search

gmenounos / kw1281test

VW KW1281 Protocol Test Tool
MIT License
111 stars 14 forks source link

Fabia 6Y SKC & dump issue #58

Closed AdisonCavani closed 1 month ago

AdisonCavani commented 4 months ago

Hello.
I have troubles with reading SKC PIN in my Skoda Fabia 6Y facelift instrument cluster (with maxi-dot / full-FIS), part number: 6Y0 920 843 L.
I saw that recently you added support for seed/key algorithm used by VW Polo 6N and Skoda Fabia 6Y clusters but it's not working for me.

Maybe you can pull out SKC PIN from the eeprom dump? I tried to read it with VAG EEPROM, but it's not working.

KW1281Test.log ``` Version 0.92-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 17 GetSKC OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L KOMBIINSTRUMENT VDO V04 Software Coding 16102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VQMJ07HH@ $08 01: $65 $26 02: $02 $0C $05 $0F $33 $3B 03: PQ24_7 HL Flash Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VQMJ07HH 08.40' is 34 3F 43 39 Please report this to the program maintainer. Sending Custom "Need Seed/Key?" block Sending Custom "Seed request" block Block: DF 50 28 D8 1A 6F BB 63 09 00 Unexpected seed suffix: $09 $00 Sending Custom "Key response" block Sending Custom "Need Seed/Key?" block Failed to unlock cluster. Saving EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin Sending ReadEeprom block (Address: $0090, Count: $10) Sending ReadEeprom block (Address: $00A0, Count: $10) Sending ReadEeprom block (Address: $00B0, Count: $10) Sending ReadEeprom block (Address: $00C0, Count: $10) Sending ReadEeprom block (Address: $00D0, Count: $10) Sending ReadEeprom block (Address: $00E0, Count: $10) Sending ReadEeprom block (Address: $00F0, Count: $10) Sending ReadEeprom block (Address: $0100, Count: $0C) ********************************************************************** *** Warning: Some bytes could not be read and were replaced with 0 *** ********************************************************************** Saved EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin GetSkc: Unable to find Immobilizer ID in cluster dump. Unable to determine SKC. Sending EndCommunication block Version 0.92-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 17 DumpEeprom 0 2048 OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L KOMBIINSTRUMENT VDO V04 Software Coding 16102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VQMJ07HH@ $08 01: $65 $26 02: $02 $0C $05 $0F $33 $3B 03: PQ24_7 HL Flash Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VQMJ07HH 08.40' is 34 3F 43 39 Please report this to the program maintainer. Sending Custom "Need Seed/Key?" block Sending Custom "Seed request" block Block: 8B FB BF 2F 9E 1D 46 BF 09 00 Unexpected seed suffix: $09 $00 Sending Custom "Key response" block Sending Custom "Need Seed/Key?" block Failed to unlock cluster. Saving EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin Sending ReadEeprom block (Address: $0000, Count: $10) Received "Read EEPROM Response" block: 00 02 35 C5 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0010, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF Sending ReadEeprom block (Address: $0020, Count: $10) Received "Read EEPROM Response" block: 31 30 30 37 36 36 33 36 46 49 4C 30 30 30 41 43 Sending ReadEeprom block (Address: $0030, Count: $10) Received "Read EEPROM Response" block: 01 17 31 30 30 37 38 31 31 34 46 49 4C 30 30 30 Sending ReadEeprom block (Address: $0040, Count: $10) Received "Read EEPROM Response" block: 41 42 01 17 31 30 30 39 30 34 38 34 46 49 4C 30 Sending ReadEeprom block (Address: $0050, Count: $10) Sending ReadEeprom block (Address: $0060, Count: $10) Sending ReadEeprom block (Address: $0070, Count: $10) Sending ReadEeprom block (Address: $0080, Count: $10) Sending ReadEeprom block (Address: $0090, Count: $10) Sending ReadEeprom block (Address: $00A0, Count: $10) Sending ReadEeprom block (Address: $00B0, Count: $10) Sending ReadEeprom block (Address: $00C0, Count: $10) Sending ReadEeprom block (Address: $00D0, Count: $10) Sending ReadEeprom block (Address: $00E0, Count: $10) Sending ReadEeprom block (Address: $00F0, Count: $10) Sending ReadEeprom block (Address: $0100, Count: $10) Sending ReadEeprom block (Address: $0110, Count: $10) Sending ReadEeprom block (Address: $0120, Count: $10) Sending ReadEeprom block (Address: $0130, Count: $10) Sending ReadEeprom block (Address: $0140, Count: $10) Received "Read EEPROM Response" block: 43 F1 44 F1 44 F1 44 F1 44 F1 10 40 00 00 00 00 Sending ReadEeprom block (Address: $0150, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0160, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0170, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0180, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0190, Count: $10) Received "Read EEPROM Response" block: 00 00 36 59 30 39 32 30 38 34 33 4C 20 20 41 30 Sending ReadEeprom block (Address: $01A0, Count: $10) Received "Read EEPROM Response" block: 56 30 34 FF FF FF FF FF 36 4E 30 39 30 39 39 30 Sending ReadEeprom block (Address: $01B0, Count: $10) Sending ReadEeprom block (Address: $01C0, Count: $10) Received "Read EEPROM Response" block: 10 64 80 02 DC 05 DC 05 FE 00 5A 03 40 0F 6C 17 Sending ReadEeprom block (Address: $01D0, Count: $10) Received "Read EEPROM Response" block: 01 07 08 04 96 00 2C 01 68 01 0F 1E 0C 0A 0A 58 Sending ReadEeprom block (Address: $01E0, Count: $10) Received "Read EEPROM Response" block: 02 0D 0C 1E 3C 20 6E 0C 8C 06 B4 04 C9 07 FF 08 Sending ReadEeprom block (Address: $01F0, Count: $10) Received "Read EEPROM Response" block: 6D 01 6D 01 96 00 96 00 6D 01 DA 02 96 00 2C 01 Sending ReadEeprom block (Address: $0200, Count: $10) Received "Read EEPROM Response" block: 00 00 31 04 67 00 6D 01 6D 01 96 00 96 00 00 00 Sending ReadEeprom block (Address: $0210, Count: $10) Received "Read EEPROM Response" block: 00 00 FF 81 2F 00 FF 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0220, Count: $10) Sending ReadEeprom block (Address: $0230, Count: $10) Received "Read EEPROM Response" block: 3F 00 25 83 CD 00 40 0C FF 80 02 00 40 14 6A 78 Sending ReadEeprom block (Address: $0240, Count: $10) Received "Read EEPROM Response" block: 7B A0 5C 53 C2 C7 1E 06 6F AF C1 D7 FF AC 79 6B Sending ReadEeprom block (Address: $0250, Count: $10) Received "Read EEPROM Response" block: 00 21 E9 08 81 3B 00 FF FF FF FF FF FF FF 0A 0F Sending ReadEeprom block (Address: $0260, Count: $10) Received "Read EEPROM Response" block: FF 03 05 00 05 00 40 1A 00 60 3C 4C 3C 4C 3C 28 Sending ReadEeprom block (Address: $0270, Count: $10) Received "Read EEPROM Response" block: 32 46 C2 C7 6F BD 47 F6 80 BE 76 77 77 7C 00 7C Sending ReadEeprom block (Address: $0280, Count: $10) Received "Read EEPROM Response" block: 50 E2 4B 96 32 0A 00 81 78 1E 0F 04 02 00 18 00 Sending ReadEeprom block (Address: $0290, Count: $10) Received "Read EEPROM Response" block: 3B 00 F1 05 F3 0B 8D 0C 8D 0C 8D 0C 8D 0C 1E 00 Sending ReadEeprom block (Address: $02A0, Count: $10) Received "Read EEPROM Response" block: 73 00 DA 07 A4 0F 6C 10 6C 10 6C 10 6C 10 00 00 Sending ReadEeprom block (Address: $02B0, Count: $10) Received "Read EEPROM Response" block: D9 03 93 0B F3 1E 27 00 24 02 09 06 C6 0F C9 00 Sending ReadEeprom block (Address: $02C0, Count: $10) Received "Read EEPROM Response" block: 05 01 7A 01 D0 01 11 02 2D 02 45 02 57 02 C9 00 Sending ReadEeprom block (Address: $02D0, Count: $10) Received "Read EEPROM Response" block: 07 01 7C 01 D2 01 14 02 2F 02 48 02 5A 02 68 01 Sending ReadEeprom block (Address: $02E0, Count: $10) Received "Read EEPROM Response" block: 50 01 08 01 B4 00 60 00 3C 00 18 00 00 00 00 00 Sending ReadEeprom block (Address: $02F0, Count: $10) Received "Read EEPROM Response" block: 18 00 3C 00 60 00 B4 00 08 01 50 01 68 01 1F 00 Sending ReadEeprom block (Address: $0300, Count: $10) Received "Read EEPROM Response" block: 1F 00 E6 00 59 01 B2 02 0C 04 74 05 74 05 85 00 Sending ReadEeprom block (Address: $0310, Count: $10) Received "Read EEPROM Response" block: AD 00 C0 00 E4 00 09 01 1C 02 70 02 94 02 E0 02 Sending ReadEeprom block (Address: $0320, Count: $10) Received "Read EEPROM Response" block: A6 03 78 04 0E 04 E0 03 98 03 58 03 08 02 B8 01 Sending ReadEeprom block (Address: $0330, Count: $10) Received "Read EEPROM Response" block: 90 01 40 01 28 00 F0 00 90 01 08 02 A0 03 E0 03 Sending ReadEeprom block (Address: $0340, Count: $10) Received "Read EEPROM Response" block: 0E 04 F0 00 90 01 08 02 60 03 E0 03 0E 04 1F 00 Sending ReadEeprom block (Address: $0350, Count: $10) Received "Read EEPROM Response" block: 1F 00 E1 02 E1 02 AD 04 65 05 78 1E 00 27 88 2F Sending ReadEeprom block (Address: $0360, Count: $10) Received "Read EEPROM Response" block: 10 38 98 40 20 49 A8 51 30 5A B8 62 40 6B 0A 00 Sending ReadEeprom block (Address: $0370, Count: $10) Received "Read EEPROM Response" block: 2A 00 46 00 60 00 78 00 8E 00 A4 00 B9 00 CD 00 Sending ReadEeprom block (Address: $0380, Count: $10) Received "Read EEPROM Response" block: E1 00 0A 32 78 C8 30 00 87 8A 3C 23 00 00 00 00 Sending ReadEeprom block (Address: $0390, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $03A0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $03B0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 05 1E 00 0F 00 64 00 0A 23 B0 00 00 00 Sending ReadEeprom block (Address: $03C0, Count: $10) Sending ReadEeprom block (Address: $03D0, Count: $10) Sending ReadEeprom block (Address: $03E0, Count: $10) Received "Read EEPROM Response" block: 35 DD DD 32 04 06 04 18 07 00 06 01 A8 FE 00 00 Sending ReadEeprom block (Address: $03F0, Count: $10) Received "Read EEPROM Response" block: 00 00 14 11 06 16 11 06 00 00 00 00 FF 43 07 01 Sending ReadEeprom block (Address: $0400, Count: $10) Received "Read EEPROM Response" block: 09 92 70 70 82 FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0410, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF 