kw1281test: A Free VDS-Pro / VagTacho Alternative

RockiesJetta

Member
Joined
Oct 18, 2024
Location
Colorado
TDI
Mk4 Jetta
While writing to ME7.5 ECU EEPROM is technically possible (just as KW1281test can do that with the EDC15 ECU), rational I have seen on nefarious motorsport forums is that the me7_95040_v1.31 program developer intentionally omitted this capability from public release since that would enable a car thief with a laptop an easy way to turn off ECU immobilizer and steal the car. I went the route of using a bench harness, opening the ECU security case and shorting pin to trigger boot mode when I wanted to re-write the EEPROM on a spare junkyard ECU to work on my IMMO 3 audi A4.
Seems like a reasonable choice to not allow it. Wouldn't you also need a key that would unlock the ignition and turn it to ON? I guess that could be anything since it doesn't have to be a RFID key just to do that. So just punch the column I suppose.

I already had rework tools, hot air, soldering iron, microscope, EEPROM programmer so it was the high speed, low drag approach I knew I could do that didn't require sourcing more stuff is all. They key was just knowing *what* addresses needed to be edited, e.g. the Nefmoto treasure trove.

I might go down the bench harness and spare ECU route at some point, I'd like to clean up the cluster and ECU. I have the flashing Immo light and a few stored DTCs now, which will irritate me, I just know it.
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Adding more info, sort of a parallel thread since kw1281test doesn't help those of us having petrol engines but probably good to have referenced since search engines got me here originally and might be useful for future owners.

I was eventually able to get the tools from Nefmoto. Be persistent, the forum is tempermental.

I was able to use "me7_95040_v1.31" get the EEPROM dumps via the the diagnostic port but the tool failed to write to the EEPROM, which is expected. To write you need to get the ECU to accept new values and that requires the ECU being in boot mode. Normally this is done by shorting a pin on the microprocessor to ground briefly when you power up the ECU.

Supposedly it can be done via OBDII port but it looked to me only specific types of interfaces would work and the KKL 409.1 red cable I have is not one of them. I didn't look into great detail but it seems some of them can pull down a pin on the port the ECU expects to allow writing. To do this it seems they bit bang one of the chip select lines and either they've only figured this out for the Prolific based intefaces or the FTDI ones (like I have) just can't do it. Like I say, I figured the lack of clear detail didn't give me confidence to I abandoned this approach.

Alternatively bench harness or opening them are relatively well documented and I felt this was a safer (to me) approach.

I considered building a bench setup and try to do it via the OBDII path. I'd have to pull the ECU and still take the lid off anyway, so I found it easier to just de-solder the EEPROM and do it manually.

Ultimately the VW-specific tool I needed was "eepromtool_04" to do what I needed to do. To do the actual firmware read/write I used an Xgecu T48 PROM/Flash tool.

I have to say thanks to you for clues on those ME7.5 tools (huge lifesaver) and to all the hackers who figured this out for us. Again, @gmenounos, even though kw1281test wasn't needed having it originally and to poke around immobilizer and ECU has be invaluable.
If someone wants to donate an ME7.x ECU (with appropriate connectors and wiring pigtails for +12V, ground and K-line) then I could probably add support to read (and maybe even write) the EEPROM.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
While writing to ME7.5 ECU EEPROM is technically possible (just as KW1281test can do that with the EDC15 ECU), rational I have seen on nefarious motorsport forums is that the me7_95040_v1.31 program developer intentionally omitted this capability from public release since that would enable a car thief with a laptop an easy way to turn off ECU immobilizer and steal the car.
If you can read the EEPROM then, assuming it's like the EDC15, you get the SKC, which allows you to add a new key via the cluster, which allows you to start the car. Even if you can't read the ECU's EEPROM, you can use kw1281test to read the SKC from the cluster, which allows you to add a new key and start the car. Maybe a little bit more involved than deleting the immobilizer, but you can buy a blank ID48 transponder chip for $1.50, which you could tape to the steering column to pretend to be a new key. I think at this point, the MKIV immobilizer is more of a hinderance to the owner who needs to add a new key than to a car thief.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
hello guys any help greatly appreciated when i try to open kw128test for windows the cmd window opens for the first few lines tommorows technology today and then simply vanishes i ahve tried switching widows defender off and simply nothing is working trying in compatability mode etc admin etc no joy , any help greatly appreciated
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
hello guys any help greatly appreciated when i try to open kw128test for windows the cmd window opens for the first few lines tommorows technology today and then simply vanishes i ahve tried switching widows defender off and simply nothing is working trying in compatability mode etc admin etc no joy , any help greatly appreciated
It's a command line program, so you need to open up a command prompt window and run it from there. Maybe this video will help:
There's probably a better video floating around somewhere, but that's the first one I found.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
It's a command line program, so you need to open up a command prompt window and run it from there. Maybe this video will help:
There's probably a better video floating around somewhere, but that's the first one I found.
Ok thank you for your reply I'm resurrecting on old Toshiba running windows 7 as well. I haven't watched the video yet. On the cmd I ased it to run net and net build and but I'll watch the video many thanks for getting back and for putting the time into this in the first place.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Ok thank you for your reply I'm resurrecting on old Toshiba running windows 7 as well. I haven't watched the video yet. On the cmd I ased it to run net and net build and but I'll watch the video many thanks for getting back and for putting the time into this in the first place.
Not supported on Windows 7. It might work or it might not. You don't need to build anything. You can download a pre built version from the GitHub page: https://github.com/gmenounos/kw1281test/releases
 

