kw1281test: A Free VDS-Pro / VagTacho Alternative

[gmenounos]

As for your requested 1J0 addresses for unlock hatch with doors, I believe it is located at:

J: 04283, 04288, 04293: Bit 7 (1=Off, 0=On)
AJ/AH: 04280, 04286, 04292: Bit 7 (1=Off, 0=On)

Thanks! I'll give those a try.

 

[caffeine]

Just used this program yesterday to retrieve the SKC from an IMMO3 cluster. Backstory - I recently converted my 00 ALH Jetta from manual to power windows using the 02+ 1C0 CCM/Window Motor setup not realizing that it wouldn't work without an IMMO3 cluster as well.

I have a VAGTacho clone that was able to retrieve the SKC from an IMMO2 cluster but not any IMMO3 clusters I tried. First try with this program and I had a functional SKC (used a VCDS Cable in Virtual COM mode)! Needless to say I'm very grateful for the work done here. I used this on an Acer Windows 8.1 tablet w/32-bit OS so I can confirm that Windows 10 is not needed.

Now, I'd also like to transfer my mileage reading from my old cluster to the new one. What's the location to write the mileage code to? Donor cluster was from an 03 ALH Jetta. I'll probably be ordering an FIS cluster from Europe soon so I'll be doing the cluster swap again at some point.

 

[slows4]

Just wanted to thank the OP for the hard work/effort they have put in.

I have some questions if you may:

1. Can I use this to dump lets say data from a Virtual Cockpit (audi)?
2. is there any ability to pull security codes from the MMI (multimedia interface)?

I am pretty tech savy, but when it comes to cars, lets say I am purely mechanical and OBD1 was as far as I got in that section. I hear protocol I think TCP lol.

Going into audis I have learned a lot. The ability to code in certain features has always struck me as really neat idea. To enable what is already there but just locked away. Had I would have known this from the get go I wouldve purchased a vw/audi as my first car.

The goal to #1 is that I have enabled graphics to a different model car in my VC. But what I am really after is the actual upshift RPM lights that happens in the RS models. I have studied this over and over again. Everyone says it can't be done. But from a software standpoint I am just assuming it is some limitation that has to be unlocked. And it is not hardware based, some says that it is firmware locked. And was told that is not updatable. But I have found that even in the newer models people are able to update/flash their firmware to both the VC and MMI.I just find it odd that they leave the graphics in there but don't allow the enabling of features that come with that graphic.

The 2nd option is that I have been looking over and over on how to bypass the authentication code in video in motion. This requires a security code that is unique? In the last b8 platform it was done by grabbing the software number and decoding it to get the actual security code. From there you would adjust using VCDS and adjust the video limiter to not shut off until 255KPH so in short the video always stays on.

I come across this thread as interesting as your able to use a basic OBD2 cable attached to a com port (though i have the cable but no com port, would it be allowable to use an adapter? I know the com number after installation) as it displays in device manger under ports. COM1 is always sys reserved so from there its either 2-9

With some adjustment to the source code or course it may or may not be able to dump data from a virtual cockpit. i am interested to see what it uses how it stores the data and how it determines the car type your in on order to turn on the RPM flashing or shift lights.

Thank you again !

 

[Nuje]

1. Can I use this to dump lets say data from a Virtual Cockpit (audi)?
2. is there any ability to pull security codes from the MMI (multimedia interface)?

I'm gonna go out on a limb and say....
1. No.
2. No

Keep in mind that the EEPROMs of the clusters in the Mk4 are pretty stupid-simple 2KB ROMs - literally, there are only 2048 bytes that one has to work with. The Virtual Cockpit / Active Info Display and MMIs are basically full-on near-modern computers, so complexity is a few (many) orders of magnitude greater, and at the same time, VWAG has learned a thing or two about locking down their hardware.

Now, with all of that said, there are some folks in Asia and Eastern Europe who have done a lot of hacking into the hardware on the MQB platform, so I'm not saying what you're trying to do is impossible, just that this tool will not be the thing to do it.

