kw1281test: A Free VDS-Pro / VagTacho Alternative

[cgentil]

Hello @gmenounos,

Thank you for tool, first of all.

This one can work on Passat B6 cluster VDO for SKC code retrieval?

Best Regards.

 

[AndradeArt]

Some vehicles (e.g. your Polo) don't have a dedicated immobilizer box, but you connect to the cluster using address 17 for cluster functions and using address 25 for immobilizer functions. You need to adapt new keys using address 25.

Hello gmenounos Sorry to bother you again, I would like to ask a question.

I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?

 

[gmenounos]

Hello @gmenounos,
This one can work on Passat B6 cluster VDO for SKC code retrieval?

What year? If the car is listed on this page then it cannot be supported as it uses CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

 

[gmenounos]

Hi, nice to have just signed up. I have a 2003 Golf IV. I would like to enable the closing and opening of the windows by remote control, but I don't understand how to do it. it only does it if I insert the key into the door and keep it turned to open or close. With vcds I don't have any adaptive function in the comfort control unit, reading online I read that vds pro was needed to modify the bios.... but I didn't understand anything. Then I got here and read this post. Can you help me add this functionality? Thank you

The following thread discusses how to do this using VDS-Pro:

Coding procedure for CCM Window Modification

For the initial discussion of this modification using Vagproduct KVW100 see these threads: http://forums.tdiclub.com/showthread.php?t=149207 Or this thread: http://forums.tdiclub.com/showthread.php?t=148070 SWEET! I was going to do the same on mine today.... guess I'll go do that. Same...

forums.tdiclub.com

Assuming your car is compatible, kw1281test can do the equivalent using the ReadEeprom and WriteEeprom commands.

 

[gmenounos]

Hello gmenounos
I noticed that in the new cluster (VDO V06 - VQMJ09HH), there are no blocks 21 and 50 in Module 17 (Instruments). They are only present in module 25 (Immobilizer).
Would it be possible to add module 25 reading to the software?

It should already be supported. Did you try it?

 

[AndradeArt]

It should already be supported. Did you try it?

Yes. The program informs that it only supports addresses 1 and 17.

 

[gmenounos]

Yes. The program informs that it only supports addresses 1 and 17.

GetSKC only supports addresses 1 and 17. You asked about "blocks 21 and 50", but I think you meant adaptation channels. Measuring blocks are available via the GroupRead command and adaptation channels are available via the AdaptationRead/AdaptationSave/AdaptationTest commands, all of which should be available for address 25.

 

[cgentil]

What year? If the car is listed on this page then it cannot be supported as it uses CAN bus for diagnostics: https://www.ross-tech.com/vcds/canbus.php

Hello @gmenounos,
From 2006.

 

[gmenounos]

Hello @gmenounos,
From 2006.

Sorry, 2006 won't work.

 

[boneskid1]

I have a quick question for my future use of kw1281 test. Hoping to use it this weekend...

My issue is with a 2000 B5 passat wagon. Had the unfortunate dead CCM (corroded like crazy inside!) from the water leak into the floorboard.... We could not read the CCM from what I remember. Managed to find a similarly matched CCM out of a 2000 Passat Sedan at the junkyard and after fixing some wires I can read it with VCDS. The problem I am realizing is that the sedan ccm is not going to allow for the correct function of the rear hatch when locking and unlocking the car.

With the background information over with... is there any lists or resources for the factory CCM EEPROM information for any B5 Passat models? If I am remembering right the CCM is a 1J0 model, which seems to match from what I have read in this thread.

If there is not I will do a read on the Sedan CCM, Try to read the broken CCM and then go from there. Goal would be working rear hatch and then the usual key fob windows and maybe the hatch unlocking with all the doors cause thats annoying me on my GTI at the moment.

I will add anymore information I gather. May check a few things tonight if I have time. If not I will update with some findings this weekend I hope!

Thanks!

 

[AndradeArt]

No idea. If you really need the SKC and none of the tools work, get an EEPROM burner and I may be able to help.

I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin

 

[gmenounos]

I bought the recorder (EZP2023+). The program EZP2019+ generated 2 different readings (ST93C86 and M93C86) I don't know which one is correct. I opened the files with the VAG EEPROM but it was unable to login, I believe it is encrypted.
Could you guide me how to decrypt the files?

