Home

ABRITES Commander for VAG User Manual

1. to increment or decrement the group number Measured Values Power Supply Scan all Voltage Terminal 30 Voltage Status Terminal 15 Status Terminal 15 ON S Contact Status activated The button Scan all will generate a file with all measurement values from all groups Measured alues x a Channel Immobilizer II a mn eo Variable Code authorized yes Key Status Transponder Lock Ree Fixed Code authorized yes Immobilizer Status 6 0 Some important measured values The most used measured value is the key recognition in the immobilizer The key recognition is made on channel 2 if the Immobilizer is by CAN or on channel 23 if the immobilizer is by K Line The only exception is the Q7 A6 Allroad where the recognition is made also on channel 23 2 4 7 Security Access Security Access gives you the possibility to perform security authorization on different levels Security Access x Secutiy access parameters Standard Type C User defined Security ccess Login Security Access CS 2332 91c Value DEC Value HEX Security ccess System 2 4 7 1 Standard Security Access This type of security access can be e Security Access Login usually used in immobilizer systems e Security Access Component Security usually used during adaptation of different units parts e Security Access System Specific
2. Y ou have to put only the number of the keys which will be adapted Procedure 6 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason separated procedure is used The Key learning procedure goes in the following steps 1 Learning dealer key purchased by VIN number If you have dealer key purchased by VIN number you ve to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument it is displayed L v v where x is number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will asked to put each next key and to press OK After pressing the OK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted from car If you have vi The Key learning procedure goes in the following steps 1 Learning a dealer key purchased by VIN number If you have dealer key purchased by VIN number you have to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument is displayed L7 x y where X is the number
3. 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 00 Lars Nas lt L Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset component protection data 95080 Required license AN009 This function allows to view and or change the component protection data found into the MED9x with ST95080 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool 2 x Type ECU MED 9 x Reset component protection data 95080 s 97 ES 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 amp FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 OS Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 00000060 01 03 AS 54 69 96 Cl 3E 00 00 OO 3F 61 1B D4 05 2i gt
4. Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 1 1 Enter security access code and number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Lear 1 4 For some VW Seat Skoda vehicles it is possible to add new key without the remaining key stop to work You will be asked whether you want to use this feature if available Please answer with yes no according your wishes The customer has to choice the vehicle model for which it wants to learn a key In the background the system tries to determine automatically what vehicle model is If succeeded the recognized model will be selected automatically If the system cannot recognize the model the user has to choice the model manually NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW CAN 2007 and VW CAN 2007 for that reason by default VW CAN 2007 is selected by default After the vehicle model is recognized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some mo
5. 06 Seat memory passenger 07 Control head 08 Climatronic Auto HVAC Connect VW Crafter ECU EEPROM Key learning i Special functions se Vehicle Selection i CAN EZS Kessyp 07 46 L m 68 A B X TY activation Key leaming Dump tool Airbag ED1 ED2 im imam Engine Control Unit Diagnostic vg Broadcast Gy Options eS gt Engine Control Unit K Line Micronas CDC32x VW Crafter Instrument K Line Instrument CAN From these buttons is possible Immobilizer Diagnostic nec 9517 VDD NEC Magnet dash Component 2009 gt DSG Mileage UDS 9512 Custom Read Write nam ote Control Diagn x Exit F 3 Steering lock adaptation lt Service interval protection gm FIN Converter when pressing ECU EEPROM the same dialog as in the Engine control unit is brought to the user and is possible to read EEPROM read mileage and make immobilizer bypass from here Not needed to select any engine type it is made automatically pressing Key learning will bring the Key learning dialog the user is not required to select a model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trou
6. Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access enter into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES Commander for VAG Using this application you can read program memory in some electronic control unit Requests sent from this application can be related for the currently running session of for some of electronic control units from the dialog You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of EDC16 In the example below we read a part of the flash of EDC16CP Custom memory download upload Choose ECU type EDC16U1 v EDC16U1 Read EDC16U31 EDC16U34 EDC16CP EDC16CP34 EDC16C4 Master EDC16C4 Slave EDC16U1 Master Write Save to file EDC16U1 Slave EDC16U31 Master Connection EDC16U31 Slave St Address 800000 MED9 5 10 MED9 1 Master Len of req fo MED9 1 Slave Total size 100000 Step 0 Encryption Download Upload C Read Write mem m Diag session Session 0 x Exit In
7. Dump Tool ra x Type ECU MED 9 x Reset component protection data 95160 v 97 E5 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 amp FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 OS Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 OO 00 BC F B2 7 7 lt eee 00000060 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 21 gt 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 OO BC F B2 7 7 lt eee 00000090 Q00000A0 Old D4 5 Ed 37 148 B 0 ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in tha
8. Program button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done When the transponder is ready you will have all the component security bytes displayed in the status bar After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MED9Y Key Learning Wizard mode lox Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9812 2009 CAN Audi A6 Allroard 2005 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Function Program dealer key To learn a key to this car you should make first a dealer key Prepare dealer key 1 Select Program Key and press Next 2 The following window will appear FA ABRITES Commander for VAG l0 x Autodetect Login Code Write Login Code Load Login Code Using Dump Tool Login Code 0 lt Back Exit 3 Choose an option to supply Login code and press Next 4 If Login is
9. 1 Select Program Key and press Next The following window will appear CY ABRITES Commander for VAG loj x Select an option C Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key C3 oO oO oO oO Component Security Bytes 0 2 Select the desired option and press Next If you have chosen Autodetect Component Security Bytes the commander will read the PIN and all 7 bytes of CS from the Visteon dashboard If by some reason the SW doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7n byte After all 7 bytes of CS are available the key will be programmed as dealer key To learn key 1 Select Learn Keys and press Next 2 Supply Login code and press Next 3 Follow the instructions 2 5 15 13 Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9S12 microc
10. 2 5 19 Special function Navigallon aaah dvs je 2 5 20 Special function Cruise control system 2 SJ Ne Junction Drake pads T LJ22 Special funcion EET EET PEE ES UO EG 7 ORRE ER tected telat oh donee tena tae boss 2 5 24 Special function Coding calculator NE EE ET 101 2 TROUBLES SOOT IL 103 EA SES 105 4 1 PROGRAMMING INSTRUMENT CLUSTERS FROM MAGNETI MARELLI K LINE DIAGNOSTIC LINK oo0vrrnrornrerernrervernvervnerenvvernnnnerr 105 4 1 1 Instrument cluster from Audi 43 Audi A6 Audi TT VW New Beetle sassa sassa 105 AEE T ER ERR 106 Version 2 26 4 ABRITES Commanper For VAG 16 x Document number 2 20071127 Date 26 03 2012 Version 2 26 5 1 INTRODUCTION Abrites Commander for VAG is a Windows PC based diagnostic software for the vehicles from VAG With the help of this tool you can perform operations with vehicles from the VAG group which are in most cases unsupported from the producer diagnostic testers The Abrites VAG Commander provides you also a full diagnostic capabilities for VAG vehicles 1 1 Installing ABRITES Commander for VAG The ABRITES Commander for VAG is contained into the installation package so please run the setup program Now you are ready to start the ABRITES Commander for VAG When starting the software there is a splash screen appeared where the connection with the hardware is examined If no problem appear then a message Connection OK sh
11. CAN Learn Keys Add Ke VAG vehicle 2007 VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Skoda Scout 2007 CAN Porsche Cayenne CAN VW Crafter Audi A4 2002 KW2000 New Beetle KW2000 S Function Produce TP22 TP23 TP24 TP25 transponder Back Next gt Exit Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key 1 Press Next 2 Follow the instructions 2 5 15 3 Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN Normally most of the newer cars require a transponder which is precoded with the VIN number from a dealer Fortunately it is also possible to precode the transponder by yourself using the Key programmer if you have available the 7 bytes of the component protection data and you need to use an Megamos 48 transponder as base for this operation NOTE The Set transponder type combo box specifies what kind of dealer key to make for VW Seat Sk
12. Long coding help xj r nee Bytes Aa dg EE di ve We We b GE atl al ee ee 2 d an 2 2 AG ae aen 8 N 8 8 N N R 8 N N RN RN NN RRR Byte 03 Bit 4 Airbags installed Byte 05 Bit 0 Right Hand Drive RHD Byte 05 Bit 2 Anti Lock Breaking System ABS installed O Byte 05 Bit 4 Trailer installed O Byte 05 Bit 5 Cruise Control System CCS installed O Byte 06 Bit 0 Start Stop System installed O Byte 07 Bit 3 Flexible Service Interval LongLife active Byte 01 Bits 0 2 01 Transmission Type Manual Transmission 05 Transmission Type Direct Shift Gearbox Dual Clutch DSG X Byte 01 Bits 3 7 10 Transmission Gear Ratio 5 Speed 18 Transmission Gear Ratio 6 Speed 20 Transmission Gear Ratio 7 Speed Byte 03 Bits 1 2 00 No OR Manual Climate Control installed 04 Semi Automatic Climate Control Climatic installed 06 Automatic Climate Control Climatronic installed Byte 04 Bits 0 2 00 Fan Control not installed Byte 04 Bits 5 6 2 4 10 Basic settings Basic settings will expect from you to enter a number of the group and to press the button ON or OFF 2 4 11 Actuator test Available are two types of tests Selective and Sequential In the selective test you have the possibility to enter a test code manually or to select it from a list box When a test is selected you just need to press Start x Choose test Se
13. To learn a key for the EZS Kessy You need to put the login and component security bytes as described above and to specify the number of keys which should be learned Then pressing the Learn button will learn the key IMPORTANT For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer 2 5 2 2 Reading changing VIN To read write the EZS Kessy VIN it is required to put the login and component security bytes as described above Then using the read write buttons you can change the VIN 2 5 2 3 Reading Writing EEPROM To read write the EZS Kessy EEPROM it is required to put the login and component security bytes as described above Then using the Read EEPROM button you can read the whole EEPROM This EEPROM is required to prepare a dealer key Pressing the Write EEPROM button respectively will write the EEPROM but the area from address 0x100 to 0x15F i e 96 bytes is not possible to write The write procedure takes about 8 9minutes while the reading of the EEPROM is completed for less than a minute 2 5 2 4 Program a blank key so it becomes like a dealer key You need to put the login and the component security bytes as described above and then to press the Make dealer key button In this time the blank key should be inside the Key programmer and the ABRITES Commander sh