 

[lijetta18t]

Thanks! I'll give those a try.

After looking at a bunch of coding and building my excel file, I have a feeling that most, if not all, of the known 1C0 bits are the same on the 1J0 controllers, just at different memory locations. Now, I don't have any CCMs to test on besides my cousins 2004 Mk4 GLI (and it isn't mine so I don't want to mess with it too much) but I have been looking at threads for the past two weeks and found that most of the bits seem to be almost exactly the same, just different addresses. I also see a lot of wrong info as well and even more unknown info.

Either way, thank you so much for building and maintaining something like this to finally unlock the mk4 with coding on modern PCs. Back when I had a 2001 Mk4 Jetta, I wanted to do a few things so badly but was never able to get over the EEPRom modifications limitations at the time. As someone who has been using VCDS for many years to do many retrofits (find me on vortex), this opens up the door for additional options to help friends.

Anyway, let me know if that coding works for you.

 

[gmenounos]

I'm gonna go out on a limb and say....
1. No.
2. No

Keep in mind that the EEPROMs of the clusters in the Mk4 are pretty stupid-simple 2KB ROMs - literally, there are only 2048 bytes that one has to work with. The Virtual Cockpit / Active Info Display and MMIs are basically full-on near-modern computers, so complexity is a few (many) orders of magnitude greater, and at the same time, VWAG has learned a thing or two about locking down their hardware.

Now, with all of that said, there are some folks in Asia and Eastern Europe who have done a lot of hacking into the hardware on the MQB platform, so I'm not saying what you're trying to do is impossible, just that this tool will not be the thing to do it.

That is correct. I only have 2 VW MKIV ALH cars (plus a rack of used MKIV clusters, radios and other modules), so until one of my cars breaks to the point that I can't fix it anymore, not only don't I have much interest in reverse engineering anything newer, I have nothing to test on. Having said that, my software is open source, so anyone is free to enhance it to work with newer cars, but I don't think there's anything in it that would apply to newer cars, so probably best to start from scratch.

 

[gmenounos]

After looking at a bunch of coding and building my excel file, I have a feeling that most, if not all, of the known 1C0 bits are the same on the 1J0 controllers, just at different memory locations. Now, I don't have any CCMs to test on besides my cousins 2004 Mk4 GLI (and it isn't mine so I don't want to mess with it too much) but I have been looking at threads for the past two weeks and found that most of the bits seem to be almost exactly the same, just different addresses. I also see a lot of wrong info as well and even more unknown info.

Anyway, let me know if that coding works for you.

Will do! Thanks for collecting all the CCM info. It'd be great to get all the programming info in one place for the MKIV CCMs.

Either way, thank you so much for building and maintaining something like this to finally unlock the mk4 with coding on modern PCs. Back when I had a 2001 Mk4 Jetta, I wanted to do a few things so badly but was never able to get over the EEPRom modifications limitations at the time. As someone who has been using VCDS for many years to do many retrofits (find me on vortex), this opens up the door for additional options to help friends.

I've learned so much on this forum over the past 17 years. It's good to be able to contribute something. I just wish I'd written this tool 5-10 years ago when more people owned MKIVs.

 

[gmenounos]

Until I have a chance to share my similar program, for those wanting to transfer the odometer/Immo info from one cluster to another as well as set a zillion different options, you can try DashDumpEdit: https://www.drive2.ru/l/471768829593126099/
Yeah, the page is in Russian but many modern browsers like Chrome can translate the page into English. It's not open-source but is free.

 

[caffeine]

I just used it on another IMMO2 cluster I have (Sport gauges, Canadian speedo with half-MFA display), and it spat out:
"Unlock code for software version VAT500MH $01 is 01 04 3D 35
Please report this to the program maintainer."

 

[gmenounos]

I just used it on another IMMO2 cluster I have (Sport gauges, Canadian speedo with half-MFA display), and it spat out:
"Unlock code for software version VAT500MH $01 is 01 04 3D 35
Please report this to the program maintainer."

