Инструкция по пользованию VAG K+CAN Commander
Published 22 Январь 2011 | 
Инструкция по пользованию VAG K+CAN Commander
Version: 2.0 issued by: Abritus 72 Ltd
| List of Revisions | |||
| Date | Chapter | Description | Revision |
| 27.11.2007 | Release version of the document | 1.0 | |
| 14.01.2008 | 2 | Update of the description of dongle installation (HID driver) | 1.1 |
| 01.02.2008 | 3.2.1.2 | Update of description regarding Audi A4 Bosch RB4/Crypto+ clusters | 1.2 |
| 12.02.2008 | Adaptation regarding SW version 4.1 | 1.3 | |
| 18.02.2008 | 2 | Changes regarding setting of the working folder for the shortcuts | 1.4 |
| 20.02.2008 | 2,4,5 | Clarification of the Installation procedure | 1.5 |
| 14.03.2008 | All | Update to V5.0 of the VAG K+CAN Commander | 2.0 |
2.2 Installing USB Interface drivers
2.3 Installing “VAG K+CAN Commander”
3 DIAGNOSTIC WITH “VAG K+CAN COMMANDER”
3.4 Standard diagnostic requests
3.4.2 Software and Hardware version of the unit
3.4.3 Extended Unit Identification
3.4.4 Read Diagnostic Trouble Codes
3.4.5 Clear Diagnostic Trouble Codes
3.4.7.1 Standard Security Access
3.4.7.2 User defined Security Access
3.4.17 Active diagnostic session
3.5.1 Special functions with “instrument CAN”
3.5.2 Special functions with “EZS Kessy CAN”
3.5.3 Special functions with “instrument K-Line”
3.5.4 Special functions with “Engine Control Unit”
3.5.5 Special function “Kessy adaptation”
3.5.6 Special function “MMI-TV activation”
3.5.7 Special function “Custom memory access Download/Upload/ReadMemory”
3.5.8 Special functions with “Airbag”
3.5.9 Special function “Key learning”
3.5.10 Special function “Dump Tool”
7.1 Programming instrument clusters from Magneti Marelli (K-line diagnostic link)
7.1.1 Instrument cluster from Audi A3, Audi A6:
7.1.2 Instrument cluster from Audi TT-K
7.1.3 VW Passat – usually this Instruments are before year 1998
7.2 Porsche Cayenne/VW Touareg gasoline engines – ECU wakeup fuses
7.3 Audi A8 fusebox (passenger side – wakeup ECU)
1 INTRODUCTION
“VAG K+CAN Commander” is a PC – Windows based diagnostic software for the vehicles from VAG. With help of your tool you can perform unusual for remaining diagnostic tools operations with vehicles. With the current SW release 4.1 “VAG K+CAN Commander” provide you full diagnostic capabilities for VAG-vehicles.
2 Installation
2.1 Installing dongle drivers
Till December, 2007 the all interfaces are equipped with dongles which are requiring drivers. Starting from December, 2007 the USB dongle is recognized automatically from Windows 2000/XP/Vista as HID device, so driver installation for it is not needed. But if the dongle doesn’t appear in the device manager, please proceed with the driver installation as described below.
Your set consist interface (USB to OBDII) and USB-dongle.
Latest dongle drivers are also available on the internet on: www.vag-commander.com/download/Dongle Driver USB/Dongle Driver USB.rar
Let to install at first dongle driver.
Open folder of “VAG_K+CAN_Commander” and from subfolder “Dongle_Driver_USB” start “inf+inst”:
ATTENTION: There might be a problem if the dongle is configured to request driver (i.e. the interface is shipped before December, 2007). The manufacturer of the dongle doesn’t provide device driver for Windows Vista 64 for the moment, i.e. the Windows Vista doesn’t recognize the dongle.
Fortunately, the dongle may run in HID mode (i.e. without a driver), but a dongle should be reconfigured. Since the Windows Vista doesn’t recognize the dongle for the moment, this should be made on other computer.
Please do the following steps to reconfigure the dongle:
- Put the dongle on computer with operating system other than Windows Vista 64.
After installation of the driver will be displayed:
Press “OK”.
- Run the dongle reconfiguration tool from:
http://www.vag-commander.com/download/Utilities/DongleToHID.exe
-> Now the dongle will be recognized from Windows Vista and will be displayed in the device
manager.
2.2 Installing USB Interface drivers
Latest USB Interface drivers are also available on the internet on:
Windows Vista / Vista x64 / XP / XP x64 / 2000 / Server 2003 / Server 2003 x64: www.vag-commander.com/download/Interface Driver USB/CDM 2 02 04.rar
Windows 98 / ME:
www.vag-commander.com/download/Interface Driver USB/Interface Driver USB 98.zip
Open folder of “VAG_K+CAN_Commander” and from subfolder
“Interface Driver USB\WIN NT XP VISTA\Executable 2.02.04″ start “CDM 2.02.04″:
When driver is installed will be displayed:
c ” C:\D0CUHE~1\ADMINI~1\L0CALS~1Memp\ckz_GST0\DPInst_HonxS6.exe
32-bit OS detected
“C: SDOCUME~lSADMI N1 ™lSLOCALS™lSTempSc]<z_GST0SDPI nstx86 . exe ” Installing driver……
FTDI CDM Driver Installation process completed. Press enter.,_
Press “Enter”.
Now you can connect your USB dongle and USB interface to your PC. Wait few seconds until Windows notify us that the new hardware is ready for usage.
2.3 Installing “VAG K+CAN Commander”
The “VAG K+CAN Commander” is contained into installation package, so please run the setup program. It will create program group in the start menu and optionally desktop icon.
The “VAG K+CAN Commander” program group contains following icons:
- Uninstall “VAG K+CAN Commander” – uninstall Tool
- ”VAG K+CAN Check” – tool for auto-diagnostic of the USB dongle/interface with possibility to generate dump file with the results, which can be reviewed from the producer.
- ”VAG K+CAN Commander” – the “VAG K+CAN Commander” diagnostic tool
- ”VAG K+CAN Update Request” – tool for requesting latest software update from the produces with possibility to check for new version.