Figster

Veteran Member
Joined
Jun 23, 2002
Location
Pliny, WV
TDI
2002 TDI Golf
Hello everyone, and thanks Greg for the monumental effort of developing and supporting this great program!
Here's my issue. I have a 2002 alh golf that I purchased new with 9 miles on the clock many years ago and the odometer has stopped at 621,358 miles about 3 weeks ago. There must be a bit of rounding/conversion error as 999,999 km converts 621,370 miles, but, what's 12 miles over that distance... 😁

Q1. How do I read the mileage off of the ECU? I understand that it keeps counting even though the cluster doesn't. I've put another 1200 ish miles on it since then.
Q2. I would like to reset the odometer to 21,358 miles, or total miles minus 600kso that it keeps counting for maintenance intervals. My plan is to put a sticker on the cluster saying add 600k. How do I do this?

I understand that there are legal issues, but the car is 23 years old and anyone looking at it wouldn't believe it only has 21k miles. She's no beauty queen...

Dump the cluster eprom and edit the bin file with a hex editor? As I understand it, the mileage is stored in a few different places with checksum values. If so, how are the checksums re calculated? I've already gotten the SKC, and by doing that, Greg's program has dumped the EEPROM to a bin file.

Thanks, Kevin
 

P2B

Top Post Dawg
Joined
Jan 11, 2006
Location
Toronto & Muskoka, Canada
TDI
2002 Jetta, 2003 Jetta, 2003 Jetta Wagon
Hello everyone, and thanks Greg for the monumental effort of developing and supporting this great program!
Here's my issue. I have a 2002 alh golf that I purchased new with 9 miles on the clock many years ago and the odometer has stopped at 621,358 miles about 3 weeks ago. There must be a bit of rounding/conversion error as 999,999 km converts 621,370 miles, but, what's 12 miles over that distance... 😁

Q1. How do I read the mileage off of the ECU? I understand that it keeps counting even though the cluster doesn't. I've put another 1200 ish miles on it since then.
Q2. I would like to reset the odometer to 21,358 miles, or total miles minus 600kso that it keeps counting for maintenance intervals. My plan is to put a sticker on the cluster saying add 600k. How do I do this?

I understand that there are legal issues, but the car is 23 years old and anyone looking at it wouldn't believe it only has 21k miles. She's no beauty queen...

Dump the cluster eprom and edit the bin file with a hex editor? As I understand it, the mileage is stored in a few different places with checksum values. If so, how are the checksums re calculated? I've already gotten the SKC, and by doing that, Greg's program has dumped the EEPROM to a bin file.

