Free key pairing - KW1281Test program

[grayjay]

Follow-up from a post I left on another thread as the KW1281Test program definitely deserves its own B6 thread, Ive not seen it previously discussed here.

I don't have VCDS to perform key adaptation, I don't really want to buy it and I was thinking it might be possible to use Vag K Commander for key adaptation instead. Here is what I found;

I previously had a spare key cut and a new virgin RFID chip, wanted to get it adapted to my immobilizer-on ECU. I connected Vag K Commander, read the ECU/Cluster SKC and then tried using the programs KEY LEARNING feature. I first re-paired my original (working) key and then added the new key. It was successful with pairing the new virgin RFID chip to the ECU immobilizer, car would start and run with the new key which previously caused ECU immobilizer to shutoff engine after 2 sec of starting. The gotcha catch is that Vag K Commander does NOT also pair the new key to the clusters (separate) immobilizer! The car will run and drive with just the ECU immobilizer working, but the cluster immobilizer causes the hazard lights to flash and the climate control system to lockup in SAFE mode. Same thing happens if trying to to use the new unpaired key with the ECU immobilizer turned off, there does not seem to be any way I can find to separately turn the cluster immobilizer off.

I next discovered a free command line program called kw1281test. More on this program at;

https://github.com/gmenounos/kw1281test/wiki
https://fiddly.net/mk4/mk4-vw-key-coding.html (key adaptation instruction for muggles)
https://forums.tdiclub.com/index.php...native.509151/ (5 years of forum postings)

Bottom line, this free open source program 100% works to pair new keys to a B6 immobilizer system (ECU AND Cluster)!

Pre-compiled distributions of the program are available so you do not need to mess with compiling it yourself from Github, just download appropriate version for your OS from
https://github.com/gmenounos/kw1281test/releases/ (I used kw1281test_0.99.9-beta_Win10.zip , works fine on the older windows 8.1 laptop I use for flashing)

This is a command line program, no GUI (yet) so you need to know the basics of running command line program, changing directory (CD), and entering commands. Pretty good instructions at https://fiddly.net/mk4/mk4-vw-key-coding.htm but note that these are written specific to using with apple OS and for a VW, if you are on windows or linux it will be slightly different. For Windows, you do not need to enter cable SN, just enter the COM port your cable is using (COM2, COM3, or whatever).

I first tried running the GetSKN command to test and it did not initially work. It communicated with the cluster, just did not work to return the SKC. The suggested command line code I first used that did NOT work was;

KW1281Test COM3 10400 17 GetSKC

edit- figured out from https://forums.tdiclub.com/index.php...1/post-5752784
Using just the the above GetSKC command to cluster works for VW's without encrypted instrument cluster. Our A4 B6 model RB4 instrument cluster is encrypted so the file cannot be read without first putting the cluster into "New Mode". Then, KW1281test can read the SKC (unencrypted) and afterwards you need to put the cluster back into "Adapted Mode" before re-starting the car. This can all is done by running the following 3 command lines, one after another;

kw1281test COM3 10400 17 ToggleRB4Mode
kw1281test COM3 10400 17 GetSKC
kw1281test COM3 10400 17 ToggleRB4Mode

This command sequence provides a quick and easy way for pulling the SKC from the cluster, rather than using separate Vag K Commander program to get SKC from the ECU Eeprom as is often suggested.

KW1281test GetSKC command apparently can find the SKC on the TDI diesel EDC15 ECU (module 1), but the location within ECU EEPROM where it is stored is different for Audi ME7.5 ECU and the command cannot resolve that. Explanation of how to read SKC directly from an Audi ECU EEPROM .bin displayed in a Hex editor can be found within https://sites.google.com/site/imnuts/home , (at .bin address 32 and 33). Similarly for a decrypted cluster .bin, the SKC hex bits can be found at address 46 & 47.

