Home

Manual for 3530044

1. 00000070 56 57 5A 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZODOOCOOOOVW OoooooBO S 43 SA 30 30 30 30 30 30 30 30 30 55 57 SA 43 ZCZOOOOOCADOVWZC 30 30 30 30 30 30 50 30 57 56 57 Sa Sk SA ZO00000000WYUZZZ SA 36 50 31 31 31 31 31 31 57 56 57 SA SA SCZ6PL1111 Wye 43 5A 36 50 51 31 3L 31 31 31 57 56 57 SA Z3CZ6PI IL LIWWZ 33 43 54 36 50 31 3L 31 31 31 31 00 00 00 ZZ3CZ6P 1111118 37 30 31 30 30 33 47 39 30 36 30 31 38 Z0 7010036906015 on 00 00 00 AF 50 AF 50 AF 50 96 ZA 85 48 centiePebaks Pe F4 58 65 51 64 95 80 3B 81 09 SL 08 83 SE vi 0 7 N 15 74 80 DE 30 30 33 47 39 30 36 30 31 D s QO3G9U601L w F an O S D we pa A io DD HOOOGOEO S 000DOODO TC 7 m S 3 t a a t W on NM 2 tn ww mon to oO Ww ECU Magneti Marelli Security Access Code 95320 Required license AN003 This function displays the security access code contained into the engine control unit from Magneti Marelli Dump Tool E x Save dump 00000090 30 33 45 39 30 36 30 32 34 48 20 20 30 31 31 38 O8C906024H 0113 COOONIAD 00 00 00 00 00 0O OO 00 00 00 00 OO 00 NO OO OO LL ee ee eee eee HODOOOBN 00 DD OO 00 00 00 00 00 55 AA 35 EC 50 90 09 08 U 5 P OOOOGOEO 38 00 06 04 07 28 D8 SF 27 70 FF FF OD 00 00 FE 6 ars DOUOQODO FF FF RF FF FF OFF FF FF FY FF FF OFF FE YY FF IN er ren COONOOED 01 GO 03 0D AB 55 38 10 13 73 JC SC CC 42 00 OO 08 8 B DOOOIIFD 10
2. 20 bit coding C Long coding Byes Coana dota rend 3 4 10 Basic settings Basic settings will expect from you to enter a number of the group and to press the button ON or OFF 3 4 11 Actuator test Available are two types of tests Selective and Sequential In the selective test you have the possibility to enter a test code manually or to select it from a list box When a test is selected you just need to press Start Output test D xj Choose test Selective test mode Selective test Enter output code Test code C Sequential iest Select output Cancel test END of selective output test Bulb far Daytime Running Light Lett 3 4 12 Reset of the unit Reset will request from the unit a SW reset Not all electronic control units support this service Please note that it is not available in all diagnostic sessions 3 4 13 Custom requests Using this function the user can send manually diagnostic requests to the corresponding unit The example below shows a request for identification of an Instrument Cluster ECU Custom requests xj Request Trace list 1A 9B 5A 9B 34 46 30 39 31 30 39 33 30 41 20 20 30 36 33 30 03 20 3E SE 38 DE 2B 67 4B 4F 4D 42 49 49 4E 53 54 52 ZE 20 4D 37 33 20 36 3 4 14 Program VIN Program VIN requests the stored in the device VIN and tries to change it Not all electronic con
3. 3 5 12 Special function Dump Tool Using this application you can calculate security access codes change odometer and so on This application needs the EEPROM dump from the corresponding unit After the dump is loaded some modification will be made and you need to store the dump as a new file which you can program into the device For more details about the concrete functions please refer to the appendix 3 5 13 Special function Service Interval Using this application you can perform reset of the service reminder reset of the service interval parameters or change service interval options With the opening of the special function window the commander will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have enabled Service reminder reset or and Service interval reset or and Change service options sections Together with these sections in the section Applicable adaptation channels you will see the adaptation channels which values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed column New value of the Applicable adaptation channels table will be automatically filled with the default values tha
4. ABRITES Commander for VAG Commander 8 6 User Manual www ecutool com Email amp MSN info sinosells com 1 INTRODUCTION Abrites VAG Commander is a Windows PC based diagnostic software for the vehicles from VAG With the help of this tool you can perform operations with vehicles from the VAG group which are in most cases unsupported from the producer diagnostic testers The Abrites VAG Commander provides you also a full diagnostic capabilities for VAG vehicles 2 INSTALLATION Your set consists of one interface USB to OBDII Optionally you might have a programmer which is connected either to the USB port of the PC or to the interface USB to OBDII 2 1 Installing USB Interface drivers The drivers are installed automatically when installing the software In case of some problem with the drivers you might download latest drivers from www ftdichip com 2 2 Uninstalling USB Interface drivers In case the installed USB drivers are corrupted and or stop work properly your USB Interface is not recognized by the PC you can try to fix the problem by uninstalling and then reinstalling them for to start over with a clean slate Uninstalling USB interface drivers can be done by running the FTClean program You can find it in the USB Interface Drivers sub folder of your ABRITES Commander or download it from the Internet using the following link http www ftdichip com Resources Utilities F TClean zip The following is
5. No more applicable Use procedure 3 instead 3 5 11 5 Procedure 5 No more applicable Use procedure 3 instead 3 5 11 6 Procedure 6 for Audi A4 RB8 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require a different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason a different procedure is used You need to choose from Special functions Key learning Audi A4 2004 RB8 Instrument Cluster KW2000 The following buttons will be available Key learning xl Vehicle model Audi A4 2004 ABS Instrument Cluster K w2000 Login Security code 0 No login code is need for the key leaming x You have to put only the number ol the keys which will be adapted Procedure 6 S Audi vehicles equipped with instrument cluster BOSCH RBS with integrated immobilizer require different i key leaming procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason separated procedure is used The Key leaming procedure goes in the following steps 1 Learning dealer key purchased by VIN number IF you have dealer key purchased by VIN number you ve to put the number of keys to be programmed and to press the Leam button Before the procedure is finished on the display of the instrument it is displayed LF xy where x is number of successfully learned ke
6. ooooooin aa ad YYY LT Immobilizer 00090020 AA A4 White immobilizer box Audi A4 AG A8 00000030 AA i Black immobilizer box Siemens 6 PIN HCOS Immo1 onsacee ak a Black immobilizer box Siemens 6 PIN HCO5 2400 IImmol coooa0so aa ag Black immobilizer box Siemens 6 PIN TMS imme 00000070 A amp A U0009080 AA i Instrument Cluster Audi A4 B5 without Board Computer 1997 Aead 00009050 AA Ad instrument Cluster Audi AB 10 1996 ROA write l Reset ECU CoooDAD AA lt icoonocno aa ginstrument Cluster Audi A8 11 1996 coooooco aa ajinstrument Cluster Audi Ab B45 1997 coooocDo AA Adinstrument Cluster Magneti Mareli Shadow I Negi Fany 00000DE0 Ag goooooord cr 00000100 oc 00000110 CS 00000120 DO D 00000130 00 00000140 nd go000150 EO SF km Odometer a on000180 DA 00000190 BE 00000140 00 00 00 00 00 00 54 00 SF 05 ZD 05 00 DO OO OD Ts ess 0000OIEO DO 00 00 OO 54 00 CD 02 00 50 4 00 S4 DO EB 02 T TT v of 7 Skip nag responses For the most of instrument clusters is implemented automatic parsing of data from the EEPROM odometer immobilizer For instrument clusters from Magneti Marelli please refer Appendix A NOTE Sometimes if you try to access the instrument cluster by selecting the wrong type the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnectin
7. C All bytes of the component protection data component security are know r Program transponder from 7 bytes Eorporient 0 Q f j 0 0 N protector brutes Find the 7th byte of the component protection data r Find 7th byte and program transponder en Component i 3a 3d de a8 b6 EP Program protection bytes Automatcial trying of the 7 byte Manual trying of the 7 byte Av Passat BB CC Key with TAH transponder in ignition Value for the autorization read by daignostic programmer over key Exit The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are stored always at least 6 of the component protection bytes sometimes also the 7 byte is contained There are several ways to extract the component security Simply press the Autodetect component security and the component security bytes will be read from the ECU This will also automatically decide whether you ve the 7 byte or you ve to search for it Also the login will be displayed in the status bar The autodetection is not always possible it works basically for EDC16 and MED9x engines which are using CAN diagnostic connection The component protection bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit
8. OBDII Pin 14 lt gt CAN H forange brown OBDII Pin 4 lt gt GND metal part of the car Unlock Vw Passat Unlock Vi EOS Unlock Audi A3 Unlock Audi A4 So for any of the desired model you ve to press the appropriate button ATTENTION In the most cases this only opens the doors It doesn t disable the alarm 4 ABRITES VAG Check The ABRITES VAG Check is a tool which performs self diagnostic of the USB dongle and interface Hne YAG K CAN hardware check x m Dongle check Dump file E Interface check Detect Interfaces Include K Line test id ee It has two sections Dongle check performs self diagnostic of the USB dongle Interface check performs self diagnostic of the USB interface Pressing the Detect button from the dongle section performs a detection whether the dongle is successfully read NOTE This will not check the dongle data for inconsistency If you specify a dump file in the dongle section and press the Generate dump button then all dongle data will be read and this file can be examined from the producer This file should be sent to the interface producer if there are problems with the interface e g interface is not recognized K Line is not working or if requested by by producer In the Interface section there is a possibility to perform a detection of the interface pressing the Detect Interface button checks for interface avai
9. displays the login and changes odometer No license required Audi A3 A4 A6 UKNSI Japan odometer and login code 93LC56 displays the login and changes odometer No license required Audi 100 VDO 1995 odometer 94C46 changes odometer No license required Golf 3 VDO 1995 odometer 93C46 changes odometer No license required Golf 3 VDO V3 9 odometer 93C46 changes odometer No license required Golf 3 Diesel odometer 93C46 changes odometer No license required Golf 3 Motometer V5 8 odometer 93C56 changes odometer No license required Polo Motometer odometer 93C46 changes odometer No license required Polo Motometer 1996 odometer 93C66 changes odometer No license required Passat VDO 1991 odometer 93C56 changes odometer No license required Passat VD202 1993 odometer 93C46 changes odometer No license required Passat GT odometer 93C46 changes odometer No license required Passat GT odometer 93C56 changes odometer No license required Caddy odometer 93C56 changes odometer No license required Corrado VDO 1993 odometer 93C46 changes odometer No license required Corrado MotoMeter 1991 1995 odometer 93C56 changes odometer No license required Corrado VDO 1991 1995 odometer 93C56 changes odometer No license required Jetta 1994 1996 odometer 93C46 changes odometer No license required T4MotoMeter 1
10. 04 57 56 47 5A 5A 5A 31 54 5A 34 57 233 WVYGZZZITZAU Read 00000020 30 39 32 32 33 33 46 09 20 09 FB DA BD FD 8D 6F 092233 o 00000030 C ZB DA 00 14 20 DO FE FS FE A OB OD 78 FF FF assena Mens 00000040 FF FF FF FF FF FF FF FF Fl 01 06 22 Ol 11 VE O03 Ain le 00000050 56 57 SA 37 5A 30 43 38 36 39 32 32 33 33 BE OB Wz27Z0C5692233 00000060 89 2A 70 67 ES 12 DB 67 FF FF FF FF FF FF FF FF pg q e e 00000070 FO OF FF FF FF FF FF FF FF FF FF FF FF FF FF FF onen nennen 00000080 FF FF 04 40 44 54 GDT Save VIN WVGZZZITZ4W092233 W GZZ21TZ4w092233 Z Update dump Serial number VwZ7Z008692233 m Transponder identificators Serial key bdid8d6te72bda KeylD1 892a7067 KeylD5 MAC tbda0d78 KeylD2 e81 2db67 KeylD6 Status 2000fef6fe KeylD3 KeylD7 Configuration f 0106220111 KeylD4 KeylD8 m PIN 2336 Program data in ECU EDC16 AMED 3 Restore IPCAmmobilizer to VIRGIN state Pressing the button Read will read immobilizer related data Pressing the button Write will program data from the HEX screen if the Update dump checkbox is NOT selected or from parsed data area if the above checkbox is selected Same data can be programmed in the EEPROM of the engine control unit From this dialog also is available function to reset immobilizer in virgin delivery condition where is allowed adaptation of this immobilizer to engine control unit 3 5 2 Special functi
11. 31 30 33 37 33 37 32 34 39 36 FO AB L037972496 00000040 01 03 AS SA 69 96 Cl 3E 00 00 00 SF 61 1B D4 OS 21 3 2a 00000050 F4 37 A amp OB 37 As 3C 13 00 01 00 00 00 BC FI BS 7 7d 0 22 cnonansa 01 03 AS SA 69 S6 Cl 32 00 00 00 SF 61 iB D4 05 21 5 a Loan AES 00000070 Ed 397 AB OB 37 As SC 13 00 01 00 00 00 BC FT BS 7 9 gocci ake pae ooooooRo 02 04 00 OO LO 57 S6 57 SA SA SA 33 43 5A 36 45 WeU2 2230268 00000090 30 30 30 30 30 30 56 57 54 43 54 30 30 30 30 30 0O0D00YVRCZOO0000 GO0ONdAD 30 30 30 30 57 56 57 SA 5A SA 33 43 54 36 45 30 OOOOWINZ22SCZ680 QOOOOOBO 30 30 30 30 30 11 00 00 HO 00 00 OO Of BF F3 a OOO00 nonoadcEn 02 04 00 O0 L0 57 56 57 54 SA SA 33 43 54 36 45 IW2ZZICZSE OOOOOIBO 30 30 30 30 30 30 30 57 SA 43 54 30 30 30 30 30 000g0DOMHZEZ00OQO ODODOOEO 30 30 30 30 57 56 57 54 5A SA 35 95 54 36 45 30 DOODMYWZZESCZBEN OOOO0OFO 30 30 30 30 30 11 00 00 00 00 CO 00 00 BF F2 A DOODO ernennen DOUDJLDU 03 04 SB CB AL TE OU DO 00 00 0O OO OU UO DU OO uvsecccens Thecksums claculated up to address Ox280 Press Ihe Seve buten ot save the changes ECU MED 9 x Reset component protection data 95080 Required license AN009 This function allows to view and or change the component protection data found into the MED9x with ST95080 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained t
12. 73 36 10 13 73 SC BC CC 42 00 00 10 73 38 10 35 3 lt B 39 D0O00ULDU 13 73 3C SC CE 42 00 00 LO 73 53 45 58 37 54 30 SK B S5EZ720 b IPC VDO VW Seat Skoda 2007 CDC3272 24C32 Required license AN002 and AN006 This function is dedicated to change the odometer inside the instruments clusters from VDO with Micronas microcontroller This function works only on microcontrollers which have the mask of the microcontroller CDC3272 If the mask is different then this function will not work Even with the correct mask it is possible that sometimes you ve got and Error when connecting the instrument cluster after changing the mileage Type IPC VDO VWS eat Skoda 2007 COC3272 24032 x 34 2 8 4Hq Ag 1 4 Load dump 00000010 71 23 90 48 90 89 08 90 89 09 08 10 18 84 06 O2 qP H 00 00000020 15 04 DA FD AF AD F2 34 51 34 12 34 12 34 12 34 see 404 4 4 4 Save dump 00000030 12 34 12 34 12 34 12 34 12 34 12 34 12 38 94 FA A 4 1 4 4 4 8 z Swap bytes Ad 00000040 DS SO 7A 89 07 09 81 23 48 97 01 23 47 OL 89 78 2 fH G x 000000950 90 78 97 89 07 88 89 07 89 07 06 96 90 70 89 78 w le px 00000060 30 78 90 70 89 78 90 79 89 88 SO 78 90 09 87 89 xp x V m 00000070 ob 89 90 87 09 87 08 97 89 07 09 87 89 OF 89 OF 2 22 n OO000080 23 0897 40 93 41 30 35 34 38 03 00 OC OO AN OO 8 40648 Odometer cO0O00030 00 CE ON OO 00 66 CO NO Ob 00 00 DO O8 LL FA 36 Lee
13. Access This type of security access can be e Security Access Login usually used in immobilizer systems e Security Access Component Security usually used during adaptation of different units parts e Security Access System Specific security access different from the previous two and different from authorization for programming session Hints When device to which you connect is using KWP1281 diagnostic protocol then only Security Access Login If you want to put the security access to the ECU you should use Security access CS This will allow you access to adaptation channel 50 If you want to put the security access on the Immobilizer you should use Security access CS If you ve a error message that it is not supported you should use then Security access Login 3 4 7 2 User defined Security Access You need to clarify the type of the security access and then by using the buttons Request SEED Send KEY authorization can be performed Security access ix Secutiy access parameters C Standard f User defined Request SEED 1 1 i Dlaafeab Value DEC Value HEX 3 4 8 Adaptation Adaptation will open for you a separate window where you can check adaptation values You need to enter the number of the channel where adaptation will be performed and then press the button Test If the specified value is accepted by the unit press t
