Home

USER MANUAL ABRITES VAG Commander - AutoKey

1. 4F0910401L lt VAG number PROGRAMMABLE Program status 00 data status 20 Coding 11772 Part number 0 Importeur s number 0 Supplier number 0 System description 3 0L V6TDI GOOOAG 3 4 2Software and Hardware version of the unit SW HW version displays if the service is supported by the corresponding controller the SW and HW version of the unit including all slave units of the master unit 5W HW version SW version of module 1 K2 6 9 SW version of module Z DZ 6 9 SW version of module 3 MZ 6 9 SW version of module 4 24 7 6 SW version of module 5 XPQ35 V19 02 Hardware number 1KO907951 3 4 3Extended Unit Identification Extended identification VIN displays programming data flash status programming attempts flash date VIN number Part serial number 3 210010 Supplier identification TF74035 Production date 16 10 03 Changes from supplier 08 Number of validation status 1001 Current supplier s number 3DEF gt Flash Programming succefull ready for driving Programming attempts 0 Succesful programming attempts 0 Status of conditions for programming 0 Flash Tool code 0x00000000000O Flash date 23 05 03 3 4 4Read Diagnostic Trouble Codes Read DTCs will display all present errors in master and slave units Displayed errors can be together with freeze frame data this depends on the checkbox Read Freeze frame S
2. 00 8 05 07 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 15 49 05 47 05 07 29 1 6 00000020 29 07 05 10 37 46 31 30 33 37 33 37 37 34 33 39 7H1037377439 Save dump 00000030 02 02 2F ZF 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS SA 69 96 Cl 3E 00 00 00 SF 61 1B D405 Zi gt a 00000050 E4 37 AS OB 37 A6 3C 13 00 O1 00 00 00 BC FF B2 7 7 lt 00000060 O1 03 AS 5A 69 96 Cl 3E 00 00 00 SF 61 1B D405 21 gt 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F BZ 7 7K eee 00000080 02 04 00 00 10 57 56 57 5A 5A 54 33 43 5A 36 45 WYWZZZ3SCZ6E 00000090 30 30 30 30 30 30 56 57 5A 43 54 30 30 30 30 30 000000YWZCZ00000 00000040 30 30 30 30 57 56 57 SA SA 5A 33 43 5A 36 45 30 OOOOWVIZZZ23CZ6E0 000000B0 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 AS OO0000 000000C0 02 04 00 00 10 57 56 57 SA SA 5A 33 43 SA 36 45 WYWZZZSCZ6E 000000D0 30 30 30 30 30 30 56 57 SA 43 5A 30 30 30 30 30 000000YWZCZ00000 O00000E0 30 30 30 30 57 56 57 5A 5A 5A 33 45 5A 36 45 30 DODOWVWWZZZSCZEEN O00000F0 30 30 30 30 30 18 00 00 00 00 00 00 00 BF F2 A5 OO000 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 00 A o s s eimiee ieee v gt ih 4 Swap bytes L H Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset CRYPTED Login Component protection Required license AN009 Th
3. Instrument Cluster Immobilizer K Choose IPC type Instrument Cluster VDO66 YDO86 Motometer v Instrument Cluster YDO66 DO86 Motometer i YW LT Immobilizer M White immobilizer box Audi A4 A6 A8 Black immobilizer box Siemens 6 PIN HCO5 Immo1 Black immobilizer box Siemens 6 PIN HC05 2400 Immo1 Black immobilizer box Siemens 6 PIN TMS Immo1 a4 Instrument Cluster Audi A4 B5 with Board Computer 1997 44 Instrument Cluster Audi A4 B5 without Board Computer 1997 Instrument Cluster Audi A8 10 1996 Instrument Cluster Audi A8 11 1996 Instrument Cluster Audi A6 B45 1997 a4 Instrument Cluster Magneti Mareli Shadow 1 44 Instrument Cluster Magneti Mareli Shadow 2 Passat i Instrument Cluster Magneti Mareli Shadow 3 TT Instrument Cluster Mangeti Mareli Direct 1996 2000 Login 0 Instrument Cluster Mangeti Mareli Direct 2000 Odometer ROM Flash ResetECU Virgin Factory AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA Hew Skip neg responses Exit For the most of instrument clusters is implemented automatic parsing of data from the EEPROM odometer immobilizer For instrument clusters from Magneti Marelli please refer Appendix A If connection to Momometer instrument is not succeeded please send the file motometers txt to moto abritus72 com and this instrument will be added to the database till three business days Latest datab
4. Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC To perform the key learning you will need the Login and for some models also a dealer key One way to obtain the login is to press the Autodetect Login Security code button This will read the login and also the component security If after that the option for making a dealer key is opened this login component security will be used there automatically 3 5 13 1Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN From Special functions Key Learning choose vehicle model Key learning x Vehicle model Audi A4 A6 1997 extemal immobilizer box KW1281 Seat Toledo CAN New key count RRT AMESA SEE Skoda Octavia Il
5. The last immobilizer system used in VAG is the Immo V It requires that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car producer can deliver such keys and such keys are called dealer keys because only the dealer can supply them For some cars a special programmer is needed in order to prepare the key to be like an ordered from the authorized VAG dealer Currently following programmers are supported Hitag2 programmer used only to program keys with Hitag2 transponders PCF7936 PCF794x Such cars are VW Touareg VW Phaeton Porsche Cayenne Bentley Continental Audi A8 Tango programmer used to program Hitag2 and Megamos 48 crypto transponder Abrites Key Tag programmer used to program Hitag2 Megamos 48 crypto transponder and Q7 A6 RS6 Allroad keys The Tango programmer and the Abrites key programmer are referred as key programmer in the following description Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car to which key learning procedure belongs Starting the key learning special function will bring the following dialog Key learning i x Detected car type IKwP1 281 extemal immo box recognized le vac external immobilizer box KW1281 v New key count E meet Learn
6. 7 1 3 VW Passat usually these Instruments are before year 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed odometer is displayed as 0 but can be changed When the Change odometer button is pressed a dialog appears where the current and the new odometer values should be entered 7 1 4 VW New Beetle First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 1 and read EEPROM The login is not displayed The odometer is displayed as 0 but can be changed When the Change odometer button is pressed a dialog appears where the current and the new odometer values should be entered 7 2Porsche Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox 7 3Audi A8 fusebox passenger side wakeup ECU es 15 TIES ase Kase G se GRS 7 4Audi Q7 To get communication with the ECU you need to short the fuses as shown on the picture below If not succeeded to communicate with the ECU then you should try as on the picture below If you re still not able to get communication with the ECU it is possible to mak
7. Find 7th byte and program transponder Component 33 3d de a8 b6 3d Program protection bytes Automatcial trying of the 7 byte C Manual trying of the 7 byte Mw Passat B6 CC Key with TAx Value for the autorization read by daignostic Bee ea The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are stored always at least 6 of the component protection bytes sometimes also the 7 byte is contained There are several ways to extract the component security Simply press the Autodetect component security and the component security bytes will be read from the ECU This will also automatically decide whether you ve the 7 byte or you ve to search for it Also the login will be displayed in the status bar The autodetection is not always possible it works basically for EDC16 and MED engines which are using CAN diagnostic connection The component protection bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit then VAG Commander will show you the component security bytes VUUVUULLU VU UU VU vU vU vuU vU Vvu vuU vu vu vu vu vu vu EEPROM memory data UJ cu 000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 O00001EO 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OO OO Read Flash ooooo1FO 00 00 0
8. Login Security code Login Security code 0 2 m Lock timers Engine start permitted No Dealer key transponder No Login acknowledge ECU Responding No Key transponder locked No min Transponder type OK No Key transponder leamed No Transponder acknowledge Key count 0 mir Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 1 1 Enter security access code and number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some Ww Seat Skoda vehicles it is possible to add new key without the remaining key stop to work You will be asked whether you want to use this feature if available Please answer with yes no according your wishes The customer has to choice the vehicle model for which it wants to learn a key In the background the system tries to determine automatically what vehicle model is If succeeded the recognized model will be selected automatically If the system cannot recognize the model the user has to choice the model manually NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW CAN 2007 and VW CAN 2007 for that reason by default VW CAN 2007 is selected by default After the vehicle model is recog
9. 117 bytes of the component protection data component security are know Program transponder from 7 bytes Component protection bytes 0 0 0 0 0 0 0 Find the 7th byte of the component protection data m Find 7th byte and program transponder Component protection bytes Ji 0 0 0 0 0 Automatcial trying of the 7 byte possible when you can check in measured values when key is recognized Manual trying of the 7 byte after each attempt you can try with the key on the ignition Value for the autorization read by daignostic m Passat B6 CC with EDC17 MED17 Login Securty code 34269 Load comfort module EEPROM dump oe Here you ve to put the PIN code after that to load the comfort module EEPROM dump and the Program button will become active After pressing the Program button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done When the transponder is ready you will have all the component security bytes displayed in the status bar After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MEDQ 3 5 14Special function Dump Tool Using this application you can calculate se
10. CDC32xxG secured gt 24C32 is selected the user will be able to read write the EEPROM memory Jdometer IAameter nad If the user wants to change the odometer read write the immobilizer data or to make a key he have to select the car type and the model in the appropriate combo boxes Changing the odometer is made from the Read odometer and Write odometer buttons Reading Writing the Immobilizer data is made from the buttons Read Immo data and Write Immo data Please pay attention that the writing the invalid immobilizer data may causes the car to stop working For that reason it is better always to make a backup of the data read If you want to make a key you need to read the immobilizer data first Then you should have a programmer connected and to put the transponder inside After that 1 key is added to the existing keys This means that existing keys continue to work NOTE It is possible to have 8 keys per car If all position are full the key is not added but replace the 8 position NOTE Pressing the Add key button programs the transponder as a dealer key and puts the transponder ID into the immobilizer data But the data are not written in the microcontroller yet you ve to press the Write immo data button to write the data Or if you want since you ve a dealer key at this moment you can exit without writing data and later learn the transponder by diagnostic IMPORTANT Sometimes the
11. Solution Probably there are some bluetooth devices installed on the PC Please try to deactivate them temporally Problem When starting the ABRITES VAG Commander a message Error code 0x10001 Please contact support abritus72 com with the Error code in the subject Solution Please run the ABRITES VAG Update Request and request an update of your software Please be sure that the version of the ABRITES VAG Update Request is at least 1 1 displayed in the title bar when ABRITES VAG Update Request is started Please specify in your mail what kind of problem you have when running the ABRITES VAG Commander Problem When starting the ABRITES VAG Commander a message Error code 0x10002 Please contact support abritus72 com with the Error code in the subject Solution Probably the dongle is not inserted into the USB slot or it is not recognized in the device manager You can check in the device manager whether it is recognized It should appear as Matrix USB Chip in the Universal serial bus controllers section if your tool is buy before December 2007 or as HID compliant device in the Human Interface Devices if it is buy after December 2007 Problem When starting the ABRITES VAG Commander a message Error code 0x10003 Please contact support abritus72 com with the Error code in the subject Solution Probably SW dedicated for other interface was run
12. The function displays also the component protection bytes by pressing the Other data button Dump Tool ji 3 i xj Type Steering lock YW Passat 6 Security code SSHCI08 E 33 2333333333333333 00000030 33 33 33 33 30 30 30 30 30 30 30 30 30 30 30 30 3333000000000000 00000040 30 30 DA DA DA CD CD CD 57 57 57 56 56 56 57 57 OO WU 00000050 57 54 5A SA 5A 33 33 33 33 33 33 33 33 33 33 33 WZZZ233333333333 00000060 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 3333333333333333 00000070 33 33 33 33 33 33 33 33 33 33 34 F F6 F6 AC AC 33333333334 00000080 AC DA DA DA CD CD CD OD OD OD B7 B7 B7 24 06 OO eee oo ween ee ECU Simos 7 K line Login code 93C76 93C86 Required license ANO06 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool xi Type ECU Simos 7 K line Login code 93076 93086 1115N150L300 H 00000010 00 00 00 45 00 00 00 45 00 00 08 35 00 IC 00 00 H H 8 00000030 00 00 00 00 9B B9 9B B9 9B B9 54 00 54 00 5400 TETEL 00000040 01 00 01 00 Ol 00 BS 6A 65 1B 66 D4 B3 6A 65 1B je f j
13. 3 5 3 2Exchanging RB8 Instrument If you want to put used RB8 instrument into a car you ve to synchronize the ECU and the RB8 instrument For that reason you need to read the ECU component protection data and the ECU MAC Then after reading the the RB8 instrument a button Reset Comp Security After pressing this button the following dialog will appear Just put here the component security and MAC of the ECU xi OCS an 41 fee fa 5A e2 New Cs AD 4 6E j 5A jad MAC Old MAC In 225 337 44 New MAC 28 B 36 NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 3 5 4Special functions with Engine Control Unit Special functions with ECU can be Read Write of flash memory Read Write the flash counters Read Write EEPROM Change odometer EDC15 Extracting security code PIN Immobilizer Enable Disable EDC 15 ME7x Functions become available after pressing the button ECU from special functions of main dialog Engine Control Unit Special Functions Choose ECU pe ECU Autodetect W ECU type h
14. Use procedure 3 instead 3 5 13 6Procedure 6 for Audi A4 RB8 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require a different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason a different procedure is used You need to choose from Special functions Key learning Audi A4 2004 RB8 Instrument Cluster KW2000 The following buttons will be available Key learning x Vehicle model New key count 0 Program dealer key Leam Login Security code 0 No login code is need for the key learning You have to put only the number of the keys which will be adapted Procedure 6 Audi vehicles equipped with instrument cluster BOSCH RBS with integrated immobilizer require different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason separated procedure is used The Key learning procedure goes in the following steps 1 Learning dealer key purchased by VIN number If you have dealer key purchased by VIN number you ve to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument it is displayed L x p where x is number of successfully learned keys and y is the total number which has to be learned When L x y is displayed you will as
15. for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 For vehicles after year 2007 or Audi A8 you need to prepare a Hitag2 key transponder before you use the key learning function You can use a virgin transponder PCF7936 or a virgin key 1 From Special functions Key Learning choose vehicle model Push Program dealer key The following dialog will appear 2 There are following possibilities 2 1 Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not Dealer key with Hitag2 j x C Load component protection data from Kessy ECU dump Autodetect from ECU m Program from Kessy ECU dump All bytes of the component protection data component security are know m Program transponder from 7 bytes IC omponent protection bytes E al 3b 5e E Find the 7th byte of the component protection data Find th byte and program transponder Find 7th byte from working Component protection bytes dd a0 3b Be Ob af key Program Login 1372 Trying bytes 022 Take key OUT and place into programmer IMPORTANT If you don t have a working key from the car you will need to short the fuses as described