14. 2Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 0 00000060 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D405 21 gt 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7K eee 00000080 02 04 00 00 10 57 56 57 5A 5A 54 33 43 54 36 45 WVWZZZ3CZ6E 00000090 30 30 30 30 30 30 56 57 5A 43 5A 30 30 30 30 30 000000VWZCZ00000 00000040 30 30 30 30 57 56 57 SA 5A 5A 33 43 5A 36 45 30 O0000WVWZZZ3CZ6EO 00000050 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 AS OO0000 00000000 02 04 00 00 10 57 56 57 5A 5A 54 33 43 54 36 45 WVWZZZ3CZ6E Q00000D0 30 30 30 30 30 30 56 57 5A 43 54 30 30 30 30 30 000000VWZCZO0000 O00000E0 30 30 30 30 57 56 57 SA 5A SA 33 43 5A 36 45 30 0000UVWZZZ3CZ6EO Q00000FO 30 30 30 30 30 18 00 00 00 00 00 00 00 BF F2 AS OOOO0 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 OG Lasses sss v L ih 4 Swap bytes L H Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset CRYPTED Login Component protection Required license AN009 The function allows changing the security access code and the component protection data into MED9 1 ECUs for which the EEPROM is encrypted As mentioned previously for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM
15. Audi 44 46 1997 external immobilizer box KW1281 Seat Toledo CAN Skoda Octavia k line diagnosis KW128 Skoda Octavia II 2007 CAN Skoda Octavia 2007 CAN Skoda Superb k line diagnosis Kw 1 281 Skoda Roomster k line diagnosis Kvw 1281 Skoda Scout CAN Skoda Fabia 1999 external immobilizer box Kyw1281 New key count Login Security code 1 1 Enter security access code and the number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining key stopping to work You will be asked whether you want to use this feature Please answer with yes no according to your wishes 1 5 Wait until adaptation finished is displayed 1 6 Remove the key and turn ignition off with all remaining keys NOTE The system will autodetect whether it is possible to add the key without erasing the remaing keys If possible and if 1 key is selected then and only then a message will appear where you ve to confirm that you want to add the key If you press No here the key will be learned normally other keys will be erased If you select other than 1 key to learn or if adding is not possible than the key will be learned normally with erasing other keys which are not present For the case where the key will be added you should give ignition with the key which you want to learn this should be
16. K Line Airbags Siemens and Bosch 100 909 605 C 8LO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4BO 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L Clear crash data K Line Airbags Siemens and Bosch 1C0 909 605 C BLO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L 2 5 14 Special function VW Crafter This special function gives the possibility read the engine control unit EEPROM together with the PIN code and component security read mileage into engine control unit make immobilizer ON OFF learn keys with prepared transponders perform diagnostic on the engine control unit and the immobilizer NOTE It is possible to connect only to the engine control unit and immobilizer for VW Crafter vehicles To connect to any other device you will need the ABRITES Commander for Mercedes Starting this special function brings a following dialog D ABRITES Commander for VAG 15 0 E 00 01 Engine Control Unit Master S Previous 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta
17. N A Connecting to Comfort module vehicle el System SG OK Comfort module vehicl Adapted to car Connecting to Memory module driver s seet Failed Climatronic Auto HVAC Adapted to car Connecting to Climatronic Auto HVAC OK Connecting to Ausilary Heater Failed Connecting to Seat memory passenger Failed Connecting to DSP Failed Scan finished From the displayed list of available modules the customer has to select the module which he want to adapt Then the procedure of adapting the component protection is performed in two steps reset to virgin state learn module to the vehicle 2 5 8 1 Reset to virgin state Reset to virgin state is possible to be made in three ways by reading the module by OBDII available for instrument cluster airbag comfort module and EZS Kessy by loading the module EEPROM dump available for airbag and EZS Kessy by loading the gateway EEPROM dump from the car from which the module is taked where it was originally build in Customer has to select from the following dialog in which way he want to proceed TAT ERTE commoner oa i Step 1 1 Reset to virgin state Please select how to reset to virgin state By OBDII available for EZS Kessy KOMBI AIRBAG and Comfort module C By module EEPROM dump available only for AIRBAG By gateway EEPROM dump available for all devices C requires the GATEWAY EEPROM dump from the car where module was originally equippe
18. Next the system will try to read login component security automatically iix amp Autodetect Login Code Write Login Code x C Load ae Investigating cluster Please wait Login Code 0 lt Back Next gt Exit If login is read successfully it will be put into field Login Code and the system will automatically proceed to the next step Write If Login is already available to the user he she can put it down directly into the field Login Code D ABRITES Commander for VAG E isl Autodetect Login Code Write Login Code C Load Login Code Using Dump Tool Login Code 36750 Next gt Exit Load using Dump Tool If this option is selected the button Dump Tool will be enabled Pressing this button will open the Dump Tool special function which you can use for the obtain Login code from a dump Load Login Code Using Dump Tool Select an option and press Next The following window will appear LY ABRITES Commander for VAG 5 x Immobilizer data Current key count 2 Transponder type OK No Dealer key transponder Yes ECU responding No Key transponder locked Yes Engine start permited No Key transponder learned No Login acknowledge 0 Transponder acknowledge 0 timeout timeout Press Next to start key learning procedure The system checks the key recognition and engine start conditions They are dis
19. VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN x Function Learn keys lt Back Exit The auto detected vehicle immobilizer is selected into the left list with supported vehicle types If not auto detected the user has to select the desired model into the left list with supported vehicle types After vehicle immobilizer type is selected in the right box appears a list with supported key learning functions At the bottom of the window appears a short description of the selected function Learn Keys To perform key learning choose Learn Keys Add Key For some models it is possible to add a key to the existing already learned keys without erasing them If available select Add Key function for this case Program Key Some models require a dealer key To prepare a dealer key select Program Key After the desired function is selected press button Next to proceed To perform the key learning in most cases you will need the Login If you have selected Learn Keys pressing Next will lead you to the following window ojx Autodetect Login Code c Write Login Code C Load Login Code Using Dump Tool Login Code 0 You can choose from three variants to obtain Login Autodetect If this option is selected by pressing
20. button will not leave the service mode if you entered the service mode by OBDII both the buttons Leave service mode and Reset will leave the service Once the service mode is entered you can Read Write the whole EEPROM Read the whole Flash Read the mileage Read Write the immobilizer data Make key for the car NOTE Sometimes writing of the data may fail In order not to lose the information all written data are backed up in the Dumps subfolder 2 5 7 Special functions with Magneti Marelli UDS 9512 The Magneti Marelli UDS 9512 special function is dedicated for the Magneti Marelli instrument clusters with 9512 microcontroller and UDS diagnostic protocol Typically these are produced after 2009 year After starting the function a following dialog will be brought to the user Magneti Marelli UDS with 9512 Microcontroller one new key first put 0 for the key count and then make the key m Magneti Marelli Dashboard with Motorola 9512 microcontroller and UDS diagnostic protocol To make a key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press Add key After several seconds the key will be ready The learned key will be added to position key count 1 i e if you want to erase all existing keys and program x ABS coding Read write EEPROM Flash Mileage Read mileage 00000028 35 4B 30 39 Mil
21. will read the power class existing PIN CS also VIN and immobilizer number Specify manually the existing CS PIN of the engine control unit Bids 7th byte nat required Id PIN 0 New immobilizer data Immo number l O VIN WAUZZZ4F85N111222 Power class eo CE FER PETE Also after successful reading the fields for the CS PIN VIN and Immo number become active and customer may specify the values he want Please pay attention that the power class for the engine control unit is displayed This is very important value which is stored inside the engine control flash and cannot be changed This value should be the same for the engine control unit and the immobilizer this means if the old broken engine control unit is from one power class and the new one is from other the car will not start even if the adaptation procedure was completed The meaning of the power class value is to prevent putting one engine control unit from e g 3 0TDI to car with 2 0TDI 2 5 10 Special function Steering lock adaptation The window Steering lock adaptation can be used for adaptation of steering lock control module to the VW Touareg VWPhaeton Porsche Cayenne Bentley Continental Audi A8 This adaptation can be by CAN TP2 0 or K KWP2000 To perform this adaptation you need to know the security access code of the immobilizer and working aligned key from the car VIlG ABRITES Commander for YAG 5 x Procedure Repl
22. wo et By selecting a device you ll be shown list of possible long code coding to choose alex Select device Select coding Engine Control Unit 3C8 920 xxx 6 digits code value AF0 920 xx 0 22 digits code value Gateway AL0 920 xxx xxx 22 digits code value Central Electric 5K0 920 xxx xxx 6 digits code value Comfort System 8R0 920 xxx xxx 22 digits code value Parking Assystant 8T0 920 xxx xxx 22 digits code value Door Control Audio System Radio Navigation Steering Control Trailer Recognition lt Back Next gt Exit Select the appropriate coding and press Next VIG ABRITES Commander for VAG E Pije x I Select all Central Electric Seat Altea 42 digits code value Coding information CO Front Fog Lights installed O Xenon Headlights with Shutter installed O Lighting system PR Q0Q4 O Daytime Running Lights Scandinavia active O Daytime Running Lights North America O Driving lights O Driving lights O Coming Home active O Rear Seat Recognition installed O Headlight Washer installed PR 8x1 x Coding information EEE Headlamp washer delay after power on Default 51 ms Headlamp washer time to excite the default 230 ms KR OOo Ose Show Coding Vale Show Coding Vale Saa as JJ em In the opened window you can check un check the desired features see list with check boxes in the above picture modify certain value see the list with the two c
23. 2 i 4 4 Audi Q7 To get communication with the ECU you need to short the fuses as shown on the picture below If not succeeded to communicate with the ECU then you should try as on the picture below If you re still not able to get communication with the ECU it is possible to make short of the external fusebox it is found under the front cover where also the engine is You ve to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you ve to use a bigger cable because if you use a small cable it can become hot 4 5 Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below _ x f J Y D i 4 Z 4 6 Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below 4 7 VAG K CAN Commander key learning procedures Programmer ar ala needed Audi A2 ai ox rra Audi AS 2003 080k tras Megamos 48 Audi A3 2003 2007 OBD CAN Key programmer dealer ke Procedure 3 Megamos 48 Audi A3 2007 OBD CAN Key programmer dealer ke Procedure 3 Audi A4 2003 2008 OBD K Key programmer dealer ke Procedure 6 udi AA oe PT ma muainsssos 1 PP o na o Audi AS 2008 oBDXK TP08 Audi A6 RS6 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Audi Allroad 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 waar mae L Audi Q7 2004 OBD CAN Abrite
24. 20 20 20 B R4 2 01 EDC Login 2 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 Has 00000090 00 00 00 00 OG 00 00 00 00 00 OO 00 00 09 F 6E n 00000040 00 04 ZA 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 036906021A O00000BO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 05 EDC 00000000 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 000000D0 oO 00 00 00 00 00 00 00 00 00 00 00 00 09 FP GE eee eee n 000000E0 24 F3 C5 72 49 E BA CD DA 00 00 00 56 57 BA 43 4rI VWZC 00000O0FO SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 6A CD DA 00 00 00 56 57 5A 43 rI VUZC lt Checksums in the file updated Press the Save button to save the changes ECU MED 9 x Reset component protection data 95160 Required license AN009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer
