kw1281test: A Free VDS-Pro / VagTacho Alternative

G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
AndradeArt said:
I have already done the procedure you mentioned, the new cluster is working. The only problem is that it's not keeping up with speed. It is not possible to change the speed sensor address (0x065) with the EEPROM encrypted, only in the decrypted file. But the cluster does not accept writing the decrypted file, so I want to know how to encrypt it again.
Click to expand...
Here is a modified dump for your new cluster that should unlock it permanently and allow you to use kw1281test to modify the EEPROM. If that works, you'll be able to easily change the speed sensor data as well as any other data in the EEPROM without needing to remove the cluster from the car.
 

Attachments

Z@gor

Z@gor

Active member
Joined
Feb 2, 2021
Location
Italy
TDI
ex GTD 5
I apologize for the misunderstanding, we don't get along very well with Google translator. Perhaps the work you are interested in can be done by Abrites
 
J

Jake01

New member
Joined
Jul 11, 2024
Location
England
TDI
1.9 Golf PD130
Hi all, having some issues with Bora sport/anniversary clock swap in my 2002 1.9 Golf (UK).

Firstly, this software is great, so thanks for putting the effort into creating it. I am relatively new to cars and even newer to messing with VCDS and the like, having got my license last year, but I am enjoying modifying and maintaining my first proper car.

Now, my situation: the 2002 Golf is a second hand car, was my dads for a while. Allegedly, the ECU was messed aroundwith in the past, and it seems that the immobiliser has been deactivated.

The original clocks (instrument cluster) work fine. I would like to upgrade to bora sport/anniversary clocks. I have followed the VCDS tutorial on how to replace clocks (immo3 -> immo3), but when reaching the stage of adjusting adaptation 50 under the instrument cluster, any input into the “new value” box causes an error and I cannot save anything. Obviously I am attempting the guide step of entering the old clock’s skc here which I pulled using this great software. For clarity: I have recoded the new (used) clocks to have the same soft coding as the old clocks. The only step I cannot complete is entering the old SKC into channel 50 under “17 - Instrument Cluster”.

For further context, I can still access the immobiliser block which returns, not quite a fault, but says something that would indicate there’s no communication from it. Also, under “Engine-01”, channel 50 can be altered, but changing this value to the SKC code accomplishes nothing. Additionally, I can’t remember which module this was in, but I found that VCDS reported the immobiliser as “1”, which according to the software means “deactivated

Thus I turn to anyone in this forum who might have some advice on how to get rid of the immobiliser active warning message on start and flashing immobiliser light on the dash. Preferably, if anyone has info on how to properly and fully recode this new set of clocks without being able to establish the instrument cluster -> immobiliser connection properly, or how to even establish that connection with the immobiliser, I would be very grateful.

thanks for taking the time to read. Again, any advice on what to do is appreciated,

Jake.
 
Z@gor

Z@gor

Active member
Joined
Feb 2, 2021
Location
Italy
TDI
ex GTD 5
Probably, to perform the immo off, the eeprom of the engine control unit was altered and It should be restored. The diesel engine Golf/Bora mk4 are equipped with ECU Bosch edc15. This job can be done using K+Can Commander
 
Z@gor

Z@gor

Active member
Joined
Feb 2, 2021
Location
Italy
TDI
ex GTD 5
I know. I mentioned the K+Can only because in its ECU e2p reading window it has the two "immo off" and "immo on" buttons to carry out the two operations automatically
 
J

Jake01

New member
Joined
Jul 11, 2024
Location
England
TDI
1.9 Golf PD130
I see, thanks for the replies, and nice to know I was on the right track with needing the immo on again to sort this out. Unfortunately neither the generic OBD2 cable or VCDS cable I have will work with the VAG Commander software I found just to check this out. Is using KWtest to address the same task something I could do as someone with intermediate experience in coding and much less experience in talking to car computers?
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Jake01 said:
I see, thanks for the replies, and nice to know I was on the right track with needing the immo on again to sort this out. Unfortunately neither the generic OBD2 cable or VCDS cable I have will work with the VAG Commander software I found just to check this out. Is using KWtest to address the same task something I could do as someone with intermediate experience in coding and much less experience in talking to car computers?
Click to expand...
Check if your VCDS cable supports the Virtual COM Port drivers: https://www.ross-tech.com/vag-com/usb/virtual-com-port.php
If not, you'll have to buy a generic KKL cable.
 