14. CD SE El AC OD 2D FF 50 19 2D 37 u 2 7 0000070 50 1E 23 34 53 00 2D FF 50 00 2A FF 64 Of 25 FF P 45 P d 0000080 64 14 IC 2p 50 15 IC 34 53 14 1C ZD 64 50 32 05 d P 45 dF2 0000090 25 39 00 00 G0 00 00 00 00 00 GF LE 01 DA G2 FF AS eee ween 0000040 00 00 00 00 00 00 00 2D 00 4B 00 48 03 ZC 01 00 K H San bytes L H 0000080 00 OF 14 03 OA GA GA OA OA OA CA OA OA FE FF FF oo ce cece eee 57 INOEDOGO FE FF FF FF FF FF FF FF FF FF FA OF D8 DE 03 08 onen vee SUnLDODU 15 00 31 OU 61 05 09 05 46 OF SE DA 46 OD BF 1D 1 HAM F S00000E0 00 00 70 00 31 07 AZ 07 04 05 BA OA FS OC AS OF ERSTER OOCOOFO 08 18 00 31 00 Sl 05 09 06 48 07 42 0A 45 OD BF 1 A H F Logn 25 Other Data D00C01090 10 00 00 50 00 AD 05 40 06 30 OF AD OA CO OD 80 P B DOOCOLLO 11 SE 4B FF 00 04 00 00 JE 03 SF OB 10 16 00 OO K eee cee 0000120 E3 OL EF 07 49 OF 60 78 00 80 80 00 80 Z0 0408 EEE Imme number 00000130 6D 00 BO 00 46 OL F4 OL SD 02 BA 02 DD OZ ED DE F Jeeeeee AO SS 00000140 EO 02 ES 02 70 02 EO OL 50 OL BO 0D 60 OD 0000 p P eee 0000150 24 08 18 00 30 00 60 00 DS OO 50 Ol BS 02 EO O2 0 P O0000150 EO 02 DO 00 57 00 34 0L IC 02 FA 02 al OS CB 05 n W4usresees 00000170 CB 05 27 06 16 00 30 00 60 00 CC 00 36 OL 7802 0 0X oe 0000130 0 02 0 02 00 00 57 00 34 DL 1C 02 FA O2 6105 en ker 0000190 CB 05 CB 05 07 05 C3 0D E9 00 4C OL CF OL B4 02
15. E 133 Fr New MAC 28 64 36 0D NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 3 5 4 Special functions with Engine Control Unit Special functions with ECU can be Read Write of flash memory Read Write the flash counters Read Write EEPROM Change odometer EDC15 Extracting security code PIN Immobilizer Enable Disable EDC 15 ME7x Functions become available after pressing the button ECU from special functions of main dialog Engine Control tink Special Functions ea Ecu Autodetect v ECU Autodete ct 00000000 q AG EDC15x uuoouolu JYAG ME7 1 1 7 5 7 8 wakcup pattern 01 HOUCUDZ0 AyAG ME7 1 1 7 5 7 8 wakeup pattern 11 is Porsche 5 2 7 3 EDC16U1 gEDC16U31 VEDCI6U34 JEDCIECPIEDCIECFIA EDC16CP34 Master EDCIECP34 Slave 5 Odometer EDC16C4 Master p r hands JEDC16C4 Slave NO amp a EDCI6U1 Master EDC1GU1 Slave RAUCH OS Fer EDC16U31 Master ieee pial Flach counter Att E Sug E mezd filosh Flach too if as ii si IMPORTANT You need to clarify the type of Engine Control Un
16. FF 37 37 35 34 32 30 39 oo FF FF FF 30 FE FF FF FF 7300260011 0577 6300040601 5925 1901206002903104 42475 60 20 02 6630UAU2274L0700 oanan 4F09 10352 10220 0_08 03 07 AFDaDSSS2E 31 Swap bytes L Login 5 305244732001 2050 0330101035330 FF D4 wens Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts an ECU dump from EDC16 PPD1x MED9x and ME7x ECUs Dun Tool F FF 00 00 09 GO 09 00 00 00 00 00 07 60 ZS OF sesecisesess Je 62 2b 2D 25 2D 2D 3E 2b 2D 33 43 30 39 35 39 b 3C0959 433H 0453370959 ernten 22 0 V A es N o0000K0 30 50 3p Enter component protection data manually 0000100 FF FF FF j mE na mi 9000110 FF FF FF 0000130 FF FF FF Coed dump trom EDC16 ME7x MED 9x jurcrypted Sinas PPO S mos FSI IF FF Fr FY FF FF F EE FE ER FEEF 2 F 0000170 FF FF FF FF FF FF FF FF FF FF FF FY FF FF FF FF essen nennen OO00180 FF FF FF FF
17. Key transponder locked No j min Transponder type OK N 1 Key transponder learned a Transponder acknowledge Key count 0 min Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via Kine and CAN 1 1 Enter security access code and number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Leam 1 4 For some Vw Seat Skoda vehicles it is possible to add new key without the remaining key stop to work You will be asked whether you want to use this feature if available Please answer with yes no according your wishes 4 The customer has to choice the vehicle model for which it wants to learn a key In the background the system tries to determine automatically what vehicle model is If succeeded the recognized model will be selected automatically If the system cannot recognize the model the user has to choice the model manually NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW CAN 2007 and VW CAN 2007 for that reason by default VW CAN 2007 is selected by default After the vehicle model is recognized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit
18. Motometer 1997 OBD K not needed TPO8 Procedure 1 VW Caddy VDO 2004 09 2006 OBD CAN not needed TP23 TAS Procedure 2 VW Caddy 2008 OBD CAN not needed TP23 TAS Procedure 2 VW EOS 08 2006 OBD CAN not needed TP23 TA3 Procedure 2 VWEOS 08 2006 2008 OBD CAN Key programmer TA3 Procedure 3 1 VWEOS 2008 OBD CAN Key programmer TA3 Procedure 3 2 VW Golf 4 BOSCH 1997 OBD K not needed TPO8 Procedure 1 VW Golf 4 Motomet er 1997 OBD K not needed TPO8 Procedure 1 VW Golf 4 VDO 1997 OBD K not needed TPO8 Procedure 1 VW Cross Golf 08 2006 OBD CAN not needed TP23 TA3 Procedure 2 VW Cross Golf 08 2006 2008 OBD CAN Key programmer TA3 Procedure 3 1 VW Cross Golf 2008 OBD CAN Key programmer TA3 Procedure 3 2 VW Jetta 08 2006 OBD CAN not needed TP23 TA3 Procedure 2 VW Jetta 08 2006 2008 OBD CAN Key programmer TA3 Procedure 3 1 VW Jetta 2008 OBD CAN Key programmer TAS3 Procedure 3 2 VW Multivan 2007 OBD K not needed TPO8 Procedure 2 VW Passat B4 Moto 1996 OBD K not needed TPO8 Procedure 1 meter VW Passat B4 VDO 1997 OBD K not needed TPO8 Procedure 1 VW Passat B5 VDO 2001 OBD K not needed TPO8 Procedure 1 VW Passat B5 Moto 2001 OBD K not needed TPO8 Procedure 1 meter VW Passat B6 2005 OBD CAN Key programmer TA3 Procedure 3 2 HITAG 2 Key pro PCF7936 or VW Phaeton 2007 OBD grammer key Procedure 7 HITAG 2 Key pro PCF7936 or VW Phaeton 2008 OBD grammer key Procedure 8 VW Polo VDO 2000 OBD K not needed TPO8 Procedure 1 VW T4 Motometer 1998 OBD K not
19. Seat Altea 2008 OBD CAN Key programmer TA2 Procedure 3 2 Seat Arosa 1998 2004 OBD K not needed TPO8 Procedure 1 Seat Cordoba 1996 2004 OBD K not needed TPO8 Procedure 1 Seat Ibiza 2007 OBD K not needed TPO8 Procedure 1 Seat Leon 2003 OBD K not needed TPO8 Procedure 1 Seat Leon 08 2006 OBD CAN not needed TP22 TA2 Procedure 2 Seat Leon 08 2006 2008 OBD CAN Key programmer TA2 Procedure 3 1 Seat Leon 2008 OBD CAN Key programmer TA2 Procedure 3 2 Seat Toledo 2003 OBD K not needed TPO8 Procedure 1 Seat Toledo 08 2006 OBD CAN not needed TP22 TA2 Procedure 2 Seat Toledo 08 2006 2008 OBD CAN Key programmer TA2 Procedure 3 1 Seat Toledo 2008 OBD CAN Key programmer TA2 Procedure 3 2 Skoda Octavia 1997 2003 OBD K not needed TPO8 Procedure 1 Skoda Octavia Il 08 2006 OBD CAN not needed TP24 TA4 Procedure 2 Skoda Octavia II 08 2006 2008 OBD CAN Key programmer TA4 Procedure 3 1 Skoda Octavia II 2008 OBD CAN Key programmer TA4 Procedure 3 2 Skoda Scout 08 2006 OBD CAN not needed TP24 TA4 Procedure 2 Skoda Scout 08 2006 2008 OBD CAN Key programmer TA4 Procedure 3 1 Skoda Scout 2008 OBD CAN Key programmer TA4 Procedure 3 2 Skoda Roomster 2007 OBD K not needed TPO8 Procedure 1 Skoda Fabia 2000 OBD K not needed TPO8 Procedure 1 01 2007 OBD K not needed TPO8 Procedure 1 VW Bora BOSCH 1997 OBD K not needed TPO8 Procedure 1 VW Bora
20. TRrouBLesHooTING Below you can find a list of typical problems and how to solve them Problem When starting the ABRITES VAG Commander on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port COMxx where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES VAG Commander If the interface is not recognized the USB interface appear with yellow exclamation mark in the device manager then you can try to solve the problem by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface drivers and Uninstalling USB interface drivers If the problem is still present you can try to set the used port manually as follows o Start the ABRITES VAG Commander o Press the Options button o Uncheck the Autodetect check box and enter the number of the port from the device manager o The changes will take effect after restart of the ABRITES VAG Commander NOTE Please take into account that the used port will change when inserting the USB interface into different USB slots so the manual setting of the port should be repeated in this case If the problem is still present please run the ABRITES VAG
21. VAG Check tool and prepare a dump file of the dongle Then send this dump file to support001 sinosells com Problem When starting the ABRITES VAG Commander on the splash screen Interface found is displayed but is not possible to connect to device especially through K Line Solution Make sure that if you run the ABRITES VAG Commander from a shortcut the working folder is set to the folder where the ABRITES VAG Commander executable is placed Problem The device connects sometimes to the device under K Line and sometimes not Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instrument cluster is A4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found on addresses 0x00 0x100 and 0x200 If the immobilizer number is placed there then the instrument is not crypt otherwise Problem After reading the A4 RB8 instrument the instrument displays LO x x instead the odometer Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible t
22. a step by step for using FTClean to remove drivers Unpack and run FTClean exe www ecutool com Email amp MSN info sinosells com FTDI Clean Utility 1 0 VID Hex FTDI PID Hex Clean System Exit Status Ready Click on Clean System button FTDI Clean Ublity 1 8 Tr IB x Information Fe i Disconnect all FTDI devices from the PC PID F p Status Ready Biga Syster Disconnect all FTDI devices from the PC and click on OK button www ecutool com Email amp MSN info sinosells com Gi 794 are about to uninstall all ETDI drivers For VID 0x0403 and all PIDs Do you want to continue Click on Yes button FID Clean Utiity 41 8 Sta Click on No button to start removing driver www ecutool com Email amp MSN info sinosells com FTDI Clean Utility 1 0 E Gf xi FTDI A Chip YID Hex FoI z MearSvstemn PID Hex aa a 7 Exit Status System clean completed Uninstallation has finished Important Do not forget to reinstall the drivers following the instructions from point 2 2 Installing USB Interface drivers 2 3 Installing ABRITES Commander for VAG The ABRITES Commander for VAG is contained into the installation package so please run the setup program Now you are ready to start the ABRITES Commander for VAG When starting the software there is a splash screen appeared where th
23. and or changing the component protection data found into the EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tonl ee Type ECU EDC15 Set component protection data 95320 00000010 FF FF 31 37 2b 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374195 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 CO000040 00 06 OS DD 04 24 10 75 As 30 32 31 30 a 32 u 0281012 coonaaso a 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 a E Sn DOHOAAEH 20 OOONNIDO SE 05 12 38 FF FF 31 36 2 34 FF 4 8 36 12 04 ODODOOED 24 FS CS 72 49 E7 SA CD DA OD 0O OO 565 57 54 45 6L eee VIZE DOODIIFO 54 30 30 30 30 30 30 30 30 30 OO AC F5 02 FS 55 Z000000000 U 4 F3 C5 72 49 E 5A CD DA 00 0O 00 56 57 5A 45 tlie eeee ECU EDC16 Immo bypass 95320 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool i xj Type ECU EDC16 Immo bypass 35320 0 34 FF 4 8 16 12 04 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 1
24. and then this modified dump should be saved back to the device via OBDII or with a programmer If data are read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data on 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means that for the same unit two different programmers can produce different dumps Normally the software tries to autodetect the byte order of the dump but if it doesn t succeed then you may need to use the Swap bytes button This buttons changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data are not valid e g displayed PIN is not accepted from the car please try to swap bytes to get result For some functions the swapping is made automatically for example the decoding of the Kessy but for some function the user has to made this manually A more detailed description of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license AN003 This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Pha
25. existing devices is one of the main diagnostic operations and broadcast requests for clearing DTCs are not accepted from all units there is a possibility to scan all devices and if connection to the device is possible then its DTCs are cleared This is made by pressing the Clear all DTCs button from the Auto scan devices panel Once again the protocols used to connect to the devices are specified in the configuration options 3 3 Broadcast requests Broadcast requests are these requests which are sent to all or a group of devices simultaneously The ABRITES VAG Commander is able to send broadcast requests to all devices with request to enter into a desired transport mode to clear all DTCs in all devices to disable enable the communication of all devices This is done by pressing the corresponding button from the CAN Broadcast panel Available functions are Transport Mode Entering into or leaving the vehicle from Transport Mode that is used by the factory to put the cars into a sleep to conserve battery charge during long periods of inactivity Disable Normal Communication This function will disable all communication between units in the car This can help you to hold current state of the car and to prevent disturbing of communication while re flashing Enable Normal Communication Restore normal message transmission Clear All DTC s Sending requests to all units in vehicle to erase its DTCs 3 4
26. is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 3 5 3 1 Transferring keys from one RB8 instrument to another Starting from V5 2 of the ABRITES VAG Commander it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Instrument Cluster Immobilizer X x Choose IPE tupe Insturen Cluster Aud 44 BOSCH RBSCHYFTO 2004 X 00000000 Cl C7 20 2B 62 BD A ZB IC AG OC 16 39 SE 45 Ad b 9 E 00000010 00 2 7 00 00 00 00 00 33 GO 00 00 00 00 00 FF fesen cB een cn 00000020 OL FO EC FD Al 70 CA 61 DO F9 09 BF AF 38 7C 9E au Pal sotone 00000030 87 23 EA PS C2 DF 1 CE CF 4 2C 96 4 27 Cl 59 rss Toe at 00000040 03 03 23 07 F3 01 SF 05 SF 3F 30 SD 42 B9 25 90 _ _20JE Load freee file 00000050 63 DC B2 CA 50 95 71 24 FA CD AA FB 5i E3 70 00 0 P 46 0 p 00000060 FD 17 00 00 CO 00 OD 00 00 00 00 00 00 00 GO OO ssissssssses Head AHON erh 00000070 00 00 00 00 00 00 OD 00 00 00 00 00 DO 00 OO OO 2 eee ee eeee ooooo08o0 OA OD 00 no OO NA AN NA no NO OO 00 OO OO OO OO ee Reset ECU oocoooso oOo 00 00 0G CO 00 DD 00 0d OO OO OO AO OO 00 OO LL 22222 Reset Comp Security DOOLKOAO OO 00 00 0O 00 00 OO 00 00 OO DO QO 00 OO DO OO ernennen 0000000 09 DO 00 00 CO 00 OD 00 00 DO DD OD DO 00 OD OD ene ew ee wee ewe OOCCOCCO 00 0
27. is used to put the Kessy e g into deliver condition Kessy keys E x Key 1 DC004426 Key 5 FFFFFFFF Key 2 5E 344320 Kep B FFFFFFFF Kep 3 FFFFFFFF Key 7 FFFFFFFF Key 4 FFFFFFFF Key 8 FFFFFFFF Immo status Exit EZS Kessy Security access code 9812 Required license AN003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola HC9S12 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Bump Tool Type EZS Kez Securty access code 9512 00000010 37 33 00000020 36 32 00000030 31 30 0000040 34 32 oo000950 36 36 00000070 31 30 Gon0ndan FF FF 00OOOORO 33 30 HOOOGGEH 30 33 000000DO FF FF ODODOOED FF FF DOOGODFO FF FF 00000080 07 ED 30 34 10 36 34 30 FF 41 FF 20 SF 38 FF 34 30 FF ETE FF ZF Ad FD Ab ES FD 30 30 36 FF SS FF 20 30 38 FF 37 31 FF FF FF BO 30 36 30 FF 5A FF 20 38 35 FF 33 30 FF FF FF FF 3l 30 30 36 SA 02 30 2E 32 FF 32 33 FT Fr ET FF 31 31 33 30 Si 20 32 30 42 FF 30 35 FF FF Fr FF FF 39 A lt 34 66 gt amp 33 2 20 FF 30 33 FF FF FF 30 35 33 30 30 34 oo 30 20 FF 38 30 FF Fr FF 35 39 3E 2E 37 46 02 37 33 FF 30 FF Tr Fr EF FF FF
28. microcontroller the unit can be either with ELMOS or Motorola microcontroller The function displays also the component protection bytes by pressing the Other data button Dump Tool i u Type Stesing lock Vw Passat 5 Securky code 6540308 00009000 24 24 1422 g 00000010 E E7 SA Sk 8a FE FE FE 56 56 56 57 57 57 SA SA acc ce 00000020 54 33 33 33 33 33 33 33 33 33 3333 33 33 33 33 2333333337333333 00000030 33 33 33 33 30 30 30 30 30 30 20 30 30 30 30 20 3333000000000000 00000040 30 30 DA DA DA CD CD CD 57 57 57 56 56 56 57 57 OO TRAV VO oo0000So 57 SA SA SA 54 33 33 33 33 33 95 33 33 33 33 33 W222233399333935 00000060 33 33 33 33 33 33 33 33 33 33 93 33 33 33 33 33 3333333343333333 00000970 33 33 33 33 33 93 33 33 33 33 D0000080 AC DA DA DA Ch CO Cb OD OD Ob oo000090 00 OC 91 OF 00 QA DO 80 15 0A oo00000a0 DO 11 07 AO Da 00 10 04 00 05 er ODT FD eat OOOOIORO 31 01 00 47 7b 04 OB 15 Li 00 3E 04 OR 08 FF FF 1 5 ee sie OOOCOCO FF FF 64 06 OL 15 66 Al 21 30 01 79 04 L2 15 QL nessis AlD oye 00000IR0 31 41 Z0 FF 27 00O FF 04 06 16 11 70 OL 00 00 Z5 18 N a gt COODOOED 61 Fl FF FF FC FC FC ZE ZE ZE amp 6 85 OB OB OF OB A sHu Henn 0 DOOGOOFn 01 UL OL FC FC FC 7A 7A 7A FD FD FD OO FF CD 3 an A AOR R 00009100 W3 In F6 F6 F aC AC 33333333324 By Bt ee i DON oa Ee Se hp Os fe 11 Aa 2 ee a ASA m Pe Or wo _ ECU Simos 7 K line Login