16. 00 O1 OO 00 00 2D 7A AO FO 7B 9B FO 72 See WVSZZZTLZ3D010000 000000E0O 9C FO 83 43 FO CE 65 90 FO 65 90 FO 00 00 00 00 Pressing the other data displays the learned keys and also allows changing the immobilizer status on some models changing the immobilizer status is used to put the Kessy e g into deliver condition Kessy keys a 3 xj Key 1 DC004426 Key 5 FFFFFFFF Key 2 SE 344320 Key 6 FFFFFFFF Key 3 FFFFFFFF Key 7 FFFFFFFF Key 4 FFFFFFFF Key 8 FFFFFFFF EZS Kessy Security access code 9S12 Required license AN003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola HC9S12 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Dump Tool i E xj Type EZS Kessy Security access code 9512 Load dump Save dump Swap bytes L H Ce 00000010 37 33 30 30 32 36 30 30 31 31 FF FF 30 35 37 37 7300260011 0577 00000020 36 33 30 30 30 34 30 36 30 31 FF FF 35 39 32 35 6300040601 5925 00000030 31 30 30 31 32 30 36 30 30 33 39 30 33 31 30 34 1001206003903104 00000040 34 32 34 37 35 FF FF FF 36 30 2E 32 30 2E 30 32 42475 60 20 02 00000050 36 36 33 30 57 41 55 SA 5A 5A 34 4C 30 37 44 30 6630WAUZZZ4L07D0 00000060 30 30 30 30 30 FF FF FF 02 20 66 03 34 46 30 39 00000 4F09 ER Es 00000070 31 30 38
17. 30 32 30 05 01 01 00 43 DS 71 1C DO 00 69 Cl OO AS 61 FC C q 1 05 01 01 00 43 DS 71 1C 00 00 69 Cl OO AS 50 FC C q i 04 01 D6 AC DS OC 2D Al BO 15 SB 00 00 OO Al FB Fuel 04 01 D6 AC DS OC 2D Al BO 15 5B 00 00 00 AO FB unsl leesse 07 02 80 02 EO 01 06 00 28 04 58 OD 07 OO FL FD X 00 00 67 OD 09 OF 00 00 18 03 00 00 00 00 54 FF g T 05 A 09 09 00 06 05 00 00 gt 2D 00 46 41 i i anne FA 05 0 09 09 00 06 05 00 00 FD 2D 00 46 AL FE 20 al E fe po fe fe nee ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access code which is contained into the ME7 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0x120 bytes because after that area the EEPROM sections are different for each different software version of the ME7x unit Fortunately the most of the interesting data are found in this section Dump Tool x Type ECU ME 7 x Security Code Checksum calculator 9P08 95080 v Z 0502032 Swap bytes L H j Login 44246 000000D0 SA 34 45 38 33 4E 30 30 37 35 39 35 41 00 EC FC Z4E83N007595A 000000E0 54 34 45 38 33 4E 30 30 37 35 39 35 41 00 EC FC Z4E53N007595A 000000F0 55 58 33 5A 30 43 31 33 31 30 34 34 33 0
18. 35 32 20 20 20 30 32 32 30 00 02 02 00 10852 0220 oga 00000080 07 ED 2A 10 77 SF 30 38 2E 30 33 2E 30 37 FF FF w_08 03 07 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B 31 i 4 000000B0 33 30 35 32 34 34 37 33 32 30 30 31 32 30 36 30 3052447320012060 0330101035330 ernennen Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts an ECU dump from EDC16 PPD1x MED9x and ME7x ECUs Dump Tool me E xi Type Comtor module component protection data Passat B6 00 00 00 00 00 00 00 00 ty 2D 2E 2D 2E 2D 2D 33 43 39 b 3 0959 48 20 20 34 35 33 33 43 39 433H 0453300959 45 20 20 FF FF FF FF 03 FF 433H FE FF FE EE FRESE ER FE FF FF FF FF F 7F FF FF BS 47 1A 00 03 63 00 03 00 03 62 FF FC B2 56 FF ECU component protection data i xj Load ECU component protection data from dump Enter component protection data manually nee ee Other Data Load dump from EDC1 6 ME7x
19. EEPROM of the source instrument and when pressing Read keys they are saved into file Then you have to go on the destination instrument read its EEPROM and pressing the Write keys button then you will prompted for the file where the source instrument keys were read After selecting the key file you will be asked what information to transfer Select key data to transfer 7 x M Transfer learned key IDs IV Transfer learned key count V Transfer component protection data IV Transfer login Transfer learned keys Ids this are the key fixed code identifiers If they are not transferred you have to perform key learning on the new dash Transfer learned key count transfer the key count Transfer component protection data this transfer the key variable code Without this the key is not recognized and cannot be learned Please pay attention that in order to start the engine you ve also to adjust these component protection data in the ECU too Transfer login transfers the car login NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes
20. ES F9 OF 31 Ja 9 l 00000030 AB 70 88 04 D2 BA Cl A4 p 00000038 49 15 FO D3 91 FE Fl 06 I en s lee Immo Data VIN LFV2A115743512345 Read Immo data Serial number 00000000000000 rm Transponder identificators a Write Immo Serial key CS 1b537aff b039 KeylD1 d2da21be KeyiD5 _ ffftttt data MAC 5689335 KeylD2 bd2300bd KeylD6 fffttttt Status 14000037dd KeylD3 bd2313bd Keyl ffffffft i i fFFFFFFF FFFFFFFE Make dealer Configuration 210106330100 01 YW Ss KeylD4 KeylD8 key and add it to the immo PIN 21891 it For these instruments it is possible to make mileage correction and keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license To make any operation on these dashboards it is required first to enter into service mode Without entering into service mode nothing is possible Entering into service mode is possible in two ways read the EEPROM 24C32 with a programmer then load it with the Load EEPROM dump button modify it then with Enter service mode by EEPROM dump and finally write back the resulting file with a programmer to the EEPROM lf the car has a working key from the car give ignition with it and then press enter service mode by OBDII Service Mode is leaved when if you entered the service mode using a programmer then Leave serv
21. FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeeeees 00000030 34 48 51 11 11 11 11 11 11 11 11 11 11 11 11 11 4HQ 00000040 11 11 11 11 l 41 FF FF FF FF FF FF FF FF FF FF een hen Saep hesien 00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ERBEN es 00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eceeeeeees ae Login 4152 00000070 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF een een een 00000080 00 06 46 22 19 02 4B ZB AA 00 00 00 00 OO OA FS F K 00000090 30 33 43 39 30 36 30 32 34 45 20 20 30 31 31 36 03C906024H 0118 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 RL TORERE IRRE 000000B0 00 00 00 00 00 00 00 00 55 AA 33 CC 50 90 09 08 LE A Pe 000000C0 35 00 06 04 07 AA DS SF 27 70 FF FF 00 00 00 FF 86 p e 000000D0 EE FFE FEFE EF FE FEEF EFCEFOFF FRAEPO EE FEEF een O00000E0O Ol 00 03 00 46 55 38 10 13 73 3C 8C CC 42 00 00 U8 s lt B 000000F0 10 73 38 10 13 73 3C 8C CC 42 00 00 10 73 38 10 38 s lt B 38 00000100 13 73 3C 8C CC 42 00 00 10 73 53 45 5A 37 5A 30 s lt B sSEZ7Z0 bd gt IPC VDO VW Seat Skoda 2007 CDC3272 24C32 Required license AN002 and AN006 This function is dedicated to change the odometer inside the instruments clusters from VDO with Micronas microcontroller This function works only on microcontrollers which have the mask of the microcontroller CDC3272 If the mask is diffe
22. K Line KWP2000 KWP1 281 when trying to connect to the device the commander will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used for configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests they are not applied when auto scanning devices 3 1 2Interface detection Normally the ABRITES VAG Commander USB Interface is recognized automatically but there is an option to set it manually So if you have troubles as described in the Troubleshooting section you can try to set the port used by the ABRITES VAG Commander manually This can be done as follows Open the Device manager and check as which COM port the USB interface is recognized Uncheck the Automatic check box and set the port in the respective field 3 1 3K Line baud rate settings When trying to connect to the device over K Line the commander will try to connect to it using one baud rate and if it doesn t succeed it will switch to another baud rate and try again There are two baud rate values currently used 10427 and 9600 Using the 10472 9600 and 9600 10247 radio buttons within the options dialog one can set the order in which these two baud rate values will be used If 10472 9600 is selected then first the commander will try to connect to the device over K Line using baud rate 10472 and if it doesn t succeed it will s
23. ZC 59 2C 59 2C 94 50 94 50 94 50 P P P 00000040 01 00 01 00 01l 00 D9 72 52 79 B2 E4 D9 72 52 79 RY RY 00000050 B2 E4 D9 72 52 79 BZ E4 A4 OO A4 00 A4 00 00 00 4rRy 00000060 00 00 00 00 80 00 80 00 80 00 33 C4 33 C4 33 C4 wee Bee Sa ran ES 00000070 56 57 SA 43 5A 30 30 30 30 30 30 30 30 30 56 57 VWZCZ0O00000000YW Login 1252 00000080 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 SA 43 ZCZ000000000YWZC 00000090 SA 30 30 30 30 30 30 30 30 30 57 56 57 SA 5A SA Z000000000WWWZZZ Oo00000a0 33 43 5A 36 50 31 31 31 31 31 31 57 56 57 5A SA 3CZ6P111111WVWZZ 000000B0 SA 33 43 SA 36 50 31 31 31 31 31 31 57 56 57 SA Z3CZ6P1111110VWZ 000000C0 SA 5A 33 43 5A 36 50 31 31 31 31 31 31 00 00 00 ZZ3CZ6P111111 000000D0 7C 7C 37 30 31 30 30 33 47 39 30 36 30 31 38 20 701003G906018 OOOOO0EO 20 20 00 00 00 00 AF 50 AF 50 AF 50 98 2A 85 AA PPPT 000000F0 76 SB F4 8A 85 51 84 9B 80 3B 81 09 81 08 83 v Q N 00000100 83 4F 82 15 F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 v gt Load dump Save dump Swap bytes L H 1 i 4 ECU Magneti Marelli Security Access Code 95320 Required license AN003 This function displays the security access code contained into the engine control unit from Magneti Marelli Dump Tool x Type ECU Magneti Marelli Security Access Code 95320 Load dump vv 00000010 E8 03 ES 03 E8 03 ES 03 ES 03 E8 03 El 03 E9 22 ne ai 00000020 FF FF FF FF
24. application load both dumps using buttons Load active ECU dump and Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in the replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device after that ECU Exchange Dump Tool Choose ECU type jeoc16 E u Load active ECU dump Pu Load replacement ECU dump Change replacement ECU dump placement EEU dump 3 5 21Special function Door unlocking This function is dedicated to open the doors of the car when the car is in SAFE mode To use this function you will need to connect manually some PINs of the VAG Interface OBDII connector with cables to the wiring of the CAR So you ve to find somewhere in the car the desired wires orange with green CAN H and orange with brown CAN L and you ve to connect them to OBDII connector PIN6 CAN H and OBDI Connector PIN14 CAN L Also you ve to connect OBDII Connector PIN4 Ground to any metal part of the car After you re ready you can call the Unlock doors special function Following dialog will be displayed Door unlocking Unlock Vw Unlock Touareg Phaeton O7 A6 Allroad udi AS Unlock Porsche Cayenne OBDII Pin 6 lt gt CAN H orange green OBDII Pin 14 lt gt CAN H orange brown OBDII Pin 4 lt gt GND metal part of
25. component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Type ECU MED 9 x Reset component protection data 95160 v Load dump Swap bytes L H 00 3300 J 8 05 07 29 FF 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 15 D405 Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC FF B2 7 7 lt 0 00000060 01 03 AS 54 69 96 Cl 3E 00 00 00 SF 61 1B D4 05 2i gt a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 F 7 lt eee eee 00000080 Component security data x CZ6E 00000090 0000 oooo00a0 Ol Im pa BO Tea far aes Te OK ABEND Ense mm is ee i bo0000c0 Fa CZ6E pooooopa NeW 0 0 jo fo fo fo fo 0000 D00000E0 000000F0 A ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated fo
26. is made 3 4 9Coding of the unit Coding will open for you a separate window where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding xi 01 4F0 910 279 D e its 02 Not supported 03 Not supported New coding value M Set coding type manually 12 bit coding 20 bit coding Long coding Bytes O Coding data read ext 3 4 10Basic settings Basic settings will expect from you to enter a number of the group and to press the button ON or OFF 3 4 11Actuator test Available are two types of tests Selective and Sequential In the selective test you have the possibility to enter a test code manually or to select it from a list box When a test is selected you just need to press Start x Choose test Selective test mode Selective test C Enter output code Test code Sequential test Select output Cancel test END of selective output test Relay for Horn Terminal 58 Bi xenon Shutter Solenoid F320 Bulb for Daytime Running Light Left 3 4 12Reset of the unit Reset will request from the unit a SW reset Not all electronic control units support this service Please note that it is not available in all diagnostic sessions 3 4 13Custom requests Using this function the user can send manually diagnostic requests to t
27. it is required that the Key programmer is placed near the key in the ignition lock so the Key programmer is able to read write the key Please refer to the picture below NOTE The automatical check might be not possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference between the automatical and manual procedure is that by the manual procedure you should put the key into the programmer then make a ignition with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively invited to put the transponder into the program and than to give it to the ignition Normally for the most models it is required that the key is in the ignition and you change only the position of the transponder You will be invited to put the transponder into the programmer then to put it near ignition lock so it is read by the immobilizer Exception from this is e g the Passat B6 For it it is required that you put the key with the transponder is put into the programmer then the key with the transponder is put into the ignition lock BUT TILL FIRST POSITION than again into the programmer and again into the ignition lock until the byte is found NOTE If you get XXX is displayed you need to stop on the current position and wait 10minutes before you continue ATTENTION For the Passat B6 there are some cars f
28. read write procedure may fail If you ve a message that controller cannot be read written you ve to retry several times If after 6 7 attempts it is not possible e g to read the odometer or to read the immobilizer data this means that the wiring is not correct or you selected wrong device type NOTE Sometimes writing of the data may fail In order not to lose the information all written data are backed up in the Dumps subfolder 3 5 6Special functions with VDO NEC The VDO NEC special function is dedicated for the VDO instrument clusters with NEC microcontroller Typically these are VW Seat Skoda Audi cars produced after 2009 year After starting the function a following dialog will be brought to the user DO with NEC Microcontroller 2009 rm Service Mode order to enter it again Load EEPROM 24032 dump ice mode dum p Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the EEPROM content with a programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the EEPROM dump in Enter Service Mode Leave Service Mode by OBDII by OBDII Odometer Odometer jo Read odometer Read write EEPROM Flash x Read Read EEPROM FLASH write EEPROM Write 00000020 08 E4 3F 5B CO F9 10 ee odometer 00000028 5D 61 CD 39
29. recognized automatically from the wake up pattern You can choose which of these protocols to try when attempting to connect as described in the Configuration section 3 1Configuration The ABRITES Commander for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed Special functions amp Vehicle Selection 1 Broadcast Options ol for diagnostic r Select COM port K Line baud rates trying sequince Language 10472 9600 English Me Advanced 96005 10472 r K Line used OBDII PINs IV Autodetect 7 K Line KWP2000 KWP1281 Logging Ea 015 MV CAN TP 1 6 fo IV Enable CAN log Antena factor l M UDS A 5 CAN Resistor 4 Test l V Enable K Line log es Som T IV Instant Logging NOTE changes regarding interface detection and timing parameters which you made in this dialog will be applied after restarting the application 3 1 1Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP2 0 with baud 500KB s CAN TP1 6 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP1 6 with baud 500KB s UDS when trying to connect to the device the commander will try to connect to it using UDS over ISO transport protocol with baud 500KB s
30. should enter the Request fields and press the Request button NOTE This requires that the dongle and the interface are connected to the PC After the request is made a text file named SW_Update_Req_xxxx bin is created where xxxx is the number of your interface 2 or 4 digits After the file is generated you have to send it manually to update abritus72 com 6 TROUBLESHOOTING Below you can find a list of typical problems and how to solve them Problem When starting the ABRITES VAG Commander on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port COMxx where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES VAG Commander If the interface is not recognized the USB interface appear with yellow exclamation mark in the device manager then you can try to solve the problem by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface drivers and Uninstalling USB interface drivers If the problem is still present you can try to set the used port manually as follows oStart the ABRITES VAG Commander oPress the Options button oUncheck the Autodetect check box an
