kw1281test: A Free VDS-Pro / VagTacho Alternative

[Leonard23]

Assuming this is the old Hex-Can cable and not the V2 (won't work), it should work if you configure the cable in VCDS to _not_ boot in intelligent mode.

Can you post the kw1281test.log from when you tried to use the BMW cable?

I got the Ross-Tech cable working with your advice. Thank you again. Here are the results, I can get SKC but can't read or write Eeprom


C:\Users\User\Documents\EEPROM\KW1281>kw1281test.exe com2 10400 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-CA
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920806L KOMBI+WEGFAHRS. RB8 V24
Software Coding 07332, Workshop Code: 00000
Sending EndCommunication block
Sending wakeup message
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
Sent: 82 17 F1 1A 94 38 (readEcuIdentification)
Received: 94 F1 17 5A 94 5F 56 57 33 34 30 5F 4D 4A 30 32 20 56 30 37 2E 31 33 F4 (readEcuIdentification ACK)
_VW340_MJ02 V07.13
Sent: 82 17 F1 27 FB AC (securityAccess)
Received: 86 F1 17 67 FB 37 8A BD 17 85 (securityAccess ACK)
Sent: 86 17 F1 27 FC D2 D4 16 C2 2F (securityAccess)
Received: 83 F1 17 67 FC 34 22 (securityAccess ACK)
Success!!!
Sent: 83 17 F1 10 84 14 33 (startDiagnosticSession)
Received: 82 F1 17 50 84 5E (startDiagnosticSession ACK)
Saving memory dump to RBx_$01040E_mem.bin
Sent: 85 17 F1 23 01 04 0E 02 C5 (readMemoryByAddress)
Received: 83 F1 17 63 88 0B 81 (readMemoryByAddress ACK)
Saved memory dump to RBx_$01040E_mem.bin
Sent: 82 17 F1 11 01 9C (ecuReset)
Received: 81 F1 17 51 DA (ecuReset ACK)
SKC: 02952


C:\Users\User\Documents\EEPROM\KW1281>kw1281test.exe com2 10400 17 ReadEeprom $065
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 ReadEeprom $065
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-CA
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920806L KOMBI+WEGFAHRS. RB8 V24
Software Coding 07332, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
Cluster did not return software version.
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is unknown.
Sending Custom "Seed request" block
Sending Custom "Get Access Level" block
Access level is unknown.
Failed to unlock cluster.
Sending ReadEeprom block (Address: $0065, Count: $01)
Received "Read EEPROM Response" block: 80
Address 101 ($0065): Value 128 ($80)
Sending EndCommunication block


C:\Users\User\Documents\EEPROM\KW1281>kw1281test.exe com2 10400 17 WriteEeprom $065 $81
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com2 10400 17 WriteEeprom $065 $81
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-CA
Opening serial port com2
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920806L KOMBI+WEGFAHRS. RB8 V24
Software Coding 07332, Workshop Code: 00000
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
Cluster did not return software version.
Unknown cluster software version. EEPROM access will likely fail.
Sending Custom "Get Access Level" block
Access level is unknown.
Sending Custom "Seed request" block
Sending Custom "Get Access Level" block
Access level is unknown.
Failed to unlock cluster.
Sending WriteEeprom block (Address: $0065, Values: $81
WriteEeprom failed
Sending EndCommunication block

 

[Tristan265]

From post #1 in this thread:

"Q: Will it work with my car?
A: kw1281test works with many VW group cars that use the K-Line for diagnostics. It's been most heavily tested on the VW MKIV Golf/Jetta/Beetle. It will not work on cars that use CAN bus diagnostics such as those listed here."

Supposedly it should work. What kind of cable are you using?

Thanks for responding, I appreciate it. I am using a generic blue VAG KKL cable. Here is what happens when i try to run the program.

C:\Users\Tristan\Desktop>kw1281test COM6 10400 1 dumpedc16eeprom
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 1 dumpedc16eeprom
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port COM6
Sending wakeup message
Reading sync byte
Keyword Lsb $EF
Keyword Msb $8F
Protocol is KW 2031 (8N1)
Caught: System.InvalidOperationException Expected KWP1281 protocol.
Unhandled exception: System.InvalidOperationException: Expected KWP1281 protocol.
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 37
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 288
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

 

[gmenounos]

Thanks for responding, I appreciate it. I am using a generic blue VAG KKL cable. Here is what happens when i try to run the program.