Now you are ready to start program “VAG K+CAN Commander.exe” from “VAG-K+CAN Commander” folder or from the program group. While startup a splash screen appears -
NOTE: If on the splash screen a text “Interface found” is written, this means your dongle/interface are recognized OK and the tool should work normally. If “Interface NOT found” is written, or nothing is written, please go to the “Troubleshooting” section.
After the splash screen is removed the main application screen is displayed. Please note that displaying the main screen doesn’t mean the dongle/interface are recognized OK. The main screen looks as follows:
ATTENTION:
Make sure you are running the “VAG K+CAN Commander” from its folder. If you are using a shortcut to the “VAG K+CAN Commander”, please be sure that the “working folder” parameter is set to the folder where the executable is placed! If the “working folder” of the shortcut is not set the K-Line may function incorrect.
3 Diagnostic with “VAG K+CAN Commander”
The “VAG K+CAN Commander” consist basically from two parts:
- Standard diagnostic functions like reading/clearing trouble codes, device identification, adaptation, measured values, etc.
- Special functions like odometer correction, reading login (PIN), reading EEPROM, etc.
All devices which can be installed into the car are listed in the main screen of the “VAG K+CAN Commander” with their VAS-Number. If you want to connect to some device please double click on it. The “VAG K+CAN Commander” will try to connect to the device using consecutively the following protocols:
- KWP2000 over TP2.0 with baud 5000KB/s (CAN)
- KWP2000 over TP1.6 with baud 5000KB/s (CAN)
- KWP1281 or KWP2000 over K-Line (the protocol is recognized automatically from the wake-up pattern).
You can choice which of these protocols to try when attempting to connect as described in the “Configuration” section
NOTE: changes regarding interface detection and timing parameters which you made in this dialog will be applied after restarting the application.
3.1 Configuration
The “VAG K+CAN Commander” can be configured by pressing the “Options” button from the main screen. The following dialog is displayed:
3.1.1 Used protocols
The meaning of the check-boxes is as follows:
- CAN TP2.0 – when trying to connect to the device the commander will try to connect to it using “KWP2000 over TP2.0 with baud 5000KB/s”
- CAN TP1.6 – when trying to connect to the device the commander will try to connect to it using “KWP2000 over TP1.6 with baud 5000KB/s”
- K-Line KWP2000/KWP1281 – when trying to connect to the device the commander will try to connect to it using “KWP1281 or KWP2000 over K-Line”
NOTE: This check-boxes are configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests, they are not applied when auto-scanning devices.
3.1.2 Interface detection
Normally the “VAG K+CAN Commander” USB Interface is recognized automatically, but there is a option to set it manually. So if you have troubles as described in the “Troubleshooting” section you can try to set the port used by the “VAG K+CAN Commander” manually. This can be done as follows:
- Open the “Device manager” and check as which COM port the USB interface is recognized
- Uncheck the “Automatic” check-box and set the port in the respective field.
3.1.3 Timing parameters
The protocols running under K-Line require very precise byte timing. Since Windows is not a realtime operating system, this times are not always respected, so it is possible that the communication with some devices is unstable, or it is not possible to connect. In such case you can try to change some of the times timing parameters from the “Advanced” button. The timing parameters have the following meaning:
- Wakeup echo delay – time after slow init between receiving “55 xx yy” and sending the inverted value of “yy” (according the K-Line wakeup procedure)
- Communication echo delay – time between reception of a byte under KWP1281 and sending it inverted back to the device
- Inter byte time – time between sending two bytes under KWP2000
- Time between messages – time delay between reception of response from device and sending new request to it.
3.2 Scanning units
After startup on the main screen of the “VAG K+CAN Commander” a list of all possible units with their VAS-Number is displayed.
The customer is able to connect to listed device by double-clicking on the desired device.
Instead of displaying all possible units you can choice a configuration of devices corresponding to specific car model (chassis type). This is done by selecting the type (e.g. “1T – VW Touran”) from the “Chassis type” combo-box. Then pressing the “Display button” will show all devices which can be build into this car type.
Pressing the “Scan all” button will attempt to connect to each device currently displayed in the list. Depending the configuration options only the selected protocols will be used when scanning for the devices.
For all devices which the “VAG K+CAN Commander” founds a detailed information is displayed in the main screen. For each device the following information is shown:
- VAS Number
- Unit name
- VAG Number – returned by device in the device identification
- Description – returned by device in the device identification
- Coding – returned by device in the device identification
- Part / Imp / Supp N (Part number / Importer number / Supplier number) – information is shown separated with spaces, also returned from the device in the device identification
- DTC – number of DTCs stored in the unit
Instead scanning all units (which can take a while) the user retrieves the list of the installed devices from the gateway by pressing the “Gateway config list” button.
Since clearing of the DTCs for all existing devices is one of the main diagnostic operations, and broadcast requests for clearing DTCs are not accepted from all units, there is a possibility to scan all devices and if connection to the deivce is possible, then its DTCs are cleared. This is made by pressing the “Clear all DTCs” button from the “Auto scan devices” panel. Once again the protocols used to connect to the devices are specified in the configuration options.
3.3 Broadcast requests
Broadcast requests are these requests which are send to all or group of devices simultaneously. The “VAG K+CAN Commander” is able to send broadcast request to all devices with request to enter into desired transport mode, to clear all DTCs in all devices, to disable/enable the communication of all devices. This is done by pressing the corresponding button from the “CAN Broadcast” panel.
Available functions are: [Transport Mode]
Enter or leaving vehicle from Transport Mode that is used by
the factory to put the cars into a “sleep” to conserve battery charge during long periods of inactivity
[Disable Normal Communication]
This function will disable all communication between units in the car. This can help you to hold current state of the car and to prevent disturbing of communication while re-flashing.
[Enable Normal Communication]
Restore normal message transmission.
[Clear All DTC's]
Sending requests to all units in vehicle to erase its DTCs,
3.4 Standard diagnostic requests
When double-clicking on the desired device in the main “VAG K+CAN Commander” window, you connect to the device to proceed standard diagnostic requests. The following dialog is opened:
This dialog provides you the possibility to execute the following diagnostic requests:
3.4.1 Identification
“Identification” will provide you VAG part number and software coding.