To read the ECU EEPROM.bin file, Nefmoto command line EEPROM program ME7_95040 can be used to read the EEPROM.bin file from the ECU over the OBDII port
http://nefariousmotorsports.com/foru...c=1168.0title=
once you have a read of the EEPROM.bin you can then use a separate program EEPROMTool_04 to display info from the .bin,
get SKC from ECU, turn ECU immobilize off/on, change VIN and other EEPROM functionality for ECUs and Clusters;
http://nefariousmotorsports.com/foru...p?topic=6134.0
or https://github.com/turboat/eepromtool/releases/

For key adaptation, the KW1281test Key adaptation command that worked perfectly to re-adapt my old key and add one new key was;

KW1281Test COM3 10400 17 AdaptationSave 21 2 01111
(syntax is: using cable on windows COM3, 10400 baud rate, module 17 (cluster), writing to module channel 21, it adapts 2 keys, logged in with example SKC 01111)

My one clarification of the key adaptation instructions for the "Fiddy" website; the key adaptation did not work first time I tried because after I sent the command, I left the original key on and in the ignition for too long, adaptation sequence started before I removed and replaced the first (original) key. It was necessary to send the command and then fairly quickly turn ignition off, remove first key and replace it back in ignition and turn 1 click to run (not start) position. The KW1281Test program takes a few seconds from time the command line is issued to re-connect to the ECU and it expects to have the key removed (ignition off) and then replaced and find it turned back to run position when it re-connects. After couple of seconds, the instrument immobilizer icon will turn off and then you need to remove first key, insert next key (turned to ON) and it will find and adapt it next. There are no program prompts explaining what to do with the keys so no need to wait, just change out key(s) after the previous key has finished and instrument immobilizer turns off.

KW1281Test has a bunch of other commands available, looking forward to trying out more features.

[ye1low]

Great info!! Thank you for sharing. This should stickied to the "Tech Archives" for future reference.

[rollerton]

Any chance you want to try this on a Rb8 / B7 cluster? Probably a long shot, but querying the ECU for the pin seems like the only way we'll ever get to pair keys on those.

[grayjay]

It does look as if KW1281test program was developed to work with RB8 clusters.

Here is one testimonial of RB8 key adaptation;
http://nefariousmotorsports.com/foru...=20859.0title=

However, in the following thread from user TR7, they were unable to get KW1281test working with a B7 due to its use of CANBUS rather than K-line. T̶h̶i̶s̶ m̶i̶g̶h̶t̶ o̶n̶l̶y̶ b̶e̶ a̶ p̶r̶o̶b̶l̶e̶m̶ i̶f̶ y̶o̶u̶ t̶r̶y̶ t̶o̶ u̶s̶e̶ K̶W̶1̶2̶8̶1̶t̶e̶s̶t̶ i̶n̶s̶t̶a̶l̶l̶e̶d̶ i̶n̶ a̶ B̶7̶ c̶h̶a̶s̶s̶i̶s̶, p̶o̶s̶s̶i̶b̶l̶y̶ m̶i̶g̶h̶t̶ s̶t̶i̶l̶l̶ w̶o̶r̶k̶ i̶f̶ t̶h̶e̶ R̶B̶8̶ c̶l̶u̶s̶t̶e̶r̶ i̶s̶ i̶n̶s̶t̶a̶l̶l̶e̶d̶ i̶n̶ B̶6̶ o̶r̶ c̶o̶n̶n̶e̶c̶t̶e̶d̶ o̶n̶ b̶e̶n̶c̶h̶?̶ Edit-no, still does not work due to CANBUS of B7 cluster.
https://forums.tdiclub.com/index.php...1/post-5794657

KW1281 has a specific command for reading RB4 and RB8 cluster EEPROM. Early version of the software just worked with RB8 and command was "DumpRB8Eeprom" but on newer versions the software author included support for (decrypted) RB4 and changed the command to "DumpRBxMem"
https://forums.tdiclub.com/index.php...4#post-5625344
Note the command arguments suggested here for address and file length needed to read an RB8 suggested as;
KW1281Test.exe COM1 10400 17 DumpRBxMem $10400 $400 (note- I think these arguments might need to be different for an RB4??)

