kw1281test: A Free VDS-Pro / VagTacho Alternative

krook

Veteran Member
Joined
Jan 13, 2021
Location
Hungary
TDI
A4 B5 AWX, A4 B5 AFN
DumpMarelliMem won't work because your cluster is made by VDO: "ECU: 8D0920932C B5-KOMBIINSTR. VDO D12"

It's not likely that I can add support for that cluster because it seems different than any of the other ones that kw1281test supports. Maybe if someone sends me one, I could do it...

Your best bet might be to get an EEPROM programmer, take apart the cluster and physically read/write the EEPROM as described here: https://www.drive2.com/l/527235342923726903/
Thanks! Since this amazing tool is open source and I am a programmer myself too, I might go ahead and try to add support for this cluster myself. Will definitely send a pull request if I succeed. Do you have some pointers on how you would get started if you had this cluster at your hand? In the meantime, I do have an eeprom writer and will try to get it done that way.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Do you have some pointers on how you would get started if you had this cluster at your hand?
I have a bench setup where I can connect the various control units to a battery. I also have a couple of old laptops and a logic analyzer ( https://usd.saleae.com/products/saleae-logic-pro-8 but something much cheaper like this would probably also work: https://www.sparkfun.com/products/18627 )
I then use some of the commercial tools to communicate with a control unit while recording what happens on the K-Line using the logic analyzer. Then based on what I see on the K-Line, I can often work out what commands to send to the control unit to retrieve the SKC.

You will need to understand the KWP1281 protocol (and also sometimes KWP2000) in order to understand what you're seeing on the K-Line. Here's a good reference: something like this might work: https://www.blafusel.de/obd/obd2_kw1281.html

Sometimes it's pretty easy. Reverse engineering how VDS-Pro talks to the CCM to change bytes in the EEPROM was straightforward as there's not much security.

Other times, such as unlocking VDO clusters, there's a cryptographic challenge/response. Just seeing the 4-byte challenge (which is random and changes every time) from the cluster and the 4-byte response from the tool doesn't give much insight on how to calculate the response from the challenge. To figure that one out, I had to download the ROM from a VDO cluster and then spend many hours disassembling it to figure that out.

I reverse engineered how to unlock the Bosch RB8 cluster challenge/response without access to the cluster ROM. For that one, I wrote a simulator that pretended to be an RB8 cluster. I then tried to unlock the cluster with a commercial tool by sending sequential challenges from the simulator while observing how the responses from the tool changed for each one. Eventually I had enough challenge/response pairs to work out how to calculate the response from the challenge. Luckily the algorithm was much simpler than the one used by VDO clusters. Otherwise it would have been too hard to figure out.

For Marelli clusters and Bosch EDC15 ECUs, I observed that the commercial tools sent a big block of binary data to the control units to unlock them. That turned out to be a small program that the control units execute. Since kw1281test is open source, I didn't want to have it sending obscure binary data with no source code, so I downloaded the data sheets for the processors used in those control units and disassembled the binary data to understand what the programs were doing. Then I made some improvements to the programs and built them into kw1281test. If you read the kw1281test source code, you can read the assembly code that is downloaded to the Marelli clusters and Bosch ECUs to in order to read the EEPROMS.
 

krook

Veteran Member
Joined
Jan 13, 2021
Location
Hungary
TDI
A4 B5 AWX, A4 B5 AFN
Amazing, thanks for the details! Although this seems like a much bigger challenge than I initially thought, it sounds like a plan for the cold winter days inside (along with assembling a dongle to work with https://github.com/fjvva/ecu-tool after watching the talk:
).