— electronic control unit identification
================ Device H: 1 ================
4F0910401L <- VAG number PROGRAMMABLE
Program status 00, data status 20
Coding :11772
Part number : 0
Importeur1s number :0
Supplier number : 0
System description : 3.0L V6TDI G000AG_
3.4.2 Software and Hardware version of the unit
“SW/HW version” displaying (if service supported from corresponding controller SW and HW version of the unit (including all slave units of the master unit).
| = = = = SW/HW version | |||
| SW version of module | i | кг.6.э | |
| SW version of module | z | D2.6.9 | |
| SW version of module | 3 | нг.6.э | |
| SW version of module | 4 | A4.7.ба | |
| SW version of module | s | XPQ35 V19 02 | |
| Har dxrar e numb e r | 1K0907951 | — | |
| l | ?v | ||
3.4.3 Extended Unit Identification
“Extended identification / VIN” displays programming data, flash status, programming attempts, flash date, VIN number.
3
| iPart serial number | 2100103A163DEF i | |
| Supplier identification | TF74035 | |
| Production date | IS.10.03 | |
| Changes from supplier | ||
| Number of validation status | 1001 | |
| Current supplier 1s number | 3DEF | |
| — Flash | ||
| Programming succefull – ready for | driving. | |
| Programming | attempts : 0 | |
| Succesful programming | attempts : 0 | |
| Status of conditions for programming : 0 | ||
| |Flash-Tool code: 0×000000000000 | Flash date: Z3.0S.03 | |
3.4.4 Read Diagnostic Trouble Codes
“Read DTCs” will display all present errors in master and slave units.
Displayed errors can be together with freeze frame data (this is depends checkbox freeze frame)
| Status : Permanent error | |||||
| 18038 Accelerator Position Sensor (G79): Status : Permanent error | Signal too Low | ||||
| 19804 Control Circuit for Controller for Status : Sporadic error теchaniс al errоr | Turbосharge r 1 | (J724i: | Electrical | Halfunction | |
| 19804 Control Circuit for Controller for Status : Permanent error lower limit exceeded | T u гЬосharge r 1 | <J7Z4): | Electrical | Halfunction | |
| T | |||||
3.4.5 Clear Diagnostic Trouble Codes
“Clear DTCs” will clear all stored DTCs inside of the unit.
3.4.6 Measured values
“Measured values” provide you possibility to check measured values in different groups. You can enter manual number of the group or using “+”/”-” to increment or decrement group number.
Button “scan all” will generate file with all groups.
3.4.7 Security Access
“Security Access” gives you possibility to perform security authorization on different levels.
3.4.7.1 Standard Security Access
This type security access can be:
• ”Security Access (Login)” – usually used in immobilizer systems
• ”Security Access (Component Security)” – usually used while adaptation of different units/parts
• ”Security Access (System Specific)” – security access different from previous two and different from authorization for programming session.
3.4.7.2 User defined Security Access
You need to clarify type of security access then using buttons “Request SEED”/”Send KEY” can be performed authorization.
3.4.8 Adaptation
“Adaptation” will open for you separate window where you can check adaptation values. Need to enter number of the channel where will be performed adaptation then press button “Test” and if value is accepted by the unit press button “Save”.
Button “Scan all” will generate file with all channels and adapted values.
3.4.9 Coding of the unit
“Coding” will open for you separate window where you can change coding value of the master and all slave units. In the example bellow only master unit supports coding. Slave units 1 and 2 are without coding.
3.4.10 Basic settings
“Basic settings” will expecting from you to enter number of the grout and to press button “ON” or “OFF”.
3.4.11 Actuator test
Available two type of test “Selective” and “Sequential”.
In selective test you have possibility to enter test code manually or to select it from list box. When test is selected just need to press “Start”.
3.4.12 Reset of the unit
“Reset” will request from the unit SW reset. Not all electronic control units supporting this service. Take care that it is not available in all diagnostic sessions.
3.4.13 Custom requests
Using this function user can send manually diagnostic requests to corresponding unit. In example bellow is requested identification of instrument cluster.
3.4.14 Program VIN
“Program VIN” request the stored in the device VIN and tries to change it. Not all electronic control units supporting this service. Take care that it is not available in all diagnostic sessions.
3.4.15 Custom download/upload
“Custom download/upload” allows direct reading from the address map of the device. This option will be available only if you have some updates in your configuration like e.g. “Reading/writing the flash counters”.
Take into account that in most cases a security authorization is required before you tries to read/write into the address map.
3.4.16 Component security
This special function allows managing of brand new units (and immobilizer units) where is allowed programming of PIN, SKC, BGW, MAC. Functions are under CAN-TP2.0.
3.4.17 Active diagnostic session
Default diagnostic session established after connection to the unit is “89″. User can request entering in different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session “89″.
Take into account that in most cases different diagnostic sessions requiring security authorization.
3.5 Special Functions
Special functions are some specific for electronic control units application which will allow you change of odometer, reading security access codes, read/program EEPROM / flash content and so on.
Special functions are available from the main dialog of the application.
Special functions
| Function | ж. |
| Instrument CAW | |
| ESS-Kessy CAN | |
| Instrument K-Line | |
| Engine Control Unit | |
| Kessy adaptation | - |
The appropriate special function is opened by selecting it in the list box and double-clicking on it, or by pressing the “Open” button.
3.5.1 Special functions with “instrument CAN”
When this function is opened, the “VAG K+CAN Commander” tries to establish diagnostic session with the Instrument / cluster using KWP2000 over TP2.0.
Available functions are:
• Reading current odometer value
• Change of odometer
• Read/Program memory of instrument cluster immobilizer
• Reading security access code of the IMMOBILIZER
• Read/Write immobilizer related data
Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the instrument cluster!
This application can be used with following models:
VW Golf5, VW Caddy, VW Touaran, VW EOS, VW Individual, Skoda Octavia II, Skoda Scout, Seat Leon, Seat Altea, Seat Toledo, Audi A3, Audi A6, Audi A8, Audi Q7, Audi Allroad.
With Audi A6, Audi A8, Audi Q7, Audi Allroad function for reading current odometer value is not available. You need directly to enter new value and to press button change odometer. After a minute you will be asked for the currently displayed value and odometer will be changed.
ATTENTION:
Please take care that some instrument clusters from Audi A3 and Audi A8 are with blocked access to these special functions. This can be recognized if after reading of current odometer value is displayed unreal value. To restore instrument cluster to normal behavior need to be removed for one minute fuse of instrument cluster (for example on Audi A8 can be used fuse number 5). Reason for blocking of security access is usage of bad diagnostic tools in the past.