Thanks! The program has a lookup table of unlock codes for different cluster versions. In order to unlock the cluster for EEPROM read faster, it tries to use the correct code first and if that fails it will try them all. I'll get that info added to the next version. Do you happen to know that cluster part number (e.g. 1J5...)?

 

[slows4]

I'm gonna go out on a limb and say....
1. No.
2. No

Keep in mind that the EEPROMs of the clusters in the Mk4 are pretty stupid-simple 2KB ROMs - literally, there are only 2048 bytes that one has to work with. The Virtual Cockpit / Active Info Display and MMIs are basically full-on near-modern computers, so complexity is a few (many) orders of magnitude greater, and at the same time, VWAG has learned a thing or two about locking down their hardware.

Now, with all of that said, there are some folks in Asia and Eastern Europe who have done a lot of hacking into the hardware on the MQB platform, so I'm not saying what you're trying to do is impossible, just that this tool will not be the thing to do it.

Thanks for the information I will go back to dig a bit further. I have some schematics, short of signing up to erwin for 1 day access and download everything MQB related; what I have is not much. Though the schematics gives me a bigger picture how it all connects/communicates. Modern computers I do know, being that I have worked in that sector for a very long time. Breaking into a computer is not a simple task but if the computer is sitting in your driveway and you have the keys it is all in getting the data. I wanted to see if i was possible for a dumb. I was naive to think that it was just a small rom. I am sure there is a harddrive that runs the entire thing. Now the main question would be what type of OS. Obv embedded.

Yea those guys in EU/AS quite simply are a bit crazier when it comes to that tech.

That is correct. I only have 2 VW MKIV ALH cars (plus a rack of used MKIV clusters, radios and other modules), so until one of my cars breaks to the point that I can't fix it anymore, not only don't I have much interest in reverse engineering anything newer, I have nothing to test on. Having said that, my software is open source, so anyone is free to enhance it to work with newer cars, but I don't think there's anything in it that would apply to newer cars, so probably best to start from scratch.

Noted and thank you. I have downloaded a copy of the source and will dig a bit further. I need a bigger diagram to show me the entire network and how it all talks to each other etc, handshaking and what drives it. I have found out the tool used to code the cockpit. and even watch several videos on how to make my own. But the downside is that I have no idea how all is that is incorporated.
But thank you!

 

[lijetta18t]

After using this software a bit, I noticed that the log file generated is overwritten every time the command is run. This is a pain as you have to write to multiple memory addresses and I like to use the log file to confirm or see what is being changed and what it was previously. Is this by design or would there be an option to allow it to append?

 

[gmenounos]

After using this software a bit, I noticed that the log file generated is overwritten every time the command is run. This is a pain as you have to write to multiple memory addresses and I like to use the log file to confirm or see what is being changed and what it was previously. Is this by design or would there be an option to allow it to append?

Sure, I'll change it to append instead of overwrite.

 

[lijetta18t]

Sure, I'll change it to append instead of overwrite.

Awesome! I also noticed that whenever I do a DumpEEPRom or DumpCCMEEPRom command, I find the command almost always fails after running for a while and the bin file is fully blank yet has 7kb file size. Is there something I am missing? I really just wanted to make a full backup of the hardware to have a full flash backup that I can comb through.

 

[gmenounos]

Awesome! I also noticed that whenever I do a DumpEEPRom or DumpCCMEEPRom command, I find the command almost always fails after running for a while and the bin file is fully blank yet has 7kb file size. Is there something I am missing? I really just wanted to make a full backup of the hardware to have a full flash backup that I can comb through.

If you send me your logs, maybe I can figure it out.

 

[lijetta18t]

If you send me your logs, maybe I can figure it out.

