kw1281test: A Free VDS-Pro / VagTacho Alternative

[kent750]

I have no idea why you can't run the program anymore. Try downloading it again.

Try disconnecting the battery from the car for a minute, then reconnect and try the GetSKC command again.

If that doesn't work, disconnect the battery for a minute and then try the following command and see if it works:
C:\Users\patso\Downloads\kw1281test_0.99.2-alpha_Win10\kw1281test.exe COM6 9600 17 DumpMarelliMem 14336 2048

I have the same cluster...got this result
C:\Users\kent\Downloads\kw1281test_0.99.3-beta_Win10>.\kw1281test.exe COM4 9600 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.3-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.11
Culture: en-CA
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D56
Software Coding 07344, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 137
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 621
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 277
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 33

Then tried the alternate command and got this

C:\Users\kent\Downloads\kw1281test_0.99.3-beta_Win10>.\kw1281test.exe COM4 9600 17 DumpMarelliMem 14336 2048
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.3-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 DumpMarelliMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.11
Culture: en-CA
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D56
Software Coding 07344, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0800
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $3800, Count: $0800)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 137
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.DumpMarelliMem(UInt32, UInt32, ControllerInfo, String ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 386
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 346
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 33


Any other suggestions gmenounos?

 

[gmenounos]

New release: https://github.com/gmenounos/kw1281test/releases/tag/v0.99.4-beta
Now supports custom baud rates (e.g. 10400) with native serial ports on Linux. For example, here's kw1281test running on a Raspberry Pi with a red FTDI KKL cable. I didn't need to install any special FTDI drivers but I did change the FTDI latency timer to 1ms as described here.

$ ./kw1281test /dev/ttyUSB0 10400 17 ReadSoftwareVersion
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.4-beta (https://github.com/gmenounos/kw1281test/releases)
Args: /dev/ttyUSB0 10400 17 ReadSoftwareVersion
OSVersion: Unix 6.6.62.8
.NET Version: 9.0.0
Culture: en-US
Opening Linux serial port /dev/ttyUSB0
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 1J5920926C  KOMBI+WEGFAHRSP VDO V13
Software Coding 07232, Workshop Code: 00442
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VWK501MH $10 $01
01: $81 $19
02: $18 $08 $01 $0B $1C $09
03: VW/Sk MH Serie/Flash
Sending EndCommunication block

 

[gmenounos]

I have the same cluster...got this result
C:\Users\kent\Downloads\kw1281test_0.99.3-beta_Win10>.\kw1281test.exe COM4 9600 17 GetSKC
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.3-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 GetSKC
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.11
Culture: en-CA
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D56
Software Coding 07344, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0400
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $0C00, Count: $0400)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 137
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.GetSkc() in /Users/gmenounos/src/kw1281test/Tester.cs:line 621
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 277
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 33

Then tried the alternate command and got this

C:\Users\kent\Downloads\kw1281test_0.99.3-beta_Win10>.\kw1281test.exe COM4 9600 17 DumpMarelliMem 14336 2048
KW1281Test: Yesterday's diagnostics...Today.

Version 0.99.3-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM4 9600 17 DumpMarelliMem 14336 2048
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 8.0.11
Culture: en-CA
Opening serial port COM4
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 8N1920930J KOMBI+WEGFAHRS. M73 D56
Software Coding 07344, Workshop Code: 00000
entryH: 0x02, regBlockH: 0x08, count: 0x0800
Sending block 0x6C
Writing data to cluster microcontroller
Receiving ACK
Writing memory dump program to cluster microcontroller
(Entry: $0200, RegBlock: $0800, Start: $3800, Count: $0800)
Receiving ACK
Receiving memory dump
Caught: System.TimeoutException The operation has timed out.
Unhandled exception: System.TimeoutException: The operation has timed out.
at System.IO.Ports.SerialPort.ReadByte()
at BitFab.KW1281Test.Interface.GenericInterface.ReadByte() in /Users/gmenounos/src/kw1281test/Interface/GenericInterface.cs:line 34
at BitFab.KW1281Test.KwpCommon.ReadByte() in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 137
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpMem(String, UInt16, Nullable`1 ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 176
at BitFab.KW1281Test.Cluster.MarelliCluster.DumpEeprom(Nullable`1, Nullable`1, String ) in /Users/gmenounos/src/kw1281test/Cluster/MarelliCluster.cs:line 21
at BitFab.KW1281Test.Tester.DumpMarelliMem(UInt32, UInt32, ControllerInfo, String ) in /Users/gmenounos/src/kw1281test/Tester.cs:line 386
at BitFab.KW1281Test.Program.Run(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 346
at BitFab.KW1281Test.Program.Main(String[]) in /Users/gmenounos/src/kw1281test/Program.cs:line 33


Any other suggestions gmenounos?