31. the car Unlock VW Passat Unlock tw EOS Unlock Audi A3 Unlock Audi 44 So for any of the desired model you ve to press the appropriate button ATTENTION In the most cases this only opens the doors It doesn t disable the alarm 4ABRITES VAG Cueck The ABRITES VAG Check is a tool which performs self diagnostic of the USB dongle and interface Hy YAG K CAN hardware check i x Dongle check Dump file m Interface check Detect Interfaces Include K Line test Dump file E Generate dump It has two sections Dongle check performs self diagnostic of the USB dongle Interface check performs self diagnostic of the USB interface Pressing the Detect button from the dongle section performs a detection whether the dongle is successfully read NOTE This will not check the dongle data for inconsistency If you specify a dump file in the dongle section and press the Generate dump button then all dongle data will be read and this file can be examined from the producer This file should be sent to the interface producer if there are problems with the interface e g interface is not recognized K Line is not working or if requested by by producer NOTE If you get an error message 0x10001 while running the ABRITES VAG Commander please send the dongle dump to support abritus72 com In the Interface section there is a possibility to perform a detect
32. 0 00 00 00 00 00 00 00 00 00 00 00 00 OO 7 Data read Component security 1b d4 05 e4 37 a8 Ob For CAN immobilizers till end of 2006 it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you ve to go to Special function then Instrument CAN and Read write immo data After you read the immobilizer data in the field Serial Key the 7 bytes of the component security will appear 3 5 13 3 1 Programming a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button 3 5 13 3 2Finding the 7 byte If the 7 byte is not available you must choose Find the 7th byte of the component protection data and you have to put the six bytes which are known There are two possible ways to check whether the 7 byte is matched automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason it is required that the ring coil is dismounted from the ignition lock and placed over the Key programmer Unfortunately for some models it is not possible to dismount the ring coil and
33. 0 E4 FC UX3Z0C1310443 00000100 55 58 33 5A 30 43 31 33 31 30 34 34 33 00 E4 FC UX3Z0C1310443 5 rf Checksums in the file updated Press the Save button to save the changes ECU EDC15 Immo bypass 24C04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU pump roon x Type ECU EDC15 Immo bypass 24004 A Swap bytes L H lt Toggle Immo On Off Immo is now OFF The Toggle Immo On Off button allows to switch on off alternatively the bypass function Gateway Odometer resetter 95160 Required license None This function resets the odometer value inside the CAN gateway Actually not all CAN gateways are containing such value and this value is not exactly a odometer but is proportional to the current mileage and this function sets this value to zero Dump Tool Odometer resetted Steering lock VW Passat 6 Security code 68HC908 Required license AN003 to view security access code and AN009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola microcontroller the unit can be either with ELMOS or Motorola microcontroller
34. 00 00 00 00 00 00 09 F 6E 24 F3 C5 72 49 E 5A CD DA 00 00 00 56 57 5A 43 4rI 5a 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 YWZC eee 24 F3 C5 72 49 E7 5A CD DA 00 00 00 56 57 5A 43 4rI YUZC 5 rf Immo is now ON A A Load dump Save dump Swap bytes L H i 4 Save dump Swap bytes L H ee Toggle Immo On Off The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Odometer calculator 95320 Required license None This function changes the odometer value contained into the EDC16 ECU Just put the new odometer value and press Set button and then save the dump Dump Tool a xi Type ECU EDC16 Odometer calculator 95320 v 8 16 12 04 FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 5 bytes L H 00000040 00 06 05 00 04 2A 10 75 A6 30 32 36 31 30 31 32 u 0281012 OPRESS 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 00000060 00 04 2A 10 75 AG 30 33 47 39 30 36 30 32 31 Al u 036906021A 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H Adana 00000090 00 00 00 DO 00 00 00 00 00 00 00 DO OD 09 FT GE ww eee ee
35. 00 00 00 00 OO F5 62 91210 b Toggle Immo On Off 00000100 03 04 4B D4 39 OB 00 00 00 00 00 00 00 00 00 00 K 9 00000110 00 00 00 00 00 00 00 00 00 00 00 OO OO OO FE 95 Lee eee 00000120 04 03 48 30 35 2D 42 50 47 38 31 30 08 02 07 31 HOS BPG810 1 00000130 33 32 34 30 31 38 31 35 43 00 00 00 00 00 FB SF 32401815C 00000140 05 03 30 33 48 39 30 36 30 33 32 47 20 30 30 30 03H906032G 000 00000150 30 30 00 00 00 00 00 00 00 00 00 OO OO OO FC Cl 00 00000160 06 02 00 07 02 7C Ol AO FF FF 04 32 11 AO OD 92 2 00000170 OE 74 00 00 00 00 00 00 00 00 00 00 00 OO FA CB t 00000180 07 02 00 00 OE 2C 7A B6 05 OO OO OO 27 BF 00 OO 2 00000190 00 00 00 00 00 00 00 00 00 00 00 00 OO FA FC AD 2 eee eee ee 00000140 07 02 00 00 OF 2C 7A B6 05 OO 00 00 27 BF 00 00 Erika iE 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 F4 FC AD ss ssssserres gt Immo is now ON x ECU ME 7 x Set component protection data 9P08 95080 Required license AN009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool a u i xj Type ECU ME 7 x Set component protection data 9P08 95080 20 20 20 20 54 FF 00 12 30 35
36. 1 G 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 Save dump 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 03 AS 54 69 96 Cl 3E 00 00 00 SF 61 1B D4 05 2i gt 2a 37 AS OB 37 46 3C 13 00 01 00 00 00 BC F B2 7 7 lt 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 21 gt 2a 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 0s 00000080 Component security data TT x Ca we Swap bytes L H ih 4 a ECU MED 9 x Security Code Checksum calculator 95080 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool i x Type ECU MED 9 x Security Code Checksum calculator 95080
37. 2 u 0281012 ee 00000050 31 31 39 20 20 00 00 00 16 SC OF DS OA 16 FA Bl 119 _ 00000060 00 04 24 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 036906021A 63638 Login 54 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 45 00 00 RB Tie cHes 00000090 00 00 00 00 00 00 00 00 00 00 00 OO 00 09 FP 6E see eeaes n 00000040 00 04 2A 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 036906021A 000000B0 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 000000C0 20 20 20 20 20 20 37 38 37 31 03 00 00 45 00 00 7871 He 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 09 F GE ee eee n 000000E0 24 F3 C5 72 49 E SA CD DA 00 00 00 56 57 5A 43 4rI YWZC 000000F0 54 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 8A CD DA 00 00 00 56 57 SA 43 4rI UZC gt Checksums in the file updated Press the Save button to save the changes ECU MED 9 x Reset component protection data 95160 Required license AN009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and
38. 2007 CAN gt Skoda Octavia I 2007 CAN SII Sk oda Superb k ine diagnosis KW1281 Skoda Roomster k line diagnosis K W1281 Skoda Scout CAN Skoda Fabia 1999 external immobilizer box Kw1281 1 1 Enter security access code and the number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining key stopping to work You will be asked whether you want to use this feature Please answer with yes no according to your wishes 1 5 Wait until adaptation finished is displayed 1 6 Remove the key and turn ignition off with all remaining keys NOTE The system will autodetect whether it is possible to add the key without erasing the remaing keys If possible and if 1 key is selected then and only then a message will appear where you ve to confirm that you want to add the key If you press No here the key will be learned normally other keys will be erased If you select other than 1 key to learn or if adding is not possible than the key will be learned normally with erasing other keys which are not present For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 Please pay attention that during the autodetection whether adding is possible reflashing
39. 3 51 1A 5B 31 32 36 2E 30 32 2E 30 37 FF FF 0 126 02 07 Save to file 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B 31 000000A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF seeeeeceeeees 00000080 33 30 35 32 31 30 30 39 33 31 38 31 32 31 35 30 3052100931812150 v Load from file KIN fl This special function is dedicated for Q7 A6 Allroad models and the user has the following possibilities Learn a key Learning a key requires in most cases a preprogrammed using VIN key which normally should be purchased from the VW Audi dealer Only models with EZS Kessy with SW version till V2 0 2 it is possible to learn an empty clear key For models with EZS Kessy over this SW version it is required to have a dealer key purchased from the dealer or create with our programmer Read the EZS Kessy EEPROM 2KB Write the EZS Kessy EEPROM 2KB but without an area of 96 bytes with the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so it becomes like a dealer key IMPORTANT To make any activity with the EZS Kessy you need one of the following to know the login PIN of the car and the first 6 bytes of the component security bytes The component security is normally 7 bytes but the 7 byte is not required The login and the component security bytes can be read normally from the ECU This is true for all cars with EDC16x MED9x ME7x ECUs Vehic
40. 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A O0000 000000C0 02 04 00 00 10 57 56 57 SA SA 5A 33 43 SA 36 45 WYWZZZSCZ6E 000000D0 30 30 30 30 30 30 30 57 5A 43 54 30 30 30 30 30 0000000WZCZ00000 O00000E0 30 30 30 30 57 56 57 5A 5A 5A 33 45 5A 36 45 30 DOOOWWWZZZICZEEN 000000F0 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A OO000 00000100 03 04 8B C Al 7B 00 00 00 00 00 00 00 00 00 00 eveeweeees v gt Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset component protection data 95080 Required license AN009 This function allows to view and or change the component protection data found into the MED9x with ST95080 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool BE x Type ECU MED 9 x Reset component protection data 95080 97 ES 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 amp Load dump FF 30 35 2D 30 37 2D 32 39 08 10 15 49 05 47 05 07 29
41. 60 00 00 00 F p 00000150 24 08 18 00 30 00 60 DO DS 00 50 Ol BS O2 EO 02 0 P 00000160 EO 02 00 00 57 00 34 Ol 1C 02 FA 02 81 05 CB OS W 4 00000170 CB 05 27 05 18 00 30 00 60 00 CC 00 38 01 78 02 0 8 x W 00000150 90 02 90 02 00 00 57 00 34 01 1C 02 FA 02 6105 VIN WAUZZZ4DZYN002822 Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s data and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump You should use transponder TPOB8 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Keys data xi Keyd 24637321 Program transponder Status You can enter manually a key in certain position or you can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to dump After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi A3 A4 A6 UKNSI 19
42. 95 1997 odometer and login code 93C56 displays the login and changes odometer No license required Audi A3 A4 A6 UKNSI 1997 1998 odometer and login code 93C56 displays the login and changes odometer No license required Audi A3 A4 A6 UKNSI Japan odometer and login code 93LC56 displays the login and changes odometer No license required Audi 100 VDO 1995 odometer 94C46 changes odometer No license required Golf 3 VDO 1995 odometer 93C46 changes odometer No license required Golf 3 VDO V3 9 odometer 93C46 changes odometer No license required Golf 3 Diesel odometer 93C46 changes odometer No license required Golf 3 Motometer V5 8 odometer 93C56 changes odometer No license required Polo Motometer odometer 93C46 changes odometer No license required Polo Motometer 1996 odometer 93C66 changes odometer No license required Passat VDO 1991 odometer 93C56 changes odometer No license required Passat VD202 1993 odometer 93C46 changes odometer No license required Passat GT odometer 93C46 changes odometer No license required Passat GT odometer 93C56 changes odometer No license required Caddy odometer 93C56 changes odometer No license required Corrado VDO 1993 odometer 93C46 changes odometer No license required Corrado MotoMeter 1991 1995 odometer 93C56 changes odometer No license required Corrado VDO 1991 1995
43. ABRITES VAG Commanper 12 x Document number 2 20071127 Date 13 05 2011 Abritus 72 Ltd Date 13 Mai 2011 CID AUOI ABRITES Commander for VAG User Manual Version 2 23 issued by Abritus 72 Ltd Version 2 23 ABRITES VAG Commanper 12 x Document number 2 20071127 Date 13 05 2011 List of Revisions 27 11 2007 __ Release version ofthe document 3 14 01 2008 01 02 2008 12 02 2008 7 18 02 2008 2 20 02 2008 14 03 2008 06 06 2008 2 1 01 07 2008 j 28 10 2008 Al 08 11 2008 01 12 2008 3 7 12 12 2008 06 01 2009 8 Update to V6 3 of the ABRITES VAG Commander 23 03 2009 3 Update to V6 4 of the ABRITESVAGCommaner 21 04 2009 3 Update to V6 5 ofthe ABRITES VAG Commander Procedures for 2 9 Q7 A6 Allroad described 19 05 2009 2 3 7 Update to V6 6 of the ABRITES Commander for VAG 2 10 2 11 17 06 2009 2 12 02 10 2009 2 13 06 01 2010 2 14 21 01 2010 2 15 15 02 2010 2 16 22 02 2010 2 17 25 03 2010 15 05 2010 25 05 2 Update to V7 7 and V7 8 of the ABRITES Commander for VAG 2 18 Update to V8 0 of the ABRITES Commander for VAG added section 2 19 for the CDC32xx programmer 27 05 2010 3 7 Update to V8 0 of the ABRITES Commander for VAG added section 2 for VW Crafter 9 09 2010 Update to V8 4 of the ABRITES Commander for VAG 2 21 20 ee cOUe Update to V9 0 of the ABRITES Commander for VAG ae 23 13 05 2011 2 Update to V12 0 of the ABRITES Commander for VAG Ver
44. Audi A8 2002 Security access code Program transponder 24c17 Required license AN006 to view security access code and AN009 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Tool BE Type Audi AB 2002 Security access code Program transponder 24c17 v 00000050 14 SE 7A 00 OA OA 31 2A SF 46 4C 60 5A 78 66 SE z 1 FL Zxh 00000060 75 A4 83 B9 91 CD 9E El AC 00 2D FF 50 19 2D 37 u Ze 00000070 50 1E 23 34 53 00 2D FF 50 00 ZA FF 64 00 25 FF P 45 P d 00000050 64 14 1C 2D 50 18 1C 34 53 14 1C 2D 64 50 32 05 d P 45 dP2 00000040 00 00 00 00 00 00 00 2D 00 4B 00 45 03 2C 0100 K H Swap bytes L H 00000060 00 OF 14 03 DA OA OA OA DA OA OA OA OA FF FF FF eee eee eee eee Save dump O00000E0 00 00 70 00 31 07 AZ 07 84 08 BA OA F9 OC A9 OF p l e 000000F0 08 16 00 31 00 81 05 09 06 46 OF 4E OA 46 OD BF 1 H N F Login 3128 Other Data 00000100 10 00 00 50 00 AO 05 40 06 80 07 AO OA CO OD 80 P 00000110 11 SE 4B FF 00 04 00 00 1E 03 SF OB 10 16 00 OO K 00000120 B3 01l EF 07 A9 OF 60 75 00 80 80 00 50 20 04 08 Kenia we Immo number see d eceeeee AUZ 7201070699 p A 00000130 8D 00 BO 00 46 Ol F4 Ol 5D 02 BA 02 DD DZ ED DZ 00000140 E0 02 BS 02 70 02 EO O1 50 01 BO 00
45. E FE FP FF PF PE EP FE FE i iets edie enn 00003BD0 04 OD 2B 41 55 5A 35 5A 30 41 55 58 56 55 56 56 AUZSZOAXXXXXX 00003BE0 58 11 1E 3B 5A 79 96 B6 OO FF FF 42 20 93 9D 43 X 2Zy Bev E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXX and the login is OD2B in hexadecimal or 3371 in decimal 2 lf the immobilizer number is not present then the login is found somewhere in the region 0x0070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF O0003610 PE FE FF FF ER FF PE FE EF PE FF FE FPF FEF EF FR en 00003820 FF FF FF FF FF FF FF FF EA 00 01 18 1F CC FF FF D0003B30 FF EA D6 01 FR Ci TE FF FF EF IE FF PF FF IE FE iceccoirconeausi 00003840 FF FF 06 06 F9 FF FF FF 10 00 47 45 36 35 54 54 GE6STT 00003850 31 30 30 30 31 10 FF FF FF FF FF FF FF FF FF 23 10001 00003860107 23 03 02 00 00 1E 00 32 20 00 00 02 OO 32 FF Den 00003870 FF FE_FF FF FF FF FF FF FF FF FF FF FF FF FF FF acc 00003880 FF 4 7F 00 01 OF 14 FB 00 00 02 OO FF FF FF FF 00 00003890 FF FF FF FF 03 6D FF FF FF FF FE 63 1B FF FE 63 Menan c e 000035AD 18 FF FE 63 1B FF FE 63 1B FF FE 63 1B FF FE 63 c c c E g on the pictur
46. If the immobilizer number is placed there then the instrument is not crypt otherwise Problem After reading the A4 RB8 instrument the instrument displays LO x x instead the odometer Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible to connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www abritus72 com mmdata bin into the ABRITES VAG Commander folder Problem Some device cannot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file 7 APPENDIX 7 1 Programming instrument clusters from Magneti Marelli K line diagnostic link 7 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these type is possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending of the production year of the car So you have to select the one of the both types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are continue to be equipped with older instruments even if they are after year 2000 So the best way