The issue is that I don't have this log as another log overwritten it and I forgot to grab the code. I do, however, have the BIN files that were dumped out which are all zeros on the CCM and

That being said, I worked on my friends 2004 US R32 yesterday and activated comfort windows via fob (04361-63 from 138 to 130) and allowed the hatch to unlock with the car (changed 04352-54 from 200 to 72) on the CCM without issue.

I did also modify his cluster (1J0920927A KOMBI+WEGFAHRSP VDO V03o VWK503MH half height MFA) to allow the cruise light to light only when cruise is set ($220 from E9 to F9) and allowed the needles to stay lit ($21F from 70 to 79). Both of which worked perfect! These are the parts I were trying to make a full dump from and also grab his SKU code for him. I tried the command kw1281test COM# 10400 17 dumpeeprom 204 6 but it gave me a bunch of random HEX so I tried another address list (266 6) and I was able to grab a repeating string. I flipped the HEX numbers and used my calc to convert from HEX to DEC which certainly looked like a SKU code but when I tried to login to the cluster on VCDS, it refused the code. Am I looking at the wrong spot? I was never able to get a full dump of the cluster to search through it as I mentioned earlier.

 

[jhax]

This is awesome! Now if only it could work to get my MK3 TDI cluster to set the odometer to 000000 on my new TDI swap...

 

[Mozambiquer]

The issue is that I don't have this log as another log overwritten it and I forgot to grab the code. I do, however, have the BIN files that were dumped out which are all zeros on the CCM and

That being said, I worked on my friends 2004 US R32 yesterday and activated comfort windows via fob (04361-63 from 138 to 130) and allowed the hatch to unlock with the car (changed 04352-54 from 200 to 72) on the CCM without issue.

I did also modify his cluster (1J0920927A KOMBI+WEGFAHRSP VDO V03o VWK503MH half height MFA) to allow the cruise light to light only when cruise is set ($220 from E9 to F9) and allowed the needles to stay lit ($21F from 70 to 79). Both of which worked perfect! These are the parts I were trying to make a full dump from and also grab his SKU code for him. I tried the command kw1281test COM# 10400 17 dumpeeprom 204 6 but it gave me a bunch of random HEX so I tried another address list (266 6) and I was able to grab a repeating string. I flipped the HEX numbers and used my calc to convert from HEX to DEC which certainly looked like a SKU code but when I tried to login to the cluster on VCDS, it refused the code. Am I looking at the wrong spot? I was never able to get a full dump of the cluster to search through it as I mentioned earlier.

On mine, you didn't have to convert from hex. Just use the flipped numbers and it logged in just right.

 

[lijetta18t]

On mine, you didn't have to convert from hex. Just use the flipped numbers and it logged in just right.

Funny you mentioned this. I was double checking what I got and it was A9 67 A9 67 A9 67. I swapped and converted to Dec and got 09641 but I just double checked and realized I must have typo-ed that into my calc yesterday so just checked again and got 09897. I have to check the car next time I see it.

 

[gmenounos]

Funny you mentioned this. I was double checking what I got and it was A9 67 A9 67 A9 67. I swapped and converted to Dec and got 09641 but I just double checked and realized I must have typo-ed that into my calc yesterday so just checked again and got 09897. I have to check the car next time I see it.

I think the SKC is 26537:

 

[gmenounos]

This is awesome! Now if only it could work to get my MK3 TDI cluster to set the odometer to 000000 on my new TDI swap...

http://nefariousmotorsports.com/forum/index.php?topic=3504.0

http://tools.varpartsma.com/mk3calc

 

[caffeine]

Thanks! The program has a lookup table of unlock codes for different cluster versions. In order to unlock the cluster for EEPROM read faster, it tries to use the correct code first and if that fails it will try them all. I'll get that info added to the next version. Do you happen to know that cluster part number (e.g. 1J5...)?

Yes, the cluster part # is 1J5 920 925 C. I'm guessing based on the part # that the Canadian speedo face was swapped onto a UK or US cluster.

 

[gmenounos]

Yes, the cluster part # is 1J5 920 925 C. I'm guessing based on the part # that the Canadian speedo face was swapped onto a UK or US cluster.