For starters, I'll try bruteforcing with the unlock codes you already found and put into the code, and see how deep I get into the rabbit hole.
 

punkassjim

Active member
Joined
Jul 16, 2003
Hey Greg, hope you are well. I think I know the answer to this, but is kw1281test capable of any tasks with a mk5 ECU or instrument cluster? Know of any tools that could retrieve the PIN for a 2009 Jetta 2.5L? I’ve got a bum ECU, need to swap in a replacement. (the old one functions, but it’s got a dead 5v reference circuit B, so it’s perpetually stuck in limp mode)
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Hey Greg, hope you are well. I think I know the answer to this, but is kw1281test capable of any tasks with a mk5 ECU or instrument cluster? Know of any tools that could retrieve the PIN for a 2009 Jetta 2.5L? I’ve got a bum ECU, need to swap in a replacement. (the old one functions, but it’s got a dead 5v reference circuit B, so it’s perpetually stuck in limp mode)
Sorry, I don't know anything about mk5 control units. My 2 vehicles are mk4. Someone on TDIClub must know, but not me. :(
 

krook

Veteran Member
Joined
Jan 13, 2021
Location
Hungary
TDI
A4 B5 AWX, A4 B5 AFN
Hey! Can I do an immo off with this software and a blue KKL cable (CH341 chip)? Looking to immo off a spare ECU I have laying around. Thanks in advance!

Edit: I have already read the EDC15 eeprom. My new question is, can I write it back once modified?
 
Last edited:

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
I've been able to load the driver for my legacy KEY-USB cable, but have not been able to find port information. Nothing shows up in any of the properties tabs for the Ross-Tech cable, although it does show that the interface is with VCP.

The 2nd to last bullet in these instructions mentions USB Serial Port. Looking at that in the device manager, it states NO DRIVER INSTALLED.



I'm stumped on this point.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Hey! Can I do an immo off with this software and a blue KKL cable (CH341 chip)? Looking to immo off a spare ECU I have laying around. Thanks in advance!

Edit: I have already read the EDC15 eeprom. My new question is, can I write it back once modified?
You can't right now, but if you want to be a Guinea pig, if I add that feature maybe you can help test it. I've been hesitant to add this functionality because if something goes wrong, I don't want to risk bricking someone's ECU and leaving them without a working car. But it's a lot less risky if you have a spare ECU.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
I've been able to load the driver for my legacy KEY-USB cable, but have not been able to find port information. Nothing shows up in any of the properties tabs for the Ross-Tech cable, although it does show that the interface is with VCP.

The 2nd to last bullet in these instructions mentions USB Serial Port. Looking at that in the device manager, it states NO DRIVER INSTALLED.



I'm stumped on this point.
Looking at the Ross Tech page for the KEY-USB ( https://www.ross-tech.com/vag-com/old-interfaces/key-usb.html ), it says "This interface requires a special driver to be installed on your PC. It does not emulate a COM port. That means this interface will not work with any other software besides VCDS."
So I think you might be out of luck with this cable.
 

krook

Veteran Member
Joined
Jan 13, 2021
Location
Hungary
TDI
A4 B5 AWX, A4 B5 AFN
You can't right now, but if you want to be a Guinea pig, if I add that feature maybe you can help test it. I've been hesitant to add this functionality because if something goes wrong, I don't want to risk bricking someone's ECU and leaving them without a working car. But it's a lot less risky if you have a spare ECU.
This is a spare ECU that doesn't start the car anyways (well it does start, but shuts down immediately because of immo), so there's nothing to lose, I'll happily assist in testing! Worst case scenario I'll desolder the EEPROM and write it that way.
 
Last edited:

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
Looking at the Ross Tech page for the KEY-USB ( https://www.ross-tech.com/vag-com/old-interfaces/key-usb.html ), it says "This interface requires a special driver to be installed on your PC. It does not emulate a COM port. That means this interface will not work with any other software besides VCDS."
So I think you might be out of luck with this cable.
Thanks. I hadn't seen that. Krash, in post #42, claimed success with the same cable I have.



I saw that post and went ahead with installing drivers for it. I did not note at the time that he said in post #38 that his also did not recognize COM ports. He pushed ahead, so perhaps I will be as lucky. I'm ignorant enough to not know of a downside to trying though....
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
Thanks. I hadn't seen that. Krash, in post #42, claimed success with the same cable I have.



I saw that post and went ahead with installing drivers for it. I did not note at the time that he said in post #38 that his also did not recognize COM ports. He pushed ahead, so perhaps I will be as lucky. I'm ignorant enough to not know of a downside to trying though....
I did some searching and there may be hope:
Or maybe @KrashDH can help...
 