ATTENTIoN:
“VAG K+CAN Commander” is designed to calculate odometer values in “KM” units. Please take care about this especially when using dump tool or when VAG Commander asking you about displayed value of instrument cluster (Audi Q7, Audi A6, Audi Allroad).
For some of vehicles you can read and program immobilizer related data inside of immobilizer and engine control unit. This can be done by pressing of button “Read/Write Immo data”. Will be displayed following screen:
Pressing button “Read” will read immobilizer related data. Pressing button “Write” will program data from HEX screen is NOT selected checkbox “update dump” or from parsed data area if is selected checkbox above.
Same data can be programmed in engine control unit eeprom.
From this dialog also is available function to reset immobilizer in virgin (delivery) condition where is allowed adaptation of this immobilizer to engine control unit.
3.5.2 Special functions with “EZS Kessy CAN”
When this function is opened, the “VAG K+CAN Commander” tries to establish diagnostic session with the “EZS-Kessy / Entry And Start Autorization” using KWP2000 over TP2.0.
VAG-K+CAN COMMANDER 5.0
.JSl.
wwi4.abritus72.CDm
Coding Part / Imp/Supp Ы Prot
Unit name
Descript ion
VAG number
00
01 Engine Control Unit-Master
02 Tr ansmisson
03 ABS
| ? 4 | Steering Angle | |
| ? 5 | EZS-Kessy/Entry And Sta… | |
| OS | Seat memory passenger | |
| 07 | Control head | |
| OS | Climatronic/Auto HUAC | |
| 09 | С ent r al E1 e ct i с | |
| OA | ||
| OE | Air heating | |
| ОС | ||
| OD | Slide door left | |
| OE | Hedia player 1 | |
| OF | Digital radio | |
| 10 | Park/steer assist | |
| 11 | Engine II | |
| 1Z | Clutch | |
| 13 | Auto Distance Regulator | |
| 14 | Suspend electronics | |
| IE | Airbag | |
| IS | Steering wheel | |
| 17 | Ins t rurnent Cluster | |
| л . | ||
| Auto scan devices | ||
| Chassis type: | General – All units j | li | Pis | |
ГАЫ ?—^rUn.
Odometer
Instrument cluster / Immobilizer special functions
SECURITY ACCESS CODE
Read current odometer value
Current odometer value New odometer value
Change odometer
Immobilizer (WFS)
0
Reset cluster
Read/Write EE PR 0M
Read/Write memory
Custom Read/Write the memory area
Read ROM/FLASH
ReadAVrite RAM
Read Security Access Code
Read/Write IMMO data
Vehicle model: depends cluster ID
This special function is dedicated to read the security code from the Kessy for Q7 and A6 models.
In order to read the security access code several attempts will be need, and after each attempt you will be invite to make the ignition OFF and ON.
3.5.3 Special functions with “instrument K-Line”
When this function is opened, the following dialog appears:
From this dialog you need to choice type of your instrument cluster / immobilizer and then you can read/write EEPROM (change odometer, read PIN code and so on). Please note that only connection via K-Line will be made (KWP1281 or KWP2000) and this doesn’t depend from the configuration options.
For the most of instrument clusters is implemented automatic parsing of data from the EEPROM (odometer/immobilizer).
For instrument clusters from Magneti Mareli please refer Appendix A.
NOTE: Sometimes if you try to access the instrument cluster by selecting the wrong type, the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnecting from battery. For example this is always happened for the Bosch clusters, which will be blocked if accessed as “Instrument cluster (VDO66, VDO86, Motometer)” type.
NOTE: Please be very careful when selecting “Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001+” and “Instrument Cluster Audi A4 BOSCH RBx” instruments. You will be able to read the EEPROM of the instrument no matter which of both types is selected,
but if you’ve chosen the wrong type and you try to make some changes, you can damage it. You can recognize whether the right type is selected by doing following:
1. Choice “Instrument Cluster Audi A4 BOSCH RBx”
2. Read the EEPROM
3. If the displayed odometer corresponds to the real value, and if the displayed login is accepted, then the type is “Instrument Cluster Audi A4 BOSCH RBx”, otherwise it is “Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001+”
Take into account that most of instrument cluster need from “Reset” after change of odometer. You can try to send diagnostic request for reset of the cluster (button “Reset ECU”). If this service is not supported you need to remove fuse of instrument cluster and to connect it again.
3.5.4 Special functions with “Engine Control Unit”
Special functions with ECU can be:
- Read/Write of flash memory
- Read/Write the flash counters
- Read/Write EEPROM
- Change odometer (EDC15)
- Extracting security code/PIN
- Immobilizer Enable/Disable (EDC15/ME7x)
Functions become available after pressing of button “ECU” from special functions of main dialog:
Engine Control Unit – Special Functions
ReadEEPROM
Choice ECU type: VAG-EDC15x
VAG-ED CI 5k
| 00000000 | 00 | 00 |
| 00000010 | 00 | 00 |
| 00000020 | 00 | 00 |
| 00000030 | 00 | 00 |
| 00000040 | 00 | 00 |
| 00000050 | 00 | 00 |
| 00000060 | 00 | 00 |
| 00000070 | 00 | 00 |
| 00000080 | 00 | 00 |
| 00000090 | 00 | 00 |
| 000000A0 | 00 | 00 |
| 000000B0 | 00 | 00 |
| ooooooco | 00 | 00 |
| 000000D0 | 00 | 00 |
| 000000E0 | 00 | 00 |
| 000000Г0 | 00 | 00 |
| 00000100 | 00 | 00 |
| 00000110 | 00 | 00 |
| 00000120 | 00 | 00 |
| 00000130 | 00 | 00 |
| 00000140 | 00 | 00 |
| 00000150 | 00 | 00 |
| 00000160 | 00 | 00 |
| 00000170 | 00 | 00 |
| 00000180 | 00 | 00 |
| 00000190 | 00 | 00 |
| 000001A0 | 00 | 00 |
| <11 | ||
VAG-ME 7.1.1/7.5/7.8 wakeup
VAG-ME7.1.1 /7.5/7.8 wakeup
Porsche 5.2/7.8
EDC1 GUI
EDC16U31
EDC16U34
EDC16CP/EDC16CP34 EDC16C4 Master EDC16C4 Slave EDC16U1 Master EDC1SU1 Slave EDC16U31 Master EDC1SU31 Slave MED Э.5.10 MED 9.1
SIMPS PPD 1.1/1.5 (Siemens)
pattern 01 pattern 11
)0 )0 )0 )0 )0 JO JO JO JO JO JO JO JO
00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 |
Write EEPROM
Save to file…
Load from file…
Login | Odometer:
fo
Change
Imnno ON
Immo OFF
Flash counter
Att |O Sue |g
Flash tool ID:
Write
Read
Read Flash
Write Flash
Exit
You need to clarify type of Engine Control Unit in the car before any actions!