ST93C86.bin
M93C86.bin

I made a web page ( https://bitfab.com/Decrypt93C86 ) that can decrypt some of the 93C86 encrypted dumps. I uploaded your M93C86.bin dump and it was able to decrypt the dump and it says that the SKC is 01070. Can you try that and let me know if it is correct? Also, can you let me know the exact number of km on the odometer for that cluster? The odometer is encrypted differently from the rest of the dump and it varies from cluster to cluster, but if you let me know the exact odometer value then I can add support for decrypting the odometer for that type of cluster.

The ST93C86.bin dump doesn't seem to be a good dump.

 

[gmenounos]

I have a quick question for my future use of kw1281 test. Hoping to use it this weekend...

My issue is with a 2000 B5 passat wagon. Had the unfortunate dead CCM (corroded like crazy inside!) from the water leak into the floorboard.... We could not read the CCM from what I remember. Managed to find a similarly matched CCM out of a 2000 Passat Sedan at the junkyard and after fixing some wires I can read it with VCDS. The problem I am realizing is that the sedan ccm is not going to allow for the correct function of the rear hatch when locking and unlocking the car.

With the background information over with... is there any lists or resources for the factory CCM EEPROM information for any B5 Passat models? If I am remembering right the CCM is a 1J0 model, which seems to match from what I have read in this thread.

If there is not I will do a read on the Sedan CCM, Try to read the broken CCM and then go from there. Goal would be working rear hatch and then the usual key fob windows and maybe the hatch unlocking with all the doors cause thats annoying me on my GTI at the moment.

I will add anymore information I gather. May check a few things tonight if I have time. If not I will update with some findings this weekend I hope!

Thanks!

There is another thread that deals more with CCM EEPROM settings: https://forums.tdiclub.com/index.ph...oding-and-configurations-with-vds-pro.160960/

VW CCMs from that era have an internal "color code" that can often only be seen with a scan tool like VCDS or kw1281test. Sometimes the label on the outside of the CCM includes the color code but often it's just the part number. See here for an example of what the color code would look like on both the label and a scan: https://forums.ross-tech.com/index.php?threads/42489/
The color code has to do with what options were installed in the car (e.g. hatch, power windows, alarm, etc.)

My understanding (and anybody who knows better, feel free to correct me) is that if you had an EEPROM dump from one CCM, you could load it into a different CCM with the same part number (but different color code) and that would make the second CCM have the same color code as the first.

So I think if you could copy the EEPROM from your dead CCM to the new CCM, you could make it properly work in your wagon. Could you share a picture of the CCM showing how bad the corrosion is? Maybe I could fix it enough to read the EEPROM if you sent it to me.

 

[boneskid1]

There is another thread that deals more with CCM EEPROM settings: https://forums.tdiclub.com/index.ph...oding-and-configurations-with-vds-pro.160960/

VW CCMs from that era have an internal "color code" that can often only be seen with a scan tool like VCDS or kw1281test. Sometimes the label on the outside of the CCM includes the color code but often it's just the part number. See here for an example of what the color code would look like on both the label and a scan: https://forums.ross-tech.com/index.php?threads/42489/
The color code has to do with what options were installed in the car (e.g. hatch, power windows, alarm, etc.)

My understanding (and anybody who knows better, feel free to correct me) is that if you had an EEPROM dump from one CCM, you could load it into a different CCM with the same part number (but different color code) and that would make the second CCM have the same color code as the first.

So I think if you could copy the EEPROM from your dead CCM to the new CCM, you could make it properly work in your wagon. Could you share a picture of the CCM showing how bad the corrosion is? Maybe I could fix it enough to read the EEPROM if you sent it to me.

I definitely can get a photo to you. One of the pins corroded off completely. Forgot about that as its been sitting in the driveway as a lower priority project. I did run over last night and tried to do some reads but got a few errors. Did some more reading on this thread and I think I was running some commands incorrectly. The good news is I was able to read some of the CCM Eeprom and I tried a dump of it, but again.... had the command wrong (managed to get back a blank file). I am going to do some more digging through this thread and the threads you linked and give it a better try this weekend and I will get back with my results.

