock you out for a certain number of minutes (similar to trying to log in with the wrong SKC multiple times). There are some measuring blocks that can tell you if you're locked out: https://www.ross-tech.com/vag-com/cars/Immo3-measuring-blocks.html
If you're locked out then you need to leave the key in the ignition for long enough that the lockout time decreases to 0. kw1281test has a "GroupRead" command that can read the measuring blocks.

If the above doesn't work then you're probably out of luck unless you have access to an EEPROM reader (e.g. https://www.aliexpress.us/item/3256804708233344.html) and are willing to disassembly the cluster to read the EEPROM directly. It will most likely be encrypted but I know how to decrypt it.

All block times are 0. Unfortunately I don't have an EEprom reader.

I've made some progress here. Follow the procedure at this link https://sites.google.com/site/imnuts/ where I can get an ECU PIN number. How he managed to log in to "25 - Immobilizer" in VCDS, but couldn't log in to "17 - Instruments". Shouldn't it be the same number since this panel is original?
Modules 17 and 25 have blocks 21 and 50 in common, can I configure a new key directly from module 25 instead of 17?

My intention is to exchange this cluster for a model that has an onboard computer 6QE920827 (Polo 2014). Connecting the new cluster and repeating the procedure above, will it return the same PIN as before, or the new one contained in the new cluster's immobilizer?
If not, how do I get the PIN for the new cluster?

 

[gmenounos]

I've made some progress here. Follow the procedure at this link https://sites.google.com/site/imnuts/ where I can get an ECU PIN number. How he managed to log in to "25 - Immobilizer" in VCDS, but couldn't log in to "17 - Instruments". Shouldn't it be the same number since this panel is original?
Modules 17 and 25 have blocks 21 and 50 in common, can I configure a new key directly from module 25 instead of 17?

Some vehicles do all immobilizer adaptation through address 17 (e.g. VW MKIV Jetta/Golf). If you try to connect to address 25, the cluster will answer and give you a message in German telling you to please use address 17.

Some vehicles have a dedicated immobilizer box that listens on address 25 (e.g. VW T4).

Some vehicles (e.g. your Polo) don't have a dedicated immobilizer box, but you connect to the cluster using address 17 for cluster functions and using address 25 for immobilizer functions. You need to adapt new keys using address 25.

My intention is to exchange this cluster for a model that has an onboard computer 6QE920827 (Polo 2014). Connecting the new cluster and repeating the procedure above, will it return the same PIN as before, or the new one contained in the new cluster's immobilizer?
If not, how do I get the PIN for the new cluster?

Immobilizer 3 key adaptation requires the immobilizer/cluster SKC and the Engine ECU SKC. Assuming that the Polo 2014 cluster is even compatible with your vehicle, you'll need to know its SKC and then pair it with the ECU before you can match your keys.

 

[AndradeArt]

Immobilizer 3 key adaptation requires the immobilizer/cluster SKC and the Engine ECU SKC. Assuming that the Polo 2014 cluster is even compatible with your vehicle, you'll need to know its SKC and then pair it with the ECU before you can match your keys.

Well, I only got the SKC from the ECU/IMMO (address 01/25), but that didn't work on the current cluster (address 17). My fear is that I will buy this new cluster and also not be able to extract the SKC from it.
Do you know if kw1281test works on cluster 6QE920827 (Polo 2014)?

 

[gmenounos]

Do you know if kw1281test works on cluster 6QE920827 (Polo 2014)?

No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.

 

[AndradeArt]

No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.

Hello. I bought the cluster, but without success extracting the PIN either, same message as before ("Unable to determine SKC."). The software version is different "VQMJ09HH".
At first I will try to disable IMMO to be able to start the car with this panel.

It is suggested for future versions to include this software.

Thank you very much for your attention.

 

[Astrolopiteco]

Hi, nice to have just signed up. I have a 2003 Golf IV. I would like to enable the closing and opening of the windows by remote control, but I don't understand how to do it. it only does it if I insert the key into the door and keep it turned to open or close. With vcds I don't have any adaptive function in the comfort control unit, reading online I read that vds pro was needed to modify the bios.... but I didn't understand anything. Then I got here and read this post. Can you help me add this functionality? Thank you

 

[cgentil]

Hello @gmenounos,

Thank you for tool, first of all.