If you just need to retrieve SKC from an RB8 you probably do not need to do an entire Eeprom dump, the "GetSKC" command is supposed to work on RB8 after decrypting;
https://forums.tdiclub.com/index.php...1#post-5673364
Command instructions specific for decrypting and reading RB4 and RB8 clusters are at https://forums.tdiclub.com/index.php...5#post-5752784

If you need any help getting kw1281test to work, feel free to ask for more clarification. Definitely watch some youtube instructions for running command line programs if you are unfamiliar with that process. The software author also seems to be fairly responsive to answering questions in the TDIClub forum and would be an even better resource for more complex questions.

As mentioned in my first thread, I did successfully use the GetSKC and Adaptation commands to pair keys to my stock RB4 cluster B6. Unfortunately, I was unable to get it working to read SKC or DumpEeprom directly from the ECU (module 1) instead of from cluster (module 17). This command was developed to work for the TDI EDC15 ECUs but apparently is not supported for gas ME7 ECUs with different storage location for SKC within the ECU EEPROM.

[grayjay]

Looking at this further, per thread;
https://www.audizine.com/forum/showt...ighlight=95040

Not all RB8 clusters use the same immobilizer. RS6 used a RB8 cluster with same immo3 as used in B6 and so can be paired with a B6 immo3 ECU. The B7 cars had immo4 system and is not compatible with immo3 so cannot be used with a B6 ECU, even if you change the SKC to match.

[grayjay]

One other use for KW1281test program is pinging (and possibly reading?) other chassis and drivetrain modules using command line syntax;

KW1281Test PORT BAUD ADDRESS COMMAND

PORT = COM1|COM2|etc. (Windows)
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND = ReadIdent (connects to the module specified in ADDRESS and returns the module identity)

possible generic audi module addresses (not all will be present on a B6) you can try to ping are ;

01 – ECU
02 – Automatic transmission
03 – ABS brakes
04 – Steering angle
05 – Ignition authorization
06 – Passengers seat memory
07 – Control head
08 – Automatic heat, ventilation, air condition
09 – Central electronics
0B – Secondary air heater
0D – Left sliding door
0E – Media player 1
0F – Digital radio
10 – Parking/steering assist
11 – Engine electronics 2
12 – Clutch
13 – Auto Dist. Reg
14 – Suspension electronics
15 – Airbags
16 – Steering wheel
17 – Instrument Cluster
18 – Auxiliary heating
19 – CAN getaway
1B – Active steering
1C – Position sensing
1D – Driver identification
1E – Media Player 2
1F – Satellite tuner
21 – Engine electronics 3
22 – AWD
23 – Brake booster
24 – Antislip (ESP)
25 – Immobilizer
26 – Electrical sunroof
27 – Control head rear
28 – HVAC rear
29 – Left light
2B - Steering Column Lock
2D – Intercom
2E – Media Player 3
2F – Digital TV
31 – Engine
32 – Differential locks
34 – Level control
35 – Central locks
36 – Drivers seat memory
37 – Navigation
38 – Roof electronics
39 – Right light
3C – Side assist
3D – Special function
3E – Media player 4
41 – Diesel fuel pump
42 – Driver door electronics
43 – Brake assistant
44 – Steering assistant
45 – Interior monitor
46 – Central convenience
47 – Sound system
48 – Rear seat drivers side
49 – Auto light switch
4B - Multifunction Module
4C – Tire pressure 2
4D – Data transfer
4E – Control head right rear
4F – Central electronics 2
51 – Electric drive
52 – Passenger door electronics
53 – Parking brake
54 – Rear spoiler
55 – Xenon range
56 – Radio
57 – TV tuner
58 – Auxiliary fuel tank
59 – Tow protection
5C – Lane assist
5D – Operations
5E – Control head left rear
5F – Information electronics
61 – Battery regulator
62 – Rear left door
63 – Entry assist driver
64 – Stabilizers
65 – Tire pressure
66 – Seat & mirror adjustment / seat rear
67 – Voice control
68 – Wipers electronics
69 – Trailer
6C – Rear view camera
6D – Trunk electronics
6E – Control hear roof
6F – Central convenience 2
71 – Batter charger
72 – Rear right door
73 – Entry assist passenger
74 – Chassis control
75 – Emergency call / Telematics
76 – Parking aid
77 – Telephone
78 – Right slide door
7D – Auxiliary heater
7E – Control head dashboard
7F – Information electronics 2
8107 - Antenna
811E - Burglary Protection FL
811F - Burglary Protection FR
8120 - Burglary Protection RL
8121 - Burglary Protection RR
82 - Heads Up Display
8C - Hybrid Battery
91 – Engine
92 – Transmission
93 – Immobiliser
94 – Airbag
95 – ESP
96 – Instruments
97 – Trip recorder
98 – Tire pressure
99 – Ignition switch
9A – Central locks
9B – Driver door
9C – HVAC
9D – Auxiliary heater (fuel)
9E – Auxiliary heater (electric)
9F – Stationery heater (water)
A0 – Radio
A1 – Navigation
A2 – CD changer
A3 – Telephone
A5 - Front Sensor Driving Assist
B0 – Roof display
B1 – Upper console
B2 – Park assist
B3 – Trailer module
B4 – Central electronic
B5 – Special function
B6 – Steering wheel
BD - Hi-voltage battery charger
C6 - Battery Charging
D6 - Light Control Left 2
D7 - Light Control Right 2