29. version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool xj Typs ECU WED 3 x Securty Code Checksum cakulata 35030 ooo00000 000000910 FF 00000020 29 00000030 02 00000040 01 00000050 Ed 8 05 07 29 a Load dump A 05 07 28 1 E 3 39 j 741037377439 Save dump i 3 30 35 2D 30 37 2D 32 39 08 10 18 49 0 OS 10 37 48 31 30 33 37 33 37 37 34 3 2F 2F 31 30 33 37 33 37 32 34 39 36 F g AB 1037372496 AS Sk 69 96 Cl 3E 00 00 00 SF Sl LB D4 08 2i 3 9a Swap bytes LA Wooo yy J m W N AS OB 37 6 3C 13 00 01 00 00 Of BE FI B2 7 7 e 2 22 00000080 01 AS Sk 69 96 fl 3E Mi 00 06 3F 461 1B 1405 2i 5 a 00000070 EA AB OB 37 2E 3 13 0001 00 00 98 BC FT B2 7 7 lt 2 2222 ooooooso 02 04 00 OO Lo 57 56 57 Sk Si SA 33 43 54 36 45 WWW22Z3CZEE Ooo00990 30 30 30 30 30 30 56 S Sa 43 Sa 30 30 30 30 30 DOOD000YW2LZ00009 OO0000R0 30 30 30 30 57 56 57 SA 5A S 33 da 5A 36 45 30 DOOOWINZ22SCZ6E0 G0O0HOOBO 30 30 30 30 30 11 00 00 00 00 GO 00 00 BF F2 aS no000 DOODANEO 02 04 00 OD 10 57 56 57 Sa S
30. 0 18 89 00 39 17 L2 G4 9 n 00000020 17 12 04 OD 43 54 51 30 33 37 33 37 34 31 30 36 CT1037374105 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 F E3 B 71037372667 00000040 00 06 05 09 04 ZA 10 75 k 30 32 38 31 30 31 32 22 u 0281012 00000050 31 31 39 20 20 00 00 00 16 SC 07 DS OA 18 F B1 119 00000080 on 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 030960214 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 01 EDC oooonden 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 TRIL u Be ooooodso OO 00 DO OO 00 CA OO OO NO ou CO OO OO 09 FIT ER 22 0 n O0QCOQAO 00 04 2A 10 75 Ab 30 33 47 39 30 36 50 32 31 Al 7 u 0969060214 0ODOOQBO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 6 R4 2 01 EDC QOOQOACO 20 20 20 29 20 20 37 35 37 31 03 00 00 46 00 00 1871 H KONDOIDO 00 00 00 OD 00 Do 00 00 DO ou DD OO 00 09 FI GE ve eee eee nn nn n DODOQOED 24 FS C5 72 49 E7 5A CD DA 00 00 OO 56 57 5A 33 CL ren VIZE DOODIIFO 54 30 30 30 30 30 30 30 30 30 OO AC F 02 FS 55 Z000000000 U O0OpgL00 24 F3 C5 72 49 E GA CD DA 00 UC 00 56 57 SA 45 a D eee VIE 3 d Immo is now ONI The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Odometer calculator 95320 Required license None This function changes the odometer value contained into the EDC16 ECU Just put the new odometer value and press Set button an
31. 070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 FF 00005610 00003820 00003630 00003840 00003850 00003860 00003870 00003880 00003890 00003840 FF Er FF FF FF EE gt OL FF N6 31 30 07 02 FE FF EF oo FE FF FF FF 16 FE FE 63 FF FF FD F9 di uu FF ul 03 1B FE EE FF FF 10 E 00 iE DE 6D a L FF FF IE EF FF ER UU 32 FF 14 FB FF 63 FF EA FF 10 FF FF ou FF LB FF Ho EF on FE 20 BE 00 FF FF Brom ae ha raj nomoy tli tt Oo ry FF ec F FF 35 SER DU ER ER FF FF FF FF FR FE FE 6 FE FF F 1E F 54 5 FF 2 32 FF Tre en GEBESTT TOOLS joes niau 2 2 E g on the picture above starting from address 0x0080 of the EEPROM there are 17 bytes with OxFF then follows the login which is 0x047F in hexadecimal or 1151 in decimal The odometer consists of two blocks usually 0x90 bytes with the inverted odometer followed by 0x90 bytes with the real odometer but this may vary e g blocks with 0x98 bytes instead 0x90 or first is the real value and then the inverted So if the odometer is displayed correct you can try to change it But please be always sure that you change the odometer only after it is displaye
32. 3C86 Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos 7x generation which are accessed through K Line or CAN for benzine engines Into the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Tyne ECU Sina 7 CON Rese component pictection dete 93076 53586 y 2 AC 42 AC A2 AC 44 00 54 00 S4 00 OL OO 01 OO T cece A 0900010 01 00 00 0G 00 00 00 0G 00 00 DO CO DO OD EF OF eee eee nn oggooz0 E7 OF E OF OO O 08 36 00 LC 00 OO 00 04 0D DO ausser 0000030 DU 00 00 00 2D ZU ZE ZU 20 ZE Z0 20 00 00 0U OU Swen bytes L H Component security data o0900C0 70 7F 00 00 EB 02 80 80 80 80 80 80 30 PF FP 80 P sesesesesirs oo000DC 80 80 80 80 FF 30 80 80 80 60 80 80 80 80 80 BO eee eee eee OOO0CEO 80 30 80 80 80 30 80 86 80 80 80 80 30 80 80 80 s ssssssssssce oo000F0 80 89 80 80 80 30 80 80 80 80 80 80 80 80 80 BO OOCOLO0 E0 80 80 80 80 80 80 80 80 IF TE 80 80 80 80 FF 2 2 nenn 2 ECU Simos PPD1x Reset component protection data Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPDix there are at least 6 bytes of the component protection found or som
33. 6 aay Far COONNIAD 00 00 04 56 00 76 30 37 32 43 24 23 42 38 97 80 VwrOr ts Be 24423 Set HOODOBD 87 80 97 08 97 08 97 90 8789 03 04 71 BI 07 ON rennen Wie HONOGIED 89 253 74 09 83 27 40 95 12 37 89 04 57 34 89 02 r D 2 Ud O0D0ODOODO 57 20 39 56 75 83 06 79 03 45 56 92 OL 55 90 58 W 9 U V HV X X OOOOOGEO 12 38 04 61 39 na 12 34 90 12 3a 90 GL 23 49 05 9 9 4 4 1 OOOOOOFD 12 34 90 SL 23 49 D5 12 39 08 12 34 90 BL 23 49 4 82 9 4 81 QOOUDULOO 06 lz 34 583 12 30 46 12 34 61 25 00 55 57 5A 44 4 08 4 VUIZD i gt Enter new odometer value and press buiton Change IPC CRYPTO Skoda Fabia Skoda Roomster VW Polo Seat Ibiza 93C86 Required license ANO06 This function changes the odometer for the Skoda Fabia Skoda Roomster VW Polo and Seat Ibiza which are with encrypted EEPROMs year 2007 Please pay attention that for some of these models it is also possible to read the mileage also by OBDII but it is different than the read with a programmer TI Ick i x Type IPC CRYPTO Skoda Fabia Skoda Roomster YW Folo Seat Ibiza 53086 00000050 44 56 Ca 10 9R 07 SB N7 54 80 DC 05 75 00 60 OF DV d u connaasn ar GO nn OO F 3 OO FF 54 00 00 OO 90 50 OO OF 20 3 P 00000070 na sO na ar nn S0 OO 9C nn 50 on ac OO 50 00 SC P P P P poo00080 01 40 OL FF 00 OO FF FF FF FF 00 00 00 00 00 OO G Odometer ono00090 E da 00 GO 45 C3 DO FF an Of QO Of BA
34. 9 00 CO CO 00 OD 00 00 00 OO 00 00 00 0G 00 LL cette eee Logn 715 00C00CDO 09 00 00 OO CO 00 OD 00 00 OO 00 00 00 00 00 00 ee ee ee eee 00000CE0 15 04 03 OD 11 00 64 03 1E 00 50 50 00 14 00 60 ee Se Odometer OOCOCOFO 30 DL 00 00 44 7A OD 00 00 OO 00 00 00 00 00 00 Dz 000 520 Chenge 00000100 4D EE 19 97 DZ DA CF OL E4 3E DO 64 DL 44 GD 46 Me gt d Dur 00000110 54 C5 9D 43 72 ED 60 FO AB 97 A9 56 26 AG 79 9A T Cr Ver 00000120 03 03 AB F4 FC 01 2B 3F 20 43 69 7E 53 5B DO 6l Ch a Immo Status 00000130 FB 1C 9E 78 9C 3C SF 03 A4 36 AE DL AD 08 70 00 x lt _ 6N p Pen Cheng 00000140 FD 17 00 00 00 00 00 00 00 GO 0O 00 00 00 0G OO ee eee eee oe 00000150 57 AL 55 SA SA SA 38 45 35 35 Al 31 3L 31 31 31 WAUZZZS8ESSA11111 00000150 31 00 01 00 BA 00 96 00 74 00 SD 00 DA 02 6D Ol 1 t J m Ee Read ke wie keys I Skip neg tesporises Mis shi In order to transfer the keys you have first to read the EEPROM of the source instrument and when pressing Read keys they are saved into file Then you have to go on the destination instrument read its EEPROM and pressing the Write keys button then you will prompted for the file where the source instrument keys were read After selecting the key file you will be asked what information to transfer Select key data to transfer b x V Transfer leamed key Ds IV Transfer learned key count IV Transfer component protecti
35. 996 1997 odometer 93C56 changes odometer No license required
36. A 0 E 37 AB OB 37 46 3C 13 00 OL OO 00 DO BE F B2 Sere hee je ol AS ey 69 96 CL 00 00 En an G1 26 DEUS 521 184 228 45 10 E4 37 AB 37 AG 3C 13 00 019 00 36 17 92 re Fein seb wens Component a data xi z 30 ld ca e fea i3 f io a io Cancel Neve fo 0 G 0 Es ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Bump Tool Type ECU MED 3 x Securty Code Checksum cabulato 35160 00 bd 00000020 29 07 05 1D 37 48 31 30 33 37 33 37 37 34 33 39 j 781037377439 Swap bytes LH 00000010 FF FF 30 35 2b 30 37 2D 32 39 08 10 18 49 GS 47 05 07 29 1 G 00000030 02 02 2F 2F
37. A SA 33 43 54 36 45 WEU22Z3 DONDAIPO 30 30 30 30 30 30 56 57 5A 43 54 30 30 30 30 30 00DADOYHZCZO0ODOO OOOOOGEO 30 30 30 30 57 56 57 54 5A 5A 35 953 5A 36 45 30 OOOONTNZZ2ZSCzZHKO DOODIOFO 30 30 30 30 30 if 00 00 00 00 00 DO 00 BF FZ AS OOUDD 00000100 03 G4 6B CB AL IE DO 00 DO 00 0O OO OD OO OO OD s s s EEE AT m LJ Login ea L 1 Checksums clacueted up to address Ox200 Press ihe Save button of save the chenges Est ECU MED 9 x Reset CRYPTED Login Component protection Required license AN009 The function allows changing the security access code and the component protection data into MED9 1 ECUs for which the EEPROM is encrypted As mentioned previously for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU requires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the MED9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster Tyne ECU MED 3 x Rese CRY PTED Locin Compon
38. Change mmobilizer status By pressing Seb you cah set mmobilizer status NOTE Normaly immobilize status should have the value Z It is recommended jo change it f is different m Wite keys to Comfort modale dump Change immobilzer status Key 1 PIC2DCRF Program tanspendes Key 5 ffoi Immo status 2 Set OK CANCEL Keys with data 00000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied positions and represent the data of the learned at the respective positions keys With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if it s type is appropriate TA3 it is also allowed to program transponder as dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car should start without making any key learning procedure By pressing OK all changes in dump s data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license AN009 This function allows viewing
39. Check and try to auto detect the interface and generate a dump from the interface Report about the problem to Abritus72 Ltd with the included interface dump file Problem When starting the ABRITES VAG Commander on the splash screen neither Interface found nor Interface NOT found is displayed Solution Please try to unplug and plug the dongle and the USB interface again into the USB slot and restart the ABRITES VAG Commander If the problem is still present please run the ABRITES VAG Update Request and request an update of your software Please be sure that the version of the ABRITES VAG Update Request is at least 1 1 displayed in the title bar when ABRITES VAG Update Request is started Please specify in your mail what kind of problem you have when running the ABRITES VAG Commander Problem When starting the ABRITES VAG Commander the splash screen is displayed but the application freeze on this state for about 1 2 minutes After that Interface found is displayed and application functions normally Solution Probably there are some bluetooth devices installed on the PC Please try to deactivate them temporally Problem When starting the ABRITES VAG Commander a message Error code 0x10001 Please contact support001 sinosells com with the Error code in the subject Solution Please run the ABRITES VAG Update Request and request an update of your softwa
40. DDI PINs Iv K Lre RWR20O0 KWP1281 Logro ra mv is S 7 Enabie CAM fog Artena tector s 7 ins INS 5 CAN Resstor Enable K Line log Tex sn nd Instant Loosing NOTE changes regarding interface detection and timing parameters which you made in this dialog will be applied after restarting the application 3 1 1 Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP2 0 with baud 500KB s CAN TP1 6 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP1 6 with baud 500KB s www ecutool com Email amp MSN info sinosells com UDS when trying to connect to the device the commander will try to connect to it using UDS over ISO transport protocol with baud 500KB s K Line KWP2000 KWP1281 when trying to connect to the device the commander will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used for configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests they are not applied when auto scanning devices 3 1 2 Interface detection Normally the ABRITES VAG Commander USB Interface is recognized automatically but there is an option to set it manually So if you have troubles as described in the Troubleshooting sec
41. EPROM better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 5 5 Special functions with Micronas CDC32xx The Micronas CDC32xx special function is dedicated for the VDO instrument clusters with Micronas CDC32xx microcontroller This is possible using the CDC32xx programmer After starting the function a following dialog will be brought to the user Micronas CDL324 x CD C324 Programmer ig 1a ae daga N CDC32kx port COM141 USB Seral Pot Device Jalta from 07 2006 X r Odometer Read ariie EEPROM Flash m ooaaaaoa 99 04 57 56 54 5A WVNZZZ Odometer 133449 ee oonon008 31 4B 5A 37 50 30 34 32 1KZ7POAZ meler 00000010 33 31 35 Ds 05 SB 58 53 315 oogccals 58 58 58 58 58 58 58 Wile coocooza 58 58 58 58 58 58 40 OF cdomeler ococ002 amp AD 1A 70 E5 99 17 ED 00000030 CS Z8 D5 00 14 00 DO oonouon38a 78 FE EO OB 12 3D i Immo data VIN AANZA K27P042315 AANSEN Read Imma r data Sendnumber VAZ 77067044319 T transponder identficaters ea mm Wirte inc Serial kepiCS 9a12bd3cc526d5 Kapol 34430813 Keyps iin jala OE AA Fyre reen c fff MAC 70052235 KeplD2 445tdol a KeylD amp Im fl Status 0000e7Ate Keypa FFI Keun IEH e a BE En Conliguration 10196220171 rw oa ifn Keying PIN 16934 NOTE Before starting any activity with the CDC32xx programmer it is important to set properly t
42. F FF FF FF FF FF FF FF FF FF FF FF FF FF FF ssssessssoee 00000080 33 30 35 32 31 30 30 39 33 31 38 31 32 31 35 30 3052100931812150 30 35 32 3 30 33 3130 31 se J gt d v Load irom file sll Reading io n ow oO w bh rj Hj rrj 4 pen hm to Go oo oo ArFowW w o 38 32 42475 50 11 62 A 31 3201UAUZZ24FX6N1 Wits EEPROM 5 1 D D eo o HPH This special function is dedicated for Q7 A6 Allroad models and the user has the following possibilities Learn a key Learning a key requires in most cases a preprogrammed using VIN key which normally should be purchased from the VW Audi dealer Only models with EZS Kessy with SW version till V2 0 2 it is possible to learn an empty clear key For models with EZS Kessy over this SW version it is required to have a dealer key purchased from the dealer or create with our programmer Read the EZS Kessy EEPROM 2KB Write the EZS Kessy EEPROM 2KB but without an area of 96 bytes with the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so it becomes like a dealer key IMPORTANT To make any activity with the EZS Kessy you need to know the login PIN of the car and the first 6 bytes of the component security bytes The component security is normally 7 bytes but the 7 byte is not required The login and the component security bytes can be read normally from the ECU This i
43. FC 58 OO 22 2 X z GOOONIAD 26 DO 46 O0 Ob 03 20 DI 96 DO ES DZ 74 OL 01 OO amp H e teas BEZ Set HOOCIORO OO 14 10 10 OL 81 00 00 0C 08 00 00 A0 00 29 OO eee ieee weer J OODOOCOCO OO 00 00 0D 00 0E OO 0O 0O 00 DD OO 00 OO DU OO vee eee eee eee ENDE 00 00 O0 OD DO 0O DO OO AO 00 OO OO OD OO OO OO oe se eeee reese COMIOEN 00 GO OO O 00 00 OO 00 0O 00 29 0O GO 00 0O OO 0 Fe sions COOOIIFO 00 00 OO OD 00 0O OO OO 00 00 BE 95 50 98 BD OO ee a5 O COUDULIO 35 48 67 80 OF 00 SE Co FA FF OF 04 50 LB UA 04 SHy gt Paws We Enter new odometer value and press buiton Change Audi A8 2002 Security access code Program transponder 24c17 Required license AN006 to view security access code and AN009 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Fool Audi AB 2002 Security access code Program transponder 24c17 oo 00 00 oo 00 00 di 0000010 0000 00 00 00 00 00 OD 00 09 00 00 00O 00 00 FF ssissssssscesaa 00000020 00 80 00 00 CO OD 00 OO FF FF 20 33 33 42 43 FF 0338C 000030 FF FF 44 32 30 15 45 55 54 59 AG DF IF OA FT FF DZ0 H Z1 0000040 CB 04 00 80 00 00 00 FF 00 00 00 OD CF 23 70 OL s sssssasess pe 0000050 14 SE 7A 00 OA OA 31 ZA IF 45 40 60 SA 78 66 SE z 1 FL 2xh 0000050 75 Ad 83 BA 91
44. FF FF FF FF FF FF FF FY FF FP FF FF 000190 FF FF EF FF FE FF FF FP RF OFF EPPS FF FE FF FP vio Wield oe OOCGIAO FY FF FY FF FF FF FF FF FF FY FFF FF FF PR FE nennen O0001B0 FF FF FF FF FF FF FF FF Fr FF fr IF FF F FF EIER rear Mae bd The function also visualize change the immobilizer and VIN numbers pemo tao x Type Comtor module component protection data Passat Bb v O0O00OGO FF FF 00 00 60 00 00 0O 00 GO 00 00 07 50 280C sure e A 00000010 83 62 ZD 2b 2E ZD 2D ZE ZU 2D 33 43 30 33 35 39 b 3C0959 00000020 34 33 33 46 20 20 30 34 35 33 33 43 30 39 35 39 433H 0453300959 00000030 34 33 39 40 20 20 20 FF SF FF FF 03 60 FF FF FF 4939 era 00000040 FF FF FF FF PF FF FF FF FF FF FF FF FF FF OFF OFF seen 00000050 FF FF FF FF FF FF F FF F8 IF FF FF FF FD PF FF vvesesessecucess 00000060 Sk Sk FE BS 47 LA FE 00 03 62 00 03 64 00 03 56 22 0 0 d 7 anannn c 00 03 57 n0 OF 62 5A FF FC E2 56 FF 00 43 S600 W bZ V C 00990080 43 82 00 43 83 00 43 64 00 43 85 54 FE 79 62 44 C C C C Z YDI 0000002G FF 00 OZ 59 00 Q2 AS NN A 6A NA A AT NAN A BA 1 X wi BR 00000040 AS FF FF O00000BG FF FF FF F F o09000c0 FF FF FF FF FF F 00000000 FF FF FF FF FF F OOQDOOEO 57 34 32 31 38 OOOUNNRO 30 50 30 30 33 D0O00100 FF FF FF FF FF P 110 FF FF FF FF FF F 00000120 FF FF FF FF FF F Immo nurrber 00900130 FF FF FF FF FF AWeczooooo000 00900140 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