8C 8C 8C 8C 8C 8C 8C 84 8C 78 Sending ReadEeprom block (Address: $0420, Count: $10) Received "Read EEPROM Response" block: 8C 70 8C A0 A0 8C 8C A0 8C D8 8C 8C 90 8C 8C 9C Sending ReadEeprom block (Address: $0430, Count: $10) Received "Read EEPROM Response" block: 8C 8C 8C 8C 88 90 8C 8C 8C 8C 8C 8C 8C 8C 8C 94 Sending ReadEeprom block (Address: $0440, Count: $10) Received "Read EEPROM Response" block: 84 8C 8C 8C 8C 8C 8C 8C 84 8C 8C 8C 8C 8C A0 8C Sending ReadEeprom block (Address: $0450, Count: $10) Sending ReadEeprom block (Address: $0460, Count: $10) Received "Read EEPROM Response" block: A0 A4 32 33 00 27 04 14 15 F6 5B 06 1E 0A 00 01 Sending ReadEeprom block (Address: $0470, Count: $10) Received "Read EEPROM Response" block: 56 28 95 52 D3 7B FF F4 FF F9 00 00 00 30 80 F0 Sending ReadEeprom block (Address: $0480, Count: $10) Received "Read EEPROM Response" block: 80 F0 80 F0 80 F0 18 00 FF 80 FF BF FF FF 18 00 Sending ReadEeprom block (Address: $0490, Count: $10) Received "Read EEPROM Response" block: FF 80 FF BF FF FF 05 00 3C 80 FF FF FF FF 00 5D Sending ReadEeprom block (Address: $04A0, Count: $10) Received "Read EEPROM Response" block: FF 61 FF 61 FF 61 FF B4 80 BC 00 C3 00 80 BF FF Sending ReadEeprom block (Address: $04B0, Count: $10) Received "Read EEPROM Response" block: 02 35 9A FF 00 80 BF FF 02 35 9A FF 00 80 BF FF Sending ReadEeprom block (Address: $04C0, Count: $10) Received "Read EEPROM Response" block: 03 3C 9D FF 00 80 BF FF 02 35 9A FF 9F 7A 71 45 Sending ReadEeprom block (Address: $04D0, Count: $10) Received "Read EEPROM Response" block: 0F 03 1B 3E 43 4B 4B 2E A4 80 7C 74 74 74 E3 00 Sending ReadEeprom block (Address: $04E0, Count: $10) Received "Read EEPROM Response" block: 08 0A 0A 00 02 0A 02 53 32 0A 08 04 04 00 00 14 Sending ReadEeprom block (Address: $04F0, Count: $10) Received "Read EEPROM Response" block: 0A 05 00 00 00 64 88 0A FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0500, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF 30 30 4D 5E 57 78 54 82 56 8B Sending ReadEeprom block (Address: $0510, Count: $10) Received "Read EEPROM Response" block: 5D 91 8A 96 8A 96 8A 96 00 00 01 03 02 14 04 32 Sending ReadEeprom block (Address: $0520, Count: $10) Received "Read EEPROM Response" block: 08 78 0A FF 0A FF 0A FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0530, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF 00 F0 FF FF 00 FF FF FF Sending ReadEeprom block (Address: $0540, Count: $10) Received "Read EEPROM Response" block: 59 4D 4D 18 7F 7F 7F 7F 59 4D 4D 3F 7F 7F 7F 7F Sending ReadEeprom block (Address: $0550, Count: $10) Received "Read EEPROM Response" block: 04 14 00 00 FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0560, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0570, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0580, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0590, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05E0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05F0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0600, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0610, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0620, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0630, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0640, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0650, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0660, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0670, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0680, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0690, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06E0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06F0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0700, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0710, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0720, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0730, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0740, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0750, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0760, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0770, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0780, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0790, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07E0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 FF FF FF 00 65 50 51 24 07 FF 00 44 Sending ReadEeprom block (Address: $07F0, Count: $10) Received "Read EEPROM Response" block: 48 4C 00 00 00 00 00 17 17 17 07 01 07 01 07 01 ********************************************************************** *** Warning: Some bytes could not be read and were replaced with 0 *** ********************************************************************** Saved EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin Sending EndCommunication block ```