C:\Users\Tristan\Desktop>kw1281test COM6 10400 1 dumpedc16eeprom
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: COM6 10400 1 dumpedc16eeprom
OSVersion: Microsoft Windows NT 10.0.19042.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port COM6
Sending wakeup message
Reading sync byte
Keyword Lsb $EF
Keyword Msb $8F
Protocol is KW 2031 (8N1)
Caught: System.InvalidOperationException Expected KWP1281 protocol.
Unhandled exception: System.InvalidOperationException: Expected KWP1281 protocol.
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 37
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 288
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

kw1281test doesn't support dumping EDC16 EEPROMs, only EDC15. However you may still be able to pull the SKC from the cluster. Try:

kw1281test.exe COM6 10400 17 GetSKC

 

[mavreix]

VagTacho 5 work with 2013 Golf MK6?

I got the cable hooked up with the right drivers but I'm not sure which ECU, only one connects under the VDO option and it doesn't do anything other than say
~Connected!

 

[PDXVWErik]

gmenounos! You are awesome!

EDIT: This is the process in the link below. I did need to re-adapt my existing FOB.

First: 2003 Jetta, generic KKL from Amazon for ~$25 (specifically this one), W10 laptop with generic USB drivers. I was able to toggle a bunch of great stuff, unlock on ignition removal, chirp on unlock, etc.

I'm wanting to pair a couple of FOBs that I got from Amazon and am starting here but am TERRIFIED of basically "bricking" my car by removing all FOBs from it.

My understanding is that I turn the car on, start the adaptation process as in the link above and then for each FOB to adapt: remove the key, then pair my new FOBs to it by inserting the FOB to program, turning to "on" (not engine start) position and waiting for the immobilizer light to go out.

Is this correct? Do I have to re-adapt my current FOB? I've read through a bunch of this thread, but there is so much!

Is there a way to just disable the immobilizer as a failsafe if I happen to screw up the adaptations?

Thank you in advance and THANK YOU, G!!

 

[blacksi]

Hey I am looking for some guidance to my next steps. I think I have pulled the correct data to get started. I am looking to reset my 1M KM odometer back to zero or optimally back to 21K miles so I can just say add 600k to that. Help please!
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com5 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22631.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port com5
Sending wakeup message
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920905L A4-KOMBIINSTR. VDO V53
Software Coding 07232, Workshop Code: 00066
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VAT500LL $01
01: $90 $17
02: $11 $04 $00 $10 $33 $07
03: VW A4 Lowline Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VAT500LL 01.20' is 01 04 3D 35
Sending Custom "Get Access Level" block
Access level is unknown.
Sending Custom "Seed request" block
Sending Custom "Get Access Level" block
Access level is unknown.
Failed to unlock cluster.
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3278051________$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Received "Read ROM/EEPROM Response" block: 56 57 5A 37 5A 30 41 33 32 37 38 30 35 31 56 57
Sending ReadEeprom block (Address: $00A0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 37 5A 30 41 33 32 37 38 30 35 31 56 57 5A 37
Sending ReadEeprom block (Address: $00B0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 30 41 33 32 37 38 30 35 31 92 34 92 34 92 34
Sending ReadEeprom block (Address: $00C0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00D0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 FF 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00E0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 FF FF FF FF FF FF FF DB 0B DB 0B DB 0B
Sending ReadEeprom block (Address: $00F0, Count: $10)
Received "Read ROM/EEPROM Response" block: DB 0B DB 0B DB 0B DB 0B DC 0B 00 00 00 00 00 00
Sending ReadEeprom block (Address: $0100, Count: $0C)
Received "Read ROM/EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 FF FF
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3278051________$0090_eeprom.bin
SKC: 03492
Sending EndCommunication block

 

[gmenounos]

gmenounos! You are awesome!

EDIT: This is the process in the link below. I did need to re-adapt my existing FOB.