Can choose ECU type – VAG- EDC15x, VAG – ME7.1.1/7.5/7.8, Porsche 5.2/7.8
BOSCH VAG-EDC15x, VAG-ME7.1.1, VAG-ME7.1, VAG-ME7.5, VAG-Cartronic ME7.8, EDC16U1, EDC16U3x/CP, etc. (Extracting security code, odometer correction, enable disable immobilizer and so on)
Example is : 1.9 TDI – EDC15
Engine Control Unit – Special Functions
Choice ECU type: |VAG-EDC15x
“I!
Read EE PROM
Write EEPROM
| 00000000 | F1 | FF | FF | FF | FF | 15 | 31 | 33 | 38 | 34 | 2E | 31 | 34 | 9B | 00 | CE | ……1384.14. . „ | * | |
| 00000010 | 15 | 31 | 33 | 33 | 34 | 2E | 31 | 34 | 6A | 00 | FF | FF | FF | FF | FF | FF | .1384.14]……. | ||
| 00000020 | FF | rF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |||
| 00000030 | FF | FF | 2F | 2F | FF | FF | FF | FF | FF | FF | FF | FF | CI | FF | 6A | 00 | ?-/|l………}? | ||
| 00000040 | 02 | 00 | 6A | 00 | 00 | 00 | FO | DS | 00 | 00 | 00 | 00 | 00 | 00 | ЗА | 00 | ? i…………. | ||
| 00000050 | 02 | 00 | 6A | 00 | 00 | 04 | F7 | 77 | 00 | F7 | 77 | 00 | 84 | 07 | FC | 85 | ..”?… . W. . TiT….. | ||
| 00000050 | 02 | 00 | 00 | 00 | BE | EF | ВС | B3 | 00 | B3 | 00 | 00 | 00 | 00 | B4 | E5 | |||
| 00000070 | 00 | 00 | Б8 | ОБ | 96 | 07 | ЕЭ | CE | 01 | 00 | FF | 00 | GO | 00 | 00 | 00 | |||
| 00000030 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |||
| 00000090 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | ОС | GO | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |||
| 000000A0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |||
| 00G000B0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | FE | FF | |||
| ooooooco | FF | FF | FF | FF | FF | FF | FF | J.D | 00 | 00 | FF | FF | 03 | 23-. | 4C | 80 | ………….§1. | Я | |
| 000000D0 | 80 | 00 | 01 | 28 | 02 | 00 | 00 | 00 | 81 | 00 | 27 | 4C | 02 | 02 | 00 | 01 | … (…… L…. | ||
| 000000E0 | 23 | 02 | 00 | 00 | 00 | ОС | F4 | 42 | 4C | 08 | 03 | 00 | 01 | 28 | FF | 00 | (……BL…. (.. | ||
| 000000F0 | 00 | 00 | 3E | 90 | ID | 4C | 01 | 01 | 00 | 01 | 20 | o3 | 00 | 00 | 00 | 12 | ШЩ- L…. (….. | ||
| 00000100 | 59 | 16 | 44 | 01 | 01 | 00 | 01 | 28 | 01 | 00 | 00 | 05 | 90 | 9E | FF | FF | Y, D____(…….. | ||
| 00000110 | FF | FF | P’F | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |||
| 00000120 | FF | rF | FF | FF | FF | 80 | CA | 39 | E5 | B4 | 52 | 3D | 96 | F1 | A2 | 06 | …….9. . R=____ | ||
| 00000130 | F1 | 41 | 55 | 5A | 36 | 5A | 30 | 43 | 30 | 30 | 39 | 37 | ?3.3 | 36 | 35 | D5 | ,AUZ6Z0C0097365. | v | |
| M | > |
Login
Ddorneier: 1123400
Done.
Save to file.
Load from file.
Chang
immo uN
Immo OFF
Read Flash
Write Flash
Exit
HINTS when reading/writing flash memories of ECUs (or change flash counters):
1. In case of EDC15 best is to remove fuse 11 to prevent disturbing of communication from instrument cluster
2. In case of ME7.x or ECUs from Porsche you can read flash memory like reading of EEPROM just difference is the need to be removed checkbox about automatic detection of EEPROM and put corresponding start address and length.
3. When flashing the device please always read and save first the original flash!
4. When using EDC16 please notice that the flash which was read is saved automatically in the “Flash” subfolder and can be used in case of any failure to restore the flash. ATTENTION: FILE IS CRYPTED!!! Don’t use it directly to write it! In case of failure during the flashing the device should enter into a boot-loader mode which will allow to flash the device (but not to read it). The flash can be then restored with the “Custom Read/Write” function.
5. Please stop all screen savers/power saving options and unused application during the flashing! Please do not do anything else while flashing.
6. Please take into account that the reading/writing of the flash will take a long time (especially when CAN connection is used) – as result the battery may become flat.
3.5.5 Special function “Kessy adaptation”
Window “Kessy adaptation” can be used for adaptation of brand new kessy unit to the car. This adaptation can be by CAN TP2.0, K-KWP2000 and also can be used with Porsche Cayenne. To perform this adaptation you need to know security access code of the old immobilizer of the car (WFS Security access code) and also Component Security code of your new kessy unit.
3.5.6 Special function “MMI-TV activation”
Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF. Covered vehicles are:
• Audi A3/S3
• Audi A6/S6 (MMI up to July 2006)
• Audi Allroad (MMI up to July 2006)
• Audi A8/S8 (MMI up to July 2006)
• Audi Allroad (MMI up to July 2006)
• Audi A6/S6 (MMI starting from August 2006)
• Audi Allroad (MMI starting from August 2006)
• Audi A8/S8 (MMI starting from August 2006)
• Audi Allroad (MMI starting from August 2006)
| ITV Activation | ||
| Speed Limit: q km/h | | j…………OK………..j | | |
| P Edition 1 С Edition 2 [ | Cancel | |
| I | ||
Use following rule when enabling TV.