25. 2006 year VW SEAT SKODA For this type you will need a virgin key or transponder TP22 TP23 TP24 depending on the type of the car as follows For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 Key Learning Standard Mode You need to choose from Special functions Key learning VW Seat Skoda 2007 CAN Key learning x Vehicle model Skoda 2007 CAN New key count 0 Make TP2x from TA2 TA3 TA4 TA5 Login Security code 0 You can reach login code using special functions of instrument immobilizer main panel Another way to B reach login code is to extract it from the ECU special function Engine Control Unit ATTENTION You can produce TP2x transponder from the corresponding TA2 TA3 TA4 TAS transponder using your Tango programmer and pressing the button Make TP2x from T amp 2 TA3 TA4 TA5 Procedure 2 Vw Seat Skoda after 09 2006 For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 2 1 Enter security access code and number of keys 2 2 Turn ignition ON new or existing key 2 3 Press button Leam 2 4 For some VW Seat Skoda vehicles it is possible to add new key without the remaining key stop to work You will be asked whether you want to use this featur
26. 29 06 2011 All r Date 27 11 2007 14 01 2008 01 02 2008 12 02 2008 18 02 2008 20 02 2008 14 03 2008 06 06 2008 01 07 2008 28 10 2008 08 11 2008 01 12 2008 12 12 2008 06 01 2009 ae 25 052 77 06 2009 02 10 2009 06 01 2010 21 01 2010 15 02 2010 22 02 2010 25 03 2010 9 09 2010 16 01 2012 Component protection chapter added 2 Chapter Remote control adaptation updated Chapter Special functions with VDO NEC updated Chapter Coding of the unit updated Chapter Repair RB8 DEF added Added ECU adaptation by OBDII chapter 1 02 2026 r 26 03 2012 9 09 2012 Added Key learning wizard mode Version 2 26 2 ABRITES Commanper ror VAG 16 x Document number 2 20071127 Date 26 03 2012 AEE 9 ERE Eh RR ER NE 9 ERE ES SET NE RER REE naaa ahane 9 ct AN BOOP L esc chase NN ge gen cate eel ET 10 TE NN TTT 10 ES PET T 11 EE RENE 11 SE JE ERE EE REE SR ERR KE 12 EEE RR tags a a ey 3 EE GE EE heen hla TER ee eee ade a 14 ERE EE TTT ig 24751 Diatidatd EAA 15 E AT Ver dened RTT A 16 KE ADON TTT 16 5 1 ET key wiih BAS Bee ioen peee EE nede Reap EE EA 26 Eee ER 27 2525 Rem Wy rine PR PRIM su ss ves bins Seb Siad bees adsl ata A leed ajussadsen 27 2 5 2 4 Program a a blank d 0 it becomes like dealer Ee 27 FREE OT LE SA EG EEE E
27. 34 34 37 33 32 30 30 31 32 30 36 30 3052447320012060 0330101035330 vanner s s s s Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts an ECU dump from EDC16 PPD1x MED9x and ME7x ECUs Dump Tool M i x Type Comfort module component protection data Passat B6 v 00 00 00 00 00 00 00 00 00 eenecccccenee Ja 00000010 83 62 2D 2D 2E 2D 2D 2E 2D 2D 33 43 30 39 35 39 b 3C0959 00000020 34 33 33 48 20 20 30 34 35 33 33 43 30 39 35 39 433H 04533C0959 00000030 34 33 33 48 20 20 20 FF FF FF FF 03 80 FF FF FF 433H_ 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF wwwccccnccsccces 00000050 FEFF EF FE EE FE UF FE FOGF ER FF EF FDGEF FE nag 6 R 6 RRR 8 R R5 00000060 54 SA FE B5 47 14 FE 00 03 63 00 03 64 00 03 56 22 G c d 00000070 00 03 57 00 03 62 BA FF FC B2 56 FF 00 43 86 00 W bZ V C 00000080 43 82 00 al component protection data xj 00000040 AS FF
28. 4 00000070 56 57 54 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZO00000000VW Login 1282 00000080 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 5a 43 ZCzo00000000VNZC 00000090 54 30 30 30 30 30 30 30 30 30 57 56 57 SA 5a 5A ZO00000000UVWZZZ OOO000A0 33 43 5A 36 50 31 31 31 31 31 31 57 56 57 BA SA 3CZ6P111111WVWZZ 00000050 54 33 43 SA 36 50 31 31 31 31 31 31 57 56 57 SA Z3CZ6P111111WVWZ 00000000 5A 5A 33 43 54 36 50 31 31 31 31 31 31 00 00 00 Z23CZ6P111111 O00000DO 7C 7C 37 30 31 30 30 33 47 39 30 36 30 31 38 20 7010036906018 000000E0 20 20 00 00 00 00 AF 50 AF 50 AF 50 98 2A 85 AA POPES te OOOOOOFO 76 55 F4 8A 85 51 84 9B 80 3B 81 09 81 08 83 w Q 7 N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 M gt ECU Magneti Marelli Security Access Code 95320 Required license AN003 This function displays the security access code contained into the engine control unit from Magneti Marelli Dump Tool E x Type ECU Magneti Marelli Security Access Code 95320 Load dump Save dump Swap bytes L H Login 4152 ih 4 00000090 30 33 43 39 30 36 30 32 34 48 20 20 30 31 31 38 03C0906024H 0118 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 OO 00 OO 000000BO 00 00 00 00 00 00 00 00 55 AA 33 CC 50 90 09 08 U J Poe 00000000 38 00 06 04 07 AA DS SF 27 70 FF FF 00 00 00 FF 8 B lt lt sss s OCOOOOODO FE FF FF OFFSET FF FF FF FE FFOFF FF FF FF FF FF
29. AD 00 00 00 56 57 SA 37 VWZ7 00000130 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F BE Z0G7000000 p E 00000140 01 B7 EB 34 45 57 56 57 SA SA 5A 31 4B SA 37 50 4EWVWZZZ1KZ7P 00000150 34 34 34 34 34 34 73 00 00 00 B7 00 00 8C F7 83 444444 atfo Sucfo EE 00000160 01 B7 EB 34 45 57 56 57 5A 5A SA 31 4B 5A 37 50 4EWVWZZZ1KZ7P Flash tool ID 00000170 34 34 34 34 34 34 73 00 00 00 B7 00 00 8C F7 83 444444s 00000180 00 02 00 6F F4 44 20 83 01 03 50 00 00 FF 00 00 0 D P 00000190 01 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF sseeeeeeeee 000001A0 FF FF FF FF FF FF 00 00 FF 00 00 00 A7 C7 7A 00 045 z Write Flash 000001BO 00 00 FF FF FF FF FF FF FF FF 01 FF 00 36 F4 44 05 E Component security 99 17 ed 3d c5 28 d5 MAC 70 E5 BD 7F HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of the Engine Control Unit window Make a quick Ignition OFF ON at this point 2 In case of ME7 x or ECUs from Porsche you can read the flash memory like reading of the EEPROM the only difference is that you need to uncheck the checkbox for automatic detection of EEPR
30. CAN Porsche Cayenne CAN Program Key VW Crafter Audi A4 2002 KW2000 New Beetle KW2000 Lamborghini Gallardo 2005 KW2000 Lamborghini Gallardo 2005 KW2000 VW Touareg K Line KW2000 VW Phaeton Bentley Cayenne K Line KW2000 Audi A2 1997 k line diag KW1281 Audi A3 1997 k line diaa KW1281 EH Function Learn keys Authomatic read of Login code Back Next gt Exit To learn a key you must either have a dealer key purchased by VIN number or prepare it To prepare a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Select Program Key function and press Next Enter key count x Key count 0 Put how many dealer keys you want to program and press OK The VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can learned it using Learn Keys To learn a key Select Learn Keys function and press Next Put how many dealer keys you want to program and press OK Follow the instructions Before the procedure is finished on the display of the instrument is displayed L7 x y where Xx is the number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the instrument will
31. FF Load ECU component protection data from dump 00000050 FF FF FF 000000C0 FF FF FF OooooODO FF FF FF OOOOO0EO 57 34 32 000000FO 30 50 30 Enter component protection data manually 00000100 FF FF FF 00000110 FF FF FF Load dump from EDC16 ME x MED9x uncrypted Simos PPD Simos FSI The function also visualize change the immobilizer and VIN numbers Dump Tool xj Type Comfort module component protection data Passat B6 v 00000000 FF FF 00 00 00 00 00 00 00 00 00 00 07 60 29 OC Se 00000010 83 62 2D 2D 2E 2D 2D 2E 2D 2D 33 43 30 39 35 39 b 3C0959 00000020 34 33 33 48 20 20 30 34 35 33 33 43 30 39 35 39 433H 04533C0959 00000030 34 33 33 48 20 20 20 FF FF FF FF 03 80 FF FF FF 433H ee 00000040 FF Fr FY FF FY FF FF FF FF FF FF FEEF FF FR OFF veseeseseesmeeee 00000050 FF FF FF FF FT FF VF FF F8 7F FF FF FF FD FF FF s seesesssssenee 00000060 SA SA FE BS 47 14 FE 00 03 63 00 03 64 00 03 56 22Z G c d 00000070 00 03 57 00 03 62 SA FF FC B2 56 FF 00 43 86 00 W bZ V C Save dump 00000080 43 82 00 43 83 00 43 84 00 43 65 SA FE 79 62 dA C C C C Z ybd 00000090 FF 00 02 69 00 02 65 nn n 66 NN N2 7 NN N2 68 die ri h 00000050 FF FF FF FF FF F 00000000 FF FF FF FF FF O00000DO FF FF FF FF FF 000000E0 57 34 32 31 38 OO00000FO 30 50 30 30 33 00000100 FF FF FF FF FF 00000110 FF FF FF FF FF 00000120 FF FF FF FF FF L Immo number 00000130 FE FFO
32. Fabia II RS 2011 UDS Key programmer dealer ke Procedure 11 OBD CAN Megamos 48 Skoda Fabia Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Superb 2008 aap Teog OBD CAN Megamos 48 Skoda Superb II 2008 UDS Key programmer dealer ke Procedure 11 OBD CAN Megamos 48 Skoda Yeti 2009 UDS Key programmer dealer ke Procedure 11 Seat Alhambra 1997 o8D K 106 Seat Altea 08 2006 OBD CAN tras Megamos 48 Seat Altea 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Seat Altea 2009 UDS Key programmer dealer ke Procedure 11 19982004 oBD K TP08 Seat Cordoba same o Ee Seat Ibiza 2008 Fesil K not Leer 1 Et Procedure 1 OBD CAN Megamos 48 Seat Ibiza 2009 UDS Key programmer PETER ke Procedure 11 Seat Leon 2003 OBD K not needed E EE 1 08 2006 OBD CAN me procedure Megamos 48 Seat Leon 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Seat Leon 2009 UDS Key programmer dealer ke Procedure 11 Seat Toledo 2003 080 EE Seat Toledo 08 2006 0BD CAN me sete H ope sog exceed Seat Toledo 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 ain ae GE nn samt Seat Toledo 2009 UDS Key programmer dealer ke Procedure 11 wu 7 reo E anor onnon sooner emcee VW American Fox 2003 OBD CAN Key programmer dealer ke Procedure 3 gem moose H ie ted VW CrossFox 2005 OBD CAN Key programmer dealer ke Procedure 3 VW Suran Spac
33. Learning choose vehicle model Write how many keys you need to program enter security access and push the Learn button Then follow strictly the recommendations Key Learning Wizard mode lol Select vehicle immobilizer type Select function Audi A4 2004 RB8 dashboard KW2000 Lamborghini Gallardo 2005 KW2000 Program Key Audi TT 1997 k line diag KW1281 Audi A4 1997 ext immobox KW1281 Audi A4 1997 2002 k line diag KW1281 Audi A6 1997 ext immobox KW1281 Audi A8 1999 ext inmobox KW1281 Audi A8 1999 2002 k line diag KW1281 Seat Cordoba k line diaa KW1281 S Function Learn keys lt Back Exit Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next then follow strictly the recommendations Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options EY ABRITES Commander for VAG 5 x Select an option C Component Security Bytes From Kessy ECU Dump Manual Input of the Component Security Bytes 7 Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 oon Je ae 4 Press Next then follow
34. Serial number m Transponder identificators pe ee Write Immo Serial key CS dba6573433d6b1 KeylD1 f07b970d KeylD5 3937340d data MAC 3fbb3b2c KeylD2 9f37940d KeylD6 2bd3cc73 Status 1400006add KeylD3 453acd73 KeylD7 ft Configuration 210106660100 01 VW KeylD4 acffoc73 Kepa fttffff Add key PIN 7752 Service mode can be entered in two ways by OBDII if the car has working key and you give ignition with it by EEPROM dump if the car is not having working key So if you ve a working key from the car simply give ignition ON with it and press Enter Service Mode by OBDII If the procedure is completed successful a message Service mode OK will be displayed in the status bar If you don t have a working key from the car to enter service mode you need to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After the EEPROM is written back the service mode should be entered normally not needed to do nothing else Please not that if you press the Leave service mode by OBDII in this case if
35. Unit Master fowp2000 Rx Tx Establishment diagnostic session with selected unit electronic control unit identification 3 3 Device N l 2 070906016BL lt VAG number PROGRAMMABLE Clear log Program status 7 data status OL Coding 11172 Part number 56823 Importeur s number 211 Supplier number 137 System description RS Z 5L EDC G000SG Diagnostic requests V Read Freeze frame Custom dovwnload uplo ad Diagnostic session This dialog provides you the possibility to execute the following diagnostic requests 2 4 1 Identification Identification will provide you the VAG part number and software coding 1 electronic control unit identification Device N l 4F0910401L lt VAG number PROGRAMMABLE Program status 00 data status 20 Coding 11772 Part number 0 Importeur s number 0 Supplier number 0 System description 3 0L V6 TDI Gooosac 2 4 2 Software and Hardware version of the unit SW HW version displays if the service is supported by the corresponding controller the SW and HW version of the unit including all slave units of the master unit SU HW version SW version of module 1 K2 6 9 SW version of module Z D2 6 9 SW version of module 3 H2 6 9 SW version of module 4 A4 7 6a SW version of module 5 XPQ35 V19 OZ Hardware number 1K0
