kw1281test: A Free VDS-Pro / VagTacho Alternative

A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Here is a modified dump for your new cluster that should unlock it permanently and allow you to use kw1281test to modify the EEPROM. If that works, you'll be able to easily change the speed sensor data as well as any other data in the EEPROM without needing to remove the cluster from the car.
Click to expand...
I redid the cluster and ecu combination and configured the keys. I tried to read the address "0x13A" (Odometer) and the program was unable to read it. The address "0x65" (SpeedSensor) was even able to read, but it is not writing a new value.

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0x13A
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending ReadEeprom block (Address: $013A, Count: $01)
EEPROM read failed
Sending EndCommunication block

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 WriteEeprom 0x65 0x86
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending WriteEeprom block (Address: $0065, Values: $86
Received "Write EEPROM Response" block: 01 00 65 79
WriteEepromResponseBlock body does not match WriteEepromBlock
Sending EndCommunication block
Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0x65
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending ReadEeprom block (Address: $0065, Count: $01)
Received "Read EEPROM Response" block: 87
Address 101 ($0065): Value 135 ($87)
Sending EndCommunication block
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Jake01 said:
Same issue as the weird one I had earlier, on first attempt the dump command and even GetSKC resulted in a timeout, after working previously.

After restarting cmd, GetSKC was successful, but the new command results in a timeout… the program is installed on the desktop, and I do have to set the working directory in each instance of opening cmd. This timeout is also usually the same error I get when messing around with AdaptationTest and AdapttionRead commands too, so maybe it is something to do with how I have installed the program?
Click to expand...
Does VCDS-Lite work reliably and consistently with your generic cable to connect to the cluster and ECU? If it gives timeouts and sometimes requires moving the cable to a different port, then it might be an issue with your cable or driver.
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
AndradeArt said:
I redid the cluster and ecu combination and configured the keys. I tried to read the address "0x13A" (Odometer) and the program was unable to read it. The address "0x65" (SpeedSensor) was even able to read, but it is not writing a new value.
Click to expand...
Ok, can you see if you can dump part of the ROM? That will hopefully help me figure out how to get the EEPROM read/write to work on your cluster.
The dump will take a number of minutes to run (about 16 times as long as it takes to dump the 2K EEPROM)

kw1281test.exe COM2 10400 17 DumpMem 0x28000 0x8000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Ok, can you see if you can dump part of the ROM? That will hopefully help me figure out how to get the EEPROM read/write to work on your cluster.
The dump will take a number of minutes to run (about 16 times as long as it takes to dump the 2K EEPROM)

kw1281test.exe COM2 10400 17 DumpMem 0x28000 0x8000
Click to expand...
At the end of the program execution, it presented "expected error": (I executed the command 3 times, and each time the reading stopped in a different block)