- if car is before 2007 try with edition 1. In case of not success wait with ignition ON above
30 minutes and then try with edition 2. If car is after 2007 better is to try at first wih eddition 2.
3.5.7 Special function "Custom memory access Download/Upload/ReadMemory"
The "Custom memory access Download/Upload/ReadMemory" functionality is available from the "Special functions" list, but also it is available in the standard diagnostic dialog. The functionality is the same on both places with that difference, that in the standard diagnostic dialog the user should open the diagnostic connection, perform security access, enter into diagnostic session prior starting the custom read/write. When this functionality is opened from the "Special functions" list, these actions are automated and performed from the "VAG K+CAN Commander".
Using this application you can read/program memory in some electronic control unit. Requests send from this application can be related for the currently running session of for some of electronic control units from the dialog.
You can use this application with many different purposes - investigations, read/program flash memories (for example you can program by this dialog internal flash memory of EDC16).
In the example bellow we read part of the flash of EDC16CP
In this dialog is needed to clarify the diagnostic session which you want to be entered before
start of read/program memory.
In the example above it is used session “86″.
If you want to save currently running diagnostic session simply enter session “0″.
3.5.8 Special functions with “Airbag”
This special function is dedicated to clear the crash data of the airbag module. For some airbag models it is required also to clear the stored trouble codes. Unfortunatelly for them the “Clear DTC” diagnostic request is not able to do this, so it is need to read and write directly into the EEPROM.
Airbag
Connection type
Read EEPROM
| Choice ECU type: | T | г | |||||||||||||||
| AUDI BOSCH 1ЭЭ7 AUDI BOSCH 2001 лиги pncru inm | 2000 2003 | ||||||||||||||||
| 00000000 | 00 | 00 | VW | SIEMENS ALL | II0 | 00 | |||||||||||
| 00000010 | 00 | DO | 00 | ||||||||||||||
| 00000020 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000030 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000040 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000050 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000060 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000070 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000080 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000090 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000000A0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000000B0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| OOOOOOCO | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000000D0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000000E0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000000F0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000100 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000110 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000120 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000130 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000140 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000150 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000160 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000170 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000180 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 00000190 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| 000001A0 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | |
| <11 | |||||||||||||||||
Write EEPROM
Save to file…
Load from file…
Clear crash data
Ewit
For some airbag models the DTCs in the EEPROM are automatically erased, but some models the user has to do this by hand.
Covered units:
1C0 909 605 C, 8L0 959 655 A, 1J0 909 609, 6Q0 909 605 C,6Q0 909 605 A, 6Q0 909 605 B, 3B0 959 655 B, 1C0 909 605 F, 1C0 909 605 H, 1J0 909 607, 1J0 909 603, 4B0 959 655 C, 4B0 959 655 J,
4D0 959 655 C, 8L0 959 655 F,8A0 959 655 C, 8A0 959 655 K, 8A0 959 655 K, 4D0 959 655 H, 8D0 959 655 C, 8D0 959 655 L
3.5.9 Special function “Key learning”
In this dialog box you have to enter security access code of immobilizer extracted by some of special functions described above. Also need to clarify number of keys which will be learned.
General Key learning procedure:
1. Enter security access code and number of keys
2. Turn ignition ON (new or existing key)
3. Press button learn
4. Wait until is displayed adaptation finished
5. Remove key and turn ignition of with all remaining keys
Note: some of new cars needed to remains with ignition ON five minutes before starting of key learning procedure (Skoda Fabia 2006+, Skoda Roomster 2006+, Scoda Superb 2007+, VW Polo 2006+, Seat Ibiza 2006+)
NOTE: In every case if there some special requirements you will be notified in process of learning. For example for some models it is possible to learn key, which is NOT purchased from a dealer, and a question is asked to the customer for it. Also for some model you can learn a key, and all previously learned keys will remain active, and you will be notified too.
3.5.10 Special function “Dump Tool”
Using this application you can calculate security access codes, change odometer and s.o. This application need from EEPROM dump from corresponding unit. After the dump is load some modification will be made and you need to store the dump as new file, which you can program into the device.
4 VAG K+CAN Check
The “VAG K+CAN Check” is a tool which performs self-diagnostic of the USB dongle and interface.
It has two sections:
- Dongle check – performs self-diagnostic of the USB dongle
- Interface check – performs self-diagnostic of the USB interface
Pressing the “Detect” button from the dongle section performs detection whether the dongle is successfully read.
NOTE: This will not read the check the dongle data for inconsistency!
If you specify dump file in the “dongle section” and press the “Generate dump” then all dongle data will be read, and this file can be examined from the producer. This file should be send to the interface producer if there are problems with the interface, e.g. interface is not recognized, K-Line is not working or if requested from the producer.
NOTE: If you get error message “0×10001″ while running the “VAG K+CAN Commander” please send the dongle dump to “support@abritus72.com“
In the “Interface section” there is a possibility to perform detection of the interface – pressing the “Detect Interface” button checks for interface availability, firmware version and interface ID. You are able to perform also test of the K-Line, but this requires that the interface is connected to the OBDII since the K-Line requires 12V.
Also results from detection of the interface and K-Line test can be saved into file if “Dump file” field is entered and “Generate dump” button is pressed. This dump file should be send to the producer if there are problems with the interface recognition.
5 VAG K+CAN Update Request
The “VAG K+CAN Update Request” tool is dedicated to inform you which is the latest version which is released from the customer, and to allow you to request from him a compilation for your interface. The “VAG K+CAN Update Request” can be used also if you have problems when running the “VAG K+CAN Commander” as described in the “Troubleshooting” section.
Pressing “Check latest version” will connect through the internet to the producer homepage and will return you which is the latest released version.
If you want to receive this latest software, or if you have some problems as described in the “Troubleshooting” section, you should enter the “Request fields” and pressing the “Request” button.