36. a programmer If he selects to read by OBDII then the next dialog displays the status of the operation Reading gateway EEPROM by OBDII Connecting to CAN Gateway OK Checking EEPROM access OK Reading EEPROM OK Gateway EEPROM read with SUCCESS Once the EEPROM data are read loaded the adaptation of the component protection is performed Once this step is completed successfully the module should be fully functional St Step 2 2 Learn module to the vehicle Connecting to CAN Gateway OK Trying to set the component protection OK Connecting to Airbag OK Trying to set the component protection OK Module learned to vehicle with SUCCESS 2 5 9 Special functions ECU adaptation by OBDII This special function is dedicated to adapt virgin or to reuse second hand engine control units from one vehicle to another In general the earlier EDC16 and ME7 and all EDC15 allow to adapt engine control units using only PIN code and adaptation on channel 50 But for the VW Seat Skoda starting from 2007 and for Audi starting from 2003 2004 this is no more possible This special function is dedicated exactly for these engine control units which do not support the channel 50 adaptation This also includes not only the Bosch EDC16 MED9 but also EDC17 MED17 and also Siemens VDO Simos PPD and Simos 9 x 6 x 7 x engine control units To adapt engine control unit to the car you need if the engine control unit is vir
37. available the following window will appear D ABRITES Commander for VAG loj x Find the 7th Byte of the Component Security Bytes Find From Working Key lt Find the 7th Byte of the Component Security Bytes Automatic Trying w __ Load Comfort Module EEPROM Dump x Here you ve to choose and option from the above two after that to load the comfort module EEPROM dump and the Next button will become active If Find the 7 Byte of the Component Security Bytes Automatic Trying is selected after pressing the Next button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MED9Y 2 5 15 11 Procedure 11 for vehicles with VDO dashboard with the NEC microcontroller These are typically the models produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally when you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the VDO NEC 2009 special function
38. be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 15 7 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne You must use a virgin transponder PCF7936 or a virgin key no need for some special preparation If you use a Transponder you need to switch it in Cipher Crypto mode You can use your Key programmeror HiTag2 programmer for that purpose if you have one This is done by replacing 0x06 with OxOE in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already OxOE then the transponder is already in cipher mode After the transponder is switched into cipher mode the key learning procedure goes as follows Key Learning Standard mode From Special functions Key
39. because the key functionality for that vehicles is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VDD or VDO So for such cars open the VDO NEC 2009 special function and the following dialog is brought to you To make keys read mileage for these cars it is necessary to enter first into the so called service mode VDO with NEC Microcontroller 2009 x m Service Mode Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the EEPROM content with a programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the EEPROM dump in order to enter it again Load EEPROM Enter Service Mode by Leave Service Mode by 24C032 24C64 dump OBDII OBDII ABS coding Read write EEPROM Flash FD q pb Read 00000008 8B 5B 7B 1D AC El 6C 31 11 EEPROM Read Flash 00000010 81 DS Al SA CO 21 OB CO Z 00000018 28 D1 41 57 21 62 7B 49 AW b I Write Read mileage 00000020 AS CD 79 DA 67 DD 1C A8 y g EEPROM 00000028 07 D9 BF 6A F4 FF 3B 65 j e Mileage jo 00000030 60 83 4D E4 DD 19 SF BC Maceo 00000038 CE FD 60 92 85 3C F amp F3 eR a TT F i m Mileage m Immo Data VIN vwLW2165BM111111 Read Immo data
40. by pressing the Clear all DTCs button from the Auto scan devices panel Once again the protocols used to connect to the devices are specified in the configuration options 2 3 Broadcast requests Broadcast requests are these requests which are sent to all or a group of devices simultaneously The ABRITES Commander for VAG is able to send broadcast requests to all devices with request to enter into a desired transport mode to clear all DTCs in all devices to disable enable the communication of all devices This is done by pressing the corresponding button from the CAN Broadcast panel Available functions are Transport Mode Entering into or leaving the vehicle from Transport Mode that is used by the factory to put the cars into a sleep to conserve battery charge during long periods of inactivity Disable Normal Communication This function will disable all communication between units in the car This can help you to hold current state of the car and to prevent disturbing of communication while re flashing Enable Normal Communication Restore normal message transmission Clear All DTC s Sending requests to all units in vehicle to erase its DTCs 2 4 Standard diagnostic requests When double clicking on the desired device in the main ABRITES Commander for VAG window you connect to the device to proceed standard diagnostic requests The following dialog is opened Ix Y6 Engine Control
41. component protection data 93C76 93C86 Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos 7x generation which are accessed through K Line or CAN for benzine engines Into the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool S ay x Type ECU Simos 7 CAN Reset component protection data 93076 93C86 M2 AC AZ AC AZ AC 54 00 54 00 54 00 01 00 OL 00 a e e et 00000010 01 00 00 00 00 00 00 OG 00 00 00 00 00 00 E OF e eee eee Fs 00000020 E7 OF E7 OF 00 00 08 38 00 1C 00 00 00 04 00 00 ene 00000030 00 00 OO 00 2D 2D 2E 2D 2D 2E 2D 2D 00 00 00 00 00000040 EH S 00000060 P va 00000070 og E 5 sc L a a o 000 ooooo090 New o o o o H 0 om 000000C0 70 7F 00 00 EB 02 80 80 80 80 80 80 80 7F 7F 80 p eeee 000000D0 80 80 80 80 7F 80 80 80 80 80 80 80 80 80 80 80 eee eee 000000E0 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 4 4 000000FO 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 00000100 80 80 80 80 80 80 80 80 80 7F 7E 80 80 80 80 FF ee ee eee v b ECU Simos PPD1x Reset component protection data Required license AN009 This function allows viewing and or changing the component protection dat
42. data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU requires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the MED9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster Dump Tool lt x Type ECU MED 9 x Reset CRYPTED Login Component protection v YR Swap bytes L H 00000000 00 EC 8E 24 38 FF FF 30 36 2D 30 36 2D 31 35 00 8 06 06 15 DC i S Login oc Old funcrypted login 53234 EK DC DL DL oc Component security protection OC Oldtumepptedjes 12 AB 32 sa 34 Fs o ie New uncrypted CS 12 od 34 AP DA ec fo 0 L Unerypted data can be read from the instrument or from the MED ECU through the OBDII A New uncrypted login 23413 ECU MED 9x Immo bypass Required license AN012 B This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes
43. data read It is also possible to extract the immo data by available EEPROM and flush dumps With Immo data by flash EEPROM dumps you can extract the immobilizer data Then you can modify the immobilizer data to learn a key With Export immo data to EEPROM you can export the modified immobilizer data to EEPROM dump If you want to make a key you need to read the immobilizer data first or to load it from flash and EEPROM dumps Then you should have a programmer connected and to put the transponder inside After that 1 key is added to the existing keys This means that existing keys continue to work NOTE It is possible to have 8 keys per car If all position are full the key is not added but replace the 8 position NOTE Pressing the Make dealer key and add it to the immo data button programs the transponder as a dealer key and puts the transponder ID into the immobilizer data But the data are not written in the microcontroller yet you ve to press the Write immo data button to write the data Or if you want since you ve a dealer key at this moment you can exit without writing data and later learn the transponder by diagnostic IMPORTANT Sometimes the read write procedure may fail If you ve a message that controller cannot be read written you ve to retry several times If after 6 7 attempts it is not possible e g to read the mileage or to read the immobilizer data this means that the wiring is not correct or you s
44. dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car should start without making any key learning procedure By pressing OK all changes in dump s data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license AN009 This function allows viewing and or changing the component protection data found into the EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool x Type ECU EDC16 Set component protection data 95320 v 12 38 FF FF 2D 31 32 34 FF 8 16 12 04 amp 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 00000040 00 06 05 00 04 2A 10 75 AG 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 eee 00000070 42 00000080 20 Old oF x 00000090 00 GE EEG n 000000A0 00 A oooooogo az New 0 o 0 o 0 o 0 die 000000E0 24 F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 SA 43 rI VWZC 000000F0 5A 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 8A CD DA 00 00 00 56 5
45. from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for the first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7in byte from working key button and then you can restore the key with the Hitag2 key tool Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU by selecting the Component Security Bytes Kessy ECU dump After pressing the Load button you ve to select the respective dump file Press Next to proceed with key programing NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7t byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer Making the key in the case when Autodetect is not functioning It is possible that by some reason the Autodetect is not functioning e g missing license you don t make the
46. interval options With the opening of the special function window the commander will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have enabled Service reminder reset or and Service interval reset or and Change service options sections Together with these sections in the section Applicable adaptation channels you will see the adaptation channels which values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed column New value of the Applicable adaptation channels table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options The applicable and available adaptation channels from column New value are also available for editing so the user may put there any other values 2 5 18 Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the commander will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation Remote control adaptation x Number
47. ny vw KeylD4 acffcc73 Keng iff Add key PIN 7752 Done For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license To make any operation on these dashboards it is required first to enter into service mode Without entering into service mode nothing is possible Entering into service mode is possible in two ways read the EEPROM 24C32 with a programmer then load it with the Load EEPROM dump button modify it then with Enter service mode by EEPROM dump and finally write back the resulting file with a programmer to the EEPROM lf the car has a working key from the car give ignition with it and then press enter service mode by OBDII ATTENTION If you use Enter service mode by EEPROM dump in the case of 24C64 it is possible that after the modified EEPROM dump is written with the programmer to the instrument cluster the ABS module loses it s coding That is why it is strongly recommended that you detach the dash and work with it on a desk not in the car Or you can switch off ABS module during your work with the dashboard If you prefer to work with the dash in the car then it is strongly recommended that you save the ABS coding before writing the EERPOM dump and restore it after th
48. of keys Instructions Remote Control Matching Enter the total number of keys including existing Press button Learn and wait for the procedure to finish Press and hold the UNLOCK button on every remote that should be learned for at least 1 sec ATTENTION All the keys must be adapted in one procedure Adaptation of all keys must not exceed 15 seconds Remote Control Erasing Press button Erase All Additional settings gt Chn 03 Auto Lock The doors will lock automatically when the vehicle reaches a speed of 15 km h or 10 mph 0 off 1 on gt Chn 04 Auto Unlock The doors will unlock automatically when the key is removed from the ignition switch 0 off 1 on Status Ready In the Instructions window within the Remote adaptation section will be available directions what should be done to learn remote controls Additionally there might be a Additional settings table where there will be listed all the applicable adaptation channels with their current values and description which are related to the remote controls function You can select the desired settings and press button Change to save them This function is available for Audi A3 S3 1997 Audi A4 S4 RS4 1995 2008 Audi A6 1997 2006 Audi TT 1999 Seat Exeo 2009 Seat Leon 2006 Seat Altea 2004 Seat Toledo 2005 Skoda Octavia 1997 Skoda Octavia II 2005 V