J

Jake01

New member
Joined
Jul 11, 2024
Location
England
TDI
1.9 Golf PD130
gmenounos said:
Check if your VCDS cable supports the Virtual COM Port drivers: https://www.ross-tech.com/vag-com/usb/virtual-com-port.php
If not, you'll have to buy a generic KKL cable.
Click to expand...
thanks for the quick replies, unfortunately our VCDS cable is the HEX-V2 and as far as I know the virtual COM port drivers won’t work for that, as for the generic cable though, I have used that to pull the SKC codes using kwtest already and it worked great, but neither cable works for VAG commander (3.6)

Also, I was messing around with kwtest earlier, and interestingly, the GetSKC command only seemed to work once, and would only work again when I changed the cable to another USB port. I thought this was strange, and the laptop I’m using registers all usb ports as COM3. This was part of my troubleshooting to see if I could communicate with channel 50 (the immo vehicle data learning) through your program (I was using GetSKC as a known working command).

Anyway, as a very amateur coder and car enthusiast I find all of this very interesting. I’ll look into possible ways to get VAG-Commander working. Until then, do you have any suggestions for messing with the immo using kwtest? On top of that, do I need a login code for the immobiliser, like the SKC of the instrument cluster?

Again, thanks for the help this far, very cool program you’ve made here!

Jake
 
J

Jake01

New member
Joined
Jul 11, 2024
Location
England
TDI
1.9 Golf PD130
Same issue as the weird one I had earlier, on first attempt the dump command and even GetSKC resulted in a timeout, after working previously.

After restarting cmd, GetSKC was successful, but the new command results in a timeout… the program is installed on the desktop, and I do have to set the working directory in each instance of opening cmd. This timeout is also usually the same error I get when messing around with AdaptationTest and AdapttionRead commands too, so maybe it is something to do with how I have installed the program?

added images (1 & 2: neither command works, 3 & 4: GetSKC works, dump eeprom doesn’t)

IMG_2596.jpeg
IMG_2595.jpeg
IMG_2594.jpeg
IMG_2593.jpeg

1.9TDI Cluster Trouble

Immo is deactivated by previous owner, can’t recode new cluster properly because of this. Trying...

Apologies for phone photos, I can’t log in on the laptop to send screenshots.
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Here is a modified dump for your new cluster that should unlock it permanently and allow you to use kw1281test to modify the EEPROM. If that works, you'll be able to easily change the speed sensor data as well as any other data in the EEPROM without needing to remove the cluster from the car.
Click to expand...
I redid the cluster and ecu combination and configured the keys. I tried to read the address "0x13A" (Odometer) and the program was unable to read it. The address "0x65" (SpeedSensor) was even able to read, but it is not writing a new value.

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0x13A
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending ReadEeprom block (Address: $013A, Count: $01)
EEPROM read failed
Sending EndCommunication block

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 WriteEeprom 0x65 0x86
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending WriteEeprom block (Address: $0065, Values: $86
Received "Write EEPROM Response" block: 01 00 65 79
WriteEepromResponseBlock body does not match WriteEepromBlock
Sending EndCommunication block
Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 ReadEeprom 0x65
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 00541, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Sending ReadEeprom block (Address: $0065, Count: $01)
Received "Read EEPROM Response" block: 87
Address 101 ($0065): Value 135 ($87)
Sending EndCommunication block
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Jake01 said:
Same issue as the weird one I had earlier, on first attempt the dump command and even GetSKC resulted in a timeout, after working previously.