45. FF OFF een 00000150 FF FF FF FF FF FF FF FF FF PF FF FF FF FF FF FF DODOMIEO FF FF FF FF RF FF FF FE EF FE FE FF RF OFF ORF OFF 0 e00ee gt 00000170 FF FF EF FF FF FW YY FF FY FF FF FY FE FF RENT ieie ay 00000180 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Ge ape eer e 00000190 FF FF FF FF FF FF FF FF FF FF FF FF FF FF PF FP es IMAAZZZECZSICHNNE o00001A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF PE FF sense O00001EC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF veeneseereenesen i a Compenent security bytes oe DI 725279 B2 E444 Pressing the other data displays the learned keys and allows several operations if a programmer has been recognized allows to read current transponder s data add it to the dump and if transponder s type is appropriate allows to program it as dealer key allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition Comfort module keys Ecmiot module kevs data white keps to comfort modde durip You can enter manualy a key certain position With pressing OK keys dala wil be writen to comfort module duro For fo delete key fiom certain position write OO000000 in the key positon field You can press Program trarsponcer to read cument transponder with programme to certain position With pressing OK keps dala wil be writen Io comfort module dime
46. HY version SW version of module 1 K2 6 9 SW version of module 2 D2 6 3 SW version of module 3 N2 6 9 SW version of module 4 44 7 6a SW version of module 5 XPO35 V19 02 Hardware rwber OSO735 3 4 3 Extended Unit Identification Extended identification VIN displays programming data flash status programming attempts flash date VIN number Part serial number f 2100103A163DEF Supplier identificacion TF74035 Production date f 16 10 03 Chenges from supplier e 08 Number of validation status l00L Current supplier s mauber F 3DEF Flash Programming succefull ready for driving Programming attempts 0 Successful programming attempts 0 Status of conditions for programming 0 Flesh Tool code 0x000000000000 Flash date 23 05 03 www ecutool com Email amp MSN info sinosells com 3 4 4 Read Diagnostic Trouble Codes Read DTCs will display all present errors in master and slave units Displayed errors can be together with freeze frame data this depends on the checkbox Read Freeze frame Status Pernanent error 18038 Accelerator Position Sensor G 9 Signal too Low Status Permanent error 19804 Control Circuit for Controller for Turbocharger 1 37274 Electrical Malfunction Status Sporadic error mechanical error 19804 Control Circuit for Controller for Turbocharger L J 24 Electrical Malfunction Status Pecmanent ecror lower limit excee
47. Octavia Il Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the function for reading current odometer value is not available You need directly to enter new value and to press button change odometer After a minute you will be asked for the currently displayed value and the odometer will be changed ATTENTION Please take care that some instrument clusters from Audi A3 and Audi A8 are with blocked access to these special functions This can be recognized if after reading of current odometer value is displayed unreal value To restore instrument cluster to normal behavior need to be removed for one minute fuse of instrument cluster for example on Audi A8 can be used fuse number 5 Reason for blocking of security access is usage of bad diagnostic tools in the past ATTENTION ABRITES VAG Commander is designed to calculate odometer values in KM units Please take this into account especially when using dump tool or when VAG Commander asks you about displayed value of instrument cluster Audi Q7 Audi A6 Audi Allroad For some of the vehicles you can read and program immobilizer related data inside of immobilizer and engine control unit This can be done by pressing the button Read Write Immo data The following screen will be displayed Read Write Immobilizer data E x 32 WVGZZZITZ4W092 00000010 32 33 33 9F
48. PR re OOCOLAN 3D 03 10 04 CO 03 20 03 0 02 90 OL FO OD 06 90 2 LLL lee 0000150 O1 30 U2 20 03 55 03 14 04 14 04 15 00 14 02 LA wee eee ni rf Wauzzzanzynonzez NO002822 Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s data and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump You should use transponder TPO8 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Keys data x Keyt N 282fetab Status You can enter manually a key in certain position or you can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to dump After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi A3 A4 A6 UKNSI 1995 1997 odometer and login code 93C56 displays the login and changes odometer No license required Audi A3 A4 A6 UKNSI 1997 1998 odometer and login code 93C56
49. Standard diagnostic requests When double clicking on the desired device in the main ABRITES VAG Commander window you connect to the device to proceed standard diagnostic requests The following dialog is opened www ecutool com Email amp MSN info sinosells com WIR Engine Control Unit Master Establishment diacmmostic session wath selactsd unit electronic control unit identificacion Sszzez22ze2 22222 Device BW L OVOS06O16BL lt VAG number PROGRAMMAR LE Program status 7 data status 01 Coding L1172 Parc n mber 56823 Teporteur s rather 211 Supplier number 157 Systen description RS 2 5L EDC CODOSS Dragnoste poqueets This dialog provides you the possibility to execute the following diagnostic requests 3 4 1 Identification Identification will provide you the VAG part number and software coding I electronic control unit identification Device N l 4F0910401L lt VAG number PROGRAMMABLE Program status 00 data status 20 Coding 11772 Part number 0 Importeur s number 0 Supplier number 0 System description 3 0L V6 TPI GOOOAG 3 4 2 Software and Hardware version of the unit SW HW version displays if the service is supported by the corresponding controller the SW and HW version of the unit including all slave units of the master unit www ecutool com Email amp MSN info sinosells com gt SW
50. ad ReadMemory The Custom memory access Download Upload ReadMemory functionality is available from the Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access enter into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES VAG Commander Using this application you can read program memory in some electronic control unit Requests sent from this application can be related for the currently running session of for some of electronic control units from the dialog You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of EDC 16 In the example below we read a part of the flash of EDC16CP Custom memory download upload Mer Choose ECU ipype EDC16U1 v u cs Load from file EDC16U31 EDCIBU3A EDCI6CPfEDC16CP34 EDC16C4 Master EDC16C4 Slave EDCI6U1 Master EDC16U1 Slave EDC16U31 Master Connection EDC16U31 Slave SEa BODOM MED3 5 10 MED9J 1 Master Len of req fo SEES ANE Toidsiee 10000 Sien g Enciypton Dewnbad Uploed ReadAwtt
51. ail amp MSN info sinosells com 3 Diacnostic with ABRITES VAG Commanper The ABRITES VAG Commander consists basically of two parts Standard diagnostic functions like reading clearing trouble codes device identification adaptation measured values etc Special functions like odometer correction reading login PIN reading EEPROM etc All devices which can be installed into the car are listed in the main screen of the ABRITES VAG Commander with their VAS Number If you want to connect to some device please double click on it The ABRITES VAG Commander will try to connect to the device using consecutively the following protocols KWP2000 over TP2 0 with baud 5000KB s CAN KWP2000 over TP1 6 with baud 5000KB s CAN UDS over ISO transport protocol CAN KWP1281 or KWP2000 over K Line the protocol is recognized automatically from the wake up pattern You can choose which of these protocols to try when attempting to connect as described in the Configuration section 3 1 Configuration The ABRITES Commander for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed Special functions amp Votice Seleciice Broadcael Options Used prolocal for daanasbe Select COM pork f Line baud rates Inang sezunge Language a Zi f 108729600 IV CAN TP 20 4 Sutoderect English Y 7 a 95004 10472 V CAN IP1 8 Klin used O
52. al value should be 5 With the Test button you can see whether with the current value the programmer reads the transponder properly If you get a message that the transponder is read on 100 then the present antenna factor is OK www ecutool com Email amp MSN info sinosells com 3 1 7 K Line PINs Normally the K Line is output on PIN7 of the OBDII connector But some models e g Porsche Cayenne 2004 the K Line with some units might be on PIN3 or PIN15 For that reason there is a option on which PINs to try to connect to the units ATTENTION If you check all PINs to be examined l e PIN3 PIN7 PIN15 then when scanning for units the time will will be significantly increased For that reason by default only PIN7 is selected 3 1 8 CAN resistance According the CAN specification there should be a resistance between CAN Low and CAN High Normally the gateway has this resistance but if you want to connect on some device on the table then you should use that resistance For that reason there is a option what resistance to use None 75 Ohme 100 Ohm 120 Ohm or 10 Kiloohme By default 120 Ohm is used Normally you should don t have any problems but if some problem appear you can try to change the CAN resistance 3 2 Scanning units After startup on the main screen of the ABRITES VAG Commander a list of all possible units with their VAS Number is displayed The customer is able to connect to the listed devices by doubl
53. alog Program dealer key x Set transponder ine Megamos 48 VW TA3 v Autadetect component pretection All 7 bytes of the component protection data component secunty are now Program transponder from bytes Component protection bytes F E E E E 6 E Find the 7th bete of the component protection data Find 7th byte and program transponder Component protection byte j8 E fi 0 E j Automatcial ting of the 7 byte possible when you can check m measured values when keys recognized Manualtiying ofthe 7 byte after each attempt you can try with the key or the ignition Value for the sutorization read by daignostic m Passat B6 CC with EDC17 MED17 Login Securty code 34269 er ge ump Here you ve to put the PIN code after that to load the comfort module EEPROM dump and the Program button will become active After pressing the Program button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done When the transponder is ready you will have all the component security bytes displayed in the status bar After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MED
54. alue inside the CAN gateway Actually not all CAN gateways are containing such value and this value is not exactly a odometer but is proportional to the current mileage and this function sets this value to zero Bump Taal l xl Type Gateway Odometer resetter 95160 y Swap bytes LAA Oono909so0 00 60 00 OAN 00 no no 00 OO NQ ON OO OO OO AO OO 2 2L nn oo000960 on 60 00 09 Of 00 00 00 0O 00 06 00 A3 OO OA OO 00009970 00 00 00 AD 00 00 00 00 00 00 NOO OO OD DF Fl 22 2 LL Fr 0000080 02 04 OO 03 00 00 CO OO O 00 00 00 Of 00 A0 33 222u 3 00000090 33 33 33 33 00 00 00 00 OO 00 QO 00 O86 00 O00 OO 3333 ooooodaO 00 00 OO OO 00 00 GO 00 ON OO 00 OO OO 00 00 OO 1 KOODDOEN 00 0O OO OO 00 00 OO OO 00 00 00 OO Of 00 00 OO eee eee QODOONEO 00 00 00 OO 00 07 55 4 54 S50 00 00 00 00 OQ OO UAaP DO0OONOIPO 00 00 00 OD 00 DO OO 00 00 58 00 OD DO 00 OO OO han nen ODODOOED 00 GG OO NO NON 00 DO DA OO 00 CD OO 00 00 00 OO REICH ppoppgoro UO 0o OO By 2 00 00 00 00 00 GO 00 00 DF Fl 66 72 ect e eae L QOOODLOD 03 04 569 1D 50 43 DO DO 00 00 00 00 00 OL OO OO 1 C af Odometet resetted Steering lock VW Passat 6 Security code 68HC908 Required license AN003 to view security access code and AN009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola
55. as 14 OU 31 20 4 lt no 31 A A an 46 34 30 00 OU oo oo oo 00 ou 15 37 02 2F oo Sh oo oo 32 20 31 no 32 20 31 D4 oo 30 30 33 on 0 00 00 oo ou 36 2D 20 31 71 ce 71 ce LO 31 5 30 10 31 57 30 39 oo 35 31 13 oo 02 00 OE 00 OF 00 30 oo 36 39 oo TC 00 2c 00 2c 00 FF 32 31 33 AS DB AS DE 4l 20 55 Do 4 zu 55 o0 oo oo qz 31 30 oo 0l 50 TA D0 wh oo 30 30 2 Fo FO 55 20 oo 55 zu SA oo oo oo pei 35 36 oo Ag 00 BG oo B6 oo 37 30 33 33 D0 oo 00 D0 5A 20 SA Do SAS 2 5A D0 00 oo 47 43 30 no FF oo 05 oo 05 oo 2D 38 37 386 oo cl oo ol 54 z0 00 20 oo oo oo 36 oo 33 oo FF oo co 00 oo 00 30 08 33 33 oo oo 00 oo 5A z0 34 00 5A zu 34 o0 nn on 3L oo KA oo 04 oo oo o0 oo oo 32 10 38 37 43 oo 43 oo 34 20 4c co 34 20 ac oo oo 00 30 oo 47 oo 32 co oo 00 oo oo zD 13 34 38 44 00 44 oo 4c 20 33 oo 4c 20 33 00 on oo 06 a0 20 an ak oo 2 00 27 oo ho ca Db O 35 56 FF Se FF 33 20 37 oo 33 20 37 20 oo 00 02 oo 30 oo AO oo iF F4 BF F4 F4 37 oD 00 31 Bol sans OF 77 16 17 16 44 20 30 62 44 1 0 07 02 08 07 02 08 9 10373849658 oo ff1037383765 es 2Q 7 CDV CU cecesDeerecs
56. ash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using Clear crash data function from device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units 1C0 909 605 C 8LO 959 655 A 1J0 909 609 600 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L 3 5 10 Special function VW Crafter This special function gives the possibility read the engine control unit EEPROM together with the PIN code and component security read write mileage into engine control unit make immobilizer ON OFF learn keys with prepared transponders perform diagnostic on the engine control unit and the immobilizer NOTE It is possible to connect only to the engine control unit and immobilizer for VW Crafter vehicles To connect to any other device you will need the ABRITES Commander for Mercedes Starting this special function brings a following dialog ABRITES Coiminanihie for VAG AE ale ps Lek 3 g Unit name va ember Description fre Coming a II Di Engine Cont
57. byte is matched automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason it is required that the ring coil is dismounted from the ignition lock and placed over the Key programmer NOTE The automatical check might be not possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference between the automatical and manual procedure is that by the manual procedure you should put the key into the programmer then make a ignition with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively invited to put the transponder into the program and than to give it to the ignition Normally for the most models it is required that the key is in the ignition and you change only the position of the transponder You will be invited to put the transponder into the programmer then to put it near ignition lock so it is read by the immobilizer Exception from this is e g the Passat B6 For it it is required that you put the key with the transponder is put into the programmer then the key with the transponder is put into the ignition lock BUT TILL FIRST POSITION than again into the programmer and again into the ignition lock until the byte is found NOTE If you get XXX is displayed you need to stop on the current position and wa
58. cess code Checksum calculator 95320 Required license None This function displays the security access code which is contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section Dump Taal x ECU EDC15 Securty anzess code Checksum calculator 99320 Type oonno0so ooon006o ooo00070 oooooo8o oo000030 na 42 00 31 on 42 A oo 00 42 20 oo 24 54 a4 lt 03 06 31 04 20 20 00 04 20 20 00 FS 30 F3 04 2F 05 39 2h 2 20 oo Z 52 20 on cS 50 Cs oo 2F oo 20 10 34 20 ao 10 a4 20 oo 72 30 72 43 sl 04 20 75 20 20 oo 75 20 20 oo 49 30 49 54 30 2h on A h 3 32 20 oo 0 Ab 32 20 00 D Ey 30 Ei 30 37 75 oo 33 30 33 00 33 30 33 oo ED 30 CD 33 33 Ae 16 47 ac 37 oo 47 At 37 oo DA 30 D 37 37 30 sc 39 20 31 oo 39 20 3i ou nn 30 00 2 00 30 45 03 00 00 go 00 un oo oo 34 36 sl OA 30 43 ao ao 45 oo a0 56 F 55 3L 37 30 18 32 20 45 09 32 20 46 ng 57 UZ 37 Checksums nthe file updated Press the Sav
59. code 93C76 93C86 Required license ANO06 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Bump Tool Type ECU Simos 7 K Ine Login code 93078 33656 x sea 00000070 56 57 Sk 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZODOOCOOOCOVW Login 918 OoooooeO S 43 SA 30 30 30 30 30 30 30 30 30 55 57 5A 43 ZEZONOODNUDDVYWET ooo00090 Si 30 30 30 30 30 30 30 30 30 57 56 57 5a 5A SA ZOODOODOCCUVUZZZ GCOO000A0 33 43 SA 33 33 33 33 33 33 33 33 33 33 33 33 33 3023333333333333 QOO0IOBO 33 33 33 33 33 33 33 33 33 33 33 33 57 56 57 5A 3333333333337 oogogoco SA SA 33 43 54 33 33 33 33 33 33 33 33 00 00 OO 2230233333333 0000D0QODO TC FC 30 39 30 37 33 32 33 39 30 36 30 31 38 46 1103073238o5013F ODODOOLO 47 20 00 on nn 00 01 05 GO 03 16 OF OL L DI BAG russ HH HH HR OOOOOOFD 01 05 00 053 L 07 O1 13 OL 64 01 05 00 03 CO OO ssesiissesssssss OOUDULOO TC 7C OL 54 BF 2B SD AS 30 33 47 39 30 36 30 Sl 03G9U601 Oo to ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license AN003 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x gen