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 DumpMem 0x28000 0x8000
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending Custom "Get Access Level" block
Sending Custom "Unlock Additional Commands" block
Access level is 7.
Cluster is unlocked for memory access. Skipping Seed/Key login.
Saving memory dump to cluster_mem_$028000.bin
Sending Custom "Read Memory" block (Address: $028000, Count: $0F)
Sending Custom "Read Memory" block (Address: $02800F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02801E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02802D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02803C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02804B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02805A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028069, Count: $0F)
Sending Custom "Read Memory" block (Address: $028078, Count: $0F)
Sending Custom "Read Memory" block (Address: $028087, Count: $0F)
Sending Custom "Read Memory" block (Address: $028096, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280A5, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280B4, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280C3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280D2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280E1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280F0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280FF, Count: $0F)
Sending Custom "Read Memory" block (Address: $02810E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02811D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02812C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02813B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02814A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028159, Count: $0F)
Sending Custom "Read Memory" block (Address: $028168, Count: $0F)
Sending Custom "Read Memory" block (Address: $028177, Count: $0F)
Sending Custom "Read Memory" block (Address: $028186, Count: $0F)
Sending Custom "Read Memory" block (Address: $028195, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281A4, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281B3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281C2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281D1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281E0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281EF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281FE, Count: $0F)
Sending Custom "Read Memory" block (Address: $02820D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02821C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02822B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02823A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028249, Count: $0F)
Sending Custom "Read Memory" block (Address: $028258, Count: $0F)
Sending Custom "Read Memory" block (Address: $028267, Count: $0F)
Sending Custom "Read Memory" block (Address: $028276, Count: $0F)
Sending Custom "Read Memory" block (Address: $028285, Count: $0F)
Sending Custom "Read Memory" block (Address: $028294, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282A3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282B2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282C1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282D0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282DF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282EE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282FD, Count: $0F)
Sending Custom "Read Memory" block (Address: $02830C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02831B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02832A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028339, Count: $0F)
Sending Custom "Read Memory" block (Address: $028348, Count: $0F)
Sending Custom "Read Memory" block (Address: $028357, Count: $0F)
Sending Custom "Read Memory" block (Address: $028366, Count: $0F)
Sending Custom "Read Memory" block (Address: $028375, Count: $0F)
Sending Custom "Read Memory" block (Address: $028384, Count: $0F)
Sending Custom "Read Memory" block (Address: $028393, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283A2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283B1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283C0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283CF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283DE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283ED, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283FC, Count: $0F)
Sending Custom "Read Memory" block (Address: $02840B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02841A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028429, Count: $0F)
Sending Custom "Read Memory" block (Address: $028438, Count: $0F)
Sending Custom "Read Memory" block (Address: $028447, Count: $0F)
Sending Custom "Read Memory" block (Address: $028456, Count: $0F)
Sending Custom "Read Memory" block (Address: $028465, Count: $0F)
Sending Custom "Read Memory" block (Address: $028474, Count: $0F)
Sending Custom "Read Memory" block (Address: $028483, Count: $0F)
Sending Custom "Read Memory" block (Address: $028492, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284A1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284B0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284BF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284CE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284DD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284EC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284FB, Count: $0F)
Sending Custom "Read Memory" block (Address: $02850A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028519, Count: $0F)
Sending Custom "Read Memory" block (Address: $028528, Count: $0F)
Sending Custom "Read Memory" block (Address: $028537, Count: $0F)
Sending Custom "Read Memory" block (Address: $028546, Count: $0F)
Sending Custom "Read Memory" block (Address: $028555, Count: $0F)
Sending Custom "Read Memory" block (Address: $028564, Count: $0F)
Sending Custom "Read Memory" block (Address: $028573, Count: $0F)
Sending Custom "Read Memory" block (Address: $028582, Count: $0F)
Sending Custom "Read Memory" block (Address: $028591, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285A0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285AF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285BE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285CD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285DC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285EB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285FA, Count: $0F)
Sending Custom "Read Memory" block (Address: $028609, Count: $0F)
Sending Custom "Read Memory" block (Address: $028618, Count: $0F)
Sending Custom "Read Memory" block (Address: $028627, Count: $0F)
Sending Custom "Read Memory" block (Address: $028636, Count: $0F)
Sending Custom "Read Memory" block (Address: $028645, Count: $0F)
Sending Custom "Read Memory" block (Address: $028654, Count: $0F)
Sending Custom "Read Memory" block (Address: $028663, Count: $0F)
Sending Custom "Read Memory" block (Address: $028672, Count: $0F)
Sending Custom "Read Memory" block (Address: $028681, Count: $0F)
Sending Custom "Read Memory" block (Address: $028690, Count: $0F)
Sending Custom "Read Memory" block (Address: $02869F, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286AE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286BD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286CC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286DB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286EA, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286F9, Count: $0F)
Sending Custom "Read Memory" block (Address: $028708, Count: $0F)
Sending Custom "Read Memory" block (Address: $028717, Count: $0F)
Sending Custom "Read Memory" block (Address: $028726, Count: $0F)
Sending Custom "Read Memory" block (Address: $028735, Count: $0F)
Sending Custom "Read Memory" block (Address: $028744, Count: $0F)
Sending Custom "Read Memory" block (Address: $028753, Count: $0F)
Sending Custom "Read Memory" block (Address: $028762, Count: $0F)
Sending Custom "Read Memory" block (Address: $028771, Count: $0F)
Sending Custom "Read Memory" block (Address: $028780, Count: $0F)
Sending Custom "Read Memory" block (Address: $02878F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02879E, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287AD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287BC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287CB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287DA, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287E9, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287F8, Count: $0F)
Sending Custom "Read Memory" block (Address: $028807, Count: $0F)
Sending Custom "Read Memory" block (Address: $028816, Count: $0F)
Sending Custom "Read Memory" block (Address: $028825, Count: $0F)
Sending Custom "Read Memory" block (Address: $028834, Count: $0F)
Sending Custom "Read Memory" block (Address: $028843, Count: $0F)
Sending Custom "Read Memory" block (Address: $028852, Count: $0F)
Sending Custom "Read Memory" block (Address: $028861, Count: $0F)
Sending Custom "Read Memory" block (Address: $028870, Count: $0F)
Sending Custom "Read Memory" block (Address: $02887F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02888E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02889D, Count: $0F)
Sending Custom "Read Memory" block (Address: $0288AC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0288BB, Count: $0F)
Error receiving block: Received block end $04 but expected $03. Block bytes: 03 67 09 04
Partial block: $03 $67 $09 $04
Error receiving blocks: Received block end $04 but expected $03. Block bytes: 03 67 09 04
Blocks received:
Block: $12 $65 $1B $8D $14 $0B $8D $2E $0B $AD $99 $02 $8D $15 $0B $8D $2F $0B $03
Caught: System.InvalidOperationException Received block end $04 but expected $03. Block bytes: 03 67 09 04
Unhandled exception: System.InvalidOperationException: Received block end $04 but expected $03. Block bytes: 03 67 09 04
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 411
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 354
at BitFab.KW1281Test.Cluster.VdoCluster.CustomReadMemory(UInt32, Byte) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 94
at BitFab.KW1281Test.Cluster.VdoCluster.DumpMem(String, UInt32, UInt32) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 167
at BitFab.KW1281Test.Tester.DumpClusterMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 1082
at BitFab.KW1281Test.Tester.DumpMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 402
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 345
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