I think for now, your cluster is not supported. I'll see if I can support it in the future. I have another TT cluster that someone gave me that also doesn't work (but I forgot the part number). If I ever can get it to work then maybe I can add support for yours.

 

[kent750]

I think for now, your cluster is not supported. I'll see if I can support it in the future. I have another TT cluster that someone gave me that also doesn't work (but I forgot the part number). If I ever can get it to work then maybe I can add support for yours.

It's curious... the Readfaultcodes command did work.

 

[gmenounos]

It's curious... the Readfaultcodes command did work.

Getting the SKC is a special function that has to be written specially for every kind of cluster.

 

[skinny602]

Will this work with mk5 cars. 2009 eos and 2006/2007 jettas?

 

[gmenounos]

Will this work with mk5 cars. 2009 eos and 2006/2007 jettas?

Read the first post in this thread.

 

[vampirelo]

Hello, tryed to read eeprom from 3U0920942D cluster.
It is amazing that it can read Crypted cluster! However is it possible to read all data including keys, milleage and matching to engine?
There are addresses 50-5f, 70 to 14f not read from cluster.
What can I do to read data in full? Match one key to cluster?


From log file info:

Version 0.99.4-beta (https://github.com/gmenounos/kw1281test/releases)
Args: COM1 10400 17 DumpEeprom 0 2048 eeprom.bin
OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1
.NET Version: 9.0.0
Culture: ru-RU
Opening Generic serial port COM1
Sending wakeup message
Reading sync byte
Keyword Lsb $01
Keyword Msb $8A
Protocol is KW 1281 (8N1)
ECU: 3U0920942D KOMBI+WEGFAHRSP VDO V06
Software Coding 31415, Workshop Code: 00222
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: KB5M07HH $00 $09
01: $36 $26
02: $16 $06 $06 $0D $2E $01
03: Skoda Superb MJ07
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'KB5M07HH 09.00' is 3E 35 3D 3A
Sending Custom "Get Access Level" block
Access level is 2.
Sending Custom "Seed request" block
Block: 06 09 26 DC F9 D9 00 6E 0D 00
Access level 7 secret: $0A $5B $41 $4F
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 2.
Failed to unlock cluster.
Saving EEPROM dump to eeprom.bin
Sending ReadEeprom block (Address: $0000, Count: $10)
Received "Read EEPROM Response" block: 02 02 55 F7 02 55 FD 02 00 DE 00 00 00 00 00 00
Sending ReadEeprom block (Address: $0010, Count: $10)
Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Sending ReadEeprom block (Address: $0020, Count: $10)
Received "Read EEPROM Response" block: 31 30 30 38 32 36 32 37 46 49 4C 30 30 30 41 44
Sending ReadEeprom block (Address: $0030, Count: $10)
Received "Read EEPROM Response" block: 04 03 31 30 30 38 32 36 33 35 46 49 4C 30 30 30
Sending ReadEeprom block (Address: $0040, Count: $10)
Received "Read EEPROM Response" block: 41 41 01 02 31 30 31 30 31 36 33 32 46 49 4C 30
Sending ReadEeprom block (Address: $0050, Count: $10)
Sending ReadEeprom block (Address: $0060, Count: $10)
Received "Read EEPROM Response" block: FF FF FF FF 0C 81 FF FF FF FF FF FF FF FF FF FF
Sending ReadEeprom block (Address: $0070, Count: $10)
Sending ReadEeprom block (Address: $0080, Count: $10)
Sending ReadEeprom block (Address: $0090, Count: $10)
Sending ReadEeprom block (Address: $00A0, Count: $10)
Sending ReadEeprom block (Address: $00B0, Count: $10)
Sending ReadEeprom block (Address: $00C0, Count: $10)
Sending ReadEeprom block (Address: $00D0, Count: $10)
Sending ReadEeprom block (Address: $00E0, Count: $10)
Sending ReadEeprom block (Address: $00F0, Count: $10)
Sending ReadEeprom block (Address: $0100, Count: $10)
Sending ReadEeprom block (Address: $0110, Count: $10)
Sending ReadEeprom block (Address: $0120, Count: $10)
Sending ReadEeprom block (Address: $0130, Count: $10)
Sending ReadEeprom block (Address: $0140, Count: $10)
Received "Read EEPROM Response" block: 45 C3 45 C3 45 C3 45 C3 45 C3 04 10 10 40 10 01
Sending ReadEeprom block (Address: $0150, Count: $10)
Received "Read EEPROM Response" block: 15 84 00 10 00 A2 00 00 00 00 33 55 30 39 32 30
Sending ReadEeprom block (Address: $0160, Count: $10)
--- skipped ---
Received "Read EEPROM Response" block: 00 00 00 00 FF FF FF 00 D2 53 4B 45 07 FF 00 44
Sending ReadEeprom block (Address: $07F0, Count: $10)
Received "Read EEPROM Response" block: 48 4C 00 00 00 00 00 03 02 03 0F 10 0F 0B 0F 0E