49. of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working 2 Preparing a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Put how many dealer keys you want to program and press the Program dealer key It is not required to enter anything the VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can proceed like in the case Learning dealer key purchased by VIN number NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 Key Learning Wizard mode lol x Select vehicle immobilizer type Select function Seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Skoda Scout 2007
50. purchased from the dealer or create with our programmer Read the EZS Kessy EEPROM 2KB Write the EZS Kessy EEPROM 2KB but without an area of 96 bytes with the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so it becomes like a dealer key IMPORTANT To make any activity with the EZS Kessy you need one of the following to know the login PIN of the car and the first 6 bytes of the component security bytes The component security is normally 7 bytes but the 7 byte is not required The login and the component security bytes can be read normally from the ECU This is true for all cars with EDC16x MED9x ME7x ECUs Vehicles with other ECU e g EDC17x or MED17x are not supported The login and the component security bytes can be read manually from the ECU from the customer using the Engine control unit special function or decoded from EEPROM dump which is read with programmer It is also possible that the VAG Commander reads the required information automatically when you press the Autodetect button In this case the VAG Commander connects to the ECU and reads the login and CS automatically and then fill the required fields Cars equipped with EDC17 MED17 is not possible to read the ECU and to get the component security from there In this case if the car has working key you can read the CS and PIN from the EZS Kessy using the Get component security fr
51. security access different from the previous two and different from authorization for programming session Hints When device to which you connect is using KWP1281 diagnostic protocol then only Security Access Login If you want to put the security access to the ECU you should use Security access CS This will allow you access to adaptation channel 50 If you want to put the security access on the Immobilizer you should use Security access CS If you ve a error message that it is not supported you should use then Security access Login 2 4 7 2 User defined Security Access You need to clarify the type of the security access and then by using the buttons Request SEED Send KEY authorization can be performed Security Access x Secutiy access parameters C Standard Type User defined fi Request SEED 1 1 Value DEC Value HEX Return KEY h Olaafeab 2 4 8 Adaptation Adaptation will open for you a separate window where you can check adaptation values You need to enter the number of the channel where adaptation will be performed and then press the button Test If the specified value is accepted by the unit press the button Save x Channel 50 Personal Identification Number PIN Ad aptatio n CHANNEL ME Enter E Scan all Stored value 32000 Test value 12336 Test New value 2336 The b
52. sega Raa 000000E0 01 00 03 00 46 55 38 10 13 73 3C 8C CC 42 00 00 US 3 lt B O00000FO 10 73 38 10 13 73 3C 8C CC 42 00 00 10 73 38 10 38 8 lt B 388 00000100 13 73 3C 8C CC 42 00 00 10 73 53 45 BA 37 5A 30 3 B 85EZ720 Q L Audi A8 2002 Security access code Program transponder 24c17 Required license AN006 to view security access code and ANO09 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Tool xi Type Audi A8 2002 Security access code Program transponder 24c17 v P 45 P d 00000080 64 14 1C 2D 50 18 1C 34 53 14 1C 2D 64 50 32 05 d P 45 dP2 Save dump 0000004A0 00 00 00 00 00 00 00 2D 00 4B 00 48 03 2C OL O0 K Hezea Swap bytes L H 00 OF 14 03 OA OA OA OA OA OA OA OA OA FF FF FF 2 eee eee eee 00 00 70 00 31 07 AZ 07 84 08 BA OA F9 OC A9 OF p l 0ee 00000050 08 18 00 31 00 81 05 09 06 48 07 4E OA 46 OD BF 1 H N F Login 3126 Other Data 00000100 10 00 00 50 00 AO 05 40 06 80 07 AO OA CO OD 80 P 00000120 B3 01 EF 07 AS OF 60 78 00 80 80 00 80 20 04 08 nors se Immo number 00000130 8D 00 BO 00 46 O1 F4 Ol SD 02 BA 02 DD 02 ED 02 F Jeseeeee AUZ7201070699 00000140 EO 02 B8 02 70 02 EO 01 50 01 BO 00 60 00 00 00 en ot CB OS 27 08
53. the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC Press Next to start the key learning procedure 2 5 15 1 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN You must use Keys or transponders TP05 TP08 TP22 TP23 TP24 Note some of the new vehicles need to remain with ignition ON five minutes before starting of the key learning procedure VW Golf5 Skoda Octavia II VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with ignition ON until programming becomes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007 VW Polo 2006 Seat Ibiza 2006 Key Learning Standard Mode From Special functions Key Learning Standard Mode choose vehicle model Key learning x Vehicle model
54. type e g 1T VW Touran from the Chassis type combo box Then pressing the Display button will show all devices which can be installed into this car type Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protocols will be used when scanning for the devices For all devices which the ABRITES Commander for VAG finds a detailed information is displayed in the main screen For each device the following information is shown VAS Number Unit name VAG Number returned by device in the device identification Description returned by device in the device identification Coding returned by device in the device identification Part Imp Supp N Part number Importer number Supplier number information is shown separated with spaces also returned from the device in the device identification DTC number of DTCs stored in the unit Instead of scanning all units which can take a while the user retrieves the list of the installed devices from the gateway by pressing the Gateway config list button Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing DTCs are not accepted from all units there is a possibility to scan all devices and if connection to the device is possible then its DTCs are cleared This is made
55. will need to connect manually some PINs of the VAG Interface OBDII connector with cables to the wiring of the CAR So you ve to find somewhere in the car the desired wires orange with green CAN H and orange with brown CAN L and you ve to connect them to OBDII connector PIN6 CAN H and OBDI Connector PIN14 CAN L Also you ve to connect OBDII Connector PIN4 Ground to any metal part of the car After you re ready you can call the Unlock doors special function Following dialog will be displayed Door unlocking Unlock Vw Unlock Touareg Phaeton 07 46 Allioad Audi AS Unlock Porsche Cayenne OBDII Pin 6 lt gt CAN H orange green OBDII Pin 14 lt gt CAN H orange brown OBDII Pin 4 lt gt GND metal part of the car Unlock Vw Passat Unlock Vw EOS Unlock Audi 44 Unlock Audi 43 So for any of the desired model you ve to press the appropriate button ATTENTION In the most cases this only opens the doors It doesn t disable the alarm 2 5 24 Special function Coding calculator Using this function you can calculate long code coding value of different modules When you open the special function the following window appears IG ABRITES Commander for VAG jo x Select device Select coding Engine Control Unit Instrument Cluster Gateway Central Electric Comfort System Parking ssystant Door Control Audio System Radio Navigation Steering Control Trailer Recognition
56. 0 00 00 FC Cl OO 00000160 06 02 00 07 02 7C 0l AO FF FF 04 32 11 AO OD 92 2 00000170 OE 74 00 00 00 00 00 00 00 00 00 00 00 OO FA CB t 0 00000180 07 02 00 00 OE 2C 74 B6 OS OO 00 OO 27 BF OO OO Z 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 F4 FC AD sss eee eee 00000140 07 02 00 00 OE 2C 74 B6 05 00 00 00 27 BF 00 OG planene lave 000001580 00 00 00 00 00 00 00 00 00 00 00 00 OO F4 FC AD wee eee eee gt Immo is now ON x ECU ME 7 x Set component protection data 9P08 95080 Required license AN009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool Type 05 05 04 04 07 oo 05 os 20 OL OL ol ol 02 00 04 04 20 0l 0l D6 D6 80 67 22 22 20 oo 00 AC AC DZ DD 09 09 20 43 43 DS D8 EO 09 09 09 D8 DS oc oc 0l OE oo oo S 71 71 2D 2D 06 oo 06 06 EF oo 1C 1C Al Al oo oo os os 12 oo oo BO BO 28 18 oo oo 30 oo oo 18 18 04 03 oo oo 35 69 69 5B 5B 58 oo FD FD 30 Cl Cl oo oo DD oo 2D 2D ECU ME 7 x Set component protection data 9708 95080 32 oo oo oo oo 07 oo oo oo 30 AS AS oo oo o
57. 18 00 30 00 60 00 CC 00 38 O1 78 02 0 8 x 90 02 90 02 00 00 57 00 34 01 1C 02 FA 02 81 05 vasse Wadena VIN WAUZZZ4DZYNOD2822 Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s data and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump You should use transponder TP08 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Keys data E x Keyl 28cfcf9b Status Keys You can enter manually key in certain position or you can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to dump After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi A3 A4 A6 UKNSI 1995 1997 mileage and login code 93C56 displays the login and calculates mileage No license required Audi A3 A4 A6 UKNSI 1997 1998 mileage and login code 93C56 displays the login and calculates mile
58. 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 OO BC F B2 7 7 lt eee eee 0000080 TNT Poona g 0 0 0 Cancel ECU MED 9 x Security Code Checksum calculator 95080 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool E E x Type ECU MED 9 x Security Code 7 Checksum calculator 95080 oo 8 05 07 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 1 7H1037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 15 D405
59. 4 37 a8 Ob For CAN immobilizers till end of 2006 it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you ve to go to Special function then Instrument CAN and Read write immo data After you read the immobilizer data in the field Serial Key the 7 bytes of the component security will appear j Read Flash z Write Flash gt 2 5 15 3 1Programming a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In case of Standard mode In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button In case of Wizard mode After you have chosen Autodetect Component Security Bytes or Manual Input of Component Security Bytes press button Next If all 7 bytes are available the system will automatically proceed with dealer key preparation 2 5 15 3 2Finding the 7 byte In case of Standard mode If the 7 byte is not available you must choose Find the 7th byte of the component protection data and you have to put the six bytes which are known There are three possible ways to check whether the 7 byte is matched from working key if you ve a key which can start the ca
60. 4fdec Key 6 5ca38ef4 Key 3 d2da21be Key 7 d4c12be Key 4 58ff4 Key 8 TT Configuration 210103780600 Add Key To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work 2 5 15 12 Procedure 12 for vehicles with Visteon dashboards Normally the Visteon dashboards are build in the VW Golf V models So if the car is with Visteon dashboard the software recognize the type automatically The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VN4 For this dashboard type normally the a Megamos 48 Crypto transponder should be prepared as a dealer key and then learned to the car Fortunately it is possible to read the PIN and all 7 bytes of CS from the Visteon dashboard Key Learning Standard mode If you press Autodetect Login Security code will read the PIN code And pressing the program dealer key will read the 7 bytes of CS and program the transponder without opening any other dialogs After the dealer key is ready you need to lear
61. 7 2011 OBD CAN Key programmer dealer ke Procedure 10 vw Praen dl toy procedure VW Phaeton 2007 OBD grammer ke Procedure 7 k HITAG 2 Key pro PCF7936 or VW Touareg 08 2007 OBD K grammer ke Procedure 7 HITAG 2 Key pro PCF 7936 or VW Touareg 08 2007 OBD CAN grammer ke Procedure 8 40812006 _ _OBD CAN P23 Megamos 48 VW Touaran 08 2006 2009 OBD CAN Key programmer dealer ke Procedure 3 HITAG 2 Key pro PCF 7936 or VW Phaeton 2008 OBD grammer e Procedure 8 ram mee H ri S rest VW Touaran 2009 UDS Key programmer dealer ke Procedure 11 Porsche Cayenne 2007 OBD K grammer ke Procedure 7 Porsche Cayenne 2007 OBD CAN grammer ke Procedure 8 Bentley Continental 2007 OBD K grammer ke Procedure 7 Bentley Continental 2007 OBD CAN grammer ke Procedure 8 4 8 Dump tool special function The dump tool receives as input a dump file from the corresponding unit input dump is loaded with the Load dump button The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is not possible As output the dump tool displays some data extracted from the input file and or makes some modifications to the input data If any modifications were made for some sub functions there are no modifications made only data are visualized the user has to write the modified dump to a desired file with the Save dump button and then this modified dump should be saved back to th