On the 4th attempt, the program ran until time out.

One detail: I managed to change the odometer with the ETSmart program calculator, directly on the encrypted file, without needing to decrypt it. Then, I wrote the EEPROM to the chip.
The only thing missing is changing the address 0x065 (SpeedSource) from $87 to $86 and 0x190 from 00 to $75, because the speedometer is not working and the fuel gauge is oscillating.


The requested dump is attached.
Also attached is the EEPROM currently written.

cluster_mem_$028000.bin (expected error)
cluster_mem_$028000.bin (time_out)
M93C86_CURRENT_KM_L7.bin
 
Last edited:
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
AndradeArt said:
At the end of the program execution, it presented "expected error": (I executed the command 3 times, and each time the reading stopped in a different block)
...
On the 4th attempt, the program ran until time out.

One detail: I managed to change the odometer with the ETSmart program calculator, directly on the encrypted file, without needing to decrypt it. Then, I wrote the EEPROM to the chip.
The only thing missing is changing the address 0x065 (SpeedSource) from $87 to $86 and 0x190 from 00 to $75, because the speedometer is not working and the fuel gauge is oscillating.
Click to expand...
Thanks! I'll work on changing those 2 bytes in the encrypted dump. While I do that, could you try dumping the ROM, starting from where it timed out?

kw1281test.exe COM3 10400 17 DumpMem 0x2CE39 0x4000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Thanks! Hopefully that part of the ROM will have the info I need. I've attached your encrypted EEPROM with the 2 patches applied. Let me know if it works.
Click to expand...
It worked!!!!!
You are the best! I've been trying to get this cluster to work for almost 2 months.
Thank you very much!

Could you explain to me how you made this patch?
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
AndradeArt said:
It worked!!!!!
You are the best! I've been trying to get this cluster to work for almost 2 months.
Thank you very much!
Click to expand...
Glad to hear that it worked.