KrashDH

Top Post Dawg
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
So check out my post 42.
I had to set up the port/cable as a
VCP (virtual COM port). I don't remember of the top of my head how I did it, but I used the Google machine to figure that part out. My memory bank in my head doesn't store data from that far back 😂
 

caffeine

Veteran Member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
03 Allroad w/04 BHW/02X conversion, 00 ALH Jetta
You can't right now, but if you want to be a Guinea pig, if I add that feature maybe you can help test it. I've been hesitant to add this functionality because if something goes wrong, I don't want to risk bricking someone's ECU and leaving them without a working car. But it's a lot less risky if you have a spare ECU.
I've got a couple spare ECUs if you want another guinea pig
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion)
This is a spare ECU that doesn't start the car anyways (well it does start, but shuts down immediately because of immo), so there's nothing to lose, I'll happily assist in testing! Worst case scenario I'll desolder the EEPROM and write it that way.
I've got a couple spare ECUs if you want another guinea pig
Great! However, I likely won't have this ready until sometime next week. I'll let you know.
 

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
So check out my post 42.
I had to set up the port/cable as a
VCP (virtual COM port). I don't remember of the top of my head how I did it, but I used the Google machine to figure that part out. My memory bank in my head doesn't store data from that far back 😂
I checked out post #42 again, and didn't see any details on what you might have done differently. The only thing that looks like directions was "converted cable to a VCP", which was what was trying to be done in the 1st place, AFIAK.
 

KrashDH

Top Post Dawg
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
I checked out post #42 again, and didn't see any details on what you might have done differently. The only thing that looks like directions was "converted cable to a VCP", which was what was trying to be done in the 1st place, AFIAK.
As I mentioned, I don't have a step by step for that, but it's something you should be able to research and do
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
I checked out post #42 again, and didn't see any details on what you might have done differently. The only thing that looks like directions was "converted cable to a VCP", which was what was trying to be done in the 1st place, AFIAK.
You'll need to delete the original drivers and then install the vcp drivers instead. Then you'll need to figure out which port is says it is (which com port, that is) and be sure to unchecked boot in intelligent mode on vcds.
 

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
You'll need to delete the original drivers and then install the vcp drivers instead. Then you'll need to figure out which port is says it is (which com port, that is) and be sure to unchecked boot in intelligent mode on vcds.
I've got the VCP drivers installed (see post #1087). The issue is that the COM port info is not showing up. I'll need to review the AUDI forum post on this above and hopefully figure out what KrashDH was able to.
 

Mozambiquer

Vendor , w/Business number
Joined
Mar 21, 2015
Location
Versailles Missouri
TDI
2004 VW Touareg V10 TDI, 2012 Audi Q7 V6 TDI, 1998 VW Jetta TDI. 1982 VW Rabbit pickup, 2001 VW Jetta TDI, 2005 VW Passat wagon TDI X3, 2001 VW golf TDI, 1980 VW rabbit pickup,
I've got the VCP drivers installed (see post #1087). The issue is that the COM port info is not showing up. I'll need to review the AUDI forum post on this above and hopefully figure out what KrashDH was able to.
Try hitting update driver and when it asks for a trailer location, direct it to the vcp drivers and see what that does.
 

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
I went ahead and ordered the cable linked in the 1st post. I'm not up to going as deep into the weeds to figure this one out as would be needed.
 

BrettLu

Member
Joined
Jul 22, 2016
Location
Martinez, CA
TDI
02 Golf
I came across this thread over the weekend when I was trying to figure out getting an SKC for my spare ecu. I ordered the suggested cable and had a little trouble on a Windows 10 x64 on version v0.79. I tried different Baud rates and differ COM ports with no luck. I downloaded v0.62 since it was the first version with the SKC command and it worked flawlessly.

I look forward to playing with this more!
 

KrashDH

Top Post Dawg
Joined
Dec 22, 2013
Location
Washington
TDI
2002 Golf
I went ahead and ordered the cable linked in the 1st post. I'm not up to going as deep into the weeds to figure this one out as would be needed.
Sorry I wasn't much help.
I've since gotten a "new" to me computer that I only run MPPS and VCDS on, so I'll have to figure it out all over again as well at some point :)
 

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
I came across this thread over the weekend when I was trying to figure out getting an SKC for my spare ecu. I ordered the suggested cable and had a little trouble on a Windows 10 x64 on version v0.79. I tried different Baud rates and differ COM ports with no luck. I downloaded v0.62 since it was the first version with the SKC command and it worked flawlessly.