47. MEDSx uncrypted Simos PPD Simos FSI The function also visualize change the immobilizer and VIN numbers pump Toon x _ Type Comtor module component protection data Passat B6 v J u b 3C00959 VCH 433H 0453300959 00000050 FECFF FF FF FF FF YE FPF FO TF VEE PREF FDOFE RP 0a 00000060 SA SA FE BS 47 14 FE 00 03 63 00 03 64 00 03 56 22 G c d 00000070 00 03 57 00 03 62 5A FF FC B2 56 FF 00 43 86 00 W bZ V C Save dump 00000050 43 82 00 43 83 00 43 54 00 43 65 5A FE 79 62 4A C C C C 2 ybJ 00000090 FF 00 02 69 00 02 65 NN Nn 6A NN N2 67 NN N2 8 ii e fo pi 00000040 AS FF FF FF FF r a i i IE 00000050 FF FF FF FF FF F 000000C0 FF FF FF FF FF u Ci Component security bytes are D9 72 52 79 B2 E4 A4 Other Data F E 000000F0 30 50 30 30 33 F F F x Immo number vwzczagooooooo 00000180 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeseess ae 00000190 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeseeeeeeees WVWZZZ3CZ83000082 OOOCOLAO FF FF FF EF FF FF FF FF FF FF FF EF FF FF EF FF GG en COOUOIBO FF FF FF FF FF EP ER FF FF FF OFF FF FF OFF OBE CER sn e gt Component security bytes are DI 72 52 79B2 E4 A4 Pressing the other data displays the learned keys and allows several operations if a programmer has been recognized allows to read current transponder s data add it to the dump and if transponder s type is appropriate al
48. ROM it is required to put the login and component security bytes as described above Then using the Read EEPROM button you can read the whole EEPROM This EEPROM is required to prepare a dealer key Pressing the Write EEPROM button respectively will write the EEPROM but the area from address 0x100 to 0x15F i e 96 bytes is not possible to write The write procedure takes about 8 9minutes while the reading of the EEPROM is completed for less than a minute 3 5 2 4Program a blank key so it becomes like a dealer key You need to put the login and the component security bytes as described above and then to press the Make dealer key button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned with the learn button 3 5 3Special functions with instrument K Line When this function is opened the following dialog appears From this dialog you need to choose the type of your instrument cluster immobilizer and then you can read write EEPROM change odometer read PIN code and so on Please note that only connection via K Line will be made KWP1281 or KWP2000 and this doesn t depend on the configuration options ATTENTION All read EEPROM dumps are stored in the Dumps sub folder of the ABRITES VAG Commander so it is possible to restore the EEPROM in case of unwanted changes
49. The applicable and available adaptation channels from column New value are also available for editing so the user may put there any other values 3 5 16Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the commander will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation In the Instructions window within the Remote adaptation section will be available directions what should be done to learn remote controls Additionally in the Available settings table will be listed all the applicable adaptation channels with their current values and description which are related to the remote controls function By editing the New value column values and pressing Change settings button the user can change certain settings This function is available for Audi A6 2000 Audi A4 and VW vehicles 2001 Audi A3 2003 For Audi A8 VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 3 5 17Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value applicable for the navigation controller function 3 5 18Special function Cruise control
50. ZZZIKZ7P042315 2 RETRO Read Immo Fr eee data Serial number vYWZ7Z0G7044319 Transponder identificators rege _ engeren pe rite mma Serial key CS 9al abd3cc528d5 KeylD1 3443daf3 KeylD5 tft ders MAC 7065229 KeylD2 445fdb1a KeylD6 ffffffft Status 0000fe78fe Keylb3 tft Keyp ttt Configuration 10196220111 o yw v KeylD4_ ffftfffr Keylbg _ titttttt PIN 6834 NOTE Before starting any activity with the CDC32xx programmer it is important to set properly the communication port COM port used by the programmer This is made from the CDC32xx port combo box If the port is properly set after starting any activity the LEDs of the CDC32xx programmer will start to blink If they re not blinking this is probably indication that you don t selected the port properly From the Type and Device combo boxes the user has to select the car type or the microcontroller type For each selection there is a possibility to view the wiring PIN outs using the Connection diagram button If the user wants to read the whole Flash EEPROM he have to select Micronas Secured from the Type combo and then the microcontroller sub type from the Device combo Type Micronas Secured Device CDC3217G secured z CDC3217G secured CDC3272G secured CDC3297G secured CDC32e G secured gt 24032 If CDC3217G CDC3272G or CDC3297G is selected the user will be able to read write the flash memory If
51. able Normal Communication This function will disable all communication between units in the car This can help you to hold current state of the car and to prevent disturbing of communication while re flashing Enable Normal Communication Restore normal message transmission Clear All DTC s Sending requests to all units in vehicle to erase its DTCs 3 4Standard diagnostic requests When double clicking on the desired device in the main ABRITES VAG Commander window you connect to the device to proceed standard diagnostic requests The following dialog is opened 2NG Engine Control Unit Master x Establishment diagnostic session with selected unit electronic control unit identification ss Device N l O70906016BL lt VAG number PROGRAMMABLE Clear log Program status 7 data status 0l Coding 11172 Part number 56823 Importeur s number 211 Supplier number 137 System description RS Z 5L EDC GOOOSG Write log Diagnostic requests v Read Freeze frame Custom M Basic settings download uplo Diagnostic session ad ee Components Security This dialog provides you the possibility to execute the following diagnostic requests 3 4 1ldentification Identification will provide you the VAG part number and software coding I electronic control unit identification Device N l
52. ase for Motometer instruments is available on www abritus72 com mmdata bin NOTE Sometimes if you try to access the instrument cluster by selecting the wrong type the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnecting from battery For example this always happens for the Bosch clusters which will be blocked if accessed as Instrument cluster VDO66 VDO86 Motometer type NOTE Please be very careful when selecting Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instruments You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi A4 BOSCH RBx 2 Read the EEPROM 3 If the displayed odometer corresponds to the real value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH RBx otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 Take into account that most instrument clusters need a Reset after change of the odometer You can try to send a diagnostic request for reset of the cluster button Reset ECU If this service is not supported you need to remove the fuse of the instrument c
53. at Toledo 2008 OBD CAN TA2 Procedure 3 2 Skoda Roomster 2007 OBD K TPO8 Procedure 1 Skoda Fabia 2000 OBD K TPO8 Procedure 1 Skoda Superb VW BoraBOSCH 1997 VW Bora Motometer 01 2007 OBD K not needed TPO8 osx notneeded Teos TP08 OBD K Procedure 1 Procedure 1 1997 notneeded Tpos 1997 TP08 VW caddy VDO 2004 09 2006 _oBp caN TP2Q TAS VW Cadd VW Eos 08 2006 OBD CAN TP23TA3 vw Eos 08 2006 208 _OBD CAN VW EOS WW GotaBoscH 1997 op OBD CAN TP23TAS 2008 Procedure 2 Procedure 3 2 e T SEGAN TPO8 2008 1997 OBD K not needed Procedure 1 1997 OBD K not needed TPO8 Procedure 1 ter vwGoravoo 1997 obok VW Cross Golf 08 2006 VW Cross Golf VW Cross Got zum VW Jetta VW Jetta VW Jetta VW Multivan VW Passat B4 Mo tometer VW Passat B4 VDO VW Passat B5 VDO VW Passat B5 Mo tometer VW Passat B6 VW Phaeton VW Phaeton VW Polo VDO VW T4 Motometer VW T4 VDO VW T5 VW Touareg 1997 OBD K not needed TPO8 OBD CAN TP23TAS 08 2006 208 _OBD CAN OED CAN Keyprogrammer Tas e Procedure 1 Procedure 2 Procedure 3 1 2008 TA3 Procedure 3 2 08 2006 OBD CAN TeearTAg 08 2006 2008 _OBD CAN Procedure 3 1 2008 K T OBD CAN Procedure 3 2 meos Procedure TP08 OK notneeded 2007 OBD K 1996 OBD K not needed TPO8 iors oapx notneeded Teos TPO8 Procedure 1 OBD K notneed
54. at enabling logging may significant decrease the PC performance since writing big data block on the hard drive may consumes more time on slower machines So if your PC is slower please use the log function only when a problem have to be reported 3 1 6Antenna factor This parameter is applicable only to the Hitag2 programmer not applicable for the other Key programmers The parameter is used to specify the amplify factor of the antenna You should specify a value in the range from 0 to 9 typical value should be 5 With the Test button you can see whether with the current value the programmer reads the properly If you get a message that the transponder is read on 100 then the present antenna factor is OK 3 1 7K Line PINs Normally the K Line is output on PIN7 of the OBDII connector But some models e g Porsche Cayenne 2004 the K Line with some units might be on PIN3 or PIN15 For that reason there is a option on which PINs to try to connect to the units ATTENTION If you check all PINs to be examined l e PIN3 PIN7 PIN15 then when scanning for units the time will will be significantly increased For that reason by default only PIN7 is selected 3 1 8CAN resistance According the CAN specification there should be a resistance between CAN Low and CAN High Normally the gateway has this resistance but if you want to connect on some device on the table then you should use that resistance For that reason there is a option wh
55. at resistance to use None 75 Ohme 100 Ohm 120 Ohm or 10 Kiloohme By default 120 Ohm is used Normally you should don t have any problems but if some problem appear you can try to change the CAN resistance 3 2Scanning units After startup on the main screen of the ABRITES VAG Commander a list of all possible units with their VAS Number is displayed The customer is able to connect to the listed devices by double clicking on the desired device Instead of displaying all possible units you can choose a configuration of devices corresponding to specific car model chassis type This is done by selecting the type e g 1T VW Touran from the Chassis type combo box Then pressing the Display button will show all devices which can be installed into this car type Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protocols will be used when scanning for the devices For all devices which the ABRITES VAG Commander finds a detailed information is displayed in the main screen For each device the following information is shown VAS Number Unit name VAG Number returned by device in the device identification Description returned by device in the device identification Coding returned by device in the device identification Part Imp Supp N Part number Importer number Supplier num
56. ber information is shown separated with spaces also returned from the device in the device identification DTC number of DTCs stored in the unit Instead of scanning all units which can take a while the user retrieves the list of the installed devices from the gateway by pressing the Gateway config list button Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing DTCs are not accepted from all units there is a possibility to scan all devices and if connection to the device is possible then its DTCs are cleared This is made by pressing the Clear all DTCs button from the Auto scan devices panel Once again the protocols used to connect to the devices are specified in the configuration options 3 3Broadcast requests Broadcast requests are these requests which are sent to all or a group of devices simultaneously The ABRITES VAG Commander is able to send broadcast requests to all devices with request to enter into a desired transport mode to clear all DTCs in all devices to disable enable the communication of all devices This is done by pressing the corresponding button from the CAN Broadcast panel Available functions are Transport Mode Entering into or leaving the vehicle from Transport Mode that is used by the factory to put the cars into a sleep to conserve battery charge during long periods of inactivity Dis
57. communication with the EZS Kessy is possible only if you press the brake pedal So if don t have a working key before learning keys making dealer keys read write VIN read write EEPROM you ve to make Ignition OFF then Ignition ON and press and hold the brake After that you can continue with the function from learning a key making a dealer key reading writing EEPROM or reading writing VIN NOTE To make any activity with the EZS Kessy you need to put the login and the component security bytes or to load the EZS Kessy EEPROM dump or to get the component security and CS by OBDII from EZS Kessy If this information is not made any attempt to make any activity with the EZS Kessy will result an error 3 5 2 1Learning key with EZS Kessy To learn a key for the EZS Kessy You need to put the login and component security bytes as described above and to specify the number of keys which should be learned Then pressing the Learn button will learn the key IMPORTANT For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer 3 5 2 2Reading changing VIN To read write the EZS Kessy VIN it is required to put the login and component security bytes as described above Then using the read write buttons you can change the VIN 3 5 2 3Reading Writing EEPROM To read write the EZS Kessy EEP
58. curity access codes change odometer and so on This application needs the EEPROM dump from the corresponding unit After the dump is loaded some modification will be made and you need to store the dump as a new file which you can program into the device For more details about the concrete functions please refer to the appendix 3 5 15Special function Service Interval Using this application you can perform reset of the service reminder reset of the service interval parameters or change service interval options With the opening of the special function window the commander will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have enabled Service reminder reset or and Service interval reset or and Change service options sections Together with these sections in the section Applicable adaptation channels you will see the adaptation channels which values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed column New value of the Applicable adaptation channels table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options
59. d enter the number of the port from the device manager oThe changes will take effect after restart of the ABRITES VAG Commander NOTE Please take into account that the used port will change when inserting the USB interface into different USB slots so the manual setting of the port should be repeated in this case If the problem is still present please run the ABRITES VAG Check and try to auto detect the interface and generate a dump from the interface Report about the problem to Abritus72 Ltd with the included interface dump file Problem When starting the ABRITES VAG Commander on the splash screen neither Interface found nor Interface NOT found is displayed Solution Please try to unplug and plug the dongle and the USB interface again into the USB slot and restart the ABRITES VAG Commander If the problem is still present please run the ABRITES VAG Update Request and request an update of your software Please be sure that the version of the ABRITES VAG Update Request is at least 1 1 displayed in the title bar when ABRITES VAG Update Request is started Please specify in your mail what kind of problem you have when running the ABRITES VAG Commander Problem When starting the ABRITES VAG Commander the splash screen is displayed but the application freeze on this state for about 1 2 minutes After that Interface found is displayed and application functions normally