60. d correct only small deviation is possible 7 1 2 Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 3 TT and read EEPROM Currently for the software versions we know the login can be located as described above and the odometer starts from address OxAA to address 0x1C8 marked in the picture below 00000000 00000010 00000020 00000030 00000040 00000050 00000060 00000070 00000050 00000090 000000AD 000000B0 D00000C0 DO00000DD OO0000E0 oOoO000F0 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 00000150 00000190 00000130 000001B0 000001C0 000001DD 000001E0 7 1 3 VW Passat usually these Instruments are before year 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed odometer is displayed as 0 but can be changed When the Change odometer button is pressed a dialog appears where the current and the new odometer values should be entered 7 1 4 VW New Beetle First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succe
61. d Key ure Audi A2 all OBD K not needed TPO8 Procedure 1 Audi A3 2003 OBD K not needed TPO8 Procedure 1 Audi A3 2003 2007 OBD CAN Key programmer TP25 TA5 Procedure 4 Audi A3 2007 OBD CAN Key programmer TA5 Procedure 5 Audi A4 2003 OBD K not needed TPO8 Procedure 1 Audi A4 2003 2008 OBD K Key programmer TA25 Procedure 6 Audi A4 2008 n a Audi A5 S5 n a Audi A6 2004 OBD K not needed TPO8 Procedure 1 Blank key for Audi A6 RS6 2004 OBD CAN Abrites programmer OTIAG Procedure 9 Audi Allroad 2004 OBD K not needed TPO8 Procedure 1 Blank key for Audi Allroad 2004 OBD CAN Abrites programmer Procedure 9 Q7 A6 Blank key for 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Audi A8 2002 OBD K not needed TPO8 Procedure 1 HITAG 2 Key pro PCF7936 or Audi A8 2002 OBD CAN grammer key Procedure 7 HITAG 2 Key pro PCF7936 or Audi A8 2007 grammer key Procedure 8 Audi R8 na Audi TT 2005 OBD K yes TPO8 Procedure 1 Audi TT 2007 OBD CAN Key programmer TA5 Procedure 3 2 VW Golf5 08 2006 OBD CAN not needed TP23 TA3 Procedure 2 VW Golf5 08 2006 2008 OBD CAN Key programmer TA3 Procedure 3 1 VW Golf5 2008 OBD CAN Key programmer TAS Procedure 3 2 Seat Alhambra 2000 OBD K not needed TP22 TA2 Procedure 1 Seat Altea 08 2006 OBD CAN not needed TP22 TA2 Procedure 2 Seat Altea 08 2006 2008 OBD CAN Key programmer TA2 Procedure 3 1
62. d push the Learn button Then follow strictly the recommendations 3 5 11 8 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 For vehicles after year 2007 or Audi A8 you need to prepare a Hitag2 key transponder before you use the key learning function You can use a virgin transponder PCF7936 or a virgin key 1 From Special functions Key Learning choose vehicle model Push Program dealer key The following dialog will appear 2 There are following possibilities 2 1 Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not Dealer key with Hitag2 x Autodetect from ECU C Lead component protection data from Kessy ECU durrp r Program from Kessy ECU dump C all bytes of the component protection data component security are know Program transponder from 7 hutes Component prolestior byles id all si 6 Program Find the 7th byte of the component protection data Find 7th byle ard program transponder sg r i Find th byte ee protection bytes dd jao E Se f 0b val Program from working Logn 1372 Trying bytes 022 Take key OUT and place into piogremmer IMPORTANT If you don t hav
63. d then save the dump Dump Toal ig x ECU EDC16 Odometer calcularor 35320 Tyne oooooo Ro 00000090 Oooooo ao DANO GOONAITEN Enter new odometer value and press buiton Changs oe om 31 00 42 20 oo un 42 zu oo 24 54 gt FF 12 06 31 04 20 00 0a 20 20 00 2 30 F3 sl 04 2F 05 39 2A 52 20 oo Z 5z 20 oo C5 30 CS 37 op 2F 08 20 10 34 20 oo 10 34 29 go 72 30 72 2b 43 3L oa 20 75 20 20 00 75 20 20 oo 49 30 49 31 54 30 2h oo h 32 20 oo 46 32 20 00 30 E7 32 sl 33 10 oo 30 2c 37 oo 30 av 3 oo BA 30 BA 2D 30 37 75 oo 33 30 33 00 33 30 35 ng co 30 CD 30 33 33 k l6 47 ac 37 00 4 4E 37 oo DA 30 DA 34 37 37 30 sc 39 4 a 31 ou ag 20 31 oo p oo O 30 Dp 10 37 36 33 DS 36 00 00 36 44 3 00 oo oo oo 18 34 36 31 oh 30 43 oo oo 30 43 oo oo 56 Fo sg 31 37 30 18 32 20 48 09 32 20 46 09 57 gt 57 34 FF 8 16 12 04 00 36 Fo 31 Fi 31 20 oo RY 31 20 00 E3 5A FS SA 39 36 E3 2 El al 20 oo 6E al 20 pa BE 43 55 43 Re ES eh ee 9 2 071037374105 B 741037372667 RER u 0281012 130 ale oan 0 036906021 B R4 2 01 EDC 7831 H RB R4 2 01 EDC 1871 H Siete asin YUZG ZO00000000 U Beetle seeen VUZE I gt ECU EDC16 Security ac
64. ded 3 4 5 Clear Diagnostic Trouble Codes Clear DTCs will clear all stored DTCs inside of the unit 3 4 6 Measured values Measured values provide you a possibility to check measured values in different groups You can enter manual number of the group or use to increment or decrement the group number Measured Values Power Supply Channel C e Votage Terminal 30 Yollags Stetus TERMS Stes Terminal 1500 amp Contact Status ecivoted The button Scan all will generate a file with all measurement values from all groups Measured alues za x Immobilizer Channel Pen ll eC VYarable Code authorized ves Key Status Transponder a Lack Fed Code authorized BS Immobilizer Status 60 Some important measured values The most used measured value is the key recognition in the immobilizer The key recognition is made on channel 2 if the Immobilizer is by CAN or on channel 23 if the immobilizer is by K Line The only exception is the Q7 A6 Allroad where the recognition is made also on channel 23 3 4 7 Security Access Security Access gives you the possibility to perform security authorization on different levels Security Access p xj m Secutiy access parameters Standard Type C User defined Security Access Login Security Access CS 233 ic Value DEC Value HEx Security Access System 3 4 7 1 Standard Security
65. e TP2s from TA2TASTA4 TASY Procedure 2 Viwi Seat Skods after 09 2006 For SEAT you must use Yirgin key cr Transponder TP22 For Vw you must use Virgin key of Transporder TP23 For SKODA you rust use Virgin key or Transponder TP24 2 1 Erte secunty access code and number of keys 2 2 Tumigniton ON new or existing key 2 3 Press button Lean 2 4 Foi some Vi SeateSkoda vehicles itis possible to add new kes without the iemaining key sop to work You wil ri asked whether ycu wani to use this fealure Please answer with yes no accordng your wishes if prompte 25 Wait until adaptation finished is displaved 2 6 Remove key and lum ignition on wilh all remaining keys NOTE If you have an TA2 TA3 TA4 TAS5 transponder and a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer This is done by using the Make TP2x from TA2 TA3 TA4 TA5 button This requires only a connection with the Key programmer no connection to the car is needed The key learning procedure when have a Tp2x transponder is the following 2 1 Enterthesecurityaccesscodeandthenumberofkeys 2 2 TurnignitionON neworexistingkey 2 3 Pressbutton Learn 2 4 ForsomeV W Seat Skodavehiclesitispossibletoaddanewkey withouttheremaining keystostopworking Youwillbeaskedwhetheryouwanttousethisfeature Pleaseanswer withyes noaccordingtoyourwishes ifprompted 2 5 Waituntiladaptationfinishedisdisplayed 2 6 Remo
66. e a working key from the car you will need to short the fuses as described in the appendix to get communication with the ECU After the component security is read if you ve all 7 bytes then you can program the key directly If you have only the 6 bytes you have to choice a if you have working key from this car you can put it into the programmer and press the Find 7 byte from working key the 7 byte will be found in several seconds NOTE If you use the Tango programmer this function will not work the function work only on Hitag2 or Abrites key programmer b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty tran
67. e button lo save the changes al 20 pa 6E 43 55 43 17 13 04 271037374105 B 71037372667 REN u 0281012 119 as 1 036906021A B R4 2 01 EDC 0 0369060218 B R4 2 01 EDC Kj gS ee ae Soen reper eeseeces n See Els occ ee e VIE Z000000000 0 Gee Elves cce e VUZE S Swap bytes LAA ECU MED 9 x Reset component protection data 95160 Required license AN009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer _ _ a xj Type ECU MED s Rese component pictection data 35160 i 38 a5 2D 32 35 veas8e 05 07 29 Load dump FF FF 30 35 2D 30 37 2D 32 39 08 LO 18 49 05 47 05 07 29 1 29 07 05 10 37 48 31 30 32 37 33 37 37 34 33 39 7H1L037377439 Seve dump 02 02 2F 27 31 30 33 37 33 37 32 34 49 36 FO AR ned Pantene 75 01 03 AS 54 69 96 CL 3E QO 00 00 3F 6 1B DA 08 Zi Ase san WET
68. e clicking on the desired device Instead of displaying all possible units you can choose a configuration of devices corresponding to specific car model chassis type This is done by selecting the type e g 1T VW Touran from the Chassis type combo box Then pressing the Display button will show all devices which can be installed into this car type Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protocols will be used when scanning for the devices For all devices which the ABRITES VAG Commander finds a detailed information is displayed in the main screen For each device the following information is shown VAS Number Unit name VAG Number returned by device in the device identification Description returned by device in the device identification Coding returned by device in the device identification Part Imp Supp N Part number Importer number Supplier number information is shown separated with spaces also returned from the device in the device identification DTC number of DTCs stored in the unit Instead of scanning all units which can take a while the user retrieves the list of the installed devices from the gateway by pressing the Gateway config list button www ecutool com Email amp MSN info sinosells com Since clearing of the DTCs for all
69. e connection with the hardware is examined If no problem appear then a message Connection OK should appear The main screen looks like this www ecutool com Email amp MSN info sinosells com ABRITES Commander for YAG 5 0 www abril ine Zc j x e Wie meme VAG Number Description fore coding ai oo 01 Engine Control Unit Master 02 Transnisson 03 ABS 04 Steering Angle 05 E2ZS Kessy Entry And Sta 065 Seat menory passenger E 0 Control head 08 Climwatronac auto HVAC Coriniect 09 Central Electric AA OB Air heating oc 11Ge door left A Specilhachons as Weticl Selaton Broadcast Options 2 j 2 E gt ao AR Instrument EZS Kossp instrument Engine Conii Micronas Kasey TY scbvatioy Keyleanng Dump toz CAN OQ 7426 K Line Un LDEI32 adaptation ED1JED2 al fee AR a Airbag Ww Calter Custom PIN Converter Services Remote Navigation Liuss control Brake pace ReadAwit interval convel a system change Eal ATTENTION Make sure you are running the ABRITES Commander for VAG from its folder If you are using a shortcut to the ABRITES Commander for VAG please be sure that the working folder parameter is set to the folder where the executable is placed If the working folder of the shortcut is not set the K Line may function incorrectly www ecutool com Email amp MSN info sinosells com www ecutool com Em
70. e diagnosis K wW1281 Skoda Roomster k line diagnosis K W1281 Skoda Scout LAN Skoda Fabia 1999 external immobilizer box Kw1281 New key count Login Security code 1 1 Enter security access code and the number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining key stopping to work You will be asked whether you want to use this feature Please answer with yes no according to your wishes 1 5 Wait until adaptation finished is displayed 1 6 Remove the key and turn ignition off with all remaining keys NOTE The system will autodetect whether it is possible to add the key without erasing the remaing keys If possible and if 1 key is selected then and only then a message will appear where you ve to confirm that you want to add the key If you press No here the key will be learned normally other keys will be erased If you select other than 1 key to learn or if adding is not possible than the key will be learned normally with erasing other keys which are not present For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 Please pay attention that during the autodetection whether adding is possible reflashin
71. e mem Diag session Session lo In this dialog is needed to clarify the diagnostic session which you want to be entered before start of read program memory In the example above it is used session 86 If you want to save currently running diagnostic session simply enter session 0 3 5 9 Special functions with Airbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Awrhag xj Connection type Ch ECU ive Manual base ipype v Read EEPROM 7 AUDI BOSCH 1997 2000 AT Hannenan Mo mAYDI_BOSCH_2001_2003 ooocooLo oo ouJAUDI_BOSCH_ 2003 _ i 00000020 oo VW SIEMENS ALL SOD Teor ice ts White EEPROM p0o00030 GO OO HIG BD ce cece ences N0000040 00 ANETTE OO eee noooonsa oo 0 No j 10 CO DO 00 00 00 OO znereneee rennen 00000059 OG HBERI300 Of einan anne 00000079 0 0 00 00000030 DO GOGO Diener nnononan on DO CO 00 OO DO Save to file DOOQOOLD OO 00 I E OO DO ooocooso i DO HODAO DE eracsaias caaan ooocoocs 00 D0 00000000 90 nonnnorn on J Anae epa eea BI y A OOOCODFY U a oo DD000190 90 DD000110 00 D0 00000120 DO 60 00 00 POP asiasia eaa ia Wian 00000130 nO i no I DD wen DODOUDLAO oo 00000150 00 DD000150 D0 00000170 86 O84 ia A EA T T 0000080 0 10 l t oo 0 I Be For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request but the cr
72. e pay attention that the writing the invalid immobilizer data may causes the car to stop working For that reason it is better always to make a backup of the data read If you want to make a key you need to read the immobilizer data first Then you should have a programmer connected and to put the appropriate TAx transponder inside After that 1 key is added to the existing keys This means that existing keys continue to work NOTE It is possible to have 8 keys per car If all position are full the key is not added but replace the 8 position NOTE Pressing the Add key button programs the transponder as a dealer key and puts the transponder ID into the immobilizer data But the data are not written in the microcontroller yet you ve to press the Write immo data button to write the data Or if you want since you ve a dealer key at this moment you can exit without writing data and later learn the transponder by diagnostic IMPORTANT Sometimes the read write procedure may fail If you ve a message that controller cannot be read written you ve to retry several times If after 6 7 attempts it is not possible e g to read the odometer or to read the immobilizer data this means that the wiring is not correct or you selected wrong device type NOTE Sometimes writing of the data may fail In order not to lose the information all written data are backed up in the Dumps subfolder 3 5 6 Special function Kessy adaptation Th
73. e window Kessy adaptation can be used for adaptation of brand new kessy units to the car This adaptation can be by CAN TP2 0 K KWP2000 and also can be used with Porsche Cayenne To perform this adaptation you need to know the security access code of the old immobilizer of the car WFS Security access code and also the Component Security code of your new kessy unit Kessy Adaptation Bi x Kessy adaptation 4E 0958520 1534 saun ES ace code WFS ace code Coding C 20bit 2 7 2 14342 7068 Adapiation 28 toby Me 3 5 7 Special function MMI TV activation Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF Covered vehicles are e Audi A3 S3 e Audi A6 S6 MMI up to July 2006 e Audi Allroad MMI up to July 2006 e Audi A8 S8 MMI up to July 2006 e Audi Allroad MMI up to July 2006 e Audi A6 S6 MMI starting from August 2006 e Audi Allroad MMI starting from August 2006 e Audi A8 S8 MMI starting from August 2006 e Audi Allroad MMI starting from August 2006 T Activation xi Speed Limit 0 km h G Edini Ediion2 Use the following rule when enabling TV if the car is before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is after 2007 it is better to try at first with edition 2 3 5 8 Special function Custom memory access Download Uplo
74. eded proceed as described above If not succeeded select type Magneti Marelli Shadow 1 and read EEPROM The login is not displayed The odometer is displayed as 0 but can be changed When the Change odometer button is pressed a dialog appears where the current and the new odometer values should be entered 7 2 Porsche Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox 7 3 Audi A8 fusebox passenger side wakeup ECU 7 4 Audi Q7 To get communication with the ECU you need to short the fuses as shown on the picture below If not succeeded to communicate with the ECU then you should try as on the picture below If you re still not able to get communication with the ECU it is possible to make short of the external fusebox it is found under the front cover where also the engine is You ve to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you ve to use a bigger cable because if you use a small cable it can become hot 7 5 Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below 7 6 Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below 7 7 VAG K CAN Commander key learning procedures Programmer Transponder Key Learnig proced Year Solution neede