NOTE: This requires that the dongle and the interface are connected to the PC. After the request is made a text file named “SW_Update_Req_xxxx.bin” is create, where “xxxx” is the number of your interface (2 or 4 digits). After the file is generated you will be prompted to send this file to the producer automatically. If don’t choice to send it you will need to send it manually by e-mail to update@abritus72.com.
6 Troubleshooting
Below you can find a list of typical problems and how to solve them:
Problem: When starting the “VAG K+CAN Commander” on the splash screen “Interface NOT
found” is displayed
Solution:
- Please be sure that the USB interface drivers are installed properly. You can look at the device manager, the USB interface should appear as “USB Serial Port (COMxx)” where “xx” is the number of the port
- If the interface is recognized OK, then please try to unplug and plug it again into the USB slot and restart the “VAG K+CAN Commander”.
- If the problem is still present, you can try to set the used port manually as follows:
o Start the “VAG K+CAN Commander” o Press the “Options” button
o Uncheck the “Autodetect” check-box and enter the number of the port from the device manager.
o The changes will take effect after restart of the “VAG K+CAN Commander”
NOTE: Please take into account that the used port will change when inserting the USB interface into different USB slots, so the setting the port manually should be repeat in this case.
- If the problem is still present, please run the “VAG K+CAN Check” and try to auto-detect the interface and generate a dump from the interface. Report for the problem to Abritus72 Ltd. with the included interface dump file.
Problem: When starting the “VAG K+CAN Commander” on the splash screen neither “Interface
found” or “Interface NOT found” is displayed
Solution:
- Please try to unplug and plug the dongle and the USB interface again into the USB slot and restart the “VAG K+CAN Commander”.
- If the problem is still present, please run the “VAG K+CAN Update Request” and request an update of your software. Please be sure that the version of the “VAG K+CAN Update Request” is at least 1.1 (displayed in the title bar when “VAG K+CAN Update Request” is started). Please specify in your mail what kind of problem you have when running the “VAG K+CAN Commander”.
Problem: When starting the “VAG K+CAN Commander” a message “Error code: 0×10001. Please
contact ‘support@abritus72.com’ with the Error code in the subject”
Solution:
- Please run the “VAG K+CAN Update Request” and request an update of your software. Please be sure that the version of the “VAG K+CAN Update Request” is at least 1.1 (displayed in the title bar when “VAG K+CAN Update Request” is started). Please specify in your mail what kind of problem you have when running the “VAG K+CAN Commander”.
Problem: When starting the “VAG K+CAN Commander” on the splash screen “Interface found”
is displayed, but is not possible to connect to device (especially through K-Line)
Solution:
Make sure that if you run the “VAG K+CAN Commander” from a shortcut the “working folder” is set to the folder where the “VAG K+CAN Commander” executable is placed.
Problem: The device connects sometimes to the device under K-Line, and sometimes not. Solution:
Try to increase/decrease the “Wakeup echo delay” timing parameter.
Problem: The connection with the device under K-Line is unstable. Solution:
Try to increase/decrease the “Inter byte time”, “Time between messages” and “Communication echo delay” parameters.
7 Appendix
7.1 Programming instrument clusters from Magneti Marelli (K-line diagnostic link)
7.1.1 Instrument cluster from Audi A3, Audi A6:
- Access this types of instruments using “Magneti Marelli direct”
- EEPROM is mapped as far as we know from address 0×3800 to address 0x3FFF (length 0×800 – 2048 bytes). But on some software version this may vary so we always read the whole memory area. For recognition where is mapped EEPROM can be number of immobilizer and VIN (AUZ… and WAUZ).
In order to extract the PIN and change the odometer please use the checksum calculator. The checksum calculator displays the login and the odometer, or you can extract the login by yourself:
1. In the EEPROM search for the Immobilizer number (AUZ…, WAUZ…). If the immobilizer number is found, then the login is the two bytes preceeding the immobilizer number.
| 00003B10 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |
| D00D3B20 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |
| 00003B30 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | 87 | 6F | ……………? |
| 00003B40 | 78 | 90 | FF | FF | FF | FF | FF | FF | 00 | 00 | FF | FF | FF | FF | FF | 00 | X…………… |
| 00003B50 | 00 | FF | FF | FF | FF | FF | FF | FF | 00 | 01 | 04 | I0D 2Bi | 41 | 55 | 5A | …………+AUZ | |
| 00003B60 | 35 | 5A | 30 | 41 | 58 | 58 | 58 | 58 | 58 | 58 | 58 | 11 | IE | 3B | 5A | 79 | 5Z0AXXXXXXX..;Zy |
| 00003B70 | 96 | B6 | 00 | FF | FF | 42 | 20 | 93 | 9D | 43 | 7F | FF | 30 | 42 | DE | B5 | …..В . .С. .0B. . |
| 00003B80 | 57 | 42 | 20 | E8 | 31 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | WB .1……….. |
| 00003B90 | FF | FF | FF | FF | FF | 04 | 0D | 2B | 41 | 55 | 5A | 35 | 5A | 30 | 41 | 58 | …….+AUZ5Z0AX |
| 00003BA0 | 58 | 58 | 58 | 58 | 58 | 58 | 11 | IE | 3B | 5A | 79 | 96 | B6 | 00 | FF | FF | XXXXXX..;Zy….. |
| 00003BB0 | 42 | 20 | 93 | 9D | 43 | 7F | FF | 30 | 42 | DE | B5 | 57 | 42 | 20 | E8 | 31 | В . .С. .0B..WB .1 |
| 00003BC0 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |
| 00003BD0 | 04 | 0D | 2B | 41 | 55 | 5A | 35 | 5A | 30 | 41 | 58 | 58 | 58 | 58 | 58 | 58 | ..+AUZ 5 Z 0AXXXXXX |
| 00003BE0 | 58 | 11 | IE | 3B | 5A | 79 | 96 | B6 | 00 | FF | FF | 42 | 20 | 93 | 9D | 43 | X. . ;Zy…..В . .С |
E.g. on the picture above the immobilizer number is AUZ5Z0AXXXXXXX and the login is “0D2B” in hexadecimal or 3371 in decimal
2. If the immobilizer number is not present, then the login is found somewhere in the region 0×0070-0x009F in the EEPROM. Starting from 0×0070 in the EEPROM (i.e. 0×3870 in the memory area) there should be a long sequence of 0xFF (e.g. about 7-8 bytes of 0xFF). The first two bytes which are not 0xFF should be the login.