I was able to extract a secret key from the ROM dumps that you provided so I think you'll be able to read/write the EEPROM directly with kw1281test and not have to deal with the encryption anymore. Can you try this new release and see if that works?

https://github.com/gmenounos/kw1281test/releases/tag/v0.99-beta

AndradeArt said:
Could you explain to me how you made this patch?
Click to expand...
Sure, I'll create a page on my cluster info site ( https://github.com/gmenounos/vwcluster ) that explains how the VDO 93C86 encryption works. At some point, when I have more time, I'll enhance the decryption web page to also allow editing and re-encryption.

In the meantime, could you please try to get me a couple more ROM dumps so I can learn more about your cluster?

kw1281test.exe COM3 10400 17 DumpMem 0x38000 0x4000
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Can you try this new release and see if that works?

https://github.com/gmenounos/kw1281test/releases/tag/v0.99-beta
Click to expand...
I tried GetSkc but it timed out :

Version 0.99.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ09HH 05.10' is 37 42 47 43
Please report this to the program maintainer.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Saving EEPROM dump to 6QE920827C__KOMBIINSTRUMENT_VDO_V06_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 140
at BitFab.KW1281Test.KW1281Dialog.SendBlock(List`1) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 345
at BitFab.KW1281Test.KW1281Dialog.ReadEeprom(UInt16, Byte) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 143
at BitFab.KW1281Test.Cluster.VdoCluster.DumpEeprom(UInt16, UInt16, Byte, String) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 737
at BitFab.KW1281Test.Cluster.VdoCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 46
at BitFab.KW1281Test.Tester.DumpClusterEeprom(UInt16, UInt16, String ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 903
at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 563
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31


gmenounos said:
kw1281test.exe COM3 10400 17 DumpMem 0x38000 0x4000
Click to expand...
This command did not work in version 99, only in 98.
cluster_mem_$038000.bin

gmenounos said:
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000
Click to expand...
This other one didn't work in either of the 2 versions:

Version 0.99.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 DumpMem 0x3C000 0x4000
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending Custom "Get Access Level" block
Sending Custom "Unlock Additional Commands" block
Access level is 7.
Cluster is unlocked for memory access. Skipping Seed/Key login.
Saving memory dump to cluster_mem_$03C000.bin
Sending Custom "Read Memory" block (Address: $03C000, Count: $0F)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 141
at BitFab.KW1281Test.KW1281Dialog.SendBlock(List`1) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 345
at BitFab.KW1281Test.Cluster.VdoCluster.SendCustom(List`1) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 199
at BitFab.KW1281Test.Cluster.VdoCluster.CustomReadMemory(UInt32, Byte) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 95
at BitFab.KW1281Test.Cluster.VdoCluster.DumpMem(String, UInt32, UInt32) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 167
at BitFab.KW1281Test.Tester.DumpClusterMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 1108
at BitFab.KW1281Test.Tester.DumpMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 402
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 345
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I made a typo in the previous release that's causing the "Unlock code for software version 'VQMJ09HH 05.10' is 37 42 47 43 Please report this to the program maintainer." message. Can you try this new release and see if the message goes away? https://github.com/gmenounos/kw1281test/releases/tag/v0.99.1-beta

I'm not sure what's causing the timeouts. Could you try the following command a few more times to verify that it always times out immediately?
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000

Also maybe try the GetSKC a couple more times to verify that it always times out.

Thanks.
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
spoony said:
can anyone help me retreive the cluster bin file using kw1281test?
clocks are bosch RB8.
Click to expand...
If you want to dump the RB8 EEPROM, you would use the following command (replace "COM1" with the correct port that your cable is using):
kw1281test.exe COM1 10400 17 DumpRBxMem 66560 1024

If you just need the SKC, this is the easier way to get it:
kw1281test.exe COM1 10400 17 GetSKC
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
spoony said:
cool Thats confirmed my skc but i still cant get my new clocks to adapt!!
Click to expand...
Can you share some details of how you're trying to do the adaptation? Are you using kw1281test? VCDS?
What command are you using to try to do the adaptation?
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
spoony said:
trying to use vcds to adapt.
full genuine cable(y)
Click to expand...
Please post details about how you're trying to do the adaptation. What address are you connecting to? What login code are you using to login (old or new SKC)? What channel are you adapting? What value are you entering? What error message is being displayed that tells you that the adaptation isn't working?