75. en and so on If you ve already read the component security bytes previously e g by dissoldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and proceed as described in step 2 1 3 After the key is programmed like a dealer key write how many keys you need to program write security access and push Learn button 3 5 11 9 Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 It is possible to program a key for the Audi A6 Q7 Allroad but this function is not located in the key learning dialog The function is available in the EZS Kessy A6 Q7 function from the Special functions list This is so because it requires separate license Please refer to section Special functions with EZS Kessy CAN 3 5 11 10 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 If such car is equipped with EDC17 MED17 then it is not possible to read the component security from the engine control unit Instead it is only possible to read the PIN code from it Fortunately it is possible to program a key for such car You need to read the PIN from the EDC17 MED17 and also to read the comfort module EEPROM with a programmer Then you ve to select VW Passat B6 CC with EDC17 MED17 CAN from the key learning dialog To learn a key to this car you should make first a dealer key This is made by pressing the Program dealer key button which brings the following di
76. ent protection 36 2D 30 36 20 31 35 00 8 05 06 15 amp xj Swan tutes LH 24 38 FF FF 30 nondnon OO EC BE a Hid urcipoted login 59234 New iLnorypted logre 123413 Component security pectection seal J s Oldfureypieiee 12 fas az fe 34 fre Jo New uncnpted CS fiz fo t ar Da fac 0 Uncypted dala can be read from the instiumentor ftom Ihe MED ECU through the OBDI ECU MED 9x Immo bypass Required license AN012 B This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED x require only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Dump Tool Type T Ecu MED 9 x Immo Bypass v 0000000 0000010 01 00 08 02 ol AS 01 Bis 02 30 20 39 02 30 20 39 03 3 00 04 33 os 30 06 OE 07 00 07 00 2c 00 02 02 05 03 AS 04 33 20 31 n4 39 20 31 0A oo 03 32 03 30 02 74 02 00 02 0g Immo is now ONIH 4c 30 07 2F AS L4
77. er and the ECU Dump Toal 31 CI 1 1596 02 00000910 16 31 35 38 36 2E 30 E3 00 FF FF FF FF FF FF 1586 02 00000020 FF FF FF FF FF FF FF FF FF FF FF FE FF FY FF FF 0 2 ccsccnccee 00000030 FF FF 2F 2F FF FF FF FF FF FF FF FF CL OL EI 00 ffisccccsccees 00000040 66 CO ES 99 00 CO FO DS 00 00 00 00 OD 00 EE OO Eu een fis o00009S50 66 DO ES O0 00 CC 35 C5 00 N0 DO OO 18 87 FC 85 52 2 00000060 66 00 DO OD BE BF BC 17 OO B3 FF FF 00 00 BA BS f 00000070 00 00 BS OB 96 DT ES CE OL 00 FF OO O09 00 DO OO elle ooooooRo FF QO 00 00 00 Of OO Oo OO 00 0O OO OO OO OO OO LLL Lee cooondsn 00 DE 00 OO 00 un HO 00 OO 00 OO 00 OO 00 OO OO 222222 Tagge treno Brit DONDOTAD 00 00 OO OO 00 00 00 00 DD 00 DD 00 00 00 OO OO oe eee eee eee GOODOOBO OO 0O DO OQ 00 00 OO DO 00 00 GO OO AO 00 95 FF eee epee eee ee GOODODEO FF FF FF FS FF FF FF 1D 00 00 FF FF 03 24 05 02 5eeeee DODDOODO DZ OZ 00 26 OL 00 DO 00 EA OC 11 05 40 40 02 OO f eee Gf DODOQOED 26 01 OD 09 0U 90 02 16 45 02 02 OO FF 28 01 OO E f OOOOODOFO 00 05 AZ F4 21 05 06 US D2 00 26 DL 00 00 SB 11 5 f 0e OOODILOO 05 46 45 05 08 0U O04 25 DL 00 UG 05 43 Ab 46 OS FE ss lee f Immo is now OFFI The Toggle Immo On Off button allows to switch on off alternatively the bypass function Gateway Odometer resetter 95160 Required license None This function resets the odometer v
78. eration which are accessed through CAN for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Toal x Type ECU Simos 7 CAN Secunty Access Code 93076 S3C86 x 1118NL 0L300 H Load dump Save dump 00000040 01 00 O1 09 OL GO B3 SA 55 1B 66 D4 B3 64 65 1B je je Swap bytes LAH 000000950 66 DA B3 SA 65 1B 66 DA 00 01 00 Ol OO OL 14 CP je f 00000060 14 C7 14 C7 0O no 00 00 00 00 AG B2 AO B2 A0 B2 2 00000070 56 57 SA 43 54 30 30 30 33 33 33 33 30 30 56 57 WIZC2000333 3moviT GCOODDOBD SA 43 SA 30 30 30 33 33 33 30 30 30 56 57 S 43 2020003330 009W2C 00000090 S Lo oO 30 30 30 30 33 33 30 30 597 56 57 54 SA SA Z000003500WVWZ22Z ooocadan 33 43 5 amp 4 38 33 33 33 33 33 33 33 57 56 57 SA SA 3026333333322 QHOOOIOBO 4 33 43 SA 38 50 31 33 33 33 33 33 57 56 57 5A Z3C2Z8P 1333330 OOONOICO S S 33 43 5A 38 33 33 33 33 35 33 33 00 00 OO 2236283333333 DONDDIDD FE IC 30 39 30 37 30 33 47 39 30 36 30 31 38 46 1090703CS06015F DODOQOED 47 20 OD OO nn 00 DI 05 00 03 15 OF OL L 01 B46 eee Rn HH ER DODDDIEO 01 05 00 03 L 07 OL 15 OL 84 01 05 OD 03 0U OO esvireenennunn CO0DILIU TC TC OL 54 57 20 SD AS 30 33 47 33 30 36 30 Sl Il 7 03690501 5 ECU Simos 7 CAN Reset component protection data 93C76 9
79. eses oa dQee gt s s COVE wiser Diran ur WAUZZZALSTU 091210 WAUZZZ4L37D0 031210 WAUZZZALITDO 912l0 s s s H05 BPG810 1 J240l0lSC sses 0389060326 000 vee TERET ALET ee ee ee eee ee ee ee es Toggle Imma OnsDif ECU ME 7 x Set component protection data 9P08 95080 Required license AN009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Tyne ECU ME 7 Set component protection data 9P03 35980 r 20 20 20 Sh no 12 30 35 30 32 30 33 54 OL OL DG 43 DS 7L LC 00 OO 69 EI 00 AS SL FE n Ces Iree 0000020 05 01 OL 00 43 DS 71 LC 00 00 69 Ci OO AS SD FC oe Cge 20000030 04 DL DA AC DS OC ZP Al BO 15 55 00 00 OO Al FB zur ERE RT SA Fr 0909040 04 OL DS AC DE OC ZD Al BO 18 5B 00 00 OO AD FB aenene mens Leese SASER 0900050 07 OZ 80 02 EO Ol 05 00 26 04 58 OD 07 00 FL FD i s BR 2 0000060 06 00 57 OD 09 OE 00 00 18 03 00 00 00 00 54 FF s sssssssrsre T 70 05 BL ZZ PH Er a 05 00 a gt ve a x He ee eee 7 FA 0000060 05 04 22 0 5 05 000 EEEE cema F mwan a a E ew t OO e e ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access code which is contained into the ME7 un
80. etimes there are 7 bytes Ifthere are 6 bytes contained then the 7 byte is zero Domp Tar x Tyne ECU Simos PPD 1 Reset component protector data 31 30 00 o0DOHALO OO OO DO 48 00 00 DA 46 00 AO 08 38 00 LE DO OO H K 8 00000020 DO FF 80 80 80 50 80 80 96 80 80 80 80 DU BO BO eee eee nn 00000030 OO FF 19 9E 59 2C 59 ZC 59 20 94 50 94 50 94 50 3 P P 00000040 C1 00 DL 00 Cl OO DY 12 52 79 BZ E3 DI FZ 32 79 a s ss TRY ERY 00000950 BZ E4 D9 72 52 79 BZ E4 A4 00 Ad 00 Ad DD 00 00 ERY weer 33 ra RA _ 5 3 hi B 482 85 51 84 9B 80 33 81 09 Sl 08 83 vl Q 7 ne Tees 2 IB F4 80 DE 30 30 33 47 39 30 36 30 31 O 003G90501 g i rf i Ze wo ECU Simos PPD1x Security Access Code Required license AN007 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Bump Tool Type ECU Simos FFO1s Secirily Access Code bd 00000010 00 00 00 48 00 CO 0O 48 DO 00 08 38 O0 IC OO 0O H H 8 00000020 00 FF 80 8D 80 80 80 80 96 80 80 80 80 00 80 ED TERT 00000030 00 FF 19 9E 59 2C 59 20 59 20 94 50 94 50 9A 50 Y Y Y P P P 00000040 01 00 O1 00 OL 00 DO 72 52 79 B2 EA OD 72 52 79 rhy rRy fap oon00050 B2 Ed D9 72 52 79 B2 E4 A4 00 Ad 00 Aa ON OO OO ePy 2 00000960 00 GO 00 ON 80 00 80 00 50 Da 33 Ca 33 CA 33 CA ice anaes Login 3282
81. eton Porsche Cayenne and Bentley Continental The function also displays the learned keys and visualize change the immobilizer and VIN numbers Bump Tool x Type IMMO KESSY Audi AS V Touareg Phaeton Porsche Cayenne Bentiey Continental 93086 X Swap bytes LAA O0000950 35 57 AB 34 37 30 32 31 DA S 42 52 42 34 78 DA SUKA7021 VERBAx onnnnasn 56 42 52 42 34 78 DA 55 42 52 42 34 78 05 04 OO VERRAx VRRBAx ao in SVE 00000070 00 FF OS 02 00 G2 FF Ol FF FF FF FF OL FF FF FF 2 2 e lee Login 5767 ooooooeo FF OL FF FF FF FF OL FF FP FF EF OL FF FF FF FF 2 2 00000040 00 OF OF AB 33 44 30 39 30 39 31 33 35 46 20 D7 K3b090S9135F Inmo numbei 00000090 01 FF FF EF FF Ol FF FF FY FF 01 FF FF FF FF D2 OOONONAD 01 70 56 57 54 33 54 30 43 31 30 33 34 34 39 30 pVWZ320C1034490 REITER QO0000B0 oi 00 ON GO 00 0O 00 00 29 00 23 OS OR 00 07 O3 eBe eens FP cooog0co 01 00 00 HO L 00 0000 OL 00 00 OO OL OO BA OO see cee eee ee ye ee 00000ODO 01 00 00 O00 OL 00 OO 00 ZD TA AD FO 7B 9B FO FZ s s s Zu dee k WWV OZZL 0000 O0DODOOEO 9C FO 53 A3 FO CE 65 90 FO 65 SO FO OO 00 00 OO AE IAES oo000oro 00 00 01 OD 00 ES EB ES 7D 35 AK FO CZ 2B Al 75 ee rl DOUDOLDU Fo BO 80 45 OL OO VF VE DL 00 99 ZC 6C UL UU DO Kis rece clans ie 2 Pressing the other data displays the learned keys and also allows changing the immobilizer status on some models changing the immobilizer status
82. g from battery For example this always happens for the Bosch clusters which will be blocked if accessed as Instrument cluster VDO66 VDO86 Motometer type NOTE Please be very careful when selecting Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instruments You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi A4 BOSCH RBx 2 Read the EEPROM 3 If the displayed odometer corresponds to the real value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH RBx otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 Take into account that most instrument clusters need a Reset after change of the odometer You can try to send a diagnostic request for reset of the cluster button Reset ECU If this service is not supported you need to remove the fuse of the instrument cluster and to connect it again NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery
83. g of the instrument may be needed for newer cars 2007 so you will be asked for that You must use Keys or transponders TP05 TP08 TP22 TP23 TP24 Note some of the new vehicles need to remain with ignition ON five minutes before starting of the key learning procedure VW Golf5 Skoda Octavia Il VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with ignition ON until programming becomes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007 VW Polo 2006 Seat Ibiza 2006 3 5 11 2 Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA For this type you will need a virgin key or transponder TP22 TP23 TP24 depending on the type of the car as follows For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 You need to choose from Special functions Key learning VW Seat Skoda 2007 CAN Key learning x Yehick model ERE Serer New key count 0 Make TP2k rom TAX TAU TAPTAS Logn Securty code 0 You can teach bgn code using special functions cf nstrument inmobilizsr main panel Another way to reach logn code i to exirast it from the ECU special function Engine Cortrel Unit ATTENTION You can produce TP2x transponder from the corresponding TA2 TA3 TA4 TAS transponder using your Tango programmer and pressing he button Mak
84. he Engine Control Unit window Make a quick Ignition OFF ON at this point 2 In case of ME7 x or ECUs from Porsche you can read the flash memory like reading of the EEPROM the only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length If you experience problems with reading ME7 x memory better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please notice that the flash which was read is saved automatically in the Flash subfolder and can be used in case of any failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write it In case of failure during the flashing the device should enter into a boot loader mode which will allow to flash the device but not to read it The flash can be then restored with the Custom Read Write function 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flashing 6 Please take into account that the reading writing of the flash will take a long time especially when CAN connection is used as result the battery may become flat HINTS when reading writing EEPROM memory of ECUs 1 If you experience problems with reading ME7 x E
85. he button Save Adaptation En Channel SU Personal Ident fication Number FIN Adaptation CHANNEL iso as Enter Seon ll Stored value 32000 Testvalue 12336 Test New value 9995 The button Scan all will generate a file with all channels and adapted values Some important channels used for adaptation Channel 50 is used for adaptation of new parts Usually to get access to this channel you should make a security access with the Login of the device to which you re connected and which you will adapt to the car After you gain access to the channel 50 you should put the Login PIN of the car to which you adapt the new part Channel 21 If the Immobilizer is by K Line then on channel 21 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made Channel 1 If the Immobilizer is by CAN then on channel 1 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made 3 4 9 Coding of the unit Coding will open for you a separate window where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding x shaortup to 23 bits 1312 bei Not supported 03 Net supported New coding value M Set coding type manually 12 bit coding
86. he car doesn t have any working key it is not possible to give ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you ve a car without any valid key you will need dismount the ECU and connect it on the table or to connect the CAN wires of the ECU directly to the interface NOTE For the key learning it is needed to give ignition with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock but the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to make ignition ON with each key which you want to learn NOTE Sometimes during communication with the immobilizer it is possible to lost communication with it so you will need to repeat the procedure in this case 3 5 11 Special function Key learning Inside every key there is a small chip called a transponder In most cases this chip doesn t require an external power supply but is supplied from the magnetic field which induces electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general there are five different types of immobilizers trans
87. he communication port COM port used by the programmer This is made from the CDC32xx port combo box If the port is properly set after starting any activity the LEDs of the CDC32xx programmer will start to blink If they re not blinking this is probably indication that you don t selected the port properly From the Type and Device combo boxes the user has to select the car type or the microcontroller type For each selection there is a possibility to view the wiring PIN outs using the Connection diagram button If the user wants to read the whole Flash EEPROM he have to select Micronas Secured from the Type combo and then the microcontroller sub type from the Device combo Type Micronas Secured Device CDC3217G secured domete ____ 0032726 secured CDC3297G secured meta sense COC32xxG secured gt 24032 ICH If CDC3217G CDC3272G or CDC3297G is selected the user will be able to read write the flash memory If CDC32xxG secured gt 24C32 is selected the user will be able to read write the EEPROM memory If the user wants to change the odometer read write the immobilizer data or to make a key he have to select the car type and the model in the appropriate combo boxes Changing the odometer is made from the Read odometer and Write odometer buttons Reading Writing the Immobilizer data is made from the buttons Read Immo data and Write Immo data Pleas
88. hen the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Tyne ECU MED Rese component pictection deta 95080 5 97 ES 81 38 30 35 3 39 00 8 05 07 29 FF 30 35 2D 30 37 2D 32 39 08 L0 18 49 05 4 05 07 29 1 6 07 US 10 37 46 31 30 33 37 33 37 37 34 33 39 741037377439 OZ 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037572496 03 AS 5 amp 69 96 Cl SE 00 00 00 SF 61 15 0405 21 7 5 278 37 AB OB 37 36 3C 15 00 01 00 00 00 BC F7 BS we Cece wees 03 AS 54 63 96 Cl 3E 00 00 00 If 61 15 D4 05 Zi rm sc ta 37 AS 0B 37 86 JC 13 00 01 00 00 CO BC F B2 wee Fede aie ewes 0200000 TT x Seber ee f i ie fo fo le fo Fangel Swap bites L H ECU MED 9 x Security Code Checksum calculator 95080 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software
89. hich you wish to replace it called in the application replacement ECU After opening the application load both dumps using buttons Load active ECU dump and Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in the replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device after that ECU Exchange Dump Tool x Choose ECU type EDe16 Load active ECU dump Load replacement ECU dump Change terlaeemen EEU dirin Seyeresiacei ent ECU dyin 3 5 19 Special function Door unlocking This function is dedicated to open the doors of the car when the car is in SAFE mode To use this function you will need to connect manually some PINs of the VAG Interface OBDII connector with cables to the wiring of the CAR So you ve to find somewhere in the car the desired wires orange with green CAN H and orange with brown CAN L and you ve to connect them to OBDII connector PIN6 CAN H and OBDI Connector PIN14 CAN L Also you ve to connect OBDII Connector PIN4 Ground to any metal part of the car After you re ready you can call the Unlock doors special function Following dialog will be displayed Door unlocking Unlock Unlock Yin Touareg Phaeton O7 A6 Allroad Audi AS Unlock Porsche Cayenne OBDII Pin 6 lt gt CAN H forange green
90. hing the VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can proceed like in the case Learning dealer key purchased by VIN number NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 3 5 11 7 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne You must use a virgin transponder PCF7936 or a virgin key no need for some special preparation If you use a Transponder you need to switch it in Cipher Crypto mode You can use your Key programmeror HiTag2 programmer for that purpose if you have one This is done by replacing 0x06 with OxOE in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already 0x0E then the transponder is already in cipher mode After the transponder is switched into cipher mode the key learning procedure goes as follows From Special functions Key Learning choose vehicle model Write how many keys you need to program enter security access an