This one can work on Passat B6 cluster VDO for SKC code retrieval?

Best Regards.

 

[AndradeArt]

Some vehicles (e.g. your Polo) don't have a dedicated immobilizer box, but you connect to the cluster using address 17 for cluster functions and using address 25 for immobilizer functions. You need to adapt new keys using address 25.

Hello gmenounos Sorry to bother you again, I would like to ask a question.

I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?

 

[gmenounos]

Hello @gmenounos,
This one can work on Passat B6 cluster VDO for SKC code retrieval?

What year? If the car is listed on this page then it cannot be supported as it uses CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

 

[gmenounos]

Hi, nice to have just signed up. I have a 2003 Golf IV. I would like to enable the closing and opening of the windows by remote control, but I don't understand how to do it. it only does it if I insert the key into the door and keep it turned to open or close. With vcds I don't have any adaptive function in the comfort control unit, reading online I read that vds pro was needed to modify the bios.... but I didn't understand anything. Then I got here and read this post. Can you help me add this functionality? Thank you

The following thread discusses how to do this using VDS-Pro:

Coding procedure for CCM Window Modification

For the initial discussion of this modification using Vagproduct KVW100 see these threads: http://forums.tdiclub.com/showthread.php?t=149207 Or this thread: http://forums.tdiclub.com/showthread.php?t=148070 SWEET! I was going to do the same on mine today.... guess I'll go do that. Same...

forums.tdiclub.com

Assuming your car is compatible, kw1281test can do the equivalent using the ReadEeprom and WriteEeprom commands.

 

[gmenounos]

Hello gmenounos
I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?

It should already be supported. Did you try it?

 

[AndradeArt]

It should already be supported. Did you try it?

Yes. The program informs that it only supports addresses 1 and 17.

 

[gmenounos]

Yes. The program informs that it only supports addresses 1 and 17.

GetSKC only supports addresses 1 and 17. You asked about "blocks 21 and 50", but I think you meant adaptation channels. Measuring blocks are available via the GroupRead command and adaptation channels are available via the AdaptationRead/AdaptationSave/AdaptationTest commands, all of which should be available for address 25.

 

[cgentil]

What year? If the car is listed on this page then it cannot be supported as it uses CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

Hello @gmenounos,
From 2006.

 

[gmenounos]

Hello @gmenounos,
From 2006.

Sorry, 2006 won't work.

 

[boneskid1]

I have a quick question for my future use of kw1281 test. Hoping to use it this weekend...

My issue is with a 2000 B5 passat wagon. Had the unfortunate dead CCM (corroded like crazy inside!) from the water leak into the floorboard.... We could not read the CCM from what I remember. Managed to find a similarly matched CCM out of a 2000 Passat Sedan at the junkyard and after fixing some wires I can read it with VCDS. The problem I am realizing is that the sedan ccm is not going to allow for the correct function of the rear hatch when locking and unlocking the car.

With the background information over with... is there any lists or resources for the factory CCM EEPROM information for any B5 Passat models? If I am remembering right the CCM is a 1J0 model, which seems to match from what I have read in this thread.

If there is not I will do a read on the Sedan CCM, Try to read the broken CCM and then go from there. Goal would be working rear hatch and then the usual key fob windows and maybe the hatch unlocking with all the doors cause thats annoying me on my GTI at the moment.

I will add anymore information I gather. May check a few things tonight if I have time. If not I will update with some findings this weekend I hope!

Thanks!

 

[AndradeArt]

No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.

I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin

 

[gmenounos]

I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin

I made a web page ( https://bitfab.com/Decrypt93C86 ) that can decrypt some of the 93C86 encrypted dumps. I uploaded your M93C86.bin dump and it was able to decrypt the dump and it says that the SKC is 01070. Can you try that and let me know if it is correct? Also, can you let me know the exact number of km on the odometer for that cluster? The odometer is encrypted differently from the rest of the dump and it varies from cluster to cluster, but if you let me know the exact odometer value then I can add support for decrypting the odometer for that type of cluster.

The ST93C86.bin dump doesn't seem to be a good dump.