You're not going to get much help if you just say "It won't adapt".
 
S

spoony

Member
Joined
Aug 4, 2024
Location
huddersfield uk
TDI
golf
read skc of old cluster and got skc 00751
connected new cluster and obtained skc 06326
then followed instructions from ross tech.
cluster, login, new cluster skc, adaption channel 50, enter old skc, test.
the four boxes at the top say, system, not ok, ?,?
save, close controller.
then turn ignition off for 1 minute.
When i turn on and check the vin and immo code havent changed!

hope this helps.

Amymore info needed please ask :)
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
spoony said:
read skc of old cluster and got skc 00751
connected new cluster and obtained skc 06326
then followed instructions from ross tech.
cluster, login, new cluster skc, adaption channel 50, enter old skc, test.
the four boxes at the top say, system, not ok, ?,?
save, close controller.
then turn ignition off for 1 minute.
When i turn on and check the vin and immo code havent changed!

hope this helps.

Amymore info needed please ask :)
Click to expand...
Since you have VCDS, can you do an autoscan of all the modules in the car and post the results here?
 
S

spoony

Member
Joined
Aug 4, 2024
Location
huddersfield uk
TDI
golf
this before i did anything.........

Saturday,03,August,2024,17:42:06:28686
VCDS -- Windows Based VAG/VAS Emulator Running on Windows 11 x64
VCDS Version: 24.7.0.0 (x64) HEX-V2 CB: 0.4643.4
Data version: 20240715 DS356.3
www.Ross-Tech.com


VIN: WVWZZZ1JZ3W465667 License Plate:


Chassis Type: 1J (1J - VW Golf/Bora IV (1998 > 2006))
Scan: 01 02 03 08 15 16 17 19 22 29 35 36 37 39 46 47 55 56 57 75
76

VIN: WVWZZZ1JZ3W465667 Mileage: 269540km-167484miles
-------------------------------------------------------------------------------
Address 01: Engine Labels: 06A-906-032-AJQ.clb
Part No: 06A 906 032 MJ
Component: 1.8L R4/5VT 0003
Coding: 11510
Shop #: WSC 00000
VCID: 72BED0103DB8217A597-5160
VINID: 9E69EAAAA05AA839C41851861C381F06E1
WVWZZZ1JZ3W465667 VWZ6Z0B0411629

No fault code found.
Readiness: 0010 1100

-------------------------------------------------------------------------------
Address 03: ABS Brakes Labels: 1C0-907-37x-ESP-F.lbl
Part No: 1C0 907 379 M
Component: ESP FRONT MK60 0102
Coding: 0019970
Shop #: WSC 01271 785 00200
VCID: 34321608022C6F4A8BB-5184

No fault code found.

-------------------------------------------------------------------------------
Address 08: Auto HVAC Labels: 3Bx-907-044.lbl
Part No: 3B1 907 044 C
Component: CLIMATRONIC C 2.0.0
Coding: 11000
Shop #: WSC 01271
VCID: 211CEF5CA8DEEAE270D-51A8

1 Fault Found:
01274 - Air Flow Flap Positioning Motor (V71)
37-00 - Faulty

-------------------------------------------------------------------------------
Address 15: Airbags Labels: 6Q0-909-605-VW5.lbl
Part No: 1C0 909 605 A
Component: 27 AIRBAG VW51 01 0006
Coding: 12855
Shop #: WSC 01271
VCID: 221EE050ADD8F1FA697-5160

1 Fault Found:
00532 - Supply Voltage B+
07-10 - Signal too Low - Intermittent

-------------------------------------------------------------------------------
Address 17: Instruments Labels: 1J0-920-xx5-17.lbl
Part No: 1J0 920 926 A
Component: KOMBI+WEGFAHRS. RB8 V28
Coding: 05414
Shop #: WSC 00000
VCID: 280AF278CBE41BAA373-5160
WVWZZZ1JZ3W465667 VWZ6Z0B0411629

No fault code found.