62. 7 5A 43 rI VUZC lt gt ECU EDC16 Immo bypass 95320 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool x Type ECU EDC16 Immo bypass 95320 v 8 16 12 04 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 Save dump 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 Swap bytes L7H 00000040 00 06 05 00 04 ZA 10 75 A6 30 32 38 31 30 31 32 u 0281012 scl te m 00000050 31 31 39 20 20 00 00 00 16 9C OF DS OA 18 FA Bl 119 swears as 00000060 00 04 ZA 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 03G906021 Toggle Immo On Off 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 T87L4 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 09 F GE n 00000040 00 04 ZA 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 03G906021 4 O00000BO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000000 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 09 FP GE ee
63. 8 OF 01 18 01 84 01 05 00 03 OO OO 00000100 7C 7C 0l 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G90601 7 ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license AN003 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through CAN for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool x Type ECU Simos 7 CAN Security Access Code 93CC76 93C86 00000070 56 57 54 43 54 30 30 30 33 33 33 33 30 30 56 57 vuzczo003333ovw Login 1138 00000080 5A 43 5A 30 30 30 33 33 33 30 30 30 56 57 5A 43 ZCZ000333000VWZC 00000090 5A 30 30 30 30 30 33 33 30 30 57 56 57 SA 5A SA ZO00003300UVWZZZ 00000040 33 43 5A 38 33 33 33 33 33 33 33 57 56 57 BA SA 3CZ83333333WVvUWZZ 000000BO 54 33 43 SA 38 50 31 33 33 33 33 33 57 56 57 SA Z3CZ8P133333WVWZ 00000000 5A 5A 33 43 54 38 33 33 33 33 33 33 33 00 00 00 2230283333333 O00000DO 7C 7C 30 39 30 37 30 33 47 39 30 36 30 31 38 46 090703G906018F 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF 01 18 Ol 84 G 000000FO 01 05 00 03 18 OF 01 18 01 84 01 05 00 03 00 OO 00000100 7C 7C 0l 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G90601 v gt ECU Simos 7 CAN Reset
64. 907951 2 4 3 Extended Unit Identification Extended identification VIN displays programming data flash status programming attempts flash date VIN number Part serial number Z100103AL63DEF Supplier identification A TF74035 Production date G 16 10 03 Changes from supplier S as Number of validation status 1001 Current supplier s number G 3DEF Flash Programming succefull ready for driving Programming attempts 0 Succesful programming attempts 0 Status of conditions for programming 0 Flash Tool code 0x000000000000 Flash date 23 05 03 2 4 4 Read Diagnostic Trouble Codes Read DTCs will display all present errors in master and slave units Displayed errors can be together with freeze frame data this depends on the checkbox Read Freeze frame Status Permanent error 18038 Accelerator Position Sensor G79 Signal too Low Status Permanent error 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Sporadic error mechanical error 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Permanent error lower limit exceeded 2 4 5 Clear Diagnostic Trouble Codes Clear DTCs will clear all stored DTCs inside of the unit 2 4 6 Measured values Measured values provide you a possibility to check measured values in different groups You can enter manual number of the group or use
65. A 5A 38 45 35 35 41 34 35 37 33 39 WAUZZZ8E55555739 00000160 39 00 01 00 BA 00 96 00 74 00 5D 00 DA 02 6D 01 9 t m Immo Status 00000170 01 00 00 00 00 00 00 00 00 80 FF 7F 00 00 02 Ol 200 e 00000180 00 4A 9B FF FF 14 3B 00 00 00 32 46 50 73 7B 82 J 2FPs 00000190 00 16 2D 2D 46 5A 00 00 00 00 00 38 FF 00 00 00 FZ Buses 000001A0 00 00 00 93 63 OF 1E 00 00 00 00 00 00 9B FF FF B i 000001BO 45 04 80 9A OF FF 06 FF 04 OF FF 1F FF 30 30 87 E 00 E off O Skip neg responses RBS Crypto data read x Exit In order to transfer the keys you have first to read the EEPROM of the source instrument and when pressing Read keys they are saved into file Then you have to go on the destination instrument read its EEPROM and pressing the Write keys button then you will prompted for the file where the source instrument keys were read After selecting the key file you will be asked what information to transfer Select key data to transfer 7 E IV Transfer learned key IDs IV Transfer leamed key count IV Transfer component protection data IV Transfer login Transfer learned keys Ids this are the key fixed code identifiers If they are not transferred you have to perform key learning on the new dash Transfer learned key count transfer the key count Transfer component protection data this transfer the key variable code Without this the key is not recog
66. ABRITES Commanper For VAG 16 x Document number 2 20071127 Date 26 03 2012 OND UO ABRITES Commander for VAG User Manual Version 2 26 issued by Abritus 72 Ltd Version 2 26 ABRITES Commanper For VAG 16 x Document number 2 20071127 Date 26 03 2012 List of Revisions Chapter Release version of the document Update of the description of dongle installation HID driver 27 11 2007 14 01 2008 01 02 2008 3 2 1 2 12 02 2008 18 02 2008 2 20 02 2008 2 4 14 03 2008 06 06 2008 01 07 2008 28 10 2008 08 11 2008 01 12 2008 12 12 2008 06 01 2009 23 03 2009 21 04 2009 3 Update to V6 5 of the ABRITES Commander for VAG Procedures for Q7 A6 Allroad described 2 3 7 Update to V6 6 of the ABRITES Commander for VAG 3 All 02 10 2009 3 7 06 01 2010 3 5 16 21 01 2010 7 7 15 02 2010 3 5 7 o gt NIN Bd Weed IN Pad N TI wo oo gt 19 05 2009 25 05 2 17 06 2009 3 22 02 2010 3 Update to V7 6 of the ABRITES Commander for VAG 25 03 2010 3 Update to V7 7 and V7 8 of the ABRITES Commander for VAG 15 05 2010 3 Update to V8 0 of the ABRITES Commander for VAG added section 27 05 2010 3 7 Update to V8 0 of the ABRITES Commander for VAG added section 9 09 2010 Update to V8 4 of the ABRITES Commander for VAG Cee Update to V9 0 of the ABRITES Commander for VAG Update to V12 0 of the ABRITES Commander for VAG Update to V13 0 of the ABRITES Commander for VAG 13 05 2011
67. EE OPE TE FT OTe PTR NE SEERE EE TE 31 25 33 Removing RBSRE4 k ERR 31 Version 2 26 3 ABRITES Commanper ror VAG 16 x Document number 2 20071127 Date 26 03 2012 255 Special functions wih Moor CDEI ee 37 KE GE EN aaa 38 25 2 Special functions wih Maneti Marelli UDS OSL 2 vega nemna enn sind ss sui tet ebbet je eek dn 41 235 8 Special functions Component BOE T KJE EE ERR 2 5 8 2 Learn module to the vehicle 2 5 9 Special functions ECU adaptation by OBDIT EEE TRA GE sie adacsl olin dascina i e rancid abi 2 5 11 Special function MMI TV activation syssscascnccasncnineiasinsasssinsinanianiavansasanhsndussbeabendssnnsstuniasiasabnsiaiabastantanaasanaesy 2 5 12 Special function Custom memory access Download Upload ReadMemo ry sassa assan nnan anana 50 LISE Special acions MEG AR VER cat ssc capes epsess0e8 Raie 51 IT NN TI CTO oada a aaa aa le aa a 53 2 515 Special junction Kevlearmin oo unsin nAn AAEE AS AE brae sat pe ann AE EARE AEE EARE ANENA 54 2 5 15 1 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 64 2 5 15 2 Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA serrenrensenrenrenresssrnssrsensenssnnssessavesenrnsennne 67 2 5 15 3 Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN 69 25 15 31 Pr eraniming dealer cy with AT bytes ava
68. FE FE FF EEE FE EE EE PEPP BE GEE OPE aa nnan scale Rana VYWZCZ000000000 DO000L40 FF FFOFY FF FF FF FF FF FF FF FF FF FF FE FF FF DOODOLSO FF FF FE FF OFF EE FFE FF FE FF FY FRE FE FE FF s e c 0c 0 0 0 0 0 0 0 0 0 0 00000160 FF Fr FF FF FF FF FF FF FF FF FE FF FF FF OFF EF o c c 0i0 0 0 0 0 0 0 0 0 0 0 8 Swap bytes L H i Component security bytes are D9 72 52 79 B2 E4 A4 N Other Data HG F t ta aA f LA a a 00000170 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeeeees VIN 00000180 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF seeeeeeeeeees 00000190 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeeeees WWZZ73C253000082 OOOOOLAD FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeeeees 00000150 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeeeeeeeeeees E sf Component security bytes are D9 72 52 79 B2 E4 A4 x Exit Pressing the other data displays the learned keys and allows several operations if a programmer has been recognized allows to read current transponder s data add it to the dump and if transponder s type is appropriate allows to program it as dealer key allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition i Comfort module keys x Comfort module keys data Write keys to comfort module dump You can enter manually a key
69. FF FF FF FF FF FF FFl eeeees O0003B10 FF FF FE FE FF FF FE FF EF FF FF FF FF FF FE FF os seen sieeve 00009820 FF PY FF FE FF FF FF FF EA DODI 18 IF CC FF Fr sasossssbeasmees 00003830 FF EA D6 01 FD C1 1E FF FF FF 1E FF FF FF IE FF asasssaremskene 00003840 FF FF 06 06 F9 FF FF FF 10 OG 47 45 36 35 54 54 GE65TT 00003850 31 30 30 30 31 10 FF FF FF FF FF FF FF FF FF 23 10001 00003860 07 23 03 02 00 00 1E 00 32 20 00 00 02 00 32 FF 2 de 00003870 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeee0es 00003880 FF 04 7F 00 01 OF 14 FB 00 OO 02 OO FF FF FF FF 08 00003890 FF FF FF FF 03 6D FF FF FF FF FE 63 1B FF FE 63 Messe c e 000038A0 1B FF FE 63 1B FF FE 63 1B FF FE 63 1B FF FE 63 C C C E g on the picture above starting from address 0x0080 of the EEPROM there are 17 bytes with OxFF then follows the login which is 0x047F in hexadecimal or 1151 in decimal The mileage consists of two blocks usually 0x90 bytes with the inverted mileage followed by 0x90 bytes with the real mileage but this may vary e g blocks with 0x98 bytes instead 0x90 or first is the real value and then the inverted 4 1 2 Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 3 TT and
70. M and decoding it by dump tool then you can put the component security bytes manually and proceed as described in step 2 1 3 After the key is programmed like a dealer key write how many keys you need to program write security access and push Learn button Key Learning Wizard mode lol Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 S3 2004 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia II 2007 CAN Skoda Octavia I 2007 CAN Seat Altea Toledo 2007 CAN zi Function Program dealer key Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options LY ABRITES Commander for VAG l 5 x Select an option Component Security Bytes From Kessy ECU Dump Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 aT te em If you have all 7 bytes of CS available select Manual Inp
71. NT If you don t have a working key from the car you will need to short the fuses as described in the appendix to get communication with the ECU After the component security is read if you ve all 7 bytes then you can program the key directly If you have only the 6 bytes you have to choice a if you have working key from this car you can put it into the programmer and press the Find 7 byte from working key the 7 byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for the first time If by some reason
72. OBD CAN Key programmer aa ke Procedure 3 VW Multivan 2007 OBD K not needed dr Procedure 2 vw 14 19984 ons tros VW T5 2002 2009 Ko TP08 HE GR s o pam eo tt VW T5 2009 UDS Key programmer dealer ke Procedure 11 VW Sharan ook L meos moan ae me omme VW Sharan 2009 UDS Key programmer dealer ke Procedure 11 somes san genser mme ter renin VW Scirocco 2008 2009 OBD CAN Key programmer dealer ke Procedure 3 pesana aam me a VW Scirocco 2009 UDS Key programmer dealer ke Procedure 11 omg oe oe gt E VW Touran 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 nm ae me ter one tt VW Touran 2009 UDS Key programmer dealer ke Procedure 11 noen aan opon meme ter renin VW Tiguan 2008 2009 OBD CAN Key programmer dealer ke Procedure 3 puram am me tr bommet VW Tiguan 2009 UDS Key programmer dealer ke Procedure 11 il uon ono amea me rene meter 1996 OBD K not needed TP08 Procedure 1 VW PassatB4 vDo 1997 omD TPo8 VW bassa S VDO 2001 oBD Tpos E aie oeo met ae pene meter 2001 OBD K not needed TP08 Procedure 1 tamme open senn ri rec VW Passat B6 2005 OBD CAN Key programmer dealer ke Procedure 3 VW Passatco 2008 O8D GAN key programmer doalerkey Procedureto VW Passat CC 2008 OBD CAN Key programmer dealer ke Procedure 10 vw passatz zoms 08D GAN Keyprogrammer doalerkey Procedureto VW Passat
73. OM and put the corresponding start address and length If you experience problems with reading ME7 x memory better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please notice that the flash which was read is saved automatically in the Flash subfolder and can be used in case of any failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write it In case of failure during the flashing the device should enter into a boot loader mode which will allow to flash the device but not to read it The flash can be then restored with the Custom Read Write function 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flashing 6 Please take into account that the reading writing of the flash will take a long time especially when CAN connection is used as result the battery may become flat HINTS when reading writing EEPROM memory of ECUs 1 If you experience problems with reading ME7 x EEPROM better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 2 5 5 Special functions with Micronas CDC32xx The Micronas CDC32xx special function is dedicated for the VDO instrument clusters with M