eeproms.zip

gmenounos commented 4 months ago

Try this new release and see if it works any better: https://github.com/gmenounos/kw1281test/releases/tag/v0.93-beta If it doesn't work, please attach the log.

AdisonCavani commented 4 months ago

Didn't worked unfortunately. I tried to reverse engineer the EEPROM .bin dump, but it seems that VIN number is missing...

Log ``` Version 0.93.0-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 17 GetSKC OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L KOMBIINSTRUMENT VDO V04 Software Coding 16102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VQMJ07HH@ $08 01: $65 $26 02: $02 $0C $05 $0F $33 $3B 03: PQ24_7 HL Flash Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VQMJ07HH 08.40' is 34 3F 43 39 Sending Custom "Need Seed/Key?" block Sending Custom "Seed request" block Block: 73 C9 D5 68 C1 D1 33 EB 09 00 Sending Custom "Key response" block Sending Custom "Need Seed/Key?" block Failed to unlock cluster. Saving EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin Sending ReadEeprom block (Address: $0090, Count: $10) Sending ReadEeprom block (Address: $00A0, Count: $10) Sending ReadEeprom block (Address: $00B0, Count: $10) Sending ReadEeprom block (Address: $00C0, Count: $10) Sending ReadEeprom block (Address: $00D0, Count: $10) Sending ReadEeprom block (Address: $00E0, Count: $10) Sending ReadEeprom block (Address: $00F0, Count: $10) Sending ReadEeprom block (Address: $0100, Count: $0C) ********************************************************************** *** Warning: Some bytes could not be read and were replaced with 0 *** ********************************************************************** Saved EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin GetSkc: Unable to find Immobilizer ID in cluster dump. Unable to determine SKC. Sending EndCommunication block ```
AdisonCavani commented 4 months ago

@gmenounos can you recommend what should I do now? I also tried Vag eeprom programmer 1.19g, but it says "Eeprom area blocked - can't read it".

gmenounos commented 4 months ago

There is a version of VAG K+CAN Commander 2.5 floating around that works with generic KKL cables. You could try that if you can find a copy.

I'm willing to try to enhance kw1281test to work with any VW Group K-line cluster, but I've already bought quite a few at my own expense and don't have the space nor funds to collect any more. If someone wants to donate one, then I can give it a try. An additional challenge is that I live in the USA and most of the remaining clusters that kw1281test doesn't support are from vehicles that aren't sold here, so it takes longer and costs more to acquire one.

AdisonCavani commented 4 months ago

This is probably an edge case. I tested it with non maxidot cluster and it worked. This cluster is impossible to buy, there are only a couple of them in the world. I will try the K+CAN software and if it fails, I will read EEPROM directly from PCB.

gmenounos commented 3 months ago

Can you email or attach the kw1281test.log for the non-maxidot cluster that worked? I'm trying to track which clusters (including exact part number and software version) work and which don't.

Also, I will soon be releasing a new version that might work with your maxidot cluster.

gmenounos commented 3 months ago

Can you try this new release with your maxidot cluster and see if GetSKC and DumpEEPROM work now?

However, the first thing you should do is use the kw1281test reset command so that your cluster reboots. The newer clusters use a new secret key and if the old key had been used, the cluster will refuse to accept the new key until it is reset.

AdisonCavani commented 3 months ago

I didn't use the reboot command, because I have a bench setup and the cluster was disconnected from power for a long time.