First: 2003 Jetta, generic KKL from Amazon for ~$25 (specifically this one), W10 laptop with generic USB drivers. I was able to toggle a bunch of great stuff, unlock on ignition removal, chirp on unlock, etc.

I'm wanting to pair a couple of FOBs that I got from Amazon and am starting here but am TERRIFIED of basically "bricking" my car by removing all FOBs from it.

My understanding is that I turn the car on, start the adaptation process as in the link above and then for each FOB to adapt: remove the key, then pair my new FOBs to it by inserting the FOB to program, turning to "on" (not engine start) position and waiting for the immobilizer light to go out.

Is this correct? Do I have to re-adapt my current FOB? I've read through a bunch of this thread, but there is so much!

Is there a way to just disable the immobilizer as a failsafe if I happen to screw up the adaptations?

Thank you in advance and THANK YOU, G!!

So, you were able to get this to work successfully?

(and, yes, when you add new keys, you need to re-add your old keys because the adaptation begins by telling the immobilizer to forget all existing keys)

 

[gmenounos]

VagTacho 5 work with 2013 Golf MK6?

I got the cable hooked up with the right drivers but I'm not sure which ECU, only one connects under the VDO option and it doesn't do anything other than say
~Connected!

This thread is for discussing kw1281test, not VagTacho, and mostly for MK4 cars, so I'm not sure you'll get your question answered here. Maybe start a new thread in the "OBD Scanners" area.

 

[Leonard23]

I have finally been able to reprogram the Cluster to read ABS instead of VSS. Was wondering if anyone has insight now to changing the ECU to do the same. (Cruise is not working) Not having luck finding much for info. One post suggested an eeprom address I can't seem to find on my ecu. (0x51BBA)
As well is it normal that after changing cluster to ABS, the odometer goes up 10x too fast. It's accurate but exactly 10x too fast.
Only changes made were address $065 $80to$81

 

[bn_]

I have finally been able to reprogram the Cluster to read ABS instead of VSS. Was wondering if anyone has insight now to changing the ECU to do the same. (Cruise is not working) Not having luck finding much for info. One post suggested an eeprom address I can't seem to find on my ecu. (0x51BBA)
As well is it normal that after changing cluster to ABS, the odometer goes up 10x too fast. It's accurate but exactly 10x too fast.
Only changes made were address $065 $80to$81

My cluster also read too high after switching to VSS (it was more like double instead of 10x). Send me your cluster dump via PM and i will check if i can help... And if i get you right, you are not able to find the VSS switch in your ecu? If yes, then also send me that file and i will check for the switch...

 

[Leonard23]

My cluster also read too high after switching to VSS (it was more like double instead of 10x). Send me your cluster dump via PM and i will check if i can help... And if i get you right, you are not able to find the VSS switch in your ecu? If yes, then also send me that file and i will check for the switch...

Thanks, but I just bit the bullet and swapped my Bosch cluster for a VDO. Two weeks of headaches solved in 10 minutes. Was able to program VDO in no time. All works well

 

[Nuje]

Recently i bought a brand new comfort unit 1J0 959 799 AH but this is for Bettle and leaves the trunk open when i lock the car and as it has been advised to me needs re-programming with VDS pro...

Do we have an expert to advise? I have been told i need to find the proper Channel...

Here's a spreadsheet that has the EEPROM addresses for various functions, and a few different CCMs.
(The tabs at the bottom of the spreadsheet will let choose which CCM(s) you're looking at.)

 

[RockiesJetta]

@gmenounos

Thank you for the hard work on this utility! I registered on the this thread since it seems to be one your main troubleshooting entry points.

I'm trying to get this working on a Mac and it's not. Hoping you or someone might have some insight.

Car is 2002 Jetta 2.0L gasoline. Tried with both key off and removed and key in on position, dash lights on.

Running on macOS Monterey. SIP is on but I haven't seen any security warnings.

Interface I'm attempting to use is a Sparkfun OBD-UART. This implements a STN1110 ELM27 and routes K-line.