Thanks for everything though! This tool is awesome!

 

[boneskid1]

EDIT: Should I be using DumpMem for the CCM? maybe that is what I am missing? I just need to dump the whole thing.

ok ccm is connecting to the computer/program ok. Had some bad fuses oddly enough that were causing issues..... also my front door module and/or lock assembly appears to be dead.....

besides that when I try a dumpeeprom: KW1281Test COM3 9600 46 DumpEeprom 0 2048 TEST.bin
I get a blank .bin file. it does connect and I will paste some of that below. Is this the right command?

C:\Users\bones\Downloads\kw1281test_0.97.0-beta_Win10>KW1281Test COM3 9600 46 DumpEeprom 0 2048 TEST.bin
KW1281Test: Yesterday's diagnostics...Today.

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 46 DumpEeprom 0 2048 TEST.bin
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.0
Culture: en-US
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799AJ 6W Zentral-SG Komf. 0001
Software Coding 04097, Workshop Code: 00028
Sending Login block
Saving EEPROM dump to TEST.bin
Sending ReadEeprom block (Address: $0000, Count: $0C)
Received "Read EEPROM Response" block: FC
Sending ReadEeprom block (Address: $000C, Count: $0C)
Sending ReadEeprom block (Address: $0018, Count: $0C)
Sending ReadEeprom block (Address: $0024, Count: $0C)
Sending ReadEeprom block (Address: $0030, Count: $0C)
Sending ReadEeprom block (Address: $003C, Count: $0C)
Sending ReadEeprom block (Address: $0048, Count: $0C)
Sending ReadEeprom block (Address: $0054, Count: $0C)
Sending ReadEeprom block (Address: $0060, Count: $0C)
Sending ReadEeprom block (Address: $006C, Count: $0C)
Sending ReadEeprom block (Address: $0078, Count: $0C)
Sending ReadEeprom block (Address: $0084, Count: $0C)
Sending ReadEeprom block (Address: $0090, Count: $0C)
Sending ReadEeprom block (Address: $009C, Count: $0C)
Sending ReadEeprom block (Address: $00A8, Count: $0C)
Sending ReadEeprom block (Address: $00B4, Count: $0C)
Sending ReadEeprom block (Address: $00C0, Count: $0C)
Sending ReadEeprom block (Address: $00CC, Count: $0C)
Sending ReadEeprom block (Address: $00D8, Count: $0C)
Sending ReadEeprom block (Address: $00E4, Count: $0C)

 

[AndradeArt]

I made a web page ( https://bitfab.com/Decrypt93C86 ) that can decrypt some of the 93C86 encrypted dumps. I uploaded your M93C86.bin dump and it was able to decrypt the dump and it says that the SKC is 01070. Can you try that and let me know if it is correct? Also, can you let me know the exact number of km on the odometer for that cluster? The odometer is encrypted differently from the rest of the dump and it varies from cluster to cluster, but if you let me know the exact odometer value then I can add support for decrypting the odometer for that type of cluster.

The ST93C86.bin dump doesn't seem to be a good dump.

SKC worked perfectly, thank you very much! Congratulations on the incredible tools you created.
The odometer reads 165785 km.

However, another problem arose, the speedometer needle is not showing. All others are working.

VCDS indicates the following errors:

Address 01: Engine Labels: None
Part No: 032 906 032 L
Component: ME7.5.10 2803
Coding: 00041
Shop #: WSC 00000
VCID: 152174536F819F2CC0-515A
9BWHB09N97P009363 VWZ7Z0F4579581

1 Fault Found:
16885 - Vehicle Speed Sensor
P0501 - 35-00 - Implausible Signal
Readiness: 0000 0000


Address 46: Central Conv. Labels:. 6Q0-959-433.clb
Part No: 6Q0 959 433 E
Component: 69 Komfortger t 0002
Coding: 00019
Shop #: WSC 00000
VCID: 3D718CF33771A76C28-4B18

1 Fault Found:
01312 - Powertrain Data Bus
79-00 - Please Check Fault Codes

In the pointer sweep test, it moved normally. I returned with the original cluster, the speedometer works normally and these errors disappear. Do you have any idea what it could be?