Thanks, Kevin
Here are a couple of Greg's posts detailing where and how the odometer reading is stored:
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Q1. How do I read the mileage off of the ECU? I understand that it keeps counting even though the cluster doesn't. I've put another 1200 ish miles on it since then.
Run the GetSKC command against your ECU (address 1) and it should tell you the ECU's odometer estimate.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
Not supported on Windows 7. It might work or it might not. You don't need to build anything. You can download a pre built version from the GitHub page: https://github.com/gmenounos/kw1281test/releases
Thankyou Greg, the penny is dropping. cmd prompt programmes are reactionary rather than automatic? i found the 128kwtest facility. however i have 3 cables 1 rosstech cable however it is the HEX-V2 , i have a chinese VAG-K+CAN Commander and i have a lead that i rem buying in 2010 simply says OBDII. i read the HEX-V2 wont work, can i install the vcp drivers to either the OBDII or the VAG-K-CAN ?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Thankyou Greg, the penny is dropping. cmd prompt programmes are reactionary rather than automatic?
From the first post in this thread:

Q: Why is it a command line program?
A: That was easiest for me. I have a day job so I only have limited time for hobby stuff like this. It also made it relatively easy to get it running on macOS and Linux.

i found the 128kwtest facility. however i have 3 cables 1 rosstech cable however it is the HEX-V2 , i have a chinese VAG-K+CAN Commander and i have a lead that i rem buying in 2010 simply says OBDII. i read the HEX-V2 wont work, can i install the vcp drivers to either the OBDII or the VAG-K-CAN ?
I don't have any of those cables (though the HEX-V2 is known not to work with the VCP drivers) so you'll have to try and see if you can get them to appear as a COM port. You could also try ordering one of these: https://www.aliexpress.us/item/3256807382992296.html
The red cables are my favorite right now because they use an FTDI chip, which makes it easier to find drivers and they work on Windows/Mac/Linux. The generic blue KKL cables use a Chinese CH340 chip that only has Windows drivers available.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
I think the leads i mentioned there previously must be the FTDI chip and not the CH340 chip because i managed to install the VCP drivers onto the generic OBDII diagnostic cable and i noticed the FTDI name in the properties. Yaaaay thanks so much for this so far.. now i simply need to use your programme to dump the EEPROM
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
yes indeed thanks for all the replies and also pointing me in the right direction , i have an edc15 ecu however my immo box is a seperate box concealed beside the cluster not in the cluster 2000 vw t4 transporter 2.5tdi Acv .. looks like i will have to resurrect the win 7 laptop and install vag k can commander.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
yes indeed thanks for all the replies and also pointing me in the right direction , i have an edc15 ecu however my immo box is a seperate box concealed beside the cluster not in the cluster 2000 vw t4 transporter 2.5tdi Acv .. looks like i will have to resurrect the win 7 laptop and install vag k can commander.
You might be able to use the GetSKC command against the immo box (address 25) if there's a properly matched key in the ignition. I have a few immo boxes I got from Europe but I don't have any matched keys so have no ability to test. Some of the immo boxes can be read with an eeprom reader. See here for more info: https://transpondery.com/pinouts/vag/immo_boxes.html
 

schoon

New member
Joined
Oct 30, 2025
Location
aus
TDI
0
sorry to be a pain, probably been asked. ive just got a hex-v2. can it extract skc with your software?
 