You can use the ReadSoftwareVersion command to get the exact part number and software version that the cluster is reporting. Or send me the log.

 

[lijetta18t]

I think the SKC is 26537:

I am not going to lie, I honestly have no idea how I got the first two numbers.... I will be trying that for sure!

 

[caffeine]

You can use the ReadSoftwareVersion command to get the exact part number and software version that the cluster is reporting. Or send me the log.

Here's a link to the log https://drive.google.com/file/d/12x4v6Wt6LAiMmUnhbUIT_MgPok0es3Sv/view?usp=sharing

Also, I was tinkering with my old base model IMMO2 cluster experimenting with altering the mileage and when writing to the cluster, the program says
"WriteEeprom returned 0 blocks instead of 1
EEPROM write failed. You should probably try again."
but I know that the write did NOT fail because I did successfully change the mileage. So I'm not sure what to make of that. Here's a link to the log for that https://drive.google.com/file/d/12wmzluCSKq5NyK7qYK8Vv4khJnv_GH-1/view?usp=sharing

 

[pkhoury]

I've learned so much on this forum over the past 17 years. It's good to be able to contribute something. I just wish I'd written this tool 5-10 years ago when more people owned MKIVs.

The Mk4 sub-forum still seems to be fairly active. I do know that nice looking Mk4 TDIs are harder to come by, now.

That is correct. I only have 2 VW MKIV ALH cars (plus a rack of used MKIV clusters, radios and other modules), so until one of my cars breaks to the point that I can't fix it anymore, not only don't I have much interest in reverse engineering anything newer, I have nothing to test on. Having said that, my software is open source, so anyone is free to enhance it to work with newer cars, but I don't think there's anything in it that would apply to newer cars, so probably best to start from scratch.

I have my 2010 Sportwagen I can test on if need be. You know I'm more than happy to be a guinea pig, but I also have 5 TDIs at my disposal!

 

[caffeine]

Until I have a chance to share my similar program, for those wanting to transfer the odometer/Immo info from one cluster to another as well as set a zillion different options, you can try DashDumpEdit: https://www.drive2.ru/l/471768829593126099/
Yeah, the page is in Russian but many modern browsers like Chrome can translate the page into English. It's not open-source but is free.

Thanks for the link. I tinkered with this for a while and also figured out how to change the mileage to just about whatever I want. Once I found the formula to convert from a 2 byte number to kilometers, it was fairly simple to extrapolate how to adjust the numbers. Interestingly, I did find that the odo code location was different between my original base model IMMO2 cluster and the sport IMMO2 euro clusters I have. And the base model IMMO3 cluster I temporarily installed in my car has a very similar ODO code location to my original cluster but not exactly the same.

 

[gmenounos]

Here's a link to the log https://drive.google.com/file/d/12x4v6Wt6LAiMmUnhbUIT_MgPok0es3Sv/view?usp=sharing

Also, I was tinkering with my old base model IMMO2 cluster experimenting with altering the mileage and when writing to the cluster, the program says
"WriteEeprom returned 0 blocks instead of 1
EEPROM write failed. You should probably try again."
but I know that the write did NOT fail because I did successfully change the mileage. So I'm not sure what to make of that. Here's a link to the log for that https://drive.google.com/file/d/12wmzluCSKq5NyK7qYK8Vv4khJnv_GH-1/view?usp=sharing

Thanks for the logs. I guess the Immo2 clusters behave differently than the Immo3. I do have at least one Immo2 cluster so I will test out writing to the EEPROM in that to confirm the behavior that you saw.

 

[jhax]

You mention that the MK4 cluster operates at a baud rate of 10400 is that all clusters or just the MK4? The link you posted reads

"Read eeprom (93C46C) in 16bit"

I dont suspect 16bit is the baud rate?

 

[BobnOH]

Not sure what you folks are into, but 16 is not a baud rate. It more than likely refers to base 16 or hexidecimal.