60. e 00000050 66 D4 B3 64 65 1B 66 D4 00 O1 00 O1 00 O1 14 C je f 00000060 14 C7 14 C7 00 00 00 00 00 00 AO BZ AO BZ AU BZ oo cee eee eens ER Saa 00000070 56 57 SA 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZ0O0000000OYW aga 00000080 54 43 5A 30 30 30 30 30 30 30 30 30 56 57 5A 43 ZCZO00000000YWZC 00000090 SA 30 30 30 30 30 30 30 30 30 57 56 57 SA 5A 5A Z000000000WWWZZZ 00000040 33 43 5A 33 33 33 33 33 33 33 33 33 33 33 33 33 3023333333333333 000000B0 33 33 33 33 33 33 33 33 33 33 33 33 57 56 57 SA 333333333333WVWZ 000000C0 SA 5A 33 43 5A 33 33 33 33 33 33 33 33 00 00 00 2230233333333 000000D0 7C 7C 30 39 30 37 33 32 33 39 30 36 30 31 35 46 10907323Q05015F 000000E0O 47 20 00 00 00 00 01 05 00 03 18 OF O1 16 OL B4G 000000F0 01 05 00 03 15 OF Ol 15 Ol 84 01 05 00 03 00 OO 00000100 7C 7C 01l 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03690601 7 gt Load dump Save dump Swap bytes L H ih 4 ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license AN003 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through CAN for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool j x Type ECU Simos 7 CAN Security Acc
61. e ve je fer ew u 0281012 a te fp POPE PEEP 0 24 F3 C5 72 49 E 8A CD DA 00 00 00 56 57 5A 43 rI WZC 54 30 30 30 30 30 30 30 30 30 00 AC F6 02 FS 55 Z000000000 U 24 F3 CS 72 49 E 8A CD DA 00 00 00 56 57 SA 43 4rI W2Z0 Md gt ECU EDC16 Immo bypass 95320 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool J x Type ECU EDC16 Immo bypass 95320 8 16 12 04 FF FF 31 37 2D 31 32 2D 30 34 08 10 16 89 00 39 17 12 04 9 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 32 u 0281012 31 31 39 20 20 00 00 00 16 9C 07 D5 OA 18 FA Bl 119 00 04 ZA 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 036906021A 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 Beea Hes 00 00 00 00 00 00 00 00 00 00 00 00 00 09 F GE n 00 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 03G69060214 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 20 20 20 20 20 20 37 38 37 31 03 00 00 45 00 00 7871 H 00 00 00 00 00 00 00
62. e above starting from address 0x0080 of the EEPROM there are 17 bytes with OxFF then follows the login which is 0x047F in hexadecimal or 1151 in decimal The odometer consists of two blocks usually 0x90 bytes with the inverted odometer followed by 0x90 bytes with the real odometer but this may vary e g blocks with 0x98 bytes instead 0x90 or first is the real value and then the inverted So if the odometer is displayed correct you can try to change it But please be always sure that you change the odometer only after it is displayed correct only small deviation is possible 7 1 2 Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 3 TT and read EEPROM Currently for the software versions we know the login can be located as described above and the odometer starts from address OxAA to address 0x1C8 marked in the picture below 00000000 00000010 00000020 000000530 00000040 00000050 00000060 00000070 00000050 00000090 00000030 000000B0 D0O0000C0 000000DO OO0000E0 ooo000F0 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 00000150 00000190 00000130 000001B0 000001C0 40 FF OD 55 FF QOOOO1IDO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF QOOOO1EO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
63. e function allows changing the security access code and the component protection data into MED9 1 ECUs for which the EEPROM is encrypted As mentioned previously for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU requires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the MED9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster Dump Tool g xj Type ECU MED 9 x Reset CRYPTED Login Component protection 00000000 00 EC SE 2A 38 FF FF 30 36 2D 30 36 2D 31 35 00 OC Reset crypted Login C S 8 06 06 15 A Swap bytes L H Login Old funcrypted login 193234 a anc New funcrypted login 23413 f m Component security protection p p Old unerypted CS 2 AB 22 E 34 F8 00 New unerypted CS 12 og 34 aF Da fac fo Uncrypted data can be read from the instrument or from the MED ECU through the OBDII ECU MED 9x Immo bypass Requi
64. e short of the external fusebox it is found under the front cover where also the engine is You ve to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you ve to use a bigger cable because if you use a small cable it can become hot 7 5Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below 7 6Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below 7 7VAG K CAN Commander key learning procedures Programmer need Transponder Key Learnig proce Year ed Ke dure Audi 2 at o 108 108 TP26 TAS TAS 108 Tas o na SS Audi AS SS a Blank key for Audi A6 RS6 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Audi Allroad 2004 OBDK TPos Audi Allroad 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Audi 6 204 osx TPoB Blank key for Audi Q7 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Mere I HITAG 2 Key pro PCF7936 or Audi A8 2002 OBD CAN grammer ke Procedure 7 zea ae he ce Audi A8 2007 grammer ke Procedure 8 Audi Re anaes eee eee Ce Ge 2008 OBD CAN Key programmer Procedure 3 2 Seat Alhambra Procedure 2 Procedure 3 2 Seat Arosa 1998 2004 OBD K TPO8 Procedure 1 Seat Cordoba 1996 2004 OBD K TPO8 Procedure 1 Seat Ibiza 2007 OBD K TP08 Procedure 1 208 osok TPo8 Procedure 1 Seat Leon Procedure 3 1 Se
65. ected Same data can be programmed in the EEPROM of the engine control unit From this dialog also is available function to reset immobilizer in virgin delivery condition where is allowed adaptation of this immobilizer to engine control unit 3 5 2Special functions with EZS Kessy CAN When this function is opened the ABRITES VAG Commander tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP2 0 EZS Kessy for Q7 A6 Allroad i x gt Component security Get component security from Engine Control Unit ECU Component protection bytes ad 32 df ad a3 3d PIN Login code 23242 Get component security from EZS Kessy EEPROM dump O Get component security from EZS Kessy by OBDII requires to give ignition ON with working key m Learn keys i learn r EZS EEPROM 00000000 00000010 31 33 30 30 32 36 30 30 31 31 FF FF 37 33 38 37 1300260011 7387 Read EEPROM 00000020 30 33 30 30 30 34 30 36 30 31 FF FF 31 30 30 38 0300040601 1008 00000030 34 31 32 31 31 31 35 30 30 30 39 30 33 31 30 34 4121115000903104 00000040 34 32 34 37 35 FF FF FF 35 30 2E 31 31 2E 38 32 42475 50 11 82 00000050 33 32 30 31 57 Al 55 5A 5A 5A 34 46 58 36 34 31 3201WAUZZZAFXEAL 00000060 32 31 31 33 31 FF FF FF 11 28 23 10 34 46 30 39 2113l 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 0l 0l 00 10852 0220 00000080 OA A
66. ed TPoB Procedure TP08 Procedure 1 2001 2001 OBD K TPO8 Procedure 1 el Procedure 3 2 programmer TA3 HITAG 2 Key pro PCF7936 or grammer ke Procedure 7 OBD CAN Ke HITAG 2 Key pro PCF7936 or 2008 OBD grammer ke Procedure 8 2000 OBD K Tpos tess osb notneeded Teos Proceawer TP08 tee procedwe1 OBD K not needed TPO8 osx notneeded Tpos 2002 TPO8 Procedure 1 HITAG 2 Key pro PCF7936 or L 08 2007 OBD K grammer ke Procedure 7 not needed 2005 2007 1998 VW Touareg 08 2007 OBD CAN grammer ke Procedure 8 VW Touaran 08 2006 2008 _OBD CAN 08 2006 OBD CAN TP23 TA3 Procedure 2 Procedure 3 1 VW Touaran 2008 OBD CAN Key programmer TA3 Procedure 3 2 bassoon un oxox genet pater Porsche Cayenne 2007 OBD K grammer ke Procedure 7 roxincoarm aor omom genet Pe nn Porsche Cayenne 2007 OBD CAN grammer ke Procedure 8 mercone au one gene TO nme Bentley Continental 2007 OBD K grammer ke Procedure 7 aeecainons amr onen Sue iar aaa Bentley Continental 2007 OBD CAN grammer ke Procedure 8 7 8Dump tool special function The dump tool receives as input a dump file from the corresponding unit input dump is loaded with the Load dump button The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is not possible As output the dump tool disp
67. eee n 00000040 00 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 Al u 036906021A 27052 00000080 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 000000C0 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 00000000 00 00 OO 00 00 00 00 00 00 00 00 00 00 09 F GE n D00000E0 24 F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 5A 43 rI VWzC 000000F0 5A 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 2000000000 U 00000100 24 F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 5A 43 rI vWZc y rf Enter new odometer value and press button Change ECU EDC16 Security access code Checksum calculator 95320 Required license None This function displays the security access code which is contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section Dump Tool A xi Type ECU EDC16 Security access code Checksum calculator 95320 v 8 16 12 04 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 Swap bies LH 00000040 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 3
68. elp a Read Na ECU Autodetect EEPROM d AG EDC15x Load from file VAG ME7 1 1 7 5 7 8 wakeup pattern 01 VAG ME7 1 1 7 5 7 8 wakeup pattern 11 Porsche 5 2 7 8 Wite EDC16U1 EEPROM JEDC16U31 1 EDC16U34 JEDC16CP EDC16CP34 Login B EDC16CP34 Master jEDCI16CP34A Slave Odometer j EDC16C4 Master Change JEDC16C4 Slave Save to file NEDC16U1 Master rm Flash counter i Read Flash Flash tool ID Write Flash IMPORTANT You need to clarify the type of Engine Control Unit in the car before proceeding To help you in this operation there is a button ECU type help which will ask you for the model and engine and will give you the possible models of ECUs There is also a Autodetect function implemented if you select the ECU autodetect then system will try automatically to find the ECU type Please pay attention that this will be not always possible especially for EDC17 MED17 ECUs You can choose ECU type VAG EDC 15x VAG ME7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCH VAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG Cartronic ME7 8 EDC16U1 EDC16U3x CP etc Extracting security code odometer correction enable disable immobilizer and so on Example is 1 9 TDI EDC15 Engine Control Unit Special Functions Choice ECU type VAG EDC15x v Write EEPROM 1354 14 FF 1384 14j 2 Save to file Load from file Login fies Odo
69. ent transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if it s type is appropriate TAS it is also allowed to program transponder as dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car should start without making any key learning procedure By pressing OK all changes in dump s data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license AN009 This function allows viewing and or changing the component protection data found into the EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Bump Tool Type ECU EDC16 Set component protection data 35320 12 38 FF FF FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 34 FF 8 16 12 04 EF LAr URs 9 00 06 05 00 04 24 10 75 A6 sr BL 3031 32 orius 31 31 39 20 20 00 00 00 16 9 5 04 16 FA Bl 119 tt ao oe m R
70. er eRead Program memory of instrument cluster immobilizer eReading security access code of the IMMOBILIZER eRead Write immobilizer related data Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the instrument cluster This application can be used with the following models VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda Octavia Il Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the function for reading current odometer value is not available You need directly to enter new value and to press button change odometer After a minute you will be asked for the currently displayed value and the odometer will be changed ATTENTION Please take care that some instrument clusters from Audi A3 and Audi A8 are with current odometer value is displayed unreal value To restore instrument cluster to normal behavior need to be removed for one minute fuse of instrument cluster for example on Audi A8 can be used fuse number 5 Reason for blocking of security ATTENTION ABRITES VAG Commander is designed to calculate odometer values in KM units Please take this into account especially when using dump tool or when VAG Commander asks you about displayed value of instrument cluster Audi Q7 Audi A6 Audi Allroad For some of the vehic
71. er into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES VAG Commander Using this application you can read program memory in some electronic control unit Requests sent from this application can be related for the currently running session of for some of electronic control units from the dialog You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of EDC16 In the example below we read a part of the flash of EDC16CP Custom memory download upload Choose ECU type EDC16U1 v DC16U1 Read Load from file EDC16CP EDC16CP34 EDC16C4 Master EDC16C4 Slave EDC16U1 Master Save to file EDC16U1 Slave EDC16U31 Master ee EDC16U31 Slave St Address 800000 MED9 5 10 MED9 1 Master Len of reg f MED9 1 Slave Total size 100000 Step 0 Encryption Download Upload C Read Write mem Session 0 x Exit In this dialog is needed to clarify the diagnostic session which you want to be entered before Diag session start of read program memory In the example above it is used session 86 If you want to save currently running diagnostic session simply enter session 0 3 5 11Special functions with A
72. ess Code 33C76 93086 1115N150L300 H 00000010 00 00 00 45 00 00 00 46 00 00 08 35 00 IC 00 00 H H 8 00000030 00 00 00 00 9B B9 9B B9 9B B9 54 00 54 00 54 00 Pe ier Aes 00000040 01 00 01 00 Ol 00 B3 6A 65 1B 66 D4 B3 6A 65 1B je f je 00000050 66 D4 B3 64 65 1B 66 D4 00 O1 00 O1 00 01l 14 C je f 00000060 14 C7 14 C7 00 00 00 00 00 00 AD BZ AO BZ AO BZ wee eee eee eee X 00000070 56 57 SA 43 5A 30 30 30 33 33 33 33 30 30 56 57 vuzczo003333ovw Login 1138 00000080 54 43 5A 30 30 30 33 33 33 30 30 30 56 57 5A 43 ZCZ000333000VNZC 00000090 54 30 30 30 30 30 33 33 30 30 57 56 57 SA 5A SA 2000003300WWWZZZ 00000040 33 43 5A 38 33 33 33 33 33 33 33 57 56 57 5A SA 3CZ83333333UVUZZ 000000B0 SA 33 43 SA 38 50 31 33 33 33 33 33 57 56 57 SA Z3CZ8P133333WVWZ 000000C0 SA 5A 33 43 5A 36 33 33 33 33 33 33 33 00 00 00 2230283333333 000000D0 7C 7C 30 39 30 37 30 33 47 39 30 36 30 31 38 46 090703G906016F 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF 01 16 OL 84 G 00 000000F0 01 05 00 03 15 07 Ol 16 Ol 84 01 05 00 03 00 OO 00000100 7C 7C 0l 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G90601 Md gt Load dump Save dump Swap bytes L H ih 4 ECU Simos 7 CAN Reset component protection data 93C76 93C86 Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos 7x generation
73. eta oben tamipweaiblatdinn 27 SAAT AVB PEI nennen rennen 28 ISBN Pe TBB n AT A E 29 Dod Special TuneNnons wih mstinment CAN nenne 29 De SERIE PURCHOUN WER EZS Resy CAN auiii ethu eibi eia aih ee 32 33 2 1 Lessnine key with EZS Kesey siaciaicnctisscnsncintscaasinasnentiancataauaiinpenaiesanenadecenoanirnigasasenseiadtaait tanassnebaivasmisavoersenenenebesaraa 34 33 22 Resch VID nennen 34 3 5 2 Reames Writing EEPROM 2 0er 35 Version 2 23 3 ABRITES VAG Commanper 12 x Document number 2 20071127 Date 13 05 2011 33 24 Programa blank key so it becomes like a dealert key nennen ana nennen a nalen aAa a A 33 3 Special PCTS wiin JANICE KEINE neck ne dicot ais een esse ee 3 3 3 1 Transfering keys fromone RBS Instrument 5 anafher us sinne 23 ER an na RBE TOSET nenne 3 5 4 Special functions with Engine Control Unit 3 SPOTL RUCRORS WEEE WIDOT ORGS CCS Ia nie 3 2 0 Speen Tune nS WHR VDONET suisse ee hs OPONI TUNCHON SETE Ok Anapa OR nahen 2 20 Spesen inch Kerr CANE nn nun warnen SS DEAL MUCHO NITY COI nennen 3 5 10 Special function Custom memory access Download Upload ReadMemory eenrsnesnnrsnnnsnensennsennaennene hl i ONEC RIBERARR WIR Ir OD ieh II Special tuncion VW Craje f ansehen 2AL DABEI TUREHON KN EONO rn riesen 3 5 13 1 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 53 3 5 13 2 Procedure 2 fo
74. fter the dealer key is prepared you can proceed like in the case Learning dealer key purchased by VIN number NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 3 5 13 7Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne You must use a virgin transponder PCF7936 or a virgin key no need for some special preparation If you use a Transponder you need to switch it in Cipher Crypto mode You can use your Key programmeror HiTag2 programmer for that purpose if you have one This is done by replacing 0x06 with OxOE in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already 0x0E then the transponder is already in cipher mode After the transponder is switched into cipher mode the key learning procedure goes as follows From Special functions Key Learning choose vehicle model Write how many keys you need to program enter security access and push the Learn button Then follow strictly the recommendations 3 5 13 8Procedure 8