74. The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 and then will allow you to choose whether you like the commander to recover the old learned keys or you will learn all keys again by yourself using the Key learning special function Depending from your choice it will recover the old keys or not and finish the procedure If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards security access code on channel 50 After that you have to learn all keys using the Key learning special function Repair RB4 DEF During the procedure the commander will read modify and write back the EERPOM memory to the dashboard After the fixed EEPROM is written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away s
75. W Caddy 2004 VW Eos 2006 VW Jetta 1998 VW Golf Bora IV 1998 VW Golf Golf Plus Bora V 2004 VW Golf Golf Plus Golf Variant 2009 VW Touran 2003 Skoda Fabia 2007 VW New Beetle Cabriolet 1998 2010 VW Fox Spacefox Sportvan Suran 2005 VW Passat 1997 2011 VW Transporter 1997 2009 VW Tiguan 2007 For Audi A8 VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 2 5 19 Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value applicable for the navigation controller function 2 5 20 Special function Cruise control system Using this application you can activate deactivate a cruise control system and change the related steering wheel electronics SWE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the commander will read and display it s current configuration After Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate cruise control system function and apply any changes of the SWE configuration to the SWE unit 2 5 21 Special function Brake pads change 6 Using this application you can Open rear parking brake for pad change Close rear par
76. a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 Please pay attention that during the autodetection whether adding is possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that Key Learning Wizard Mode If this model is autodetected selected the system will also autodetect whether it is possible to add the key without erasing the remaining keys Please pay attention that during the autodetection whether adding is possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that If possible the Add Key function will be available into the list with key learning functions If you choose Learn Keys the key s will be learned normally other keys will be erased If you choose Add Key the key will be added to the remaining other keys will NOT be erased For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 D ABRITES Commander for VAG 5 x Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 w
77. a found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPD1x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool B x Type ECU Simos PPD1x Reset component protection data 31 31 31 53 4E 30 49 30 46 31 30 00 48 1115NOIOF71LO Load dump 00000010 00 00 00 48 00 00 00 48 00 OG 08 38 00 1C 00 OO H H 8 00000020 00 FF 80 80 80 80 80 80 96 80 80 80 80 OO 80 80 005 Save dump 00000030 00 FF 19 9E 59 2C 59 2C 59 2C 94 50 94 50 94 50 Y P P P Swap bytes LAH 00000040 01 00 01 00 01 00 D9 72 52 79 B2 E4 D9 72 52 79 rRy rRy 00000050 B2 E4 D9 72 52 79 B2 E4 A4 00 A4 00 A4 00 OO OO 4rRy 00000060 ON nn nn nn An nn an nn an nn 33 ra 33 FA 33 rA 3 3 00000080 5 ZLC ZZ Zz h 4 u fe fe fe i G G w o NJ oon Ww Ln OOOOOOFO 76 5B F4 84 85 51 84 9B 80 3B 81 09 81 08 83 v Q 7 N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 o03G90601 lt gt Canceled ECU Simos PPD1x Security Access Code Required license AN007 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Dump Tool x Type ECU Simos PPD1x Security Access Code 1115NOIOF710 H Load dump Save dump Swap bytes L H h
78. aar Write EEPROM EDCI6CP34 Slave 00 on ee ee ee JEDC16C4 Master 00 Lee eee eee e eee I1EDC16C4 Slave 100 ne eee eee eee eee SEDC16U1 Master En ne eee eens EDCI6U1 Slave l JEDC16U31 Master dd JEDC16U31 Slave 100 Lee ee eee ee ee eee ET Immo ON Immo GFF ilia esse ad m Flash counter NE NS an Suc R MED EE aie er EE ETE pe MED 9 1 Master ou ER d MED 9 1 Slave 100 ee eee eee IMED 9 1 Single OD te ee ee eee eee eee SIMOS PPD 1 1 1 5 Siemens 09 terete ree ee tenes COn A A A A A A TT UT UTTTUT ta IMPORTANT You need to clarify the type of Engine Control Unit in the car before proceeding To help you in this operation there is a button ECU type help which will ask you for the model and engine and will give you the possible models of ECUs There is also a Autodetect function implemented if you select the ECU autodetect then system will try automatically to find the ECU type Please pay attention that this will be not always possible especially for EDC17 MED17 ECUs You can choose ECU type VAG EDC15x VAG ME7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCH VAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG Cartronic ME7 8 EDC16U1 EDC16U3x CP etc Extracting security code enable disable immobilizer and so on Example is 1 9 TDI EDC16 Engine Control Unit Special Functions Choos
79. acelalign Steering column lock using PIN The complete system consist of the following Steering column lock control element EZS Kessy control module Engine management control module master slave Up to 8 vehicle keys Only with this the procedure Steering columng lock control element can be aligned Do you want to continue Press NEXT to continue or EXIT to exit to leave the operation 2 5 11 Special function MMI TV activation Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF Covered vehicles are eAudi A3 S3 eAudi A6 S6 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A8 S8 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A6 S6 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 eAudi A8 S8 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 TY Activation x Speed Limit 0 kmh Edition 1 C Edition 2 Use the following rule when enabling TV if the car is before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is after 2007 it is better to try at first with edition 2 2 5 12 Special function Custom memory access Download Upload ReadMemory The Custom memory access Download Upload ReadMemory functionality is available from the
80. age No license required Audi A3 A4 A6 UKNSI Japan mileage and login code 93LC56 displays the login and calculates mileage No license required Audi 100 VDO 1995 mileage 94C46 calculates mileage No license required Golf 3 VDO 1995 mileage 93C46 calculates mileage No license required Golf 3 VDO V3 9 mileage 93C46 calculates mileage No license required Golf 3 Diesel mileage 93C46 calculates mileage No license required Golf 3 Motometer V5 8 mileage 93C56 calculates mileage No license required Polo Motometer mileage 93C46 calculates mileage No license required Polo Motometer 1996 mileage 93C66 calculates mileage No license required Passat VDO 1991 mileage 93C56 calculates mileage No license required Passat VD202 1993 mileage 93C46 calculates mileage No license required Passat GT mileage 93C46 calculates mileage No license required Passat GT mileage 93C56 calculates mileage No license required Caddy mileage 93C56 calculates mileage No license required Corrado VDO 1993 mileage 93C46 calculates mileage No license required Corrado MotoMeter 1991 1995 mileage 93C56 calculates mileage No license required Corrado VDO 1991 1995 mileage 93C56 calculates mileage No license required Jetta 1994 1996 mileage 93C46 calculates mileage No license required T4 MotoMeter 1996 1997 mileage 93C56 calculates m
81. ansponders PCF 7936 PCF794x Such cars are VW Touareg VW Phaeton Porsche Cayenne Bentley Continental Audi A8 Abrites Key Tag programmer used to program Hitag2 Megamos 48 crypto transponder and Q7 A6 RS6 Allroad keys The Abrites key programmer is referred as key programmer in the following description Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car to which key learning procedure belongs Starting the key learning special function will bring the following dialog alo Wizard Mode Press Standard Mode to use key learning special function as till version 15 0 of the Abrites Commander for VAG Press Wizard Mode to use key learning special function in wizard mode which will guide you to the key learning procedure for the specific vehicle type Pressing Standard Mode will bring the following dialog Key learning xj Detected car type KWPI 281 external immo box recognized ee vac external immobilizer box KW1281 lt New key count I FER Leam Login Security code 0 Login Security code Engine start permitted No Dealer key transponder No IR daie Login acknowledge ECU Responding No Key transponder locked No min Transponder type OK No Key transponder learned No Transponder acknowledge Key count 0 min
82. at For this case there are buttons Backup and Restore in section ABS coding Press Backup for the Abrites commander for VAG to read and save the ABS module coding before writing the modified dump to the instrument cluster Press Restore for the Abrites commander for VAG to write the saved coding back to the ABS module after you have finished your work with the instrument cluster Additionally the commander will automatically try to read and save the ABS module coding when you load an EEPROM dump using button Load EEPROM 24C32 24C64 The interface should be connected to the car and ignition must be ON in this case If the ABS coding is successfully saved the commander will automatically try to restore it after you use Enter Service Mode by OBDII It is possible that the ABS module refuses to accept the coding even though it is the valid coding read before it was lost In this case the commander gives you the option to write the coding directly to the ABS module EEPROM Read the ABS EEPROM with a programmer and then use button Set EEP into ABS coding section which will write the saved coding into the EEPROM dump Save the modified EEPROM and write it back to the ABS Service Mode is leaved when if you entered the service mode using a programmer then Leave service mode will leave it If you want to enter again you need to modify the EEPROM dump again Pressing the Reset
83. at type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 3 Removing RB8 RB4 DEF error When you select ICP type Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 or Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 a button Repair RB8 DEF Repair RB4 DEF respectively will appear Pressing this button will initiate the procedure for removing the DEF string from the dashboards display NOTE It is recommended that you read and save the dashboards EERPOM and to make a note of the dashboards Login code before the procedure is started Instrument Cluster Immobilizer K Choose IPC type VSA Read ROM Flash ResetECu Repair RBS Security DEF Login 9 Mileage 0 O Skip neg responses Exit During the procedure the commander will read and write several times the EERPOM memory to the dashboard It is normal if on dashboards display appears string Error during the procedure is in progress Repair RB8 DEF After the fixed EEPROM is written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait for some time
84. ble codes etc to the immobilizer NOTE If the car doesn t have any working key it is not possible to give ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you ve a car without any valid key you will need dismount the ECU and connect it on the table or to connect the CAN wires of the ECU directly to the interface NOTE For the key learning it is needed to give ignition with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock but the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to make ignition ON with each key which you want to learn NOTE Sometimes during communication with the immobilizer it is possible to lost communication with it so you will need to repeat the procedure in this case 2 5 15 Special function Key learning Inside every key there is a small chip called a transponder In most cases this chip doesn t require an external power supply but is supplied from the magnetic field which induces electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general
85. byte is found NOTE If you get XXX is displayed you need to stop on the current position and wait 10minutes before you continue ATTENTION For the Passat B6 there are some cars for which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of the component security from the engine you can extract the 7 byte from the comfort module EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you ve attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand whether for the desired car is possible by performing the following procedure a Connect with 25 Immobilizer and go to Measured Vaues Channel 2 b Put the original key or key with Megamos 48 transponder in this case in the Measured values you should have yes or 1 on the second possition of channel 2 c Eject the key so there is no key in the ignition lock If the second positions changes to No or 0 you CANNOT search for the 7 byte If the second positions remains Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number