After restarting cmd, GetSKC was successful, but the new command results in a timeout… the program is installed on the desktop, and I do have to set the working directory in each instance of opening cmd. This timeout is also usually the same error I get when messing around with AdaptationTest and AdapttionRead commands too, so maybe it is something to do with how I have installed the program?
Click to expand...
Does VCDS-Lite work reliably and consistently with your generic cable to connect to the cluster and ECU? If it gives timeouts and sometimes requires moving the cable to a different port, then it might be an issue with your cable or driver.
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
AndradeArt said:
I redid the cluster and ecu combination and configured the keys. I tried to read the address "0x13A" (Odometer) and the program was unable to read it. The address "0x65" (SpeedSensor) was even able to read, but it is not writing a new value.
Click to expand...
Ok, can you see if you can dump part of the ROM? That will hopefully help me figure out how to get the EEPROM read/write to work on your cluster.
The dump will take a number of minutes to run (about 16 times as long as it takes to dump the 2K EEPROM)

kw1281test.exe COM2 10400 17 DumpMem 0x28000 0x8000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Ok, can you see if you can dump part of the ROM? That will hopefully help me figure out how to get the EEPROM read/write to work on your cluster.
The dump will take a number of minutes to run (about 16 times as long as it takes to dump the 2K EEPROM)

kw1281test.exe COM2 10400 17 DumpMem 0x28000 0x8000
Click to expand...
At the end of the program execution, it presented "expected error": (I executed the command 3 times, and each time the reading stopped in a different block)