I look forward to playing with this more!
That was a very timely response for me. I also had problems running the latest release, but going back to v0.62 it ran without a hitch. I wouldn't have thought of that myself.
_________________________________________

Thanks again to gmenounos for not only creating and sharing this, but also continuing to respond to questions in this thread. All the best to you.
 
Last edited:

timsch

Veteran Member
Joined
Nov 12, 2009
Location
Brookside Village, Texas
TDI
2003 Mk4 Jetta (blue), 2003 Mk4 Jetta (black), 2011 Mk6 Jetta, all manuals
@timsch @BrettLu - I'd love to know what I broke between v0.62 and v0.79 so that I can fix it. What cables are you using? Can you share your kw1281test.log files? If you don't feel comfortable sharing them here, you can email them to me. My email address can be found on this page: https://bitfab.com/Contact
Email sent. Feel free to post any of that content back here if you want. I didn't want to clutter up the thread with possibly unnecessary screenshots.
 

BrettLu

Member
Joined
Jul 22, 2016
Location
Martinez, CA
TDI
02 Golf
@timsch @BrettLu - I'd love to know what I broke between v0.62 and v0.79 so that I can fix it. What cables are you using? Can you share your kw1281test.log files? If you don't feel comfortable sharing them here, you can email them to me. My email address can be found on this page: https://bitfab.com/Contact
Email sent, let me know if you want me to retry anything this weekend.
 

punkassjim

Active member
Joined
Jul 16, 2003
Hi y’all. So, I’ve had a number of times in recent years where I’ve thanked my lucky stars that I have an immo-2 vehicle…but now I can’t recall what those situations were. It’s a 2001 Jetta Wolfsburg Edition, basically stock, aside from being shoehorned into the shell of a mk3 GTI.

I’m in the very early planning stages for swapping in a DQ250 trans from a 2012 Golf TDI. Along with it, I’m considering trying to also find an Immo-3 FIS cluster so I can have heads-up gear indicator, door-open icons, miles-to-empty, etc.

My question is, are there pitfalls I’m not thinking of? Given my vague recollection of bullets I’ve dodged, sounds to me like going from immo-2 to immo-3 might close off some avenues that are currently available to me. I don’t know, my memory is mush. Would all of the functions of Greg’s utility work fine with a newer FIS cluster? Are there other reasons I should reconsider doing this? Or, failing that, does anyone know which vehicles came with such a cluster?

Thanks in advance.
 

caffeine

Veteran Member
Joined
Jan 4, 2021
Location
B.C., Canada
TDI
03 Allroad w/04 BHW/02X conversion, 00 ALH Jetta
Hi y’all. So, I’ve had a number of times in recent years where I’ve thanked my lucky stars that I have an immo-2 vehicle…but now I can’t recall what those situations were. It’s a 2001 Jetta Wolfsburg Edition, basically stock, aside from being shoehorned into the shell of a mk3 GTI.

I’m in the very early planning stages for swapping in a DQ250 trans from a 2012 Golf TDI. Along with it, I’m considering trying to also find an Immo-3 FIS cluster so I can have heads-up gear indicator, door-open icons, miles-to-empty, etc.

My question is, are there pitfalls I’m not thinking of? Given my vague recollection of bullets I’ve dodged, sounds to me like going from immo-2 to immo-3 might close off some avenues that are currently available to me. I don’t know, my memory is mush. Would all of the functions of Greg’s utility work fine with a newer FIS cluster? Are there other reasons I should reconsider doing this? Or, failing that, does anyone know which vehicles came with such a cluster?

Thanks in advance.
To get the door open indicator, you'll also need a 1C0 CCM and the 'comfort CAN' wiring to the cluster. Besides that, it should be more-or-less plug and play. I have an IMMO 3 FIS cluster in my '00 along with a 1C0 CCM, but stock IMMO2 ECU. B5.5 Passat clusters are also compatible if you flash them with a Mk4 cluster dump and swap the Mk4 lens/gauge faces over (they're a bit cheaper to source usually).
 
Top