Log (6Y0920843L - failed) - EEPROM 93C83WP and MCU Micronas 3301 (encrypted): ``` Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 25 ReadIdent OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L IMMOBILIZER VDO V04 Software Coding 00102, Workshop Code: 13765 Sending ReadIdent block Ident: TMBJX46Y474118351 SKZ7Z0F3897249 Sending EndCommunication block Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 17 GetSKC OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L KOMBIINSTRUMENT VDO V04 Software Coding 00102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VQMJ07HH@ $08 01: $65 $26 02: $02 $0C $05 $0F $33 $3B 03: PQ24_7 HL Flash Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VQMJ07HH 08.40' is 34 3F 43 39 Sending Custom "Get Access Level" block Access level is 4. Sending Custom "Seed request" block Block: FE 18 A0 FA B8 C7 97 68 09 00 Access level 7 secret: $FD $8E $31 $96 Sending Custom "Key response" block Sending Custom "Get Access Level" block Access level is 4. Failed to unlock cluster. Saving EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin Sending ReadEeprom block (Address: $0090, Count: $10) Sending ReadEeprom block (Address: $00A0, Count: $10) Sending ReadEeprom block (Address: $00B0, Count: $10) Sending ReadEeprom block (Address: $00C0, Count: $10) Sending ReadEeprom block (Address: $00D0, Count: $10) Sending ReadEeprom block (Address: $00E0, Count: $10) Sending ReadEeprom block (Address: $00F0, Count: $10) Sending ReadEeprom block (Address: $0100, Count: $0C) ********************************************************************** *** Warning: Some bytes could not be read and were replaced with 0 *** ********************************************************************** Saved EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0090_eeprom.bin GetSkc: Unable to find Immobilizer ID in cluster dump. Unable to determine SKC. Sending EndCommunication block Version 0.97.0-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM1 10400 17 DumpEeprom 0 2048 OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM1 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920843L KOMBIINSTRUMENT VDO V04 Software Coding 00102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VQMJ07HH@ $08 01: $65 $26 02: $02 $0C $05 $0F $33 $3B 03: PQ24_7 HL Flash Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VQMJ07HH 08.40' is 34 3F 43 39 Sending Custom "Get Access Level" block Access level is 4. Sending Custom "Seed request" block Block: FC 98 A0 FA B8 C7 97 68 09 00 Access level 7 secret: $FD $8E $31 $96 Sending Custom "Key response" block Sending Custom "Get Access Level" block Access level is 4. Failed to unlock cluster. Saving EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin Sending ReadEeprom block (Address: $0000, Count: $10) Received "Read EEPROM Response" block: 00 02 35 C5 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0010, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF Sending ReadEeprom block (Address: $0020, Count: $10) Received "Read EEPROM Response" block: 31 30 30 37 36 36 33 36 46 49 4C 30 30 30 41 43 Sending ReadEeprom block (Address: $0030, Count: $10) Received "Read EEPROM Response" block: 01 17 31 30 30 37 38 31 31 34 46 49 4C 30 30 30 Sending ReadEeprom block (Address: $0040, Count: $10) Received "Read EEPROM Response" block: 41 42 01 17 31 30 30 39 30 34 38 34 46 49 4C 30 Sending ReadEeprom block (Address: $0050, Count: $10) Sending ReadEeprom block (Address: $0060, Count: $10) Sending ReadEeprom block (Address: $0070, Count: $10) Sending ReadEeprom block (Address: $0080, Count: $10) Sending ReadEeprom block (Address: $0090, Count: $10) Sending ReadEeprom block (Address: $00A0, Count: $10) Sending ReadEeprom block (Address: $00B0, Count: $10) Sending ReadEeprom block (Address: $00C0, Count: $10) Sending ReadEeprom block (Address: $00D0, Count: $10) Sending ReadEeprom block (Address: $00E0, Count: $10) Sending ReadEeprom block (Address: $00F0, Count: $10) Sending ReadEeprom block (Address: $0100, Count: $10) Sending ReadEeprom block (Address: $0110, Count: $10) Sending ReadEeprom block (Address: $0120, Count: $10) Sending ReadEeprom block (Address: $0130, Count: $10) Sending ReadEeprom block (Address: $0140, Count: $10) Received "Read EEPROM Response" block: 43 F1 44 F1 44 F1 44 F1 44 F1 10 40 00 00 00 10 Sending ReadEeprom block (Address: $0150, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0160, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0170, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0180, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0190, Count: $10) Received "Read EEPROM Response" block: 00 00 36 59 30 39 32 30 38 34 33 4C 20 20 41 30 Sending ReadEeprom block (Address: $01A0, Count: $10) Received "Read EEPROM Response" block: 56 30 34 FF FF FF FF FF 36 4E 30 39 30 39 39 30 Sending ReadEeprom block (Address: $01B0, Count: $10) Sending ReadEeprom block (Address: $01C0, Count: $10) Received "Read EEPROM Response" block: 00 64 80 02 DC 05 DC 05 FE 00 5A 03 40 0F 6C 17 Sending ReadEeprom block (Address: $01D0, Count: $10) Received "Read EEPROM Response" block: 01 07 08 04 96 00 2C 01 68 01 0F 1E 0C 0A 0A 58 Sending ReadEeprom block (Address: $01E0, Count: $10) Received "Read EEPROM Response" block: 02 0D 0C 1E 3C 20 6E 0C 8C 06 B4 04 C9 07 FF 08 Sending ReadEeprom block (Address: $01F0, Count: $10) Received "Read EEPROM Response" block: 6D 01 6D 01 96 00 96 00 6D 01 DA 02 96 00 2C 01 Sending ReadEeprom block (Address: $0200, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 6D 01 6D 01 96 00 96 00 00 00 Sending ReadEeprom block (Address: $0210, Count: $10) Received "Read EEPROM Response" block: 00 00 FF 01 FF FF FF 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $0220, Count: $10) Sending ReadEeprom block (Address: $0230, Count: $10) Received "Read EEPROM Response" block: 3F 00 25 83 CD 