75. g by dissoldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and proceed as described in step 2 1 3 After the key is programmed like a dealer key write how many keys you need to program write security access and push Learn button 3 5 13 9Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 It is possible to program a key for the Audi A6 Q7 Allroad but this function is not located in the key learning dialog The function is available in the EZS Kessy A6 Q7 function from the Special functions list This is so because it requires separate license Please refer to section Special functions with EZS Kessy CAN 3 5 13 10Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 If such car is equipped with EDC17 MED17 then it is not possible to read the component security from the engine control unit Instead it is only possible to read the PIN code from it Fortunately it is possible to program a key for such car You need to read the PIN from the EDC17 MED17 and also to read the comfort module EEPROM with a programmer Then you ve to select VW Passat B6 CC with EDC17 MED17 CAN from the key learning dialog To learn a key to this car you should make first a dealer key This is made by pressing the Program dealer key button which brings the following dialog Program dealer key Set transponder ype Megamos 48 VW TA3 v
76. he corresponding unit The example below shows a request for identification of an Instrument Cluster ECU Custom requests x Request Trace list Tx 00 02 1A 9B Rx 00 30 SA 9B 34 46 30 39 31 30 39 33 30 41 20 20 30 36 33 30 03 20 3E 12 01 5B 38 DE 2B 67 4B 4F 4D 42 49 49 4E 53 54 52 2E 20 4D 37 33 20 48 31 36 3 4 14Program VIN Program VIN requests the stored in the device VIN and tries to change it Not all electronic control units support this service Please note that it is not available in all diagnostic sessions Urgent point for this diagnostic service is that most of electronic control units updating its internal memory when ignition is turned off and current diagnostic session is closed Example are engine control units BOSCH EDC16 3 4 15Custom download upload Custom download upload allows direct reading from the address map of the device This option will be available only if you have some updates in your configuration like e g Reading writing the flash counters Take into account that in most cases a security authorization is required before you try to read write into the address map 3 4 16Component security This special function allows managing of brand new units and immobilizer units where is allowed programming of PIN SKC BGW MAC Functions are under CAN TP2 0 3 4 17 Active diagnostic session Default diagnostic session established after connection to the
77. he first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool 2 2 Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you ve to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer 2 3 Making the key in the case when the Autodetect button is not functioning It is possible that by some reason the Autodetect button is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e
78. he procedure Steering columng lock control element can be aligned Do you want to continue Press NEXT to continue or EXIT to exit to leave the operation 3 5 9Special function MMI TV activation Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF Covered vehicles are eAudi A3 S3 eAudi A6 S6 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A8 S8 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A6 S6 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 eAudi A8 S8 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 TY Activation x Speed Limit kmh f ET Enon Use the following rule when enabling TV if the car is before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is after 2007 it is better to try at first with edition 2 3 5 10Special function Custom memory access Download Upload ReadMemory The Custom memory access Download Upload ReadMemory functionality is available from the Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access ent
79. ible by checking the Enable CAN Log or Enable K Line Log check boxes from the options dialog Please note that they are active by default The log files are binary files which are placed in the Trace sub folder of the ABRITES VAG Commander Per each start of the ABRITES VAG Commander one file is created and it contains the date time when it is created in its filename NOTE In some operation systems the ABRITES VAG Commander installation folder is created with restricted permissions for creating writing files As a result the ABRITES VAG Commander cannot create the log files In this case at the startup of the Commander you will see a warning message like this Cannot create log file The diagnostic communication will not be logged Please check the permissions of the TRACE folder where this application is installed Refer to USER MANUAL for help For to remove the restrictions go to the ABRITES VAG Commander installation folder right click the Trace folder click Properties and then click Security tab Remark If you are using Windows Vista click Edit to open the permissions for Trace folder For all users in the Group or user names section select the Allow check box for Full control in the Permissions for users section Click Apply Refer also to topic Set view change or remove file and folder permissions from the Windows Help and Support Center NOTE Please pay attention th
80. ice mode will leave it If you want to enter again you need to modify the EEPROM dump again Pressing the Reset button will not leave the service mode if you entered the service mode by OBDII both the buttons Leave service mode and Reset will leave the service Once the service mode is entered you can Read Write the whole EEPROM Read the whole Flash Read Write the mileage Read Write the immobilizer data Make key for the car NOTE Pressing the Make dealer key and add it to immo data writes the required data into the transponder and modifies the displayed immobilizer data but DON T write the immobilizer data into the dashboards You need to do this explicitly with the Write Immo data button 3 5 7Special function Steering lock adaptation The window Steering lock adaptation can be used for adaptation of steering lock control module to the VW Touareg VWPhaeton Porsche Cayenne Bentley Continental Audi A8 This adaptation can be by CAN TP2 0 or K KWP2000 To perform this adaptation you need to know the security access code of the immobilizer and working aligned key from the car 6 ABRITES Commander for YAG lolx Procedure Replacelalign Steering column lock using PIN The complete system consist of the following Steering column lock control element EZS Kessy control module Engine management control module master slave Up to 8 vehicle keys Only with this t
81. icronas VDONEC Steetinglock TY activation Key learning CAN Q7 46 K Line Unit CDC32xx 2009 adaptation ED1 ED2 2 Q s a X E gt Dump tool Airbag Vw Crafter DSG Custom Kessy PIN Converter Service Remote Odometer Read Write adaptation interval control a im farm A ATTENTION Make sure you are running the ABRITES Commander for VAG from its folder If you are using a shortcut to the ABRITES Commander for VAG please be sure that the working folder parameter is set to the folder where the executable is placed If the working folder of the shortcut is not set the K Line may function incorrectly 3Diacnostic with ABRITES VAG CommanbeR The ABRITES VAG Commander consists basically of two parts Standard diagnostic functions like reading clearing trouble codes device identification adaptation measured values etc Special functions like odometer correction reading login PIN reading EEPROM etc All devices which can be installed into the car are listed in the main screen of the ABRITES VAG Commander with their VAS Number If you want to connect to some device please double click on it The ABRITES VAG Commander will try to connect to the device using consecutively the following protocols KWP2000 over TP2 0 with baud 5000KB s CAN KWP2000 over TP1 6 with baud 5000KB s CAN UDS over ISO transport protocol CAN KWP1281 or KWP2000 over K Line the protocol is
82. in the appendix to get communication with the ECU After the component security is read if you ve all 7 bytes then you can program the key directly If you have only the 6 bytes you have to choice a if you have working key from this car you can put it into the programmer and press the Find 7 byte from working key the 7 byte will be found in several seconds NOTE If you use the Tango programmer this function will not work the function work only on Hitag2 or Abrites key programmer b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for t
83. ion of the interface pressing the Detect Interface button checks for interface availability firmware version and interface ID You are able to perform also test of the K Line but this requires that the interface is connected to the OBDII since the K Line requires 12V Also results from detection of the interface and K Line test can be saved into a file if Dump file field is entered and Generate dump button is pressed This dump file should be sent to the producer if there are problems with the interface recognition 5ABRITES VAG Uppate Request The ABRITES VAG Update Request tool is dedicated to inform you which is the latest version which is released from the producer and to allow you to request a compilation for your interface The ABRITES VAG Update Request can be used also if you have problems when running the ABRITES VAG Commander as described in the Troubleshooting section YNG YAG K CAN update request x Last SW released from Abritus72 VAG K CAN commander 4 1 Check latest version Request data Contact person Peter Adams i e mail peter adams yahoo com i Interface ID sans Pressing Check latest version will connect through the Internet to the producer homepage and will return to you which is the latest released version If you want to receive this latest software or if you have some problems as described in the Troubleshooting section you
84. irbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Airbag x m Connection type Choose ECU type v Manual Read EEPROM AUDI_BOSCH_1997_2000 Automatic 00 AUDI_BOSCH_2001_2003 ig 00 ennnnnnnnnnnnnnn oo AUDI_BOSCH_2003_ sn 00 ss eee eee eee oo yW SIEMENS ALL 0 00 ss eee ee eee Write EEPROM ey ecececeennececacanr Save to file Load from file RESTE Clear crash data For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request but the crash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using Clear crash data function from device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units 1C0 909 605 C 8LO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 600 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8L0 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L 3 5 12Special function VW Crafter This special function gives the possibility read
85. is to choose first the Instrument Cluster Magneti Marelli Direct 1996 2000 if not succeeded you have to make the ignition OFF and again ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If succeeded to read the PIN code and odometer are automatically recognized and displayed for Magneti Marelli direct types but in case of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number OOOUSE1O FE FF EF ER TE BE FR PP FP FF EF FF PE FF PE OPE eae aac ed 8s DOBDSBZU Fe PE EP EP FE EF FE FEFE EP ER PE URE FE ER PE ian cue eee awe sc OOQUSBS0 PF FF EF FE FF EF FE FE FE EF FR FE ORE FF 6 GF isi ncectca we wnais fe 00003540 78 90 FF FF FF FF FF FF DO 00 FF FF FE FF FE OO x 5 0 0028 tances 00003B50 DD FF FF FF FF FF FF FF 00 01 in G5 OAs oe wes oe we AUZ 00003B60 35 5A 30 41 55 55 56 58 56 56 58 3B 5A 79 SZOAXXXXXXX Zy 00003B70 96 B6 OO FF FF 42 20 93 9D 43 7F FF 30 42 DE BS B C OB 00003B80 57 42 20 ES 31 FF FF FF FF FF FF FF FF FF FF FFIWB 1 00003B90 FF FF FF FF FF 04 OD 2B 41 55 SA 35 SA 30 41 58 AUZ5ZOAX 00003BA0 55 55 56 56 58 56 11 1E 3B 5A 79 96 B6 OO FF FF XXXXXX 3Zy OOOO3BBO 42 20 93 9D 43 7F FF 30 42 DE B5 57 42 20 ES 31 B C 0B WB 1 GOUOSBCO FE FE EF FE FE FF FE P
86. ked to put each next key and to press OK After pressing the DK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted from car If you have The Key learning procedure goes in the following steps 1 Learning a dealer key purchased by VIN number If you have dealer key purchased by VIN number you have to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument is displayed L7 x y where X is the number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working 2 Preparing a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Put how many dealer keys you want to program and press the Program dealer key It is not required to enter anything the VAG Commander connects to the RB8 instrument and reads all required information A
87. lays some data extracted from the input file and or makes some modifications to the input data If any modifications were made for some sub functions there are no modifications made only data are visualized the user has to write the modified dump to a desired file with the Save dump button and then this modified dump should be saved back to the device via OBDII or with a programmer If data are read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data on 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means that for the same unit two different programmers can produce different dumps Normally the software tries to autodetect the byte order of the dump but if it doesn t succeed then you may need to use the Swap bytes button This buttons changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data are not valid e g displayed PIN is not accepted from the car please try to swap bytes to get result For some functions the swapping is made automatically for example the decoding of the Kessy but for some function the user has to made this manually A more detailed descri
88. les with other ECU e g EDC17x or MED17x are not supported The login and the component security bytes can be read manually from the ECU from the customer using the Engine control unit special function or decoded from EEPROM dump which is read with programmer It is also possible that the VAG Commander reads the required information automatically when you press the Autodetect button In this case the VAG Commander connects to the ECU and reads the login and CS automatically and then fill the required fields Cars equipped with EDC17 MED17 is not possible to read the ECU and to get the component security from there In this case if the car has working key you can read the CS and PIN from the EZS Kessy using the Get component security from EZS Kessy by OBDII function If the car doesn t have any working key you need to open the EZS Kessy and to read its EEPROM with a programmer Then you ve to select the Get component security from EZS Kessy and to load the EZS Kessy dump After that you can learn make a dealer key also from such cars IMPORTANT If the car doesn t have any existing working key it is not possible to give ignition ON in order to get communication with the ECU So to be able to communicate with the ECU you ve to make short with the fuses as described in the Appendix After the login and the component security bytes are read you can restore the fuses IMPORTANT If the car doesn t have a working key
89. les you can read and program immobilizer related data inside of immobilizer and engine control unit This can be done by pressing the button Read Write Immo data The following screen will be displayed Read Write Immobilizer data Eixj 32 WVGZZZITZAW092 00000010 32 33 33 9F 04 57 56 47 SA 5A SA 31 54 SA 34 57 233 WGZZZITZAU Bead 00000020 30 39 32 32 33 33 AS 09 20 09 FB DA BD FD 8D 6F 092233 o 00000030 C7 2B DA 00 14 20 00 FE F8 FE A OB OD 78 FF FF t een X 00000040 FF FF FF FF FF FF FF FF Fl 01 06 22 0l 11 7C 03 a 00000050 56 57 SA 37 5A 30 43 38 36 39 32 32 33 33 BE OB YWZ720C8692233 00000060 89 2A 70 67 E8 12 DB 67 FF FF FF FF FF FF FF FF pg g eeee 00000070 FO OF FF FF FF FF FF FF FF FF FF FF FF FF FF FF One nee 00000080 FF FF 04 40 44 54 BDT gt VIN WVGZZZ1 TZ4W092233 7 WVGZZZ1TZ4W092233 V Update dump Serial number Wwi27Z008692233 m Transponder identificators Serial key bdfd8d6fe72bda KeylD1 89237067 KeylD5 MAC fbdald78 KeylD2 281 2db67 KeyID6 E Status 2000fef8fe KeylD3 KeylD Configuration in 0106220111 KeylD4 KeylD8 L PIN 2336 Program data in ECU EDC16 MED 9x Restore IPC lmmobilizer to VIRGIN state Pressing the button Read will read immobilizer related data Pressing the button Write will program data from the HEX screen if the Update dump checkbox is NOT selected or from parsed data area if the above checkbox is sel
90. ll try also first to read them from the instrument cluster if the instrument cluster supplier is VDO Please pay attention that for VDO version after end of 2006 it might be required that the part of the instrument cluster is re flashed This is also required for functions for changing the mileage reading writing the odometer As mentioned in the license agreement use these operations on your own risk 3 5 1Special functions with instrument CAN When this function is opened the ABRITES VAG Commander tries to establish diagnostic session with the Instrument cluster using KWP2000 over TP2 0 Unit name 0l Engine Control Unit Master Read Write memory 02 Transmisson 03 ABS Read Write EEPROM 04 Steering Angle ba J 05 EZS Kessy Entry And Sta ee i Current odometer value Read Write RAM Read ROM FLASH 07 Control head 0 New odometer value 08 Climatronic Auto HVAC Custom Read Write the memory area OB Air heating oc m Immobilizer WFS 09 Central Electic a 0 SECURITY ACCESS CODE Read Security Access Code wo D T O a T 5 3 5 3 a 5 w a T 5 5 Read Write IMMO data GD K Line Instrument EZS Kessy Instrumer Vehicle model CAN 07786 K Line Reset cluster EZ Custom PIN Converter Service Read Write interval Available functions are eReading current odometer value eChange of odomet