-------------------------------------------------------------------------------
Address 19: CAN Gateway Labels: 6N0-909-901-19.clb
Part No: 6N0 909 901
Component: Gateway K<->CAN 0001
Coding: 00006
Shop #: WSC 01271
VCID: 70BADA1833B4136AAF3-5160

No fault code found.

-------------------------------------------------------------------------------
Address 46: Central Conv. Labels: 1C0-959-799.lbl
Part No: 1C0 959 799 B
Component: 1X Komfortgerát HLO 0003
Coding: 00258
Shop #: WSC 01271
VCID: 36362C0011507D5AB5F-4B3C

Subsystem 1 - Part No: 1C2959802A
Component: 1X Tõrsteuer.FS KLO 0009

Subsystem 2 - Part No: 1C2959801A
Component: 1X Tõrsteuer.BF KLO 0202

Subsystem 3 - Part No: 1C0959811A
Component: 1X Tõrsteuer.HL KLO 0009

Subsystem 4 - Part No: 1C0959812A
Component: 1X Tõrsteuer.HR KLO 0009

No fault code found.

End----(Elapsed Time: 04:51, VBatt start/end: 12.0V/12.0V. VIgn 12.0V)-----

and this after fitting new cluster and tried to adapt.....

Saturday,03,August,2024,20:04:48:28686
VCDS -- Windows Based VAG/VAS Emulator Running on Windows 11 x64
VCDS Version: 24.7.0.0 (x64) HEX-V2 CB: 0.4643.4
Data version: 20240715 DS356.3
www.Ross-Tech.com


VIN: WVWZZZ1JZ3W304780 License Plate:


Chassis Type: 1J (1J - VW Golf/Bora IV (1998 > 2006))
Scan: 01 02 03 08 15 16 17 19 22 29 35 36 37 39 46 47 55 56 57 75
76

VIN: WVWZZZ1JZ3W304780 Mileage: 268700km-166962miles
-------------------------------------------------------------------------------
Address 01: Engine Labels: 06A-906-032-AJQ.clb
Part No: 06A 906 032 MJ
Component: 1.8L R4/5VT 0003
Coding: 11510
Shop #: WSC 00000
VCID: 72BED0103DB8217A597-5160
VINID: 9E69EAAAA05AA839C30041C80060CEB0DE
WVWZZZ1JZ3W465667 VWZ6Z0B0411629

1 Fault Found:
17978 - Engine Start Blocked by Immobilizer
P1570 - 35-00 -
Readiness: 0010 1100

-------------------------------------------------------------------------------
Address 03: ABS Brakes Labels: 1C0-907-37x-ESP-F.lbl
Part No: 1C0 907 379 M
Component: ESP FRONT MK60 0102
Coding: 0019970
Shop #: WSC 01271 785 00200
VCID: 34321608022C6F4A8BB-5184

No fault code found.

-------------------------------------------------------------------------------
Address 08: Auto HVAC Labels: 3Bx-907-044.lbl
Part No: 3B1 907 044 C
Component: CLIMATRONIC C 2.0.0
Coding: 11000
Shop #: WSC 01271
VCID: 211CEF5CA8DEEAE270D-51A8

1 Fault Found:
01274 - Air Flow Flap Positioning Motor (V71)
37-00 - Faulty

-------------------------------------------------------------------------------
Address 15: Airbags Labels: 6Q0-909-605-VW5.lbl
Part No: 1C0 909 605 A
Component: 27 AIRBAG VW51 01 0006
Coding: 12855
Shop #: WSC 01271
VCID: 221EE050ADD8F1FA697-513C

1 Fault Found:
00532 - Supply Voltage B+
07-10 - Signal too Low - Intermittent

-------------------------------------------------------------------------------
Address 17: Instruments Labels: 1J0-920-xx5-17.lbl
Part No: 1J5 920 946 A
Component: KOMBI+WEGFAHRSP VDO V13
Coding: 04412
Shop #: WSC 00000
VCID: 2F381964EE0A4C92F69-513C
WVWZZZ1JZ3W304780 VWZ7Z0B6042217

2 Faults Found:
01176 - Key
65-10 - Unauthorized - Intermittent
01177 - Engine Control Unit
65-10 - Unauthorized - Intermittent

-------------------------------------------------------------------------------
Address 19: CAN Gateway Labels: 6N0-909-901-19.clb
Part No: 6N0 909 901
Component: Gateway K<->CAN 0001
Coding: 00006
Shop #: WSC 01266
VCID: 70BADA1833B4136AAF3-513C

No fault code found.