Grayjay

Member
Joined
Jun 14, 2025
Location
Alaska
TDI
Audi A4
It's a command line program, so you need to open up a command prompt window and run it from there. Maybe this video will help:
There's probably a better video floating around somewhere, but that's the first one I found.
What irks me about this particular video, they used KW1281test for the SKC retrieval but then reverted to performing the key adaptation using VCDS without ever trying or mentioning that KW1281test can also perform key adaptation. It would leave a viewer with the impression that VCDS is also needed for the adaptation when the entire process can be accomplished with KW1281test alone.
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
What irks me about this particular video, they used KW1281test for the SKC retrieval but then reverted to performing the key adaptation using VCDS without ever trying or mentioning that KW1281test can also perform key adaptation. It would leave a viewer with the impression that VCDS is also needed for the adaptation when the entire process can be accomplished with KW1281test alone.
But why would someone have a VW and not have vcds?
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
What irks me about this particular video, they used KW1281test for the SKC retrieval but then reverted to performing the key adaptation using VCDS without ever trying or mentioning that KW1281test can also perform key adaptation. It would leave a viewer with the impression that VCDS is also needed for the adaptation when the entire process can be accomplished with KW1281test alone.
It could be that whoever made that video wasn't aware of the other capabilities. Or, depending on when the video was made, maybe I hadn't added adaptation or maybe it was buggy. Either way, anyone is free to make improved how-to videos. I've never made a YouTube video, so I suspect I wouldn't do that great a job. And my time is limited, so it'd probably be better spent improving kw1281test.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
You might be able to use the GetSKC command against the immo box (address 25) if there's a properly matched key in the ignition. I have a few immo boxes I got from Europe but I don't have any matched keys so have no ability to test. Some of the immo boxes can be read with an eeprom reader. See here for more info: https://transpondery.com/pinouts/vag/immo_boxes.html
Thank you G. i have got 2 keys and both are for the t4 however they have both lost the pairing with the immo. either through the vehicle battery running flat or the new key not being paired properly or maybe as its a simple transponder its been sitting too close to an electromagnetic pulse somewhere . So the reason i need the eeprom dump for the skc is to enable me to pair the key using vcds. I didn't realize your programme can also pair a new key. will this work with my separate immo Box though? i will have a look at Transpondery link ....thank you
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Thank you G. i have got 2 keys and both are for the t4 however they have both lost the pairing with the immo. either through the vehicle battery running flat or the new key not being paired properly or maybe as its a simple transponder its been sitting too close to an electromagnetic pulse somewhere.
The immo box shouldn't forget which keys are paired just because the battery was flat. The pairings are stored in EEPROM, so no power is required to retain the settings. The SKC is stored in the same EEPROM, so you'd have bigger problems if the EEPROM got erased.

Have you considered that maybe your immobilizer coil or wiring is at fault? You should be able to scan the immo box for fault codes with one of the keys in the ignition and see if any faults come up complaining about the immo coil.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
The immo box shouldn't forget which keys are paired just because the battery was flat. The pairings are stored in EEPROM, so no power is required to retain the settings. The SKC is stored in the same EEPROM, so you'd have bigger problems if the EEPROM got erased.

Have you considered that maybe your immobilizer coil or wiring is at fault? You should be able to scan the immo box for fault codes with one of the keys in the ignition and see if any faults come up complaining about the immo coil.
Yes, I have checked all the wiring , all continuity and resistance levels all good, relay good, immo on vcds comes back talking to immo box talking to ecu immo telling me keys not paired.
 

vw51

Member
Joined
Oct 11, 2025
Location
Belfast
TDI
Audi A4 vw t4
The immo box shouldn't forget which keys are paired just because the battery was flat. The pairings are stored in EEPROM, so no power is required to retain the settings. The SKC is stored in the same EEPROM, so you'd have bigger problems if the EEPROM got erased.

Have you considered that maybe your immobilizer coil or wiring is at fault? You should be able to scan the immo box for fault codes with one of the keys in the ignition and see if any faults come up complaining about the immo coil.
Also Greg i have swapped the immobilizer coil around the ignition barrel ,replaced the black wire from ecu to ignition relay and sent ecu away to have immo switched off - which it wasnt. You can decern from the snip the immobiliser is talking to the ecu telling it the key doesnt match ? cannot figure out how to add a snip of the vcds immobiliser
 
Last edited:

Jesterking

Active member
Joined
Jul 12, 2016
Location
Hudson, MI USA
TDI
2005 Jetta GLS TDI - 465K
So, if I have read all of this correctly, ( it's late, and I am dead tired, but couldn't put his down..) I should be able to connect my cable ( VAG KLL) to my obdII port, turn on the key and type the following command while in the directory where this program is saved at: KW1281Test 3 10400 17 GETSKC
and I should receive the security code (in Hex) that will allow me to program my keys? ( 3 being the comm port, 10400 the baud rate, 17 being the address of Instrument cluster, and GETSKC the command to extract that information out of the EEPROM)
I hope I have that all correct in my head...
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
So, if I have read all of this correctly, ( it's late, and I am dead tired, but couldn't put his down..) I should be able to connect my cable ( VAG KLL) to my obdII port, turn on the key and type the following command while in the directory where this program is saved at: KW1281Test 3 10400 17 GETSKC
and I should receive the security code (in Hex) that will allow me to program my keys? ( 3 being the comm port, 10400 the baud rate, 17 being the address of Instrument cluster, and GETSKC the command to extract that information out of the EEPROM)
I hope I have that all correct in my head...
COM3 not 3
 
Top