Version 0.98.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM3 10400 17 DumpMem 0x28000 0x8000
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending Custom "Get Access Level" block
Sending Custom "Unlock Additional Commands" block
Access level is 7.
Cluster is unlocked for memory access. Skipping Seed/Key login.
Saving memory dump to cluster_mem_$028000.bin
Sending Custom "Read Memory" block (Address: $028000, Count: $0F)
Sending Custom "Read Memory" block (Address: $02800F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02801E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02802D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02803C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02804B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02805A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028069, Count: $0F)
Sending Custom "Read Memory" block (Address: $028078, Count: $0F)
Sending Custom "Read Memory" block (Address: $028087, Count: $0F)
Sending Custom "Read Memory" block (Address: $028096, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280A5, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280B4, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280C3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280D2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280E1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280F0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0280FF, Count: $0F)
Sending Custom "Read Memory" block (Address: $02810E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02811D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02812C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02813B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02814A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028159, Count: $0F)
Sending Custom "Read Memory" block (Address: $028168, Count: $0F)
Sending Custom "Read Memory" block (Address: $028177, Count: $0F)
Sending Custom "Read Memory" block (Address: $028186, Count: $0F)
Sending Custom "Read Memory" block (Address: $028195, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281A4, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281B3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281C2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281D1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281E0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281EF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0281FE, Count: $0F)
Sending Custom "Read Memory" block (Address: $02820D, Count: $0F)
Sending Custom "Read Memory" block (Address: $02821C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02822B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02823A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028249, Count: $0F)
Sending Custom "Read Memory" block (Address: $028258, Count: $0F)
Sending Custom "Read Memory" block (Address: $028267, Count: $0F)
Sending Custom "Read Memory" block (Address: $028276, Count: $0F)
Sending Custom "Read Memory" block (Address: $028285, Count: $0F)
Sending Custom "Read Memory" block (Address: $028294, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282A3, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282B2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282C1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282D0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282DF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282EE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0282FD, Count: $0F)
Sending Custom "Read Memory" block (Address: $02830C, Count: $0F)
Sending Custom "Read Memory" block (Address: $02831B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02832A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028339, Count: $0F)
Sending Custom "Read Memory" block (Address: $028348, Count: $0F)
Sending Custom "Read Memory" block (Address: $028357, Count: $0F)
Sending Custom "Read Memory" block (Address: $028366, Count: $0F)
Sending Custom "Read Memory" block (Address: $028375, Count: $0F)
Sending Custom "Read Memory" block (Address: $028384, Count: $0F)
Sending Custom "Read Memory" block (Address: $028393, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283A2, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283B1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283C0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283CF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283DE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283ED, Count: $0F)
Sending Custom "Read Memory" block (Address: $0283FC, Count: $0F)
Sending Custom "Read Memory" block (Address: $02840B, Count: $0F)
Sending Custom "Read Memory" block (Address: $02841A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028429, Count: $0F)
Sending Custom "Read Memory" block (Address: $028438, Count: $0F)
Sending Custom "Read Memory" block (Address: $028447, Count: $0F)
Sending Custom "Read Memory" block (Address: $028456, Count: $0F)
Sending Custom "Read Memory" block (Address: $028465, Count: $0F)
Sending Custom "Read Memory" block (Address: $028474, Count: $0F)
Sending Custom "Read Memory" block (Address: $028483, Count: $0F)
Sending Custom "Read Memory" block (Address: $028492, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284A1, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284B0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284BF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284CE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284DD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284EC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0284FB, Count: $0F)
Sending Custom "Read Memory" block (Address: $02850A, Count: $0F)
Sending Custom "Read Memory" block (Address: $028519, Count: $0F)
Sending Custom "Read Memory" block (Address: $028528, Count: $0F)
Sending Custom "Read Memory" block (Address: $028537, Count: $0F)
Sending Custom "Read Memory" block (Address: $028546, Count: $0F)
Sending Custom "Read Memory" block (Address: $028555, Count: $0F)
Sending Custom "Read Memory" block (Address: $028564, Count: $0F)
Sending Custom "Read Memory" block (Address: $028573, Count: $0F)
Sending Custom "Read Memory" block (Address: $028582, Count: $0F)
Sending Custom "Read Memory" block (Address: $028591, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285A0, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285AF, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285BE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285CD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285DC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285EB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0285FA, Count: $0F)
Sending Custom "Read Memory" block (Address: $028609, Count: $0F)
Sending Custom "Read Memory" block (Address: $028618, Count: $0F)
Sending Custom "Read Memory" block (Address: $028627, Count: $0F)
Sending Custom "Read Memory" block (Address: $028636, Count: $0F)
Sending Custom "Read Memory" block (Address: $028645, Count: $0F)
Sending Custom "Read Memory" block (Address: $028654, Count: $0F)
Sending Custom "Read Memory" block (Address: $028663, Count: $0F)
Sending Custom "Read Memory" block (Address: $028672, Count: $0F)
Sending Custom "Read Memory" block (Address: $028681, Count: $0F)
Sending Custom "Read Memory" block (Address: $028690, Count: $0F)
Sending Custom "Read Memory" block (Address: $02869F, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286AE, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286BD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286CC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286DB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286EA, Count: $0F)
Sending Custom "Read Memory" block (Address: $0286F9, Count: $0F)
Sending Custom "Read Memory" block (Address: $028708, Count: $0F)
Sending Custom "Read Memory" block (Address: $028717, Count: $0F)
Sending Custom "Read Memory" block (Address: $028726, Count: $0F)
Sending Custom "Read Memory" block (Address: $028735, Count: $0F)
Sending Custom "Read Memory" block (Address: $028744, Count: $0F)
Sending Custom "Read Memory" block (Address: $028753, Count: $0F)
Sending Custom "Read Memory" block (Address: $028762, Count: $0F)
Sending Custom "Read Memory" block (Address: $028771, Count: $0F)
Sending Custom "Read Memory" block (Address: $028780, Count: $0F)
Sending Custom "Read Memory" block (Address: $02878F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02879E, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287AD, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287BC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287CB, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287DA, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287E9, Count: $0F)
Sending Custom "Read Memory" block (Address: $0287F8, Count: $0F)
Sending Custom "Read Memory" block (Address: $028807, Count: $0F)
Sending Custom "Read Memory" block (Address: $028816, Count: $0F)
Sending Custom "Read Memory" block (Address: $028825, Count: $0F)
Sending Custom "Read Memory" block (Address: $028834, Count: $0F)
Sending Custom "Read Memory" block (Address: $028843, Count: $0F)
Sending Custom "Read Memory" block (Address: $028852, Count: $0F)
Sending Custom "Read Memory" block (Address: $028861, Count: $0F)
Sending Custom "Read Memory" block (Address: $028870, Count: $0F)
Sending Custom "Read Memory" block (Address: $02887F, Count: $0F)
Sending Custom "Read Memory" block (Address: $02888E, Count: $0F)
Sending Custom "Read Memory" block (Address: $02889D, Count: $0F)
Sending Custom "Read Memory" block (Address: $0288AC, Count: $0F)
Sending Custom "Read Memory" block (Address: $0288BB, Count: $0F)
Error receiving block: Received block end $04 but expected $03. Block bytes: 03 67 09 04
Partial block: $03 $67 $09 $04
Error receiving blocks: Received block end $04 but expected $03. Block bytes: 03 67 09 04
Blocks received:
Block: $12 $65 $1B $8D $14 $0B $8D $2E $0B $AD $99 $02 $8D $15 $0B $8D $2F $0B $03
Caught: System.InvalidOperationException Received block end $04 but expected $03. Block bytes: 03 67 09 04
Unhandled exception: System.InvalidOperationException: Received block end $04 but expected $03. Block bytes: 03 67 09 04
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlock() in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 411
at BitFab.KW1281Test.KW1281Dialog.ReceiveBlocks() in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 354
at BitFab.KW1281Test.Cluster.VdoCluster.CustomReadMemory(UInt32, Byte) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 94
at BitFab.KW1281Test.Cluster.VdoCluster.DumpMem(String, UInt32, UInt32) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 167
at BitFab.KW1281Test.Tester.DumpClusterMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 1082
at BitFab.KW1281Test.Tester.DumpMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 402
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 345
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