-------------------------------------------------------------------------------
Address 46: Central Conv. Labels: 1C0-959-799.lbl
Part No: 1C0 959 799 B
Component: 1X Komfortgerát HLO 0003
Coding: 00258
Shop #: WSC 01271
VCID: 36362C0011507D5AB5F-4B1E

Subsystem 1 - Part No: 1C2959802A
Component: 1X Tõrsteuer.FS KLO 0009

Subsystem 2 - Part No: 1C2959801A
Component: 1X Tõrsteuer.BF KLO 0202

Subsystem 3 - Part No: 1C0959811A
Component: 1X Tõrsteuer.HL KLO 0009

Subsystem 4 - Part No: 1C0959812A
Component: 1X Tõrsteuer.HR KLO 0009

1 Fault Found:
01299 - Diagnostic Interface for Data Bus (J533)
49-10 - No Communications - Intermittent

End----------(Elapsed Time: 04:59, VBatt start/end: 12.3V/12.3V)-----------

Hope this helps.

Regards

MIkey
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Try clearing the faults on the ECU and the cluster before doing the adaptation. Also check measuring blocks 022, 023 and 024 (especially 24):
If any of the lock times are not 0, you'll have to leave the key in the ignition and the cluster powered up until they get to 0.
 
A

Ashmeer

New member
Joined
Jul 10, 2024
Location
South Africa
TDI
1.8t
Hey Guys,

Hope everyone is well.

I've used the KW1281test, and managed to get my SKC after doing a dump of my Eeprom(had to ask for help with opening the file), I just wanted to find out if there are any sites/channels/links where i could learn more about dumping/flashing/opening these files. I'd like to learn more about software, tuning, coding etc.

Basically I'd like to learn a bit of everything if possible.

I do have some knowledge regarding PCs so it doesnt have to be very basic, I also have VCDS as well, kw1281test seems to be working just fine as well.

Any advice would be appreciated.

Thanks
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Ashmeer said:
I've used the KW1281test, and managed to get my SKC after doing a dump of my Eeprom(had to ask for help with opening the file), I just wanted to find out if there are any sites/channels/links where i could learn more about dumping/flashing/opening these files. I'd like to learn more about software, tuning, coding etc.
Click to expand...
Here are a couple of forums that specialize in that kind of thing:
Also there are some links at the very bottom of the following page in the "Credits" section: https://github.com/gmenounos/kw1281test
 
krook

krook

Veteran Member
Joined
Jan 13, 2021
Location
Hungary
TDI
A4 B5 AWX, A4 B5 AFN
I've run into an issue trying to read the eeprom of my cluster just yesterday, this time I was using a ch340 blue cable. Here are the logs:

pastebin.com

Version 0.99.0-beta (https://github.com/gmenounos/kw1281test/releases)Args: CO - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com pastebin.com

kw1281test did read, but the file is all 00s. in the end, I used vag k+can software to read the eeprom successfully, I'll attach it:

Filebin | itb5z4jjo4ccj5n7

Convenient file sharing. Registration is not required. Large files are supported.
filebin.net filebin.net

can you please take a look if my cluster number can be supported? I'm open to experiments
 
B

Blacktopsort

New member
Joined
Aug 22, 2024
Location
Venlo
TDI
Leon 1.9 tdi
Hi,

first of all thank you for an amazing job. Im fairly new to this coding stuff, I wanted to try to code my windows opening with my key fob, but I just cannot make it work. Does anyone here have a command line I can use to change it? I dont know to which value I have to change 04361, 04362 and 04363
 
You must log in or register to reply here.
Top