00 40 0C FF 80 02 00 40 14 6A 78 Sending ReadEeprom block (Address: $0240, Count: $10) Received "Read EEPROM Response" block: 7B A0 5C 53 C2 C7 1E 06 6F AF C1 D7 FF AC 79 6B Sending ReadEeprom block (Address: $0250, Count: $10) Received "Read EEPROM Response" block: 00 21 E9 08 81 3B 00 FF FF FF FF FF FF FF 0A 0F Sending ReadEeprom block (Address: $0260, Count: $10) Received "Read EEPROM Response" block: FF 03 05 00 05 00 40 1A 00 60 3C 4C 3C 4C 3C 28 Sending ReadEeprom block (Address: $0270, Count: $10) Received "Read EEPROM Response" block: 32 46 C2 C7 6F BD 47 F6 80 BE 76 77 77 7C 00 7C Sending ReadEeprom block (Address: $0280, Count: $10) Received "Read EEPROM Response" block: 50 E2 4B 96 32 0A 03 81 78 1E 0F 04 02 00 18 00 Sending ReadEeprom block (Address: $0290, Count: $10) Received "Read EEPROM Response" block: 3B 00 F1 05 F3 0B 8D 0C 8D 0C 8D 0C 8D 0C 1E 00 Sending ReadEeprom block (Address: $02A0, Count: $10) Received "Read EEPROM Response" block: 73 00 DA 07 A4 0F 6C 10 6C 10 6C 10 6C 10 00 00 Sending ReadEeprom block (Address: $02B0, Count: $10) Received "Read EEPROM Response" block: D9 03 93 0B F3 1E 27 00 24 02 09 06 C6 0F C9 00 Sending ReadEeprom block (Address: $02C0, Count: $10) Received "Read EEPROM Response" block: 05 01 7A 01 D0 01 11 02 2D 02 45 02 57 02 C9 00 Sending ReadEeprom block (Address: $02D0, Count: $10) Received "Read EEPROM Response" block: 07 01 7C 01 D2 01 14 02 2F 02 48 02 5A 02 68 01 Sending ReadEeprom block (Address: $02E0, Count: $10) Received "Read EEPROM Response" block: 50 01 08 01 B4 00 60 00 3C 00 18 00 00 00 00 00 Sending ReadEeprom block (Address: $02F0, Count: $10) Received "Read EEPROM Response" block: 18 00 3C 00 60 00 B4 00 08 01 50 01 68 01 1F 00 Sending ReadEeprom block (Address: $0300, Count: $10) Received "Read EEPROM Response" block: 1F 00 E6 00 59 01 B2 02 0C 04 74 05 74 05 85 00 Sending ReadEeprom block (Address: $0310, Count: $10) Received "Read EEPROM Response" block: AD 00 C0 00 E4 00 09 01 1C 02 70 02 94 02 E0 02 Sending ReadEeprom block (Address: $0320, Count: $10) Received "Read EEPROM Response" block: A6 03 78 04 0E 04 E0 03 98 03 58 03 08 02 B8 01 Sending ReadEeprom block (Address: $0330, Count: $10) Received "Read EEPROM Response" block: 90 01 40 01 28 00 F0 00 90 01 08 02 A0 03 E0 03 Sending ReadEeprom block (Address: $0340, Count: $10) Received "Read EEPROM Response" block: 0E 04 F0 00 90 01 08 02 60 03 E0 03 0E 04 1F 00 Sending ReadEeprom block (Address: $0350, Count: $10) Received "Read EEPROM Response" block: 1F 00 E1 02 E1 02 AD 04 65 05 78 1E 00 27 88 2F Sending ReadEeprom block (Address: $0360, Count: $10) Received "Read EEPROM Response" block: 10 38 98 40 20 49 A8 51 30 5A B8 62 40 6B 0A 00 Sending ReadEeprom block (Address: $0370, Count: $10) Received "Read EEPROM Response" block: 2A 00 46 00 60 00 78 00 8E 00 A4 00 B9 00 CD 00 Sending ReadEeprom block (Address: $0380, Count: $10) Received "Read EEPROM Response" block: E1 00 0A 32 78 C8 30 00 87 8A 3C 23 00 00 00 00 Sending ReadEeprom block (Address: $0390, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $03A0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending ReadEeprom block (Address: $03B0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 05 1E 00 0F 00 64 00 0A 23 B0 00 00 00 Sending ReadEeprom block (Address: $03C0, Count: $10) Sending ReadEeprom block (Address: $03D0, Count: $10) Sending ReadEeprom block (Address: $03E0, Count: $10) Received "Read EEPROM Response" block: 35 DD DD 32 04 06 04 18 07 00 06 01 A8 FE 00 00 Sending ReadEeprom block (Address: $03F0, Count: $10) Received "Read EEPROM Response" block: 00 00 14 11 06 16 11 06 00 00 00 00 FF 43 07 01 Sending ReadEeprom block (Address: $0400, Count: $10) Received "Read EEPROM Response" block: 09 92 70 70 82 FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0410, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF 8C 8C 8C 8C 8C 8C 8C 84 8C 78 Sending ReadEeprom block (Address: $0420, Count: $10) Received "Read EEPROM Response" block: 8C 70 8C A0 A0 8C 8C A0 8C D8 8C 8C 90 8C 8C 9C Sending ReadEeprom block (Address: $0430, Count: $10) Received "Read EEPROM Response" block: 8C 8C 8C 8C 88 90 8C 8C 8C 8C 8C 8C 8C 8C 8C 94 Sending ReadEeprom block (Address: $0440, Count: $10) Received "Read EEPROM Response" block: 84 8C 8C 8C 8C 8C 8C 8C 84 8C 8C 8C 8C 8C A0 8C Sending ReadEeprom block (Address: $0450, Count: $10) Sending ReadEeprom block (Address: $0460, Count: $10) Received "Read EEPROM Response" block: A0 A4 32 33 00 27 04 14 15 F6 5B 06 1E 0A 00 01 Sending ReadEeprom block (Address: $0470, Count: $10) Received "Read EEPROM Response" block: 56 28 95 52 D3 7B FF F4 FF F9 00 00 00 30 80 F0 Sending ReadEeprom block (Address: $0480, Count: $10) Received "Read EEPROM Response" block: 80 F0 80 F0 80 F0 18 00 FF 80 FF BF FF FF 18 00 Sending ReadEeprom block (Address: $0490, Count: $10) Received "Read EEPROM Response" block: FF 80 FF BF FF FF 05 00 3C 80 FF FF FF FF 00 5D Sending ReadEeprom block (Address: $04A0, Count: $10) Received "Read EEPROM Response" block: FF 61 FF 61 FF 61 FF B4 80 BC 00 C3 00 80 BF FF Sending ReadEeprom block (Address: $04B0, Count: $10) Received "Read EEPROM Response" block: 02 35 9A FF 00 80 BF FF 02 35 9A FF 00 80 BF FF Sending ReadEeprom block (Address: $04C0, Count: $10) Received "Read EEPROM Response" block: 03 3C 9D FF 00 80 BF FF 02 35 9A FF 9F 7A 71 45 Sending ReadEeprom block (Address: $04D0, Count: $10) Received "Read EEPROM Response" block: 0F 03 1B 3E 43 4B 4B 2E A4 80 7C 74 74 74 E3 00 Sending ReadEeprom block (Address: $04E0, Count: $10) Received "Read EEPROM Response" block: 08 0A 0A 00 02 0A 02 53 32 0A 08 04 04 00 00 14 Sending ReadEeprom block (Address: $04F0, Count: $10) Received "Read EEPROM Response" block: 0A 05 00 00 00 64 88 0A FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0500, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF 30 30 4D 5E 57 78 54 82 56 8B Sending ReadEeprom block (Address: $0510, Count: $10) Received "Read EEPROM Response" block: 5D 91 8A 96 8A 96 8A 96 00 00 01 03 02 14 04 32 Sending ReadEeprom block (Address: $0520, Count: $10) Received "Read EEPROM Response" block: 08 78 0A FF 0A FF 0A FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0530, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF 00 F0 FF FF 00 FF FF FF Sending ReadEeprom block (Address: $0540, Count: $10) Received "Read EEPROM Response" block: 59 4D 4D 18 7F 7F 7F 7F 59 4D 4D 3F 7F 7F 7F 7F Sending ReadEeprom block (Address: $0550, Count: $10) Received "Read EEPROM Response" block: 04 14 00 00 FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0560, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0570, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0580, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0590, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05E0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $05F0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0600, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0610, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0620, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0630, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0640, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0650, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0660, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0670, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0680, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0690, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06E0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $06F0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0700, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0710, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0720, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0730, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0740, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0750, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0760, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0770, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0780, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $0790, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07B0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07C0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07D0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $07E0, Count: $10) Received "Read EEPROM Response" block: 00 00 00 00 FF FF FF 00 65 50 51 24 07 FF 00 44 Sending ReadEeprom block (Address: $07F0, Count: $10) Received "Read EEPROM Response" block: 48 4C 00 00 00 00 00 17 17 17 07 01 07 01 07 01 ********************************************************************** *** Warning: Some bytes could not be read and were replaced with 0 *** ********************************************************************** Saved EEPROM dump to 6Y0920843L__KOMBIINSTRUMENT_VDO_V04_$0000_eeprom.bin Sending EndCommunication block ```
Log (6Y0920871L - success): ``` Version 0.93.0-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM2 10400 17 GetSKC OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM2 Sending wakeup message Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920871L KOMBI+WEGFAHRSP VDO V02 Software Coding 28102, Workshop Code: 13765 Sending ReadIdent block Sending Custom "Read Software Version" blocks Sending Custom "Unlock Additional Commands" block 00: VSQX01LM $01 01: $88 $19 02: $10 $04 $03 $0A $20 $2C 03: PQ24_2 LM KW40/03 Sending Custom "Unlock partial EEPROM read" block Unlock code for software version 'VSQX01LM 01.20' is 3D 36 40 36 Please report this to the program maintainer. Sending Custom "Need Seed/Key?" block Sending Custom "Seed request" block Block: C3 BC 06 A8 EB 68 3F D4 03 00 Sending Custom "Key response" block Sending Custom "Need Seed/Key?" block Cluster is unlocked for ROM/EEPROM access. Saving EEPROM dump to TMBBC26Y154232101_____SKZ7Z0D2687422_$0090_eeprom.bin Sending ReadEeprom block (Address: $0090, Count: $10) Received "Read EEPROM Response" block: 73 1D A6 85 56 D5 D7 7C FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $00A0, Count: $10) Received "Read EEPROM Response" block: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Sending ReadEeprom block (Address: $00B0, Count: $10) Received "Read EEPROM Response" block: 72 50 70 46 1E BF E2 FF 72 50 70 46 1E BF E2 FF Sending ReadEeprom block (Address: $00C0, Count: $10) Received "Read EEPROM Response" block: 72 50 70 46 1E BF E2 FF 22 22 22 06 06 06 00 14 Sending ReadEeprom block (Address: $00D0, Count: $10) Received "Read EEPROM Response" block: 00 80 72 00 10 10 10 02 14 FF FF 01 FF FF FF FF Sending ReadEeprom block (Address: $00E0, Count: $10) Received "Read EEPROM Response" block: 53 4B 5A 37 5A 30 44 32 36 38 37 34 32 32 53 4B Sending ReadEeprom block (Address: $00F0, Count: $10) Received "Read EEPROM Response" block: 5A 37 5A 30 44 32 36 38 37 34 32 32 53 4B 5A 37 Sending ReadEeprom block (Address: $0100, Count: $0C) Received "Read EEPROM Response" block: 5A 30 44 32 36 38 37 34 32 32 FF 26 Saved EEPROM dump to TMBBC26Y154232101_____SKZ7Z0D2687422_$0090_eeprom.bin SKC: 09983 Sending EndCommunication block ```
Log (6Y1920860G - success, but I don't have log with SKC): ``` Version 0.86-beta (https://github.com/gmenounos/kw1281test/releases) Args: COM5 10400 17 ReadIdent OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 8.0.0 Culture: pl-PL Opening serial port COM5 Sending wakeup message Wakeup duration: 2 seconds Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y1920860G KOMBIINSTRUMENT VDO V12 Software Coding 16141, Workshop Code: 00012 Sending ReadIdent block Ident: TMBDB16Y333700788 SKZ7Z0B1681943 Sending EndCommunication block ```
gmenounos commented 3 months ago