On the 4th attempt, the program ran until time out.

One detail: I managed to change the odometer with the ETSmart program calculator, directly on the encrypted file, without needing to decrypt it. Then, I wrote the EEPROM to the chip.
The only thing missing is changing the address 0x065 (SpeedSource) from $87 to $86 and 0x190 from 00 to $75, because the speedometer is not working and the fuel gauge is oscillating.


The requested dump is attached.
Also attached is the EEPROM currently written.

cluster_mem_$028000.bin (expected error)
cluster_mem_$028000.bin (time_out)
M93C86_CURRENT_KM_L7.bin
 
Last edited:
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
AndradeArt said:
At the end of the program execution, it presented "expected error": (I executed the command 3 times, and each time the reading stopped in a different block)
...
On the 4th attempt, the program ran until time out.

One detail: I managed to change the odometer with the ETSmart program calculator, directly on the encrypted file, without needing to decrypt it. Then, I wrote the EEPROM to the chip.
The only thing missing is changing the address 0x065 (SpeedSource) from $87 to $86 and 0x190 from 00 to $75, because the speedometer is not working and the fuel gauge is oscillating.
Click to expand...
Thanks! I'll work on changing those 2 bytes in the encrypted dump. While I do that, could you try dumping the ROM, starting from where it timed out?

kw1281test.exe COM3 10400 17 DumpMem 0x2CE39 0x4000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Thanks! Hopefully that part of the ROM will have the info I need. I've attached your encrypted EEPROM with the 2 patches applied. Let me know if it works.
Click to expand...
It worked!!!!!
You are the best! I've been trying to get this cluster to work for almost 2 months.
Thank you very much!

Could you explain to me how you made this patch?
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
AndradeArt said:
It worked!!!!!
You are the best! I've been trying to get this cluster to work for almost 2 months.
Thank you very much!
Click to expand...
Glad to hear that it worked.

I was able to extract a secret key from the ROM dumps that you provided so I think you'll be able to read/write the EEPROM directly with kw1281test and not have to deal with the encryption anymore. Can you try this new release and see if that works?

https://github.com/gmenounos/kw1281test/releases/tag/v0.99-beta

AndradeArt said:
Could you explain to me how you made this patch?
Click to expand...
Sure, I'll create a page on my cluster info site ( https://github.com/gmenounos/vwcluster ) that explains how the VDO 93C86 encryption works. At some point, when I have more time, I'll enhance the decryption web page to also allow editing and re-encryption.