SparkFun OBD-II UART

This board allows you to interface with your car's OBD-II bus. It provides you a serial interface using the ELM327 command set and supports all major OBD-II standards such as CAN and JBUS. The board also provides a footprint which mates directly to our FT

www.sparkfun.com

To connect to it I'm using an FTDI TTL-232R-5V cable. No question it's legitimate.

TTL-232R-5V - FTDI

USB to UART cable Supports +5V UART signals

ftdichip.com

There is a USB-C to USB-A adapter in the chain, too.

Can communicate with the ELM27 via a serial terminal (Cool Term FWIW), issue AT commands, etc. This is 9600-8-N-1. Returns ELM v1.3 (so firmware version on the STN chip is unknown) and battery voltage. Have tried using AT SP 0 (automatic) and explicitly setting mode 3 (ISO 9141-2 10400). I've also tried modes 4 and 5 (ISO 14230-4 KWP 5-baud and fast init, both 10400 baud).

Have tried passing just serial number argument as well as full FTDI path (e.g. /dev/cu.blah or /dev/tty.blah), using both 10400 and 9600 baud. Invoking with sudo makes no difference. Each attempt to wakeup results in activity, indicated by LEDs on the board.

Put the FTDI drivers (version is D2XX1.4.30) into /usr/local/lib and /include per the instructions.

Any thoughts? Perhaps non standard adapter issues but not sure why that would be. Wondering if there's any reason the OS kernel takes control of the FTDI chip and doesn't play nice, such as not allowing 10.4 kbaud. Baudrate is my main suspicion.

When kw1281Test is running the port appears busy to my terminal, so it is locked by the tool. Maybe there are different versions of drivers or kw1281Test I should attempt to use? Perhaps VID/PID need to be overridden?

>./kw1281test FT94IIGB 10400 17 GetSKC

KW1281Test: Yesterday's diagnostics...Today.
Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: FT94IIGB 10400 17 GetSKC
OSVersion: Unix 12.7.6
.NET Version: 8.0.6
Culture: en-US
Opening FTDI serial port FT94IIGB
Sending wakeup message
Reading sync byte
Read timed out
Retrying wakeup message...
Reading sync byte
Read timed out
Retrying wakeup message...
Reading sync byte
Read timed out
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
   at BitFab.KW1281Test.KwpCommon.WakeUp(Byte, Boolean) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 62
   at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 33
   at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 509
   at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
   at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

 

[gmenounos]

Unfortunately kw1281test isn't going to work through an ELM327 adapter. kw1281test needs a COM port with direct access to the K-line and I don't believe the ELM327 works that way. Maybe you could try a circuit like this ( https://circuitden.com/blog/20 ) to interface your USB->UART cable to the K-Line.

 

[RockiesJetta]

Unfortunately kw1281test isn't going to work through an ELM327 adapter. kw1281test needs a COM port with direct access to the K-line and I don't believe the ELM327 works that way. Maybe you could try a circuit like this ( https://circuitden.com/blog/20 ) to interface your USB->UART cable to the K-Line.

Doing more research I was coming to that conclusion. I need the adapter to just pass through, not actually do any protocol comm. I'm overthinking this w.r.t. ks1281Test.

Thanks again, will update what I do if there's something unique about it, but probably do a $10 eBay special KKL409 to achieve this. Maybe I'll tinker working around the ELM27 options in the STN1110 to see if there's a dumb mode that does this (I don't see any indication of this, looks like ISO, CAN, J1850 are the choices).

There's headers on the board being a Sparkfun experimenting board, too, so I could hack a bypass between the buffered K-line and the UART. The parts are there, an LM339 for RX and 2222 transistors for driving the TX to Vbat. Just need to jump around the controller, either using an internal command or 6" of wire.

Figured to end up with a HEX-V2 + VCDS to do the actual work I need but before I drop the money on that I want to make sure I have a good SKC. Wash, rinse, repeat just to make a key, I assume like most every post on 55 pages...

 

[gmenounos]

If you're going to use a Mac then you need a KKL cable that uses an FTDI chip. The cheaper ones use a CH340 chip and aren't compatible with kw1281test. A HEX-V2 cable isn't compatible with a Mac either as far as I know. Maybe if you can access it from a Windows VM, it might work. Maybe someone else reading this thread knows more...