91. is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable NOTE Abrites TAx transponders are NOT writable but they are unlocked internally to become writable before preparing them as a dealer key transponder Key transponder learned Indicates whether the transponder ID is recog
92. it 10minutes before you continue ATTENTION For the Passat B6 there are some cars for which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of the component security from the engine you can extract the 7 byte from the comfort module EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you ve attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand whether for the desired car is possible by performing the following procedure a Connect with 25 Immobilizer and go to Measured Vaues Channel 2 b Put the original key or key with TA3 transponder in this case in the Measured values you should have yes or 1 on the second possition of channel 2 c Eject the key so there is no key in the ignition lock If the second positions changes to No or 0 you CANNOT search for the 7 byte If the second positions remains Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned 3 5 11 4 Procedure 4
93. it It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0x120 bytes because after that area the EEPROM sections are different for each different software version of the ME7x unit Fortunately the most of the interesting data are found in this section Dump Toal xl Type ECU ME Tg Securily Code Checksum calculator IP08 350E0 x 0000000 OO 80 s So 80 Of DO 80 D 80 a0 FF OO 00 J8 FB 2 x O0OQOQAO 00 80 80 80 80 00 OO 80 0O 0 8 amp 0 FF OO OD 28 FB oe eee eee Ke HOOOIIBO 05 07 DO DU 10 57 41 55 54 54 00 00 90 00 36 FE WAUZZ 8 GOONONEN OF 07 OO OO 10 55 41 55 5A 4 00 O0 00 OO 38 FE WARE 8 QOOOHIIDO 5A 34 45 36 33 4E 30 30 37 35 39 35 4 00 EC FC ZE5300075558 DODOOTEN 5A 34 45 38 33 4F SO 30 37 35 39 35 41 00 EC FE ZIE53N0075958 DOODDIFO 55 6 33 5A 30 43 31 33 31 30 34 34 33 00 E4 FC UXSZ001510443 OOOOOLOO 55 56 335 5A 30 43 31 33 31 30 34 34 33 U0 E4 FC UMSZ001510445 j gt Checksums inthe file updated Press the Save button lo save Ihe changes ECU EDC15 Immo bypass 24C04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobiliz
94. it in the car before proceeding To help you in this operation there is a button ECU type help which will ask you for the model and engine and will give you the possible models of ECUs There is also a Autodetect function implemented if you select the ECU autodetect then system will try automatically to find the ECU type Please pay attention that this will be not always possible especially for EDC17 MED17 ECUs You can choose ECU type VAG EDC 15x VAG ME7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCHVAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG CartronicME7 8 EDC16U1 EDC16U3x CP etc Extractingsecuritycode odometercorrection enabledisableimmobilizerandsoon Example is 1 9 TDI EDC15 Engine Control Unit Special Functions Choca ECU type VAG EDCTSx Wille EEPROM EERE dda 514 1364 14 Save to He 00000929 i i 00000030 ar 2F REDEN DE aa 2 Loadtomfie Odomeier fi 272400 Change poonpoca 2 N 00000000 ET AS Feist en NO0H0IEO 28 ac Yao t NER D00000Fd 3 03 ya Immer 00090199 a 00000110 00000120 00000139 HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of t
95. lability firmware version and interface ID You are able to perform also test of the K Line but this requires that the interface is connected to the OBDII since the K Line requires 12V Also results from detection of the interface and K Line test can be saved into a file if Dump file field is entered and Generate dump button is pressed This dump file should be sent to the producer if there are problems with the interface recognition 5 ABRITES VAG Ubpopate Request The ABRITES VAG Update Request tool is dedicated to inform you which is the latest version which is released from the producer and to allow you to request a compilation for your interface The ABRITES VAG Update Request can be used also if you have problems when running the ABRITES VAG Commander as described in the Troubleshooting section Yie YAG K CAN update request xl Last SW released from Abritus72 rm a VAG K CAN commander 4 1 Check latest version m Request data Contact person Peter Adams e mail peter adams yahoo com Interface ID e003 x Pressing Check latest version will connect through the Internet to the producer homepage and will return to you which is the latest released version If you want to receive this latest software or if you have some problems as described in the Troubleshooting section you should enter the Request fields and press the Request button 6
96. mmo IV systems but also can be programmed with the Key programmer for use in Immo V system i e they can also be used for producing dealer keys For some Cars a special programmer is needed in order to prepare the key to be like an ordered from the authorized VAG dealer Currently following programmers are supported Hitag2 programmer used only to program keys with Hitag2 transponders PCF 7936 PCF794x Such cars are VW Touareg VW Phaeton Porsche Cayenne Bentley Continental Audi A8 Tango programmer used to program Hitag2 and Megamos 48 crypto transponder Abrites Key Tag programmer used to program Hitag2 Megamos 48 crypto transponder and Q7 A6 RS6 Allroad keys The Tango programmer and the Abrites key programmer are referred as key programmer in the following description Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car to which key learning procedure belongs Starting the key learning special function will bring the following dialog Key learning J E x Detected car type KwP1 281 extemal immo box recognized Vehicle model YAG external immobilizer box KW1281 v New key count a Login Security code fo a Login Security code Engine start permitted fY5 Dealer key transponder No j Hock timers Login acknowledge ECU Responding No
97. needed TPO8 Procedure 1 VW T4 VDO 1998 OBD K not needed TPO8 Procedure 1 VW T5 2002 OBD K not needed TPO8 Procedure 1 HITAG 2 Key pro PCF7936 or VW Touareg 08 2007 OBD K grammer key Procedure 7 HITAG 2 Key pro PCF7936 or VW Touareg 08 2007 OBD CAN grammer key Procedure 8 VW Touaran 08 2006 OBD CAN not needed TP23 TA3 Procedure 2 VW Touaran 08 2006 2008 OBD CAN Key programmer TA3 Procedure 3 1 2008 OBD CAN Key programmer TAS Procedure 3 2 HITAG 2 Key pro PCF7936 or Porsche Cayenne 2007 OBD K grammer key Procedure 7 HITAG 2 Key pro PCF7936 or Porsche Cayenne 2007 OBD CAN grammer key Procedure 8 HITAG 2 Key pro PCF7936 or Bentley Continental 2007 OBD K grammer key Procedure 7 HITAG 2 Key pro PCF7936 or Bentley Continental 2007 OBD CAN grammer key Procedure 8 7 8 Dump tool special function The dump tool receives as input a dump file from the corresponding unit input dump is loaded with the Load dump button The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is not possible As output the dump tool displays some data extracted from the input file and or makes some modifications to the input data If any modifications were made for some sub functions there are no modifications made only data are visualized the user has to write the modified dump to a desired file with the Save dump button
98. nized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC To perform the key learning you will need the Login and for some models also a dealer key One way to obtain the login is to press the Autodetect Login Security code button This will read the login and also the component security If after that the option for making a dealer key is opened this login component security will be used there automatically 3 5 11 1 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN From Special functions Key Learning choose vehicle model Key learning Br x Vehicle model Audi A4 46 1997 external immobilizer box K W1281 z Seat Toledo CAN Skoda Octavia k line diagnosis KW1281 Skoda Octavia Il 2007 CAN Skoda Octavia Il 2007 CAN Skoda Superb k lin
99. o connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www abritus72 com mmdata bin into the ABRITES VAG Commander folder Problem Some device cannot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file 7 APPreno x 7 1 Programming instrument clusters from Magneti Marelli K line diagnostic link 7 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these type is possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending of the production year of the car So you have to select the one of the both types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are continue to be equipped with older instruments even if they are after year 2000 So the best way is to choose first the Instrument Cluster Magneti Marelli Direct 1996 2000 if not succeeded you have to make the ignition OFF and again ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If succeeded to read the PIN code and odometer are automatically recognized and displayed for Magneti Marelli direct types but in case
100. odes read program EEPROM flash content and so on Special functions are available from the main dialog of the application is Special functions apy Vehele Selecten Broadcast Optens ee 2 m can lee gt wu N Instrument EZ5 Kees Insir ment Engine Contra Mic cnas Kass Tv activation Keyleaning Dumo tool CAN 107 45 K Lne Lirit CDCI2xx adanlaban ED1 D2 y tits 4 Airbag Vw Crofter Custom PiNConverter Semice Remote Navigation Crase cont cl Brake pads RssdAwrke interval control a apeten change er ad The appropriate special function is opened by selecting it in the list box and double clicking on it or by pressing the Open button NOTE For the purposes of the some special functions basically for the key learning there are buttons for auto detection of the PIN and component security Basically this will try to read these data from the engine control unit but it will try also first to read them from the instrument cluster if the instrument cluster supplier is VDO Please pay attention that for VDO version after end of 2006 it might be required that the part of the instrument cluster is re flashed This is also required for functions for changing the mileage reading writing the odometer As mentioned in the license agreement use these operations on your own risk 3 5 1 Special functions with instrument CAN When this function is opened the ABRITES VAG Commander tries to establish diagnostic se
101. of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number vs oooosB1o BY DE ER BE BE EF ERORF ERVER RE CORE BE ER EF PR se enone BEUNTIBZUER FE LE BE PE OPE PP or RE NER REECE FE EE ER ER et DOTUSESU FR EE FE EE FE FE BR FERNER BR FE ER ER 8 BE na 00003540 FE 90 EF EF EF EF FE BF 00 00 FE EE FE EF FE OO SS 000035850 0D FF FF FF FF FF FF FF 00 01 04 0D 2B 41 55 SA cee ees AUZ nonnsB6n 35 54 30 41 58 56 54 58 58 56 58 SB 5A 79 5Z0AXXXKXXX 1 Zy 00003B70 96 B6 00 FF FF 42 20 93 9D 43 7F FE 30 42 DE BS FAS e Shs a Costa GOOTSRBO SF 42 29 EB SL PR FE EF EF FE FE TE EE EE EF FE WB ol OO0C3B90 FF FF FF FF FF 04 DD 2B 41 55 54 35 SA 30 41 58 AUZ5Z0BX 00003BA0 53 58 58 58 58 58 11 1E 3B 5A 79 96 B6 DL FF FF XXXKXX iZy 000036B0 42 20 93 9D 43 7F FF 30 42 DE BS 57 42 20 EB 31 B C 0B WB 1 BOUUSBER REIT ER ER FE ER ER ER PP CRE OPP ER Er BR FR ER EE 00003B8D0 04 OD 2B 41 55 SA 35 5A 30 41 58 53 58 58 58 58 AUZSZI RI 000U3BEN 58 44 IE 3B 5A 79 96 BG O0 ER FF 42 20 93 9D 438 3 2 you 2G E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXX and the login is OD2B in hexadecimal or 3371 in decimal 2 If the immobilizer number is not present then the login is found somewhere in the region 0x0
102. on data IV Transfer login Transfer learned keys Ids this are the key fixed code identifiers If they are not transferred you have to perform key learning on the new dash Transfer learned key count transfer the key count Transfer component protection data this transfer the key variable code Without this the key is not recognized and cannot be learned Please pay attention that in order to start the engine you ve also to adjust these component protection data in the ECU too Transfer login transfers the car login NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 3 5 3 2 Exchanging RB8 Instrument If you want to put used RB8 instrument into a car you ve to synchronize the ECU and the RB8 instrument For that reason you need to read the ECU component protection data and the ECU MAC Then after reading the the RB8 instrument a button Reset Comp Security After pressing this button the following dialog will appear Just put here the component security and MAC of the ECU x Oldcs fap fa ee se sa ee NewS an fa ee eB fsa fed MAC Old MAC m
103. ons with EZS Kessy CAN When this function is opened the ABRITES VAG Commander tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP2 0 E25 Kessy for 07 A6 Allroad gt xj Toleam keys or to read the EEPROM you need ta put the component security and PIN Login of the car Thie iniormation can ba read from the engine control unit ECU You can put this information manually or press Autodetsct button Component secunty Get component security from Engine Contrel Unit ECL Component protection bytes 49 29 ad je 51 2 f f PIN Login code 32009 C Get component security from EZS Kess EEPROM dump Leam keys VIN Number of VIN ZZZ4FXBN111 learn r EZS EEPROM onnnonno 24 66 10 02 00 10 FD 3 00000010 31 33 30 30 32 36 30 50 31 31 FF FF 37 30 35 BEER 5367 38 37 1300260011 7387 Read EEPROM 38 0300040501 1008 30 34 4121115000903104 00000020 30 33 30 30 30 34 90000030 34 31 32 31 31 31 00000040 34 32 34 37 35 FF FF FF 35 30 ZE 31 31 00000050 33 32 30 31 57 41 55 Sk SA SA 34 46 53 3 00000060 31 31 31 31 31 FF FF FF 11 28 23 10 34 30 39 l1lli 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 00 10852 0220 00000080 OA AS 51 IA SB 31 32 36 2E 30 32 2E 30 37 FF FF Q 126 02 07 Save to file 00000090 34 46 30 39 30 35 35 35 32 42 ZU 20 ZO 33 31 FF 409055528 sl 000000A0 FF F
104. ore learning keys making dealer keys read write VIN read write EEPROM you ve to make Ignition OFF then Ignition ON and press and hold the brake After that you can continue with the function from learning a key making a dealer key reading writing EEPROM or reading writing VIN NOTE To make any activity with the EZS Kessy you need to put the login and the component security bytes or to load the EZS Kessy EEPROM dump If this information is not made any attempt to make any activity with the EZS Kessy will result an error 3 5 2 1 Learning key with EZS Kessy To learn a key for the EZS Kessy You need to put the login and component security bytes as described above and to specify the number of keys which should be learned Then pressing the Learn button will learn the key IMPORTANT For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer 3 5 2 2 Reading changing VIN To read write the EZS Kessy VIN it is required to put the login and component security bytes as described above Then using the read write buttons you can change the VIN 3 5 2 3 Reading Writing EEPROM To read write the EZS Kessy EEPROM it is required to put the login and component security bytes as described above Then using the Read EEPROM button you can read the whole EEPROM This EEPROM is required
105. ponders used They are called Immo I Immo II Immo III Immo IV and Immo V Systems from Immol till Immo III require simply that a transponder from the proper type is found inside the key and they are able to learn these transponders Starting from Immo4 it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside there are the following types of transponders Tp22 dedicated for use inside Seat vehicles Tp23 dedicated for use inside Volkswagen vehicles Tp24 dedicated for use inside Skoda vehicles Tp25 dedicated for use inside Audi vehicles especially A3 and A4 Such transponders can be used in all cars of the specific producer e g Tp24 can be used for all Skoda models The last immobilizer system used in VAG is the Immo V It requires that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car producer can deliver such keys and such keys are called dealer keys because only the dealer can supply them Abritus72 Ltd can deliver modified transponders which are programmed with special data and they have the abbreviations TA2 TA3 TA4 and TA5 Each of these TAx transponders can be transformed with the Key programmer to the corresponding TP2x transponder which can be then learned in the I