[grayjay]

Full list of all available KW1281test commands with a few B6 useage notes from me;

Usage: KW1281Test PORT BAUD ADDRESS COMMAND [args]
PORT = COM1|COM2|etc. (Windows)
/dev/ttyXXXX (Linux)
AABBCCDD (macOS/Linux FTDI cable serial number)
BAUD = 10400|9600|etc.
ADDRESS = The controller address, e.g. 1 (ECU), 17 (cluster), 46 (CCM), 56 (radio)
COMMAND =
ActuatorTest
AdaptationRead CHANNEL [LOGIN]
CHANNEL = Channel number (0-99)
LOGIN = Optional login (0-65535)
AdaptationSave CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
AdaptationTest CHANNEL VALUE [LOGIN]
CHANNEL = Channel number (0-99)
VALUE = Channel value (0-65535)
LOGIN = Optional login (0-65535)
AutoScan
BasicSetting GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
ClarionVWPremium4SafeCode
ClearFaultCodes
DelcoVWPremium5SafeCode
DumpEdc15Eeprom [FILENAME] (Only works with TDI diesel EDC15 ECU)
FILENAME = Optional filename
DumpEeprom START LENGTH [FILENAME] (Only works on the B6 encrypted RB4 instrument cluster after running command ToggleRB4Mode to decrypt)
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
LENGTH = Number of bytes in decimal (e.g. 2048) or hex (e.g. $800)
FILENAME = Optional filename
DumpMarelliMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 3072) or hex (e.g. $C00)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
DumpMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRam START LENGTH [FILENAME]
START = Start address in decimal (e.g. 8192) or hex (e.g. $2000)
LENGTH = Number of bytes in decimal (e.g. 65536) or hex (e.g. $10000)
FILENAME = Optional filename
DumpRBxMem START LENGTH [FILENAME]
START = Start address in decimal (e.g. 66560) or hex (e.g. $10400)
LENGTH = Number of bytes in decimal (e.g. 1024) or hex (e.g. $400)
FILENAME = Optional filename
FindLogins LOGIN
LOGIN = Known good login (0-65535)
GetSKC (Only works on the B6 encrypted RB4 cluster after running command ToggleRB4Mode to decrypt, does NOT work for ME7 ECU EEPROM)
GroupRead GROUP
GROUP = Group number (0-255)
(Group 0: Raw controller data)
LoadEeprom START FILENAME
START = Start address in decimal (e.g. 0) or hex (e.g. $0)
FILENAME = Name of file containing binary data to load into EEPROM
MapEeprom
ReadFaultCodes
ReadIdent
ReadEeprom ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadRAM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadROM ADDRESS
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
ReadSoftwareVersion
Reset
SetSoftwareCoding CODING WORKSHOP
CODING = Software coding in decimal (e.g. 4361) or hex (e.g. $1109)
WORKSHOP = Workshop code in decimal (e.g. 4361) or hex (e.g. $1109)
ToggleRB4Mode (flips status of RB4 instrument cluster EEPROM, run first before reading or dumping cluster, then run again to reset to Adapted (encrypted) mode)
WriteEdc15Eeprom ADDRESS1 VALUE1 [ADDRESS2 VALUE2 ... ADDRESSn VALUEn]
ADDRESS = EEPROM address in decimal (0-511) or hex ($00-$1FF)
VALUE = Value to be stored at address in decimal (0-255) or hex ($00-$FF)
WriteEeprom ADDRESS VALUE
ADDRESS = Address in decimal (e.g. 4361) or hex (e.g. $1109)
VALUE = Value in decimal (e.g. 138) or hex (e.g. $8A)