I was wondering if it might have something to do with the ABS. This new cluster came from a 2014 Polo, which has ABS. My 2007 Polo doesn't have it.

 

[Z@gor]

almost certainly, the speed sensing system is somewhat different between 2007 and 2014 VW Polo

 

[gmenounos]

EDIT: Should I be using DumpMem for the CCM? maybe that is what I am missing? I just need to dump the whole thing.

ok ccm is connecting to the computer/program ok. Had some bad fuses oddly enough that were causing issues..... also my front door module and/or lock assembly appears to be dead.....

besides that when I try a dumpeeprom: KW1281Test COM3 9600 46 DumpEeprom 0 2048 TEST.bin
I get a blank .bin file. it does connect and I will paste some of that below. Is this the right command?

C:\Users\bones\Downloads\kw1281test_0.97.0-beta_Win10>KW1281Test COM3 9600 46 DumpEeprom 0 2048 TEST.bin
KW1281Test: Yesterday's diagnostics...Today.

Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 9600 46 DumpEeprom 0 2048 TEST.bin
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.0
Culture: en-US
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0959799AJ 6W Zentral-SG Komf. 0001
Software Coding 04097, Workshop Code: 00028
Sending Login block
Saving EEPROM dump to TEST.bin
Sending ReadEeprom block (Address: $0000, Count: $0C)
Received "Read EEPROM Response" block: FC
Sending ReadEeprom block (Address: $000C, Count: $0C)
Sending ReadEeprom block (Address: $0018, Count: $0C)
Sending ReadEeprom block (Address: $0024, Count: $0C)
Sending ReadEeprom block (Address: $0030, Count: $0C)
Sending ReadEeprom block (Address: $003C, Count: $0C)
Sending ReadEeprom block (Address: $0048, Count: $0C)
Sending ReadEeprom block (Address: $0054, Count: $0C)
Sending ReadEeprom block (Address: $0060, Count: $0C)
Sending ReadEeprom block (Address: $006C, Count: $0C)
Sending ReadEeprom block (Address: $0078, Count: $0C)
Sending ReadEeprom block (Address: $0084, Count: $0C)
Sending ReadEeprom block (Address: $0090, Count: $0C)
Sending ReadEeprom block (Address: $009C, Count: $0C)
Sending ReadEeprom block (Address: $00A8, Count: $0C)
Sending ReadEeprom block (Address: $00B4, Count: $0C)
Sending ReadEeprom block (Address: $00C0, Count: $0C)
Sending ReadEeprom block (Address: $00CC, Count: $0C)
Sending ReadEeprom block (Address: $00D8, Count: $0C)
Sending ReadEeprom block (Address: $00E4, Count: $0C)

I'll have to take a look at how kw1281test does CCM EEPROM reading. It could be that it's doing something wrong. I'll try to get it figured out this week.

 

[gmenounos]

SKC worked perfectly, thank you very much! Congratulations on the incredible tools you created.
The odometer reads 165785 km.

However, another problem arose, the speedometer needle is not showing. All others are working.

VCDS indicates the following errors:

Address 01: Engine Labels: None
Part No: 032 906 032 L
Component: ME7.5.10 2803
Coding: 00041
Shop #: WSC 00000
VCID: 152174536F819F2CC0-515A
9BWHB09N97P009363 VWZ7Z0F4579581

1 Fault Found:
16885 - Vehicle Speed Sensor
P0501 - 35-00 - Implausible Signal
Readiness: 0000 0000


Address 46: Central Conv. Labels:. 6Q0-959-433.clb
Part No: 6Q0 959 433 E
Component: 69 Komfortger t 0002
Coding: 00019
Shop #: WSC 00000
VCID: 3D718CF33771A76C28-4B18

1 Fault Found:
01312 - Powertrain Data Bus
79-00 - Please Check Fault Codes

In the pointer sweep test, it moved normally. I returned with the original cluster, the speedometer works normally and these errors disappear. Do you have any idea what it could be?

I was wondering if it might have something to do with the ABS. This new cluster came from a 2014 Polo, which has ABS. My 2007 Polo doesn't have it.

Thanks for the odometer info. I've added support for that cluster to the web page.