**********************************************************************
*** Warning: Some bytes could not be read and were replaced with 0 ***
**********************************************************************

Saved EEPROM dump to eeprom.bin
Sending EndCommunication block

 

[kent750]

I think for now, your cluster is not supported. I'll see if I can support it in the future. I have another TT cluster that someone gave me that also doesn't work (but I forgot the part number). If I ever can get it to work then maybe I can add support for yours.

Appreciate that greatly. You have had success with some tt clusters ? I thought I noted some while going through the thread

 

[2003_unicorns]

TLDR, Sorry. I successfully used this to get/keep my hatch open with the door switch on my 03 Jetta Wagon. Do I need to use this software on my 03 door Golf to do the same thing or can that be accomplished via VCDS? I like to go as far as I can with VCDS and then use this.

Thanks!!

 

[gmenounos]

Appreciate that greatly. You have had success with some tt clusters ? I thought I noted some while going through the thread

It works with most but there are a few that do not. I should make a list.

 

[gmenounos]

TLDR, Sorry. I successfully used this to get/keep my hatch open with the door switch on my 03 Jetta Wagon. Do I need to use this software on my 03 door Golf to do the same thing or can that be accomplished via VCDS? I like to go as far as I can with VCDS and then use this.

Thanks!!

I believe you need kw1281test for that.

 

[2003_unicorns]

I believe you need kw1281test for that.

Thank you.

 

[gmenounos]

Hello, tryed to read eeprom from 3U0920942D cluster.
It is amazing that it can read Crypted cluster! However is it possible to read all data including keys, milleage and matching to engine?
There are addresses 50-5f, 70 to 14f not read from cluster.
What can I do to read data in full? Match one key to cluster?

It looks like kw1281test doesn't fully unlock 3U0920942D clusters for full EEPROM read. If you have access to an EEPROM programmer (e.g. like this one) I can tell you how to change a few bytes that will unlock it for use with kw1281test.

 

[vampirelo]

It looks like kw1281test doesn't fully unlock 3U0920942D clusters for full EEPROM read. If you have access to an EEPROM programmer (e.g. like this one) I can tell you how to change a few bytes that will unlock it for use with kw1281test.

Yes, I have ezp programmer and can read eeprom directly from chip, decryt it and modify as needed. Should I make cluster as New (change 060606 to 040404)? Or something other need to be updated?

 

[gmenounos]

Yes, I have ezp programmer and can read eeprom directly from chip, decryt it and modify as needed. Should I make cluster as New (change 060606 to 040404)? Or something other need to be updated?

No need to decrypt it. Read the entire EEPROM and email it to me (contact info here: https://bitfab.com/Contact) and then I can tell you how to modify it.

 

[TdiRN]

How can i use the tool to remove the immobilizer on my 2002?

 

[gmenounos]

How can i use the tool to remove the immobilizer on my 2002?

https://github.com/gmenounos/kw1281test/issues/54#issuecomment-1903305187

 

[TdiRN]

Am I just going to command prompt, changing directory to file location, and using this command: .\kw1281test.exe com2 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60 ?

 

[gmenounos]

Am I just going to command prompt, changing directory to file location, and using this command: .\kw1281test.exe com2 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60 ?