[sputnik378]

This is very interesting. Let me make sure that I'm following correctly.

Does this mean that using kw1281test would enable me to use a purchased key from anywhere? Does it have to be cut to my car before I pair it?

Seems too easy, what's the catch?

[grayjay]

Spitnik-
kw1281test basically just replaces the need for having VCDS to adapt the key, with additional benefit that it can also read the SKC (from cluster) which VCDS will not perform.

An uncut key blank will not insert into the ignition, the cut slot is needed to allow it to insert so you would need to get a key blank cut first before running the adaptation. What the adaptation does is to perform the first one-time pairing of the new/virgin IP48 RFID chip to the immobilizer. Used keys previously adapted to a different immobilizer cannot be adapted to work with another car.

For $18 you can get an uncut key blank, virgin ID48 RFID chip and new plastic case;
https://www.amazon.com/NPAUTO-Replac...BDFS56CC&psc=1

Get the key blade cut at a locksmith and the chip adapted to your car with kw1281test and you will have a spare second key that will start and run the car without setting off the ECU or cluster immobilizers.

The slight catch is that 2003-2005 B6 needs a FOB remote to lock/unlock doors with part number; 8Z0 837 231 F, the cheap amazon FOB (above) unfortunately is 8Z0 837 231 E and will not work to remote open doors on a B6. (2002 used an entirely different FOB). I searched for a reasonably priced new replacement 8Z0 837 231 F FOB but I was unable to find one that was < $100. Unlike some of the other VAG FOB numbers, 8Z0 837 231 F seems to have minimal aftermarket support for replacement options. Rather than buying a new OEM FOB, I just went on EBAY and for less than $20 I bought a used 8Z0 837 231 F key & FOB. Snap it apart, throw away the top half with used key and immobilizer chip, snap the used FOB bottom half to the new top half key & IP48 chip to make a functional door FOB and ignition key assembly. Note that pairing the FOB door remote transmitter is a completely separate and electronically unrelated process from adapting the key and ID48 chip to immobilizer. Amazon also list replacement FOB case shells and key blanks without the "E" door remote transmitter electronics board included for slightly less cost but these do not include the ID48 chip needed for immobilizer so easier to just order the cheap but wrong "E" transmitter board and then replace it. (Or order the ID48 chip separately)

Rather than sourcing the 8Z0 837 231 F door FOB for the B6, another pathway to a new key would be to use a compatible A4 B7 FOB per thread;
https://www.audizine.com/forum/showt...ob-for-B6-DIY/
Either get a new B7 FOB with a virgin ID48 chip and blank key blade, or buy a used one and replace the IP48 and key blade. The A4 B7 remote that works to with the 2003-2005 B6 CCM module is audi part 8E0837220R, FCC ID MYT4073A. I cannot tell if the B7 key ID48 chip is identical to the B6 chip, so you might need to source a new ID48 chip either way.