In the meantime, could you please try to get me a couple more ROM dumps so I can learn more about your cluster?

kw1281test.exe COM3 10400 17 DumpMem 0x38000 0x4000
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000
 
A

AndradeArt

Member
Joined
May 21, 2024
Location
Brazil
TDI
VW Polo 06/07
gmenounos said:
Can you try this new release and see if that works?

https://github.com/gmenounos/kw1281test/releases/tag/v0.99-beta
Click to expand...
I tried GetSkc but it timed out :

Version 0.99.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ09HH $10 $05
01: $90 $28
02: $17 $02 $0A $0A $31 $02
03: PQ24_9HL SQ200 Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ09HH 05.10' is 37 42 47 43
Please report this to the program maintainer.
Sending Custom "Get Access Level" block
Access level is 7.
Cluster is unlocked for ROM/EEPROM access. Skipping Seed/Key login.
Saving EEPROM dump to 6QE920827C__KOMBIINSTRUMENT_VDO_V06_$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 140
at BitFab.KW1281Test.KW1281Dialog.SendBlock(List`1) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 345
at BitFab.KW1281Test.KW1281Dialog.ReadEeprom(UInt16, Byte) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 143
at BitFab.KW1281Test.Cluster.VdoCluster.DumpEeprom(UInt16, UInt16, Byte, String) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 737
at BitFab.KW1281Test.Cluster.VdoCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 46
at BitFab.KW1281Test.Tester.DumpClusterEeprom(UInt16, UInt16, String ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 903
at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 563
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31


gmenounos said:
kw1281test.exe COM3 10400 17 DumpMem 0x38000 0x4000
Click to expand...
This command did not work in version 99, only in 98.
cluster_mem_$038000.bin

gmenounos said:
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000
Click to expand...
This other one didn't work in either of the 2 versions:

Version 0.99.0-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM2 10400 17 DumpMem 0x3C000 0x4000
OSVersion: Microsoft Windows NT 10.0.22621.0
.NET Version: 8.0.6
Culture: pt-BR
Opening serial port COM2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 6QE920827C KOMBIINSTRUMENT VDO V06
Software Coding 04541, Workshop Code: 00000
Sending Custom "Get Access Level" block
Sending Custom "Unlock Additional Commands" block
Access level is 7.
Cluster is unlocked for memory access. Skipping Seed/Key login.
Saving memory dump to cluster_mem_$03C000.bin
Sending Custom "Read Memory" block (Address: $03C000, Count: $0F)
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadComplement(Byte) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 141
at BitFab.KW1281Test.KW1281Dialog.SendBlock(List`1) in /Users/gmenounos/src/kw1281test/KW1281Dialog.cs:line 345
at BitFab.KW1281Test.Cluster.VdoCluster.SendCustom(List`1) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 199
at BitFab.KW1281Test.Cluster.VdoCluster.CustomReadMemory(UInt32, Byte) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 95
at BitFab.KW1281Test.Cluster.VdoCluster.DumpMem(String, UInt32, UInt32) in /Users/gmenounos/src/kw1281test/Cluster/VdoCluster.cs:line 167
at BitFab.KW1281Test.Tester.DumpClusterMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 1108
at BitFab.KW1281Test.Tester.DumpMem(UInt32, UInt32, String) in /Users/gmenounos/src/kw1281test/Tester.cs:line 402
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 345
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I made a typo in the previous release that's causing the "Unlock code for software version 'VQMJ09HH 05.10' is 37 42 47 43 Please report this to the program maintainer." message. Can you try this new release and see if the message goes away? https://github.com/gmenounos/kw1281test/releases/tag/v0.99.1-beta

I'm not sure what's causing the timeouts. Could you try the following command a few more times to verify that it always times out immediately?
kw1281test.exe COM3 10400 17 DumpMem 0x3C000 0x4000

Also maybe try the GetSKC a couple more times to verify that it always times out.

Thanks.
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
spoony said:
can anyone help me retreive the cluster bin file using kw1281test?
clocks are bosch RB8.
Click to expand...
If you want to dump the RB8 EEPROM, you would use the following command (replace "COM1" with the correct port that your cable is using):
kw1281test.exe COM1 10400 17 DumpRBxMem 66560 1024

If you just need the SKC, this is the easier way to get it:
kw1281test.exe COM1 10400 17 GetSKC
 
G

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
spoony said:
cool Thats confirmed my skc but i still cant get my new clocks to adapt!!
Click to expand...
Can you share some details of how you're trying to do the adaptation? Are you using kw1281test? VCDS?
What command are you using to try to do the adaptation?
 
You must log in or register to reply here.
Top