Interesting. I just got a very similar Polo cluster working this week:

ECU: 6Q0920804   KOMBIINSTRUMENT VDO V06
Software Coding 01131, Workshop Code: 00000
Sending ReadIdent block
Sending Custom "Read Software Version" blocks
Sending Custom "Unlock Additional Commands" block
00: VQMJ07LM $00 $09
01: $69 $26 
02: $0D $0C $05 $0F $1E $1A 
03: PQ24_7 LM CDVZ Maske
Sending Custom "Unlock partial EEPROM read" block
Unlock code for software version 'VQMJ07LM 09.00' is 34 3F 43 39
Sending Custom "Get Access Level" block
Access level is 4.
Sending Custom "Seed request" block
Block:  EE 1C B7 3F DD 9E EE 36 09 00
Access level 7 secret: $FD $8E $31 $96 
Sending Custom "Key response" block
Sending Custom "Get Access Level" block
Access level is 7.

Did you read the 93C86 EEPROM directly from the PCB? If so, can you send it to me? It's most likely encrypted, but that's ok.

AdisonCavani commented 3 months ago

I have a EZP 2019+ EEPROM programmer but I wasn't able to read the EEPROM directly from the PCB via clip (without desoldering). I will try to desolder it, but first I wanna try other non-intrusive solutions - other software, eg. Autel VDI etc.

IMG_20240307_191657.jpg

IMG_20240307_191206_1.jpg

gmenounos commented 3 months ago

I was able to read the EEPROM from my Polo cluster from the PCB using this and the proper adapter: https://www.mcumall.com/comersus/store/comersus_viewItem.asp?idProduct=4282 Make sure to choose 93C86 16-bit because the chip is hardwired for 16-bit mode.

gmenounos commented 3 months ago

And if the chip reads what looks like junk (see attached), it's probably just because the EEPROM is encrypted. poloswap.zip

gmenounos commented 1 month ago

I just got an EZP2019+ EEPROM programmer and it worked fine to read the 93C86 in 16-bit mode. I think the reason it wasn't working for you is that you didn't have the adapter plugged into the right part of the socket. It needs to be in the top part of the socket, not the bottom, like this:

image
AdisonCavani commented 1 month ago

Hmmm. I will try it out in a few days a let you know. Thank you for help :)

AdisonCavani commented 1 month ago

@gmenounos image

The PIN nr 1 is the one painted red?

gmenounos commented 1 month ago

Yes

AdisonCavani commented 1 month ago

image

Are these settings valid?

gmenounos commented 1 month ago

I think that's what I used. Can't remember what speed. I think I just picked whatever were the default settings for 93C86 and 16-bit.

gmenounos commented 1 month ago

I just tried those settings and they worked.

gmenounos commented 1 month ago

I used these drivers instead of the ones that came on the CD: https://dksmart.vn/download_link_me&link_download_132_20230203084136182ee649752b089bca80dfb190ba1766

AdisonCavani commented 1 month ago

It's reading for about 1-2 minutes, but after it's finished "Chip is empty".

image

gmenounos commented 1 month ago

Maybe try the slowest speed instead of 12MHz. Also make sure the clip is making good contact with all pins of the 93C86 chip in the cluster.

AdisonCavani commented 1 month ago

I managed to read it. After 2 months... Wow.

licznik.zip

gmenounos commented 1 month ago

How did you manage to read it?

AdisonCavani commented 1 month ago

Via EZP 2019 programmer. But it's super hard to clip it properly without desoldering.

gmenounos commented 1 month ago

Your EEPROM is encrypted but I found out how to decrypt many 93C86 encrypted EEPROMs and created a web page to do the decryption: https://bitfab.com/Decrypt93C86 It looks like your SKC is 01397 and the odometer is 60345 km

AdisonCavani commented 1 month ago

Yes, you are correct. I will try it out in my car soon. Thank you very much.