| 00003800 | fcT FF FF FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | |||
| 00003810 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF |
| 00003820 | FF | FF | FF | FF | FF | FF | FF | FF | EA | 00 | 01 | 18 | IF | CC | FF | FF |
| 00003830 | FF | EA | D6 | 01 | FD | CI | IE | FF | FF | FF | IE | FF | FF | FF | IE | FF |
| 00003840 | FF | FF | 06 | 06 | F9 | FF | FF | FF | 10 | 00 | 47 | 45 | 36 | 35 | 54 | 54 |
| 00003850 | 31 | 30 | 30 | 30 | 31 | 10 | FF | FF | FF | FF | FF | FF | FF | FF | FF | 23 |
| 00003860 | 07 | 23 | 03 | 02 | 00 | 00 | IE | 00 | 32 | 20 | 00 | 00 | 02 | 00 | 32 | FF |
| 00003870 | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF | FF |
| 00003880 | FF QT4 7F]00 | 01 | OF | 14 | FB | 00 | 00 | 02 | 00 | FF | FF | FF | FF | |||
| 00003890 | FF | FF | FF | FF | 03 | 6D | FF | FF | FF | FF | FE | 63 | IB | FF | FE | 63 |
| 000038A0 | IB | FF | FE | 63 | IB | FF | FE | 63 | IB | FF | FE | 63 | IB | FF | FE | 63 |
……….GE65TT
10001 ……….#
.#……2 ____2.
…m. . , . с . . . с ,
. с, . с,
. с . с
E.g. on the picture above starting from address 0×0080 of the EEPROM there are 17 bytes with 0xFF, then follows the login which is 0x047F in hexadecimal or 1151 in decimal.
The odometer is changed as follows:
1. The “Instrument Cluster Mangeti Mareli – Direct” should be selected as cluster type and press “Read” button -> whole memory area is read.
2. Store the memory area to file, then extract the EEPROM area from 0×3800 to 0x3FFF and save it to another file.
3. Open the EEPROM file with the checksum calculator (the dongle for the interface should be also inserted), set the mileage and store back the EEPROM file
4. Put the EEPROM data back into the file with the whole memory area.
5. Open the file with the so changed memory area into the commander and press the “Write” button -> you will be asked for EEPROM start address and length in order to write only the EEPROM. Default values are 0×3800 and 0×800, so simple press OK.
7.1.2 Instrument cluster from Audi TT-K
- First try to access the instrument as “Magnet Marelli direct” (especially for year 2000+) and if succeeded proceed as described above
- If not succeeded select type “Magneti Marelli – Shadow 3 (TT)” and read EEPROM. Currently for the software versions we know the login can be located as described above, and the odometer starts from address OxAA to address 0×1 C8 (marked on the picture below).
| 00000000 | 00 | id | 00 | 17 | 00 | oa | 00 | oa | 00 | ob | 00 | ob | 00 | ос | 00 | od |
| 00000010 | 00 | oe | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
| 00000020 | ff | ff | ff | ff | ff | ff | ff | ff | ea | 00 | 03 | 78 | 00 | 2b | ff | ff |
| 00000030 | ff | ff | ff | ff | ed | 9b | ff | f9 | ff | ff | ff | ff | ie | ff | ie | ff |
| 00000040 | ie | ff | 39 | 69 | c6 | 96 | 58 | 58 | 58 | 58 | 58 | 58 | 58 | 58 | ff | ff |
| 00000050 | 06 | 06 | ff | ff | ff | ff | 10 | 00 | 58 | 58 | 58 | 58 | 58 | 58 | 58 | 58 |
| 00000060 | 58 | 58 | 58 | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
| 00000070 | 09 | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
| 00000080 | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
| 00000090 | ff | ff | id | eb | 00 | 04 | of | 00 | ff | ff | ff | ff | ff | ff | ff | ff |
| 000000a0 | ff | ff | ff | ff | ff | ff | 03 | 6b | ff | ff | ff | |ff | ff | fe | 37 | ff |
| 000000b0 | fe | 35 | 17 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| ooooooco | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 000000d0 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 000000e0 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 000000f0 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 00000100 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 00000110 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 00000120 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf |
| 00000130 | ff | fe | 37 | bf | ff | fe | 37 | bf | ff | fe | 37 | bf | 00 | 01 | c8 | 40 |
| 00000140 | 00 | 01 | ca | e8 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 00000150 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 00000160 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 00000170 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 00000180 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 00000190 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 000001a0 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 000001b0 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 |
| 000001c0 | 00 | 01 | c8 | 40 | 00 | 01 | c8 | 40 | 00 | 01 | c8| | 40 | ff | od | 85 | ff |
| 000001d0 | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
| 000001e0 | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff | ff |
The odometer consist of two blocks – 0×90 bytes the inverted odometer, followed by 0×90 bytes the real odometer. For this type of instrument software we recognize the odometer and login automatically and it is possible to change the odometer directly from the “Change” button.
7.1.3 VW Passat – usually this Instruments are before year 1998
- First try to access the instrument as “Magnet Marelli direct” (especially for year 2000+) and if succeeded proceed as described above
- If not succeeded select type “Magneti Mareli – Shadow 2 (Passat)” and read EEPROM. The login is displayed; odometer is displayed as “0″, but can be changed. When the “Change odometer” button is pressed a dialog appears, where the current and the new odometer values should be entered.
7.1.4 VW Beatle
- First try to access the instrument as “Magnet Marelli direct” (especially for year 2000+) and if succeeded proceed as described above
- If not succeeded select type “Magneti Mareli – Shadow 1″ and read EEPROM. The login is not displayed. The odometer is displayed as “0″, but can be changed. When the “Change odometer” button is pressed a dialog appears, where the current and the new odometer values should be entered.
7.2 Porsche Cayenne/VW Touareg gasoline engines – ECU wakeup fuses
Porsche Caynne – fusebox
7.3 Audi A8 fusebox (passenger side – wakeup ECU):
Version 2.2 51
Hello
It is not possible to determine whether these events are related directly to these medicines or to other factors. If you experience any of these symptoms, stop taking PDE5 inhibitors, including LEVITRA, and call a doctor right away.
Pa!!!
____________________________