 

[RockiesJetta]

If you're going to use a Mac then you need a KKL cable that uses an FTDI chip. The cheaper ones use a CH340 chip and aren't compatible with kw1281test. A HEX-V2 cable isn't compatible with a Mac either as far as I know. Maybe if you can access it from a Windows VM, it might work. Maybe someone else reading this thread knows more...

I have an FTDI USB-UART cable, that's not really a problem. It's legit, got it directly from FTDI years ago. AFAIK you're 100% right about CH340 not being Mac friendly. The cable I have doesn't have the vehicle side stuff of a KKL409. It's a 5V TTL. But that Sparkfun board does, just that it puts the (now I realize unnecessary) ELM27 controller between the UART and OBD port...

Assuming I go the hacker route I have all the bits to make a quasi KKL409 in hand. If I buy a blue box I'll have to see what I can do. It seems like most KKL409 are CH340 even if they claim to be FTDI. Kind of a roll the dice it seems, not atypical of eBay/Amazon, eh?

Yeah, indeed, the Mac isn't what I use for vehicle diagnostics. I have an old Windows laptop that is only for this, for a couple of vehicle brands. I'm assuming VCDS would have to be run on that, too. Doesn't have anything else on it besides diag software and is airgap to my intranet and the Internet normally. Minimum risk of getting a virus or conflict. If it comes down to it I'll run kw1281Test on it, too. It's just old and kinda clunky and I like UNIX/Linux better. The Mac also has all the extra support "stuff" on it to tinker.

But then again, if I get a reliable interface for kw1281Test you've put the hooks in to make keys, so I might just not need VCDS and HEX-V2, as much as I want to get a new tool and support people who support shadetree mechanics keep their own junk running.

 

[patholiar]

Hi I'm hoping to get some help. After such a long time finding the right combo of laptop, KKL connector, and kw1281test, it looks like I got really close to getting my SKC, but it keeps timing out before sending the code. Now I can't even run the program anymore as it says 'access denied' and my computer says to 'find the right program for this pc'

Can anyone let me know whats I'm doing wrong? It seems like its connecting as my car ends up beeping like I just turned it on when it starts to run, then it keeps timing out. Then I try running the code a few more times and now I can't even run the program anymore.

C:\Users\patso>C:\Users\patso\Downloads\kw1281test_0.99.2-alpha_Win10\kw1281test.exe com6 9600 17 getskc
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: com6 9600 17 getskc
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port com6
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J  KOMBI+WEGFAHRS. M73 D56
Software Coding 07244, Workshop Code: 22198
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
   at System.IO.Ports.SerialPort.ReadByte()
   at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
   at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 130
   at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
   at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
   at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 625
   at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
   at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

 

[gmenounos]

Hi I'm hoping to get some help. After such a long time finding the right combo of laptop, KKL connector, and kw1281test, it looks like I got really close to getting my SKC, but it keeps timing out before sending the code. Now I can't even run the program anymore as it says 'access denied' and my computer says to 'find the right program for this pc'

Can anyone let me know whats I'm doing wrong? It seems like its connecting as my car ends up beeping like I just turned it on when it starts to run, then it keeps timing out. Then I try running the code a few more times and now I can't even run the program anymore.

C:\Users\patso>C:\Users\patso\Downloads\kw1281test_0.99.2-alpha_Win10\kw1281test.exe com6 9600 17 getskc
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: com6 9600 17 getskc
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port com6
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J  KOMBI+WEGFAHRS. M73 D56
Software Coding 07244, Workshop Code: 22198
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
   at System.IO.Ports.SerialPort.ReadByte()
   at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
   at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 130
   at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
   at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
   at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 625
   at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
   at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

I have no idea why you can't run the program anymore. Try downloading it again.

Try disconnecting the battery from the car for a minute, then reconnect and try the GetSKC command again.