91. lows to program it as dealer key allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition if Comfort module keys L x Comfort module keys data write keys to comfort module dump You can enter manually a key in certain position With pressing DK keys data will be written to comfort module dump For to delete key from certain position write 00000000 in the key position field fou can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to comfort module dump Change immobilizer status By pressing Set you can set immobilizer status NOTE Normally immobilizer status should have the value 2 It is recommended to change it if it is different r Wiite keys to Comfort module dump Change immobilizer status Key 1 21 C2DC8F Program transponder Key 5 00000000 Program transponder g po 9 p Immo status 2 Set Key 2 02698845 Key 6 00000000 Key 3 00000000 Key 7 00000000 OK CANCEL Keys with data 00000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied positions and represent the data of the learned at the respective positions keys With pressing a Program transponder button and if a programmer is recognized the curr
92. luster and to connect it again NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 3 5 3 1 Transferring keys from one RB8 instrument to another Starting from V5 2 of the ABRITES VAG Commander it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Instrument Cluster Immobilizer K u Instrument Cluster Audi 44 BOSCH RBS CRYPTO 2004 Choose IPC type c6 03 1c 17 41 00 RB8 Crypto data read 9D 9E 00 55 ol 43 F4 78 00 SA 00 72 FC 9C 00 SA BA ED ol 3C 00 5A 00 60 2B SF 00 38 96 F 3F 03 00 45 00 2D 44 00 35 74 97 43 36 00 35 00 Ag 68 00 41 5D 56 7E 0l 00 sl 00 28 53 00 sl DA A6 5B 08 00 sl 02 79 DO 70 00 sl 6D 9A T Cr V 61 au Ch 5 a OO X lt _ 6N p OD san 31 WaUZZZ8E55A11111 0l no 5 Reset ECU Reset Comp Security Login 2155 Odometer 5920 Change Immo Status Zu gt Skip neg responses In order to transfer the keys you have first to read the
93. meter 123100 Change Immo ON Immo OFF HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of the Engine Control Unit window Make a quick Ignition OFF ON at this point 2 In case of ME7 x or ECUs from Porsche you can read the flash memory like reading of the EEPROM the only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length If you experience problems with reading ME7 x memory better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please notice that the flash which was read is saved automatically in the Flash subfolder and can be used in case of any failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write it In case of failure during the flashing the device should enter into a boot loader mode which will allow to flash the device but not to read it The flash can be then restored with the Custom Read Write functi
94. metimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool f x Type ECU Simos PPD1x Reset component protection data X 31 31 31 53 4E 30 49 30 46 31 30 00 00 45 1115N0IOF 710 H Load dump 00000010 00 00 00 45 00 00 00 45 00 00 05 35 00 IC 00 00 veaHeesHeeeBsc ee 00000020 00 FF 80 80 80 80 80 80 96 80 80 80 80 00 80 80 eee eee 00000030 00 FF 19 9E 59 2C 59 2C 59 2C 94 50 94 50 94 50 P P P Swap bytes LH 00000040 01 00 01 00 O1 00 D9 72 52 79 B2 E4 D9 72 52 79 rRy rRy PES 00000050 B2 E4 D9 72 52 79 BZ E4 a4 00 A4 00 A4 00 00 00 rRy 00000050 on AN NAN NN Aan NNA AN NN AN An 33 CA 323 rA 33 ra 3 2 3 00000070 5 E E i j 00000080 5 zC 00000090 5 Old E z2 52 z9 B2 E4 as 22 00000040 22 aani I e e e J 000000p0 000000E0 ee EA r 000000F0 76 SB FA 8A 85 51 84 9B 80 3B 81 09 81 08 83 4E vD Q husa N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 gt Canceled oO oO oO oO oO w oO mM Jo in Ww in ECU Simos PPD1x Security Access Code Required license AN007 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Dump Tool x Type ECU Simos PPD1x Security Access Code LLISNOIOF 710 H 00000010 00 00 00 45 00 00 00 45 00 00 08 36 00 IC 00 00 H H 8 00000030 OO FF 19 SE 59
95. mmobilizer it is possible to lost communication with it so you will need to repeat the procedure in this case 3 5 13Special function Key learning Inside every key there is a small chip called a transponder In most cases this chip doesn t require an external power supply but is supplied from the magnetic field which induces electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general there are five different types of immobilizers transponders used They are called Immo Immo II Immo III Immo IV and Immo V Systems from Immol till Immo Ill require simply that a transponder from the proper type is found inside the key and they are able to learn these transponders Starting from Immo4 it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside there are the following types of transponders Tp22 dedicated for use inside Seat vehicles Tp23 dedicated for use inside Volkswagen vehicles Tp24 dedicated for use inside Skoda vehicles Tp25 dedicated for use inside Audi vehicles especially A3 and A4 Such transponders can be used in all cars of the specific producer e g Tp24 can be used for all Skoda models
96. nized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable
97. o programmer and pressing the button Make TP2x from T42 TA3 TA4 TAS Procedure 2 Vw Seat Skoda after 09 2006 For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 2 1 Enter security access code and number of keys 2 2 Turm ignition ON new or existing key 2 3 Press button Learn 2 4 For some VW Seat Skoda vehicles it is possible to add new key without the remaining key stop to work You will be asked whether you want to use this feature Please answer with yes no according your wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys NOTE If you have aa Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer This is done by using the Produce TP22 TP23 TP24 TP25 transponder button This requires only a connection with the Key programmer no connection to the car is needed The key learning procedure when have a Tp2x transponder is the following 2 1 Enter the security access code and the number of keys 2 2 Turn ignition ON new or existing key 2 3 Press button Learn 2 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining keys to stop working You will be asked whether you want to use this feature Please answer with yes no according to your
98. odometer 93C56 changes odometer No license required Jetta 1994 1996 odometer 93C46 changes odometer No license required T4 MotoMeter 1996 1997 odometer 93C56 changes odometer No license required
99. of the instrument may be needed for newer cars 2007 so you will be asked for that You must use Keys or transponders TP05 TP08 TP22 TP23 TP24 Note some of the new vehicles need to remain with ignition ON five minutes before starting of the key learning procedure VW Golf5 Skoda Octavia Il VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with ignition ON until programming becomes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007 VW Polo 2006 Seat Ibiza 2006 3 5 13 2Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA For this type you will need a virgin key or transponder TP22 TP23 TP24 depending on the type of the car as follows For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 You need to choose from Special functions Key learning VW Seat Skoda 2007 CAN Key learning i x Vehicle model Iv Seat Skoda 2007 CAN New key count 0 Make TP2x from TA2 TA3 TA4 TAS Login Security code 0 You can reach login code using special functions of instrument immobilizer main panel Another way to reach login code is to extract it from the ECU special function Engine Control Unit ATTENTION You can produce TP2x transponder from the corresponding TA2 TA3 TA4 TAS transponder using your Tang
100. on 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flashing 6 Please take into account that the reading writing of the flash will take a long time especially when CAN connection is used as result the battery may become flat HINTS when reading writing EEPROM memory of ECUs 1 If you experience problems with reading ME7 x EEPROM better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 5 5Special functions with Micronas CDC32xx The Micronas CDC32xx special function is dedicated for the VDO instrument clusters with Micronas CDC32xx microcontroller This is possible using the CDC32xx programmer After starting the function a following dialog will be brought to the user x r CDC32xx Programmer Type lwo si p Configuration dogam CDC32 port COM141 USB Serial Port Device Jetta from 07 2006 7 Odometer Read write EEPROM Flash SA SA WUVWZZ2 30 34 32 1KZ7P042 00000010 33 31 35 D8 05 58 58 56 315 xxx Odometer 5 Bi 00000018 58 55 55 58 58 58 55 58 XOX Write 00000020 58 58 58 58 58 58 40 08 XXX odometer 00000025 AD 1A 70 ES 99 17 ED 3D p 00000030 C5 28 D5 00 14 00 OO FE 00000035 78 FE EO OB 12 3D FF FF s oad fom Ne gt m Immo data YIN WVW
101. on your interface Please run the ABRITES VAG Check tool and prepare a dump file of the dongle Then send this dump file to support abritus72 com Problem When starting the ABRITES VAG Commander a message Error code 0x10004 Please contact support abritus72 com with the Error code in the subject Solution Please run the ABRITES VAG Check tool and prepare a dump file of the dongle Then send this dump file to support abritus72 com Problem When starting the ABRITES VAG Commander on the splash screen Interface found is displayed but is not possible to connect to device especially through K Line Solution Make sure that if you run the ABRITES VAG Commander from a shortcut the working folder is set to the folder where the ABRITES VAG Commander executable is placed Problem The device connects sometimes to the device under K Line and sometimes not Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instrument cluster is A4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found on addresses 0x00 0x100 and 0x200
102. one interface USB to OBDII Optionally you might have a programmer which is connected either to the USB port of the PC or to the interface USB to OBDII 2 1Installing USB Interface drivers The drivers are installed automatically when installing the software In case of some problem with the drivers you might download latest drivers from www ftdichip com 2 2Uninstalling USB Interface drivers In case the installed USB drivers are corrupted and or stop work properly your USB Interface is not recognized by the PC you can try to fix the problem by uninstalling and then reinstalling them for to start over with a clean slate Uninstalling USB interface drivers can be done by running the FTClean program You can find it in the USB Interface Drivers sub folder of your ABRITES Commander or download it from the Internet using the following link http www fidichip com Resources Utilities FT Clean zip The following is a step by step for using FTClean to remove drivers Unpack and run FTClean exe FTDI Clean Utility 1 0 VID Hex FTDI Clean System PID Hex Exit Status Ready Click on Clean System button FTDI Clean Utility 1 8 ia ioj x ear i Disconnect all FTDI devices from the PC PID F m Hean System Status Ready Disconnect all FTDI devices from the PC and click on OK button Y FTDI Clean Utility YEB alol x Confirm x You are about to
103. or which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of the component security from the engine you can extract the 7 byte from the comfort module EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you ve attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand whether for the desired car is possible by performing the following procedure a Connect with 25 Immobilizer and go to Measured Vaues Channel 2 b Put the original key or key with Megamos 48 transponder in this case in the Measured values you should have yes or 1 on the second possition of channel 2 c Eject the key so there is no key in the ignition lock If the second positions changes to No or 0 you CANNOT search for the 7 byte If the second positions remains Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned 3 5 13 4Procedure 4 No more applicable Use procedure 3 instead 3 5 13 5Procedure 5 No more applicable
104. ption of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license AN003 This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Phaeton Porsche Cayenne and Bentley Continental The function also displays the learned keys and visualize change the immobilizer and VIN numbers Dump toot i x Type IMMO KESSY Audi 48 Yw Touareg Yw Phaeton Porsche Cayenne Bentley Continental 93C86 v 00000020 85 32 31 2E 30 31 2E 30 33 6A 30 39 85 32 31 2E 21 01 03j09 21 00000030 30 31 2E 30 33 0l 00 00 01 00 00 O1 FF OL 00 Ol 01 03 Swap bytes LH 00000040 00 OF OF 4B 33 44 30 39 30 39 31 33 35 46 20 D K3D0909135F ee 00000050 35 57 4B 34 37 30 32 31 DA 56 42 52 42 34 78 DA SWK47021 VBRB4x 00000060 56 42 52 42 34 78 DA 56 42 52 42 34 78 05 04 00 VBRB4x VBRB4x Tas ser fien 00000070 00 FF 05 02 00 02 FF Ol FF FF FF FF Ol FF FF FF eeeeeeeee in BRO 00000080 FF OL FF FF FF FF DL FF FF FF FF OL FF FFE FF ORF one Immo number 00000090 01 FF FF FF FF Ol FF FF FF FF Ol FF FF FF FF 02 seeeeeeeeeeees D00000A0 01 70 56 57 5A 33 5A 30 43 31 30 33 34 34 39 30 pVWZ3Z0C1034490 vw23z0C1030000 00000080 01 00 00 00 00 00 00 00 29 00 23 05 OB 00 07 03 Er em 000000C0 01 00 OO 00 0l 00 00 OO Ol OO 00 00 O1 00 00 00 s s s 00000000 O1 00 00
105. r CAN vehicles after 09 2006 year VW SEAT SKRODA u 0 u020010m025040nt5nc busnensaresnnsu gansn 55 3 5 13 3 1 Programming a dealer key with all 7 bytes available sss esannanisnsa sense 58 33 1332 Mindi the Zh Oye nun nee 58 3 5 13 4 Procedure 4 No more applicable Use procedure 3 instead ss o oo iss sccisiecasesacssesnacnesaneneddenandsaut ccravavasasabasasasasasasasasin 60 33 138 Procedme G for Avdi AJ RBS asc a ia aeda eah aa a aaia e aAA Ra ia 60 3 5 13 7 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Tayenne u 61 3 5 13 8 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 61 35 13 59 Procedure 9 for vehicles Audi AGF Allroad 20056 cuanta 63 3 5 13 10 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 ccsscssseceseessecesseessseseeeenaes 64 IPO hilar et St oreo DREH TBB ae ee 65 Bel Sp cial unetan Service SOC VE osc nn een 65 sl D BEER ROER OR Rennie LONI DEAN waiccnstaicstnautrnc ravens ie heniaith A E A 65 3 5 17 Special function Navigation Bh Te SUCCIE SOHO USERN SVEN air 66 3 3 20 Special SRCHON Brake pads change nassen 66 Sidi Speciul function ECU Fxchanee Dumn Tool onen 66 3 3 27 Special fumchon Door unless 67 FAPPENDEL sui
106. r the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool Type ECU MED 3 x Security Code Checksum calculator 35160 00 8 05 07 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 15 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 45 31 30 33 37 33 37 37 34 33 39 7H1037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 C1 3E 00 00 00 3F 61 1B D4 05 Zi gt a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F BS 7 7 lt janj 4 Swap bytes L H 00000060 01 03 AS SA 69 96 Cl 3E 00 00 00 SF 61 1B D405 21 gt 2a X Login 24835 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F BS 7 7 lt 00000080 02 04 00 00 10 57 56 57 5A 5A 5A 33 43 5A 36 45 WVWZZZSCZ6E 00000090 30 30 30 30 30 30 56 57 5A 45 54 30 30 30 30 30 000000YWZCZ00000 00000040 30 30 30 30 57 56 57 SA 5A SA 33 43 5A 36 45 30 DOOOWVWZZZSCZEBEN 00000080
107. red license ANO12 B This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED9x require only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Dump Tool 7 Type ECU MED 9 x Immo Bypass v L 8 07 02 08 07 02 06 wees 1037384968 1037383785 Load sump 24 2 CDV w 00000060 01 03 AS 5A 71 96 AS 3E 00 00 00 43 44 56 66 77 2q gt CDV w 00000070 As A5 14 00 C8 44 DB FO 00 Ol OO 00 OO FF FS 16 D 4 Save dump 00000080 02 04 00 00 10 57 41 55 5A 5A 5A 34 4C 33 37 44 WAUZZZ4L37D 00000090 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 00000040 20 20 20 20 57 41 55 5A 5A 5A 34 4C 33 37 44 30 WAUZZZ4L37D0 En L 00000080 39 31 32 31 30 11 00 00 00 00 00 00 00 OO FS 62 91210 b 000000C0 02 04 00 OO 10 57 41 55 5A 5A 5A 34 4C 33 37 44 WAUZZZAL3TD 00000000 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 000000E0 20 20 20 20 57 41 55 5A 5A 5A 34 4C 33 37 44 30 WAUZZZ4L37D0 000000F0 39 31 32 31 30 11 00 00 00