Yes, bit you may need to replace "com2" with whatever com port your KKL cable is using. Also make sure to download the newest version: https://github.com/gmenounos/kw1281test/releases

 

[TdiRN]

just downloaded the latest version and am going to use my rosstech cable

 

[TdiRN]

Edit: Win 10 is a PITA. I think I've finally got it figured out.

 

[TdiRN]

Ok tried it this morning and am getting this:

Version 0.99.4-beta (https://github.com/gmenounos/kw1281test/releases)
Args: com4 9600 1 WriteEdc15Eeprom 0x1B0 0x60 0x1DE 0x60
OSVersion: Microsoft Windows NT 10.0.19045.0
.NET Version: 9.0.0
Culture: en-US
Opening Generic serial port com4
Sending wakeup message
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
The operation has timed out.
Retrying wakeup message...
Reading sync byte
The operation has timed out.
Caught: System.InvalidOperationException Controller did not wake up.
Unhandled exception: System.InvalidOperationException: Controller did not wake up.
at BitFab.KW1281Test.KwpCommon.WakeUp(Byte controllerAddress, Boolean evenParity) in /Users/gmenounos/src/kw1281test/KwpCommon.cs:line 62
at BitFab.KW1281Test.Tester.Kwp1281Wakeup(Boolean evenParityWakeup) in /Users/gmenounos/src/kw1281test/Tester.cs:line 31
at BitFab.KW1281Test.Program.Run(String[] args) in /Users/gmenounos/src/kw1281test/Program.cs:line 290
at BitFab.KW1281Test.Program.Main(String[] args) in /Users/gmenounos/src/kw1281test/Program.cs:line 33

 

[gmenounos]

Ok tried it this morning and am getting this:
...
The operation has timed out.
Caught: System.InvalidOperationException Controller did not wake up.
...

What kind of cable are you using? If it's a RossTech cable then it needs to be one of the older ones that support VCP drivers and it needs to be set to "dumb mode" (e.g. uncheck "Boot in Intelligent Mode" in VCDS settings, save settings and unplug/replug cable before using kw1281test).

 

[TdiRN]

That was it! Help is much appreciated! I am taking notes this time so I can remember the necessary steps. Immobilizer is off and all of my keys work!!

 

[gmenounos]

That was it! Help is much appreciated! I am taking notes this time so I can remember the necessary steps. Immobilizer is off and all of my keys work!!

And don't delete the EDC15 backup file that was created in case you want to turn the immobilizer back on.

 

[vampirelo]

No need to decrypt it. Read the entire EEPROM and email it to me (contact info here: https://bitfab.com/Contact) and then I can tell you how to modify it.

Checked as you have advised - cluster read in full! Thanks a lot.

 

[Nuje]

TLDR, Sorry. I successfully used this to get/keep my hatch open with the door switch on my 03 Jetta Wagon. Do I need to use this software on my 03 door Golf to do the same thing or can that be accomplished via VCDS? I like to go as far as I can with VCDS and then use this.

Thanks!!

If your 2dr Golf is the bargain-basement trim level (manual windows and mirrors typically signify that).....the CCM in those cars is not the typical 1C0***, but rather, some 1J0 thing that doesn't have the bits and bytes in the same places. I haven't been able to figure out how to get the "hatch lock status matches door lock status" that you've done on the wagon to work on one of these cars; granted, my sample size is exactly two, so....haven't spent massive resources trying to figure it out either.

 

[2003_unicorns]

If your 2dr Golf is the bargain-basement trim level (manual windows and mirrors typically signify that).....the CCM in those cars is not the typical 1C0***, but rather, some 1J0 thing that doesn't have the bits and bytes in the same places. I haven't been able to figure out how to get the "hatch lock status matches door lock status" that you've done on the wagon to work on one of these cars; granted, my sample size is exactly two, so....haven't spent massive resources trying to figure it out either.

Let me know if you need me to share what worked for me on the wagon. There is one odd and terrible cavaet though. If I open and close the hatch with it running it locks all of the doors.

I remember to leave my windows down.

The Golf is a GL and has power windows and locks but no sunroof. Thanks for the heads up.

 

[P2B]

Let me know if you need me to share what worked for me on the wagon. There is one odd and terrible cavaet though. If I open and close the hatch with it running it locks all of the doors.

In that case it didn't work That should not happen. I'd share what worked for me but I did it years ago using VDS-Pro and don't recall the details