If that doesn't work, disconnect the battery for a minute and then try the following command and see if it works:
C:\Users\patso\Downloads\kw1281test_0.99.2-alpha_Win10\kw1281test.exe COM6 9600 17 DumpMarelliMem 14336 2048

 

[RockiesJetta]

FWIW, to close the loop on my original issue. Was tinkering with the interface circuit using the LM339 and 2222s Sparkfun put on there but decided the best way was to do it right to eliminate variables.

Ended up just buying a cable. On Amazon it's the red one, says "2 real 9241A Chips" in the listing.

Amazon.com

I opened and verified the chips are marked 9241A and it also has the FTDI FT232RL in it. Are they legitimate or fakes? Always a risk with something like this but no way to know that for certain. To be honest the quality seems pretty decent to me, I have no concerns.

The 9241A is a purpose built automotive transceiver, similar to, if not perhaps even the same, as what VW put in the ECU on the other end of the line.

Worked like a champ so far, even works fine with the Mac. But I have only read back the SKC, not tried programming keys with it.

 

[RockiesJetta]

Question about the door remote, not the immobilizer. It appears the sensor in my door isn't working so using the turn key in door, hold for 10 seconds and press the unlock button method doesn't seem to work (the little alarm armed LED next to the door lock doesn't blink, which would seem to confirm this).

I've seen reference to using the AdaptationSave command to the CCM

kw1281test: A Free VDS-Pro / VagTacho Alternative

So I've been a happy VCDS user since buying my Golf in 2003 (it had 65000 miles on it so it conveniently needed an immediate timing belt replacement, hence needing VCDS - though it was named VAG-COM way back then). However there are things that VCDS doesn't do, such as pulling the SKC from an...

forums.tdiclub.com

Didn't see a resolution to increasing the number of fobs from 1 (to say 3) and whether that worked.

Also, you put a key in the ignition and turn the car on. If you're doing more than one key do you turn the key off and move between keys (such as adapting them for the immobilizer) between pressing the unlock button on each fob or does the car just have to be on while running this command?

Thus you press unlock for 1 second on key one, the horn beeps, you move to next key, press unlock for 1 second, horn beeps, move to last key, unlock, horn beeps all while key one is left in the ignition with it on.

I'd trying to avoid clearing the CCM to test this if someone's got some insight first since I already have two remotes that work and ultimately just want to add a 3rd. If it doesn't work I think I could be left with just one or perhaps no door remotes.

 

[alanuriel012]

Hey Guys, I'm new here but just wondering if you can help me out I am trying to get my SKC code for my Vehicle and cant seem to get KW1281test to work properly. I originally tried 10400 but gave me an Unexpected sync byte so I searched around this form and saw other had better lucking using 9600 and sure enough it work but then it stop when tries to receive the memory dump i end up getting this command line "Caught: System.TimeoutException The operation has timed out." Here's what I am seeing I hope you guys can help me figure out what's going on and to why it keeps timing out

PS F:\Users\White Dragon\Desktop\kw1281test> .\KW1281Test COM4 9600 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22631.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D53
Software Coding 07244, Workshop Code: 55541
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 130
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 619
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 275
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

 

[blacksi]

Bump,

Hey I am looking for some guidance to my next steps. I think I have pulled the correct data to get started. I am looking to reset my 1M KM odometer back to zero or optimally back to 21K miles so I can just say add 600k to that. Help please!
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com5 10400 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22631.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port com5
Sending wakeup message
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J0920905L A4-KOMBIINSTR. VDO V53
Software Coding 07232, Workshop Code: 00066
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VAT500LL $01
01: $90 $17
02: $11 $04 $00 $10 $33 $07
03: VW A4 Lowline Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VAT500LL 01.20' is 01 04 3D 35
Sending Custom "Get Access Level" block
Access level is unknown.
Sending Custom "Seed request" block
Sending Custom "Get Access Level" block
Access level is unknown.
Failed to unlock cluster.
Saving EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3278051________$0090_eeprom.bin
Sending ReadEeprom block (Address: $0090, Count: $10)
Received "Read ROM/EEPROM Response" block: 56 57 5A 37 5A 30 41 33 32 37 38 30 35 31 56 57
Sending ReadEeprom block (Address: $00A0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 37 5A 30 41 33 32 37 38 30 35 31 56 57 5A 37
Sending ReadEeprom block (Address: $00B0, Count: $10)
Received "Read ROM/EEPROM Response" block: 5A 30 41 33 32 37 38 30 35 31 92 34 92 34 92 34
Sending ReadEeprom block (Address: $00C0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00D0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 FF 58 58 58 58 58 58 58 58 58 58 58 58 58 58
Sending ReadEeprom block (Address: $00E0, Count: $10)
Received "Read ROM/EEPROM Response" block: 58 58 58 FF FF FF FF FF FF FF DB 0B DB 0B DB 0B
Sending ReadEeprom block (Address: $00F0, Count: $10)
Received "Read ROM/EEPROM Response" block: DB 0B DB 0B DB 0B DB 0B DC 0B 00 00 00 00 00 00
Sending ReadEeprom block (Address: $0100, Count: $0C)
Received "Read ROM/EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 FF FF
Saved EEPROM dump to IMMO-IDENTNR_VWZ7Z0A3278051________$0090_eeprom.bin
SKC: 03492
Sending EndCommunication block