108. rent then this function will not work Even with the correct mask it is possible that sometimes you ve got and Error when connecting the instrument cluster after changing the mileage Dump Tool i Ja E x Type IPC VDO VW Seat Skoda 2007 CDC3272 24C32 X Load dump Swap bytes L H Odometer OODO0DAD 00 00 04 56 00 76 30 37 32 43 24 23 42 38 97 90 V yv072C B8 24423 00000080 87 80 97 08 97 08 97 90 87 89 03 04 71 89 07 90 qe 000000C0 89 23 74 09 83 27 40 98 12 37 89 04 57 34 89 02 t R 7 Ua 00000000 57 20 39 86 75 89 06 79 03 48 56 92 01 58 90 58 W 9 u y HV X X D00000E0 12 39 04 81 39 08 12 34 90 12 34 90 81 23 49 08 9 9 4 4 81 D00000F0 12 34 90 81 23 49 08 12 39 08 12 34 90 81 23 49 4 1 9 4 1 00000100 08 12 34 89 12 30 48 12 34 81 23 00 56 57 5A 44 4 0H 4 VVZD 5 gt Enter new odometer value and press button Change IPC CRYPTO Skoda Fabia Skoda Roomster VW Polo Seat Ibiza 93C86 Required license ANO06 This function changes the odometer for the Skoda Fabia Skoda Roomster VW Polo and Seat Ibiza which are with encrypted EEPROMs year 2007 Please pay attention that for some of these models it is also possible to read the mileage also by OBDII but it is different than the read with a programmer Dump Tool Type IPC CRYPTO Skoda Fabia Skoda Roomster Yw Polo Seat Ibiza 93C86 Enter new odometer value and press button Change
109. s see serie 74 7 1 PROGRAMMING INSTRUMENT CLUSTERS FROM MAGNETI MARELLI K LINE DIAGNOSTIC LINK scccececccessseseesesssesussersesesseneses 74 7 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle ccccccccccccccccccccccececececececesesecesesesesesesstnees 74 EI INSERIERT oluster rom Audi FIER en nee 73 2 1 3 VW Passat usually these Instruments are before year J IB anna ZZ ER VW Na a a ays sh ca conn wees testes nae EE E E E E E E A AE E NETE TT Version 2 23 4 ABRITES VAG Commanper 12 x Document number 2 20071127 Date 13 05 2011 7 2 PORSCHE CAYENNE V W TOUAREG GASOLINE ENGINES ECU WAKEUP FUSES cccseccecesssececesssecesssececesssecessseecssseeesseseeseeess 78 1 3 AUD AS BUSEBOX PASSENGER SIDE WAKEUP ECT 79 ER Ub eeendadogades 80 TI AvD Ge Road E EEEE 82 Toe WNT en Mae RER 83 7 7 VAG K CAN COMMANDER KEY LEARNING PROCEDURES sssssccssssscecsssseceesssecsenseseceessececsusessssaeeesussuecesussseessacesssseensses 84 7 8 DUMP TOOL ars FUNCTION nannten 87 Version 2 23 5 1INTRODUCTION Abrites VAG Commander is a Windows PC based diagnostic software for the vehicles from VAG With the help of this tool you can perform operations with vehicles from the VAG group which are in most cases unsupported from the producer diagnostic testers The Abrites VAG Commander provides you also a full diagnostic capabilities for VAG vehicles 2INSTALLATION Your set consists of
110. sion 2 23 2 ABRITES VAG Commanper 12 x Document number 2 20071127 Date 13 05 2011 LINTRODUETIDN nennen 6 ZINSTALLA TION ss 6 ZU eSNG USB UNTER SCE DER ER nassen ae aicatdnd AA Ra E tanddeeaidamd sea al dran andauern 6 22 UNNS TAAG USB ERACE DIRERS isses T 6 2 2 Tale ABRI TES Conti ne SR VAG aua e E EEEE De aa EEE 9 BI Re N e ee iia een 5 LLS CAN FE ORCE aaa a a iw che ea a a ace a wa al av sie 15 3 2 SCANNING UNITS 33 BROADCAST REUE S Ti E een 16 Fea NAN ECT MAME ESTs cf NU REQUESTS ee eee ee ee ee eee ee er ere ere ere ee ere ee 16 DARD TEPC Mis serfs ints dc apecle A ntfs Sattar pen tas oe feet ea ed eee seit nnn i7 JAZ Software and Hardware version of th Inline iF E A A E EE A E A L E E E E E E E E E 18 S44 Read Diagnostic Trouble COGOG nenn nn a 20 RR CA ERARDBSHE TVOU EC ODON ee 20 IE DIESEN VATES oioi aa A bila 20 E NT E R ERE Lt E EE E E E E E E E E AA 22 Jo Standard SOOM ATGE Senasis ninr E 22 34A TA et deed Sec Ace sanken 23 DER PUR IE DW sis vis ahs Sic vee cae aie te een 24 HI Coding OF he Urne nennen 25 ARA RA N E E A A E E E E E E T 25 IE AED TEN ois sac cos tasted sd snag a Oa bid inte as acca ang added otacss 26 eek Raer OF IE GET ein nes 26 ATI Custom POGUES nenn nee No wal Uae a al ane lta 27 SERIE FESTER i este CETTE Tere Teeter ere terre een 27 DES C uon ROW OOJOO nn 27 ree O COMPONEN SEY bubi a a a aa indusabtapapnte d
111. ss parameters Standard Type User defined fi Request SEED 1 1 Value DEC E Value HEx Return KEY SEED 0laafeab 3 4 8Adaptation Adaptation will open for you a separate window where you can check adaptation values You need to enter the number of the channel where adaptation will be performed and then press the button Test If the specified value is accepted by the unit press the button Save Adaptation J x Channel 50 Personal Identification Number PIN Adaptation CHANNEL Stored value 32000 Testvalue 2336 New value 2336 The button Scan all will generate a file with all channels and adapted values Some important channels used for adaptation Channel 50 is used for adaptation of new parts Usually to get access to this channel you should make a security access with the Login of the device to which you re connected and which you will adapt to the car After you gain access to the channel 50 you should put the Login PIN of the car to which you adapt the new part Channel 21 If the Immobilizer is by K Line then on channel 21 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made Channel 1 If the Immobilizer is by CAN then on channel 1 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer
112. system Using this application you can activate deactivate a cruise control system and change the related steering wheel electronics SWE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the commander will read and display it s current configuration After Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate cruise control system function and apply any changes of the SWE configuration to the SWE unit 3 5 19Special function Brake pads change Using this application you can Open rear parking brake for pad change Close rear parking brake perform Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness 3 5 20Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle called in the application active ECU and the EERPOM dump of the engine control unit with which you wish to replace it called in the application replacement ECU After opening the
113. tatus Permanent error 18038 Accelerator Position Sensor G79 Status Permanent error Signal too Low 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Sporadic error mechanical error 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Permanent error lower limit exceeded 3 4 5Clear Diagnostic Trouble Codes Clear DTCs will clear all stored DTCs inside of the unit 3 4 6Measured values Measured values provide you a possibility to check measured values in different groups You can enter manual number of the group or use to increment or decrement the group number Measured Values Channel B Suppl Voltage Terminal 30 Voltage Status Terminal 15 Status Terminal 15 ON 5 Contact Status activated The button Scan all will generate a file with all measurement values from all groups Measured Yalues xj Channel Immobilizer Il 2 Variable Code authorized yes Key Status Transponder Lock yes Fixed Code authorized yes Immobilizer Status 6 0 Some important measured values The most used measured value is the key recognition in the immobilizer The key recognition is made on channel 2 if the Immobilizer is by CAN or on channel 23 if the immobilizer is by K Line The only exception is the Q7 A6 Allroad where the recogni
114. the engine control unit EEPROM together with the PIN code and component security read write mileage into engine control unit make immobilizer ON OFF learn keys with prepared transponders perform diagnostic on the engine control unit and the immobilizer NOTE It is possible to connect only to the engine control unit and immobilizer for VW Crafter vehicles To connect to any other device you will need the ABRITES Commander for Mercedes Starting this special function brings a following dialog ABRITES Commander for VAG 8 1 a iol x 0l Engine Control Unit Master 02 Transmisson Previous 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory passenger 07 Control head 08 Climatronic Auto HVAC Connect 09 Central Electric DA YW Crafter E xj OB Air heating Erick ngine ee oc ne Key learning Control Unit ei OD Slide door le Diagnostic 9 v gt if Special functions as Vehicle Selection T Broadcast Options m i E gt x go amp Instrument EZS Kessy Instrument Engine Control Micronas Kessy TY activation Key leaming Dump tool CAN 07 46 K Line Unit CDC32xx adaptation EDI ED2 z e 3 2 Airbag Vw Crafter Custom PIN Converter Service Remote Navigation Cruise control Brake pads Read wite interval control a system change fe kel fs From these buttons is possible when pressing ECU EEPROM the same dialog as in the Engine con
115. tion is made also on channel 23 3 4 7Security Access Security Access gives you the possibility to perform security authorization on different levels Security Access x Secutiy access parameters Standard Type User defined Security Access Login Security Access CS 2332 gic Value DEC Value HEx Security Access System 3 4 7 1Standard Security Access This type of security access can be e Security Access Login usually used in immobilizer systems e Security Access Component Security usually used during adaptation of different units parts e Security Access System Specific security access different from the previous two and different from authorization for programming session Hints When device to which you connect is using KWP1281 diagnostic protocol then only Security Access Login If you want to put the security access to the ECU you should use Security access CS This will allow you access to adaptation channel 50 If you want to put the security access on the Immobilizer you should use Security access CS If you ve a error message that it is not supported you should use then Security access Login 3 4 7 2User defined Security Access You need to clarify the type of the security access and then by using the buttons Request SEED Send KEY authorization can be performed Security Access x Secutiy acce
116. trol unit is brought to the user and is possible to read EEPROM change mileage and make immobilizer bypass from here Not needed to select any engine type it is made automatically pressing Key learning will bring the Key learning dialog the user is not required to select a model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trouble codes etc to the immobilizer NOTE If the car doesn t have any working key it is not possible to give ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you ve a car without any valid key you will need dismount the ECU and connect it on the table or to connect the CAN wires of the ECU directly to the interface NOTE For the key learning it is needed to give ignition with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock but the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to make ignition ON with each key which you want to learn NOTE Sometimes during communication with the i
117. uninstall all FTOI drivers For VID 0x0403 and all PIDs Do you want to continue Click on Yes button FTDI Clean Utility 1 6 lex VID Hex FTDI Confirm PID it Do you want to cancel driver uninstallation lean System Click on No button to start removing driver FTDI Clean Utility 1 0 i E laj x FTDI A Chip N ID Hex A ff PID Hex o Status System clean completed Uninstallation has finished Important Do not forget to reinstall the drivers following the instructions from point 2 2 Installing USB Interface drivers 2 3Installing ABRITES Commander for VAG The ABRITES Commander for VAG is contained into the installation package so please run the setup program Now you are ready to start the ABRITES Commander for VAG When starting the software there is a splash screen appeared where the connection with the hardware is examined If no problem appear then a message Connection OK should appear The main screen looks like this W6 ABRITES Commander for YAG 12 0 www abritus72 com io x 01 Engine Control Unit Master K 02 Transmisson 03 ABS 04 Steering Angle 05 E25 Kessy Entry And Sta 06 Seat memory passenger E gt 07 Control head 08 Climatronic Auto HVAC Connect 09 Central Electic DA OB Air heating oc OD Slide door left OE Media player 1 F Next Instrument EZS Kessy Instrument Engine Control M
118. unit is 89 User can request entering in a different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session 89 Take into account that in most cases different diagnostic sessions require security authorization Diagnostic session Ey Enter 3 5Special Functions Special functions are some specific for electronic control units application which will allow you change of odometer reading security access codes read program EEPROM flash content and so on Special functions are available from the main dialog of the application 4 Special functions as Vehicle Selection T Broadcast Options m i m N 4 A 8 CAN K Line e gt IN we A PSN Instrument EZS Kessy Instrument Engine Control Micronas Kessy Tv activation Key learning Dump tool CAN 977 86 K Line Unit CDC32xx adaptation ED1 ED2 t o fs amp i a A EH r 225 Open Airbag VW Crafter Custom PIN Converter Service Remote Navigation Cruise control Brake pads Read Write interval control a system change v A Coos The appropriate special function is opened by selecting it in the list box and double clicking on it or by pressing the Open button NOTE For the purposes of the some special functions basically for the key learning there are buttons for auto detection of the PIN and component security Basically this will try to read these data from the engine control unit but it wi
119. which are accessed through K Line or CAN for benzine engines Into the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool an ji xj Type ECU Simos 7 CAN Reset component protection data 93076 93C86 M2 AC AZ AC AZ AC 54 00 54 00 54 00 01 00 01 00 00000010 01 00 00 00 00 00 00 00 00 00 00 00 00 OO EF OF ee eee eeee 00000020 E OF E OF 00 00 05 35 00 IC 00 00 00 04 00 DD E Save dump Load dump 00000030 00 00 00 00 2D 2D 2E 2D 2D 2E 2D 2D 00 00 00 00 20000040 u Goooooza ja Te ea ee fe oooonoso New p je w fo je e 0 o f 4 Swap bytes L H O x oO oO oO 000000C0 70 FF 00 00 EB 02 80 80 80 60 80 80 80 FF FF 80 p seeeeee 00000000 80 80 80 80 7F 80 80 80 80 60 80 80 80 80 80 80 eee eee O00000ED 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 1 eee eee eee 000000F0 80 80 80 80 80 80 80 50 80 80 80 80 80 80 80 80 00000100 80 80 80 80 80 50 80 80 80 7F TE 80 80 80 80 FF nes gt gt ECU Simos PPD1x Reset component protection data Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPD1x there are at least 6 bytes of the component protection found or so
120. wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys 3 5 13 3Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN Normally most of the newer cars require a transponder which is precoded with the VIN number from a dealer Fortunately it is also possible to precode the transponder by yourself using the Key programmer if you have available the 7 bytes of the component protection data and you need to use an Megamos 48 transponder as base for this operation NOTE The Set transponder type combo box specifies what kind of dealer key to make for VW Seat Skoda or Audi As base for this operation is used Megamos 48 transponder If you have a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned But if do not have a dealer key then you should press the Program dealer key button which will show the following dialog Program dealer key amp x Set transponder type Megamos 48 TA3 Autodetect component protection C All bytes of the component protection data component security are know Program transponder from 7 bytes Component 0 a E 0 0 i E Program protection bytes 7 Programmer over key h TAx transpond Jer wit Find the 7th byte of the component protection data
121. witch to 9600 and try again with it If 9600 10472 is selected then first the commander will try to connect to the device using baud rate 9600 and if it doesn t succeed it will switch to 10472 and try again with it ATTENTION Some device working on baud 9600 cannot be waked up if they are first tried on baud 10472 so if you cannot connect to device through the K Line try to change the options so first to try on 9600 3 1 4Timing parameters The protocols running under K Line require very precise byte timing Since Windows is not a real time operating system these times are not always respected so it is possible that the communication with some devices is unstable or it is not possible to connect In such cases you can try to change some of the times timing parameters from the Advanced button The timing parameters have the following meaning Wakeup echo delay time after slow init between receiving 55 xx yy and sending the inverted value of yy according the K Line wakeup procedure Communication echo delay time between reception of a byte under KWP1281 and sending it inverted back to the device Inter byte time time between sending two bytes under KWP2000 Time between messages time delay between reception of response from device and sending new request to it 3 1 5Logging parameters It is possible to log the whole CAN K Line communication when a problem with some device is occurred This is poss

USER MANUAL ABRITES VAG Commander - AutoKey

Contents

Download Pdf Manuals

Related Search

Related Contents