Regarding the speedometer, I know that some VW cars (MKIV Golf/Jetta for example) send the vehicle speed to the cluster via a dedicated vehicle speed sensor wire. Other cars (Passat W8) send the speed over the CAN bus from the ABS system. It sounds like the 2014 Polo uses the ABS and the 2007 Polo uses the speed sensor wire. W8 clusters can be programmed to use the vehicle speed sensor wire instead of the ABS by updating a value in the EEPROM. Maybe the 2014 Polo cluster can be programmed the same way, but even if it can, it's probably not the same EEPROM location. There must be a Polo forum somewhere where you can ask. I don't think very many people here know about Polos, unfortunately.

 

[Z@gor]

Exactly

 

[tdi2006jettaowner]

Is there a way to use this on 2006 jetta I need to swapp clusters because my screen went bad And I have ross tech just need my pins

 

[Z@gor]

If only the display is faulty, just that can be replaced

 

[tdi2006jettaowner]

I was hoping to get the pin because I already have another cluster and I'm hoping to get another key

 

[Z@gor]

 

[gmenounos]

Is there a way to use this on 2006 jetta I need to swapp clusters because my screen went bad And I have ross tech just need my pins

Go to the first post in this thread. There's question titled "Will it work with my car?" Click on the link in the answer and it'll bring you to a page that says which cars use CAN bus for diagnostics. If your car uses CAN bus then it won't work with kw1281test.

 

[Z@gor]

Unfortunately, Jetta 2006 is only a Golf mk5 with the tail, both use canbus

 

[boneskid1]

I'll have to take a look at how kw1281test does CCM EEPROM reading. It could be that it's doing something wrong. I'll try to get it figured out this week.

ok did some testing this morning and I found the problem I think! So i connected my cable and I could run 1 command before I would get errors. Discovered if I unplugged the cable and plugged it back in I could run each command.... will need to investigate my driver or maybe the cable. It shows in device manager has CH340. But either way this allowed me to test the wagon features and find that the rear hatch actuator motor is shot!

awaiting some hardware from FCP Euro and then I will be back at it.

also moving on from the dump! Was able to code what I needed without doing the Eeprom dump.

 

[AndradeArt]

Thanks for the odometer info. I've added support for that cluster to the web page.

Regarding the speedometer, I know that some VW cars (MKIV Golf/Jetta for example) send the vehicle speed to the cluster via a dedicated vehicle speed sensor wire. Other cars (Passat W8) send the speed over the CAN bus from the ABS system. It sounds like the 2014 Polo uses the ABS and the 2007 Polo uses the speed sensor wire. W8 clusters can be programmed to use the vehicle speed sensor wire instead of the ABS by updating a value in the EEPROM. Maybe the 2014 Polo cluster can be programmed the same way, but even if it can, it's probably not the same EEPROM location. There must be a Polo forum somewhere where you can ask. I don't think very many people here know about Polos, unfortunately.

Apparently this location is 0x65, changing from 87 to 86.
I made this change and the odometer with the original km, but when recording, the panel was completely disconfigured.

I also tried to save the decrypted file without the changes but the same problem occurs.

How do I encrypt this changed eeprom before writing to the chip?

M93C86_decrypted_km_sensor

 

[Z@gor]

I believe the best solution is a decryption and re-encryption performed by the new cluster. All you need to do is have the pins of both clusters and a VAG/VCDS cable (also a clone), then carry out this procedure. The only precaution: carry out the procedure in the 25 Immobilizer module, NOT in the 17 Instrument module, as indicated in the last post of this 3D

 

[AndradeArt]

I believe the best solution is a decryption and re-encryption performed by the new cluster. All you need to do is have the pins of both clusters and a VAG/VCDS cable (also a clone), then carry out this procedure. The only precaution: carry out the procedure in the 25 Immobilizer module, NOT in the 17 Instrument module, as indicated in the last post of this 3D

I have already done the procedure you mentioned, the new cluster is working. The only problem is that it's not keeping up with speed. It is not possible to change the speed sensor address (0x065) with the EEPROM encrypted, only in the decrypted file. But the cluster does not accept writing the decrypted file, so I want to know how to encrypt it again.