106. pplicable for the navigation controller function 3 5 16 Special function Cruise control system Using this application you can activate deactivate a cruise control system and change the related steering wheel electronics SWE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the commander will read and display it s current configuration After Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate cruise control system function and apply any changes of the SWE configuration to the SWE unit 3 5 17 Special function Brake pads change Using this application you can Open rear parking brake for pad change Close rear parking brake perform Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness 3 5 18 Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle called in the application active ECU and the EERPOM dump of the engine control unit with w
107. re Please be sure that the version of the ABRITES VAG Update Request is at least 1 1 displayed in the title bar when ABRITES VAG Update Request is started Please specify in your mail what kind of problem you have when running the ABRITES VAG Commander Problem When starting the ABRITES VAG Commander a message Error code 0x10002 Please contact support001 sinosells com with the Error code in the subject Solution Probably the dongle is not inserted into the USB slot or it is not recognized in the device manager You can check in the device manager whether it is recognized It should appear as Matrix USB Chip in the Universal serial bus controllers section if your tool is buy before December 2007 or as HID compliant device in the Human Interface Devices if it is buy after December 2007 Problem When starting the ABRITES VAG Commander a message Error code 0x10003 Please contact support001 sinosells com with the Error code in the subject Solution Probably SW dedicated for other interface was run on your interface Please run the ABRITES VAG Check tool and prepare a dump file of the dongle Then send this dump file to support001 sinosells com Problem When starting the ABRITES VAG Commander a message Error code 0x10004 Please contact support001 sinosells com with the Error code in the subject Solution Please run the ABRITES
108. rol Imit Master 02 Tranmsmisson 03 ABS Od Steering Angle 05 EfS Ressy Entry And Sta 06 Seat memory passenger 07 Control head O68 Climstronicr uto WVAC 09 Central Electro r Ok VW Crafter x x OB Air beating E ngine 3 oc ECU p Immobiizer Key samina Control Uni N GD Slide door 1 EEPROM Disghastic Diagreshe Newt PA Specie tunsions Vehicle Selection Aradan a m Pr CAN E ims Pa lnshument EZS Kesy Insinmert Engine Conid Mironas Kessy TWaclvatin Keslesnng Dump tool CAN UT AE E Une Unk COC 32m adaptaiion EDWVED2 v i a 2 0 amp no Arbag Vw Crefter Custom PIN Convener Service Remae Navgation Crulsscontol Brake pads Read Avie interval conid a system chang From these buttons is possible when pressing ECU EEPROM the same dialog as in the Engine control unit is brought to the user and is possible to read EEPROM change mileage and make immobilizer bypass from here Not needed to select any engine type it is made automatically pressing Key learning will bring the Key learning dialog the user is not required to select a model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trouble codes etc to the immobilizer NOTE If t
109. s true for all cars with EDC16x MED9x ME7x ECUs Vehicles with other ECU e g EDC17x or MED17x are not supported The login and the component security bytes can be read manually from the ECU from the customer using the Engine control unit special function or decoded from EEPROM dump which is read with programmer It is also possible that the VAG Commander reads the required information automatically when you press the Autodetect button In this case the VAG Commander connects to the ECU and reads the login and CS automatically and then fill the required fields IMPORTANT Cars equipped with EDC17 MED17 is not possible to read the ECU and to get the component security from there So for such cars you need to open the EZS Kessy and to read its EEPROM with a programmer Then you ve to select the Get component security from EZS Kessy and to load the EZS Kessy dump After that you can learn make a dealer key also from such cars IMPORTANT If the car doesn t have any existing working key it is not possible to give ignition ON in order to get communication with the ECU So to be able to communicate with the ECU you ve to make short with the fuses as described in the Appendix After the login and the component security bytes are read you can restore the fuses IMPORTANT If the car doesn t have a working key communication with the EZS Kessy is possible only if you press the brake pedal So if don t have a working key bef
110. sponder when you search for the 7 byte at least when you prepare such keys for the first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool 2 2 Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you ve to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer 2 3 Making the key in the case when the Autodetect button is not functioning It is possible that by some reason the Autodetect button is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is brok
111. ssion with the Instrument cluster using KWP2000 over TP2 0 nn shies Ye ie alot x urn t AGIFES Commamnicr tor YAG TW mic nane oo OL Engine Control Mic Msscer Odometer gt Read Wile memon 02 Transnissen 03 ADS 04 Steering Angle RENATE N RR 05 FZ3 Kessy Entey And Sta Curent odometer value fhe Bi j 05 Seat nenory passenger i TEN Ka ReadAwiite Ran Read A0M FLASH 0 Control head a Naw odometer vale 08 Clamatronic Auto HVAC SE GOERS TROELS Changs odometer Cusiom AsadAwrke the memory area GA i Ob Air hesting Read wrte EEPROM oc Immab izee WARS I OD SATUB SoN Ley SECURITY ACCESS CODE Faad Sec Acces Code Read vitke IMHO data A Specie Functions as Vehicle Selectia Ft bite EZ Kessy Instrumer Vehicle moda CAN 07 46 Kline Reset cluster on O Ga R Custom MAhlonverer Serice Read v rte interval Available functions are e Reading current odometer value e Change of odometer e Read Program memory of instrument cluster immobilizer e Reading security access code of the IMMOBILIZER e Read Write immobilizer related data Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the instrument cluster This application can be used with the following models VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda
112. stem these times are not always respected so it is possible that the communication with some devices is unstable or it is not possible to connect In such cases you can try to change some of the times timing parameters from the Advanced button The timing parameters have the following meaning Wakeup echo delay time after slow init between receiving 55 xx yy and sending the inverted value of yy according the K Line wakeup procedure Communication echo delay time between reception of a byte under KWP1281 and sending it inverted back to the device Inter byte time time between sending two bytes under KWP2000 Time between messages time delay between reception of response from device and sending new request to it www ecutool com Email amp MSN info sinosells com 3 1 5 Logging parameters It is possible to log the whole CAN K Line communication when a problem with some device is occurred This is possible by checking the Enable CAN Log or Enable K Line Log check boxes from the options dialog Please note that they are active by default The log files are binary files which are placed in the Trace sub folder of the ABRITES VAG Commander Per each start of the ABRITES VAG Commander one file is created and it contains the date time when it is created in its filename NOTE In some operation systems the ABRITES VAG Commander installation folder is created with restricted permissions for crea
113. t should be stored into the respective adaptation channels related to the chosen options The applicable and available adaptation channels from column New value are also available for editing so the user may put there any other values 3 5 14 Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the commander will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation In the Instructions window within the Remote adaptation section will be available directions what should be done to learn remote controls Additionally in the Available settings table will be listed all the applicable adaptation channels with their current values and description which are related to the remote controls function By editing the New value column values and pressing Change settings button the user can change certain settings This function is available for Audi A6 2000 Audi A4 and VW vehicles 2001 Audi A3 2003 For Audi A8 VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 3 5 15 Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value a
114. then VAG Commander will show you the component security bytes UUUUULLU VU UV VU UU VU VU VU UU VV UU UU u uvu vu uvu EEFROM memory data 000001D0 90 00 00 0O on 0O ANA OO OO OO OO OO OO OO OO j es 000001E 0 00 00 00 OO 00 00 00 00 00 00 00 00 00 DO OD OD s ssssssossssroe Read Flash 000001F0 00 00 00 OO 00 00 On OO OO OO 00O OO 00 00 OO OO na by Write osh Data read Comoonert security 1b 04 05 e4 37 a8 Ub Ext For CAN immobilizers till end of 2006 it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you ve to go to Special function then Instrument CAN and Read write immo data After you read the immobilizer data in the field Serial Key the 7 bytes of the component security will appear 3 5 11 3 1 Programming a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button 3 5 11 3 2 Finding the 7 byte If the 7 byte is not available you must choose Find the 7th byte of the component protection data and you have to put the six bytes which are known There are two possible ways to check whether the 7
115. ting writing files As a result the ABRITES VAG Commander cannot create the log files In this case at the startup of the Commander you will see a warning message like this x Cannot create log file The diagnostic communication will not be logged Please check the permissions of the TRACE folder where this application is installed Refer to USER MANUAL for help For to remove the restrictions go to the ABRITES VAG Commander installation folder right click the Trace folder click Properties and then click Security tab Remark If you are using Windows Vista click Edit to open the permissions for Trace folder For all users in the Group or user names section select the Allow check box for Full control in the Permissions for users section Click Apply Refer also to topic Set view change or remove file and folder permissions from the Windows Help and Support Center NOTE Please pay attention that enabling logging may significant decrease the PC performance since writing big data block on the hard drive may consumes more time on slower machines So if your PC is slower please use the log function only when a problem have to be reported 3 1 6 Antenna factor This parameter is applicable only to the Hitag2 programmer not applicable for the other Key programmers The parameter is used to specify the amplify factor of the antenna You should specify a value in the range from 0 to 9 typic
116. tion you can try to set the port used by the ABRITES VAG Commander manually This can be done as follows Open the Device manager and check as which COM port the USB interface is recognized Uncheck the Automatic check box and set the port in the respective field 3 1 3 K Line baud rate settings When trying to connect to the device over K Line the commander will try to connect to it using one baud rate and if it doesn t succeed it will switch to another baud rate and try again There are two baud rate values currently used 10427 and 9600 Using the 10472 9600 and 9600 10247 radio buttons within the options dialog one can set the order in which these two baud rate values will be used If 10472 9600 is selected then first the commander will try to connect to the device over K Line using baud rate 10472 and if it doesn t succeed it will switch to 9600 and try again with it If 9600 10472 is selected then first the commander will try to connect to the device using baud rate 9600 and if it doesn t succeed it will switch to 10472 and try again with it ATTENTION Some device working on baud 9600 cannot be waked up if they are first tried on baud 10472 so if you cannot connect to device through the K Line try to change the options so first to try on 9600 3 1 4 Timing parameters The protocols running under K Line require very precise byte timing Since Windows is not a real time operating sy
117. to prepare a dealer key Pressing the Write EEPROM button respectively will write the EEPROM but the area from address 0x100 to 0x15F i e 96 bytes is not possible to write The write procedure takes about 8 9minutes while the reading of the EEPROM is completed for less than a minute 3 5 2 4 Program a blank key so it becomes like a dealer key You need to put the login and the component security bytes as described above and then to press the Make dealer key button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned with the learn button 3 5 3 Special functions with instrument K Line When this function is opened the following dialog appears From this dialog you need to choose the type of your instrument cluster immobilizer and then you can read write EEPROM change odometer read PIN code and so on Please note that only connection via K Line will be made KWP1281 or KWP2000 and this doesn t depend on the configuration options ATTENTION All read EEPROM dumps are stored in the Dumps sub folder of the ABRITES VAG Commander so it is possible to restore the EEPROM in case of unwanted changes Instrument Cluster Immobilizer K Choose IPC wpe Instrument Cluster VDO66 YD086 Motometer v Read EEEF instrument Cluster VYDO66 DO096 Motomctcr
118. trol units support this service Please note that it is not available in all diagnostic sessions Urgent point for this diagnostic service is that most of electronic control units updating its internal memory when ignition is turned off and current diagnostic session is closed Example are engine control units BOSCH EDC16 3 4 15 Custom download upload Custom download upload allows direct reading from the address map of the device This option will be available only if you have some updates in your configuration like e g Reading writing the flash counters Take into account that in most cases a security authorization is required before you try to read write into the address map 3 4 16 Component security This special function allows managing of brand new units and immobilizer units where is allowed programming of PIN SKC BGW MAC Functions are under CAN TP2 0 3 4 17 Active diagnostic session Default diagnostic session established after connection to the unit is 89 User can request entering in a different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session 89 Take into account that in most cases different diagnostic sessions require security authorization Diagnostic session 3 5 Special Functions Special functions are some specific for electronic control units application which will allow you change of odometer reading security access c
119. vekeyandturnignitiononwithallremainingkeys 3 5 11 3 Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN Normally most of the newer cars require a transponder which is precoded with the VIN number from a dealer Fortunately it is also possible to precode the transponder by yourself using the Key programmer if you have available the 7 bytes of the component protection data and you need to use an TA2 TA3 TA4 TAS transponder as base for this operation NOTE The Set transponder type combo box specifies what kind of dealer key to make for VW Seat Skoda or Audi As base for this operation is used TAx transponder TA2 for Seat TA3 for VW TA4 for Skoda and TA5 for Audi Please pay attention to the fact that the transponder which you re placing into the programmer should be from the proper type If it is not then you will receive an error message and the operation will not succeed The transponder will not be locked and can be used again this is just a check that the correct transponder is used If you have a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned But if do not have a dealer key then you should press the Program dealer key button which will show the following dialog Program dealer key SW x Set transponder type Megamos 48 VW TA3 Z Sutodetect component protection
120. ys and y is the total number which has to be learned When L xy is displayed you will asked to put each next key and ta press OK After pressing the OK the instrument will be reset and s value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted from car If you have x The Key learning procedure goes in the following steps 1 Learning a dealer key purchased by VIN number If you have dealer key purchased by VIN number you have to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument is displayed L7 x y where x is the number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working 2 Preparing a dealer key If you have a Key programmer you can prepare a dealer key from a TA5 transponder Put how many dealer keys you want to program and press the Program dealer key It is not required to enter anyt

Manual for 3530044

Contents

Download Pdf Manuals

Related Search

Related Contents