 

[gmenounos]

Hey Guys, I'm new here but just wondering if you can help me out I am trying to get my SKC code for my Vehicle and cant seem to get KW1281test to work properly. I originally tried 10400 but gave me an Unexpected sync byte so I searched around this form and saw other had better lucking using 9600 and sure enough it work but then it stop when tries to receive the memory dump i end up getting this command line "Caught: System.TimeoutException The operation has timed out." Here's what I am seeing I hope you guys can help me figure out what's going on and to why it keeps timing out

PS F:\Users\White Dragon\Desktop\kw1281test> .\KW1281Test COM4 9600 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.1-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.22631.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D53
Software Coding 07244, Workshop Code: 55541
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
...

You have a Marelli cluster. There are 2 commands you can try:

kw1281test.exe COM4 9600 17 DumpMarelliMem 3072 1024
kw1281test.exe COM4 9600 17 DumpMarelliMem 14336 2048

If neither of those work then kw1281test may not be compatible with your cluster (and there's not a whole lot I can do to add support unless I have that exact cluster to test with - and even then I may not be able to get it to work).

 

[Bent68]

I’m new to this I was wondering if you could point me in the right direction to deleting my immobilized I have a kkl cable already

 

[P2B]

I’m new to this I was wondering if you could point me in the right direction to deleting my immobilized I have a kkl cable already

EDC15 Immobilizer Off:

.\kw1281test.exe com2 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60

 

[Bent68]

EDC15 Immobilizer Off:

.\kw1281test.exe com2 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60

Thank you !

 

[Bent68]

C:\Users\Bentley Howard>Onedrive\Desktop\kw1281test.exe Com3 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.2-alpha (https://github.com/gmenounos/kw1281test/releases)
Args: Com3 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.6
Culture: en-US
Opening serial port Com3
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 038906012FF 1,9l R4 EDC G000AG 4104
Software Coding 00001, Workshop Code: 00066
Sending EndCommunication block
Reading sync byte
Keyword Lsb $6B
Keyword Msb $8F
Protocol is KW 2027 (8N1)
KW Version: 2027
Sent: 82 01 F1 10 89 0D (startDiagnosticSession)
Received: 83 06 01 7F 03 13 1F (3 NAK 19)
Caught: System.InvalidOperationException Unexpected DestAddress: 06
Unhandled exception: System.InvalidOperationException: Unexpected DestAddress: 06
at BitFab.KW1281Test.KW2000Dialog.SendReceive(DiagnosticService, Byte[], Boolean ) in /Users/gmenounos/src/kw1281test/Kwp2000/KW2000Dialog.cs:line 133
at BitFab.KW1281Test.EDC15.Edc15VM.ReadWriteEeprom(String, List`1 ) in /Users/gmenounos/src/kw1281test/EDC15/Edc15VM.cs:line 21
at BitFab.KW1281Test.Tester.ReadWriteEdc15Eeprom(String , List`1 ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 357
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 405
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 31

 

[Bent68]

First time doing this was it successful?

 

[gmenounos]

First time doing this was it successful?

Nope. Give it a couple more tries.