86. clearing trouble codes device identification adaptation measured values etc Special functions like reading login PIN reading EEPROM etc All devices which can be installed into the car are listed in the main screen of the ABRITES Commander for VAG with their VAS Number If you want to connect to some device please double click on it The ABRITES Commander for VAG will try to connect to the device using consecutively the following protocols KWP2000 over TP2 0 with baud 5000KB s CAN KWP2000 over TP1 6 with baud 5000KB s CAN UDS over ISO transport protocol CAN KWP1281 or KWP2000 over K Line the protocol is recognized automatically from the wake up pattern You can choose which of these protocols to try when attempting to connect as described in the Configuration section 2 1 Configuration The ABRITES Commander for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed if Special functions amp Vehicle Selection Y Broadcast Options r Used protocol for diagnostic K Line baud rates trying sequince r Language 104724 9600 rar S English N Advanced v 9600 5 10472 See oO r K Line used OBDII PINs K Line KwP2000 KWP1281 r Logging O3 m O15 Enable CAN log Antena factor CAN Resistor UDS 5 T 4 t Enable K Line log esl 120 Ohm Instant Logging NOTE changes regarding i
87. d After selecting the operation way another dialog with the status of the operation is displayed A ABRITES Commander for VA G Kes dl Step 1 2 Reset to virgin state Connecting to Airbag OK Disabling security OK Trying to reset component protection OK Component protection is reset with SUCCESS After the operation is completed the module is in virgin state and can be adapted to any car 2 5 8 2 Learn module to the vehicle To learn the module to the vehicle it is necessary to have the Gateway EEPROM dump from the car where you install this module r TA ABRITES Commander for VAG E eo Step 2 1 Learn module to the vehicle To learn the specified module to the vehicle you need the EEPROM dump of the GATEWAY module from the car where you want to build the module You can read the dump by OBDII but this will reflash the gateway or you can load the EEPROM dump Please specify how to proceed Read by OBDII ATTENTION this might reflash gateway if it is not already reflashed C Load gateway EEPROM dump You have the option to read the Gateway EEPROM dump manually with a programmer or to read it by OBDII Reading by OBDII takes normally about 3 4min but requires a module reflash If the gateway is once reflashed further operations of the EEPROM reading don t need reflash So the customer has the option to select whether he wants to read the EEPROM dump by OBDII or to read it with
88. del some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put
89. dress map of the device This option will be available only if you have some updates in your configuration like e g Reading writing the flash counters Take into account that in most cases a security authorization is required before you try to read write into the address map 2 4 16 Component security This special function allows managing of brand new units and immobilizer units where is allowed programming of PIN SKC BGW MAC Functions are under CAN TP2 0 2 4 17 Active diagnostic session Default diagnostic session established after connection to the unit is 89 User can request entering in a different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session 89 Take into account that in most cases different diagnostic sessions require security authorization Diagnostic session Ey Enter 2 5 Special Functions Special functions are some specific for electronic control units application which will allow you reading security access codes read program EEPROM flash content and so on Special functions are available from the main dialog of the application ifi Special functions Vehicle Selection i Broadcast be Options 2 i 2 ES a BK KX Instrument EZS Kessy Instrument Engine Control Micronas VDD NEC Magnetidash Component Steering lock CAN Q7 46 K Line Unit CDC32xx 2009 UDS 9512 protection adaptation EE EEE TY activation K
90. e Fox SportVan Fox Megamos 48 Plus 2006 OBD CAN Key programmer dealer ke Procedure 3 Megamos 48 VW Fox 2005 OBD CAN Key programmer pr ke Er 3 VW Polo 3 1997 2004 OBD K ET Fe 1 Megamos 48 VW Polo 4 2004 2009 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 VW Polo 5 2009 UDS Key programmer Pera ke Procedure 11 WW Golf 3 1993 gap Er WW Gat4 PERIE TPo8 VW Golf4 Cabrio 1998 gpp TPo8 Procedure 2 or VW Golf5 08 2006 OBD CAN not needed TP23 Procedure 12 Procedure 3 Megamos 48 or VW Golf5 08 2006 OBD CAN Key programmer dealer ke Procedure 12 Procedure 2 or VW Crossgolf 08 2006 OBD CAN not needed TP23 Procedure 12 Procedure 3 or VW Crossgolf 2006 OBD CAN not needed Megans T ma 12 VW Golf Plus 2004 OBD CAN Key programmer gg ke kg 12 Procedure 11 OBD CAN Megamos 48 or VW Golf 6 2009 UDS Key programmer ete ke ren 13 VW Jetta 08 2006 OBD CAN Et Er 2 Megamos 48 VW Jetta 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 Procedure 11 OBD CAN Megamos 48 or VW Jetta 2009 mes Ke Ks Lee a ke mrs 13 1997 Herd K not pg Lee HE Fry 1 OBD CAN Megamos 48 VW Bora 2009 UDS Key programmer mr ke gryn 11 VW EOS 08 2006 OBD CAN E eel a ae 2 Megamos 48 VW EOS 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 VW EOS 2009 UDS Key programmer dealer ke Procedure 11 VW New Beste 1998 _oBp k a VW Cad yVDO 2004 09 2008 _OBD CAN m3 Megamos 48 VW Cadd 2008
91. e Please answer with yes no according your wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer This is done by using the Produce TP22 TP23 TP24 TP25 transponder button This requires only a connection with the Key programmer no connection to the car is needed The key learning procedure when have a Tp2x transponder is the following 2 1 Enter the security access code and the number of keys 2 2 Turn ignition ON new or existing key 2 3 Press button Learn 2 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining keys to stop working You will be asked whether you want to use this feature Please answer with yes no according to your wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys Key Learning Wizard Mode NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer To do this choose the Program Key function and press Next This requires only a connection with the Key programmer no connection to the car is needed inixi Select vehicle immobilizer type Select function VW Golf V Micronas dash Magenti ECU
92. e ECU EDC16U31 w ECU ype type help Read EEPROM ojooo000 01 25 ES AE 38 FF FF 31 35 2D 30 31 2D 30 37 FF 8 15 01 07 amp Load from file 00000010 FF FF 31 38 2D 30 31 2D 30 37 08 10 14 80 03 82 18 01 07 00000020 18 01 07 08 15 21 31 30 33 37 33 38 32 30 38 33 11037382083 00000030 41 03 2F 2F 31 30 33 37 33 37 37 31 35 30 EF CA A 1037377150 00000040 00 04 02 00 00 00 00 00 01 30 33 47 39 30 36 30 0369060 Write EEPROM 00000050 32 31 41 4E 20 00 00 7F E4 BO 07 DO 00 00 FA 82 21AN 00000060 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 036906021K Save to file 00000070 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC 00000080 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 00000090 00 00 00 00 OG OG 00 OG OG OG OG OG 00 11 F8 AD se 000000a0 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 036906021K 000000BO 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC Mileage p00000G0 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 2775 000000D0 00 00 00 00 00 00 00 00 00 00 OG 00 00 11 F8 A9 ee 000000E0 99 17 ED 3D C5 28 DS 1A AD 00 00 00 56 57 SA 37 VWZ7 000000F0 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F BE Z0G7000000 p 00000100 99 17 ED 3D C5 28 DS 1A AD 00 00 00 56 57 SA 37 VWZ7 00000110 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F BE Z0G7000000 p 00000120 99 17 ED 3D C5 28 DS 1A
93. e control unit from Siemens ECUs Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool xj Type ECU Simos 7 K line Login code 93076 93086 hg 1118N130L300 H lt 00000010 00 OG 00 48 OG OG 00 48 00 OG 08 38 00 1C 00 00 H H 8 00000020 00 FF 00 00 OG OG 00 00 00 OG OG OG 00 00 OG OG 00000030 00 00 00 00 9B BY 9B BY 9B B9 54 00 54 00 54 00 T T T 00000040 01 00 0l 00 O1 00 B3 6A 65 1B 66 D4 B3 6A 65 1B je f je 00000050 66 D4 B3 6A 65 1B 66 D4 00 O1 00 Ol 00 O1 14 C f je f 00000060 14 C7 14 C7 00 00 00 00 00 00 AO B2 AO B2 AO B2 veceeeeecceceeee Logn 5308 0000070 56 57 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 VWZCZOOOOOOOOOVU ogin 00000080 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 5A 43 ZCz000000000VNZC 00000090 5A 30 30 30 30 30 30 30 30 30 57 56 57 SA 5A SA ZO00000000UVWZZZ 00000040 33 43 5A 33 33 33 33 33 33 33 33 33 33 33 33 33 3C0Z3333333333333 00000050 33 33 33 33 33 33 33 33 33 33 33 33 57 56 57 SA 333333333333WVvW2 00000000 5A 5A 33 43 5A 33 33 33 33 33 33 33 33 00 00 00 2230233333333 000000DO 7C 7C 30 39 30 37 33 32 33 39 30 36 30 31 38 46 0907323g06018F 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF 01 18 Ol 84 G 000000FO 01 05 00 03 1
94. e device via OBDII or with a programmer If data are read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data on 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means that for the same unit two different programmers can produce different dumps Normally the software tries to autodetect the byte order of the dump but if it doesn t succeed then you may need to use the Swap bytes button This buttons changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data are not valid e g displayed PIN is not accepted from the car please try to swap bytes to get result For some functions the swapping is made automatically for example the decoding of the Kessy but for some function the user has to made this manually A more detailed description of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license AN003 This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Phaeton Porsche Cayenne and Bentley Continental The func
95. e eee n O00000E0 24 F3 C5 72 49 E BA CD DA 00 00 00 56 57 5a 43 rI VWZC O00000FO SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 8A CD DA OO 00 00 56 57 5A 43 4rI VUZ C x L Immo is now ON The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Security access code Checksum calculator 95320 Required license None This function displays the security access code which is contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section Dump Tool x Type ECU EDC16 Security access code Checksum calculator 95320 v FF 8 16 12 04 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 Swap bytes L7H 00000040 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 sss sese 00000060 00 04 24 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 03G906021A in 52698 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43
96. eage jo 00000030 30 46 20 FF 00000038 FF FF FF FF FF eC 32 30 38 36 5K092086 48 31 30 FF OF H10 EST Read EEPROM Read Flash Write EEPROM m Immo Data VIN WwZZZ1 KZAW1 90001 Read Immo data Serial number 00000000000000 Transponder identificators Write Immo Serial kep CS 8111 fda502239 KeylD1 ba379bf4 KeplD5 Tm data MAC 522e2028 KeylD2 ba37c062 KeylD6 ffffffff Status 00FF KeylD3 a621d133 Keylb7 ft Key count 4 KeylD4 3ccd92b Keppa tt Add key PIN 51144 Done For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license 2 5 8 Special functions Component protection As part of the security strategy some parts of the modules build in the VAG vehicles implement the so called component protection This is a mechanism dedicated to prevent exchange of modules between different vehicles without central authorization from the VAG online database Such modules build in another vehicles activate the component protection active DTC and are with restricted functionality when build in another vehicle This special function allow to remove this component protection active trouble code and allows to the module to works with its full func
97. ehavior need to be removed for one minute fuse of instrument cluster for example on Audi A8 can be used fuse number 5 Reason for blocking of security access is usage of bad diagnostic tools in the past ATTENTION ABRITES Commander for VAG is designed to calculate mileage values in KM units Please take this into account especially when using dump tool or when VAG Commander asks you about displayed value of instrument cluster Audi Q7 Audi A6 Audi Allroad For some of the vehicles you can read and program immobilizer related data inside of immobilizer and engine control unit This can be done by pressing the button Read Write Immo data The following screen will be displayed Read Write Immobilizer data i x 32 WYGZZZITZAWNIZ 00000010 32 33 33 9F 04 57 56 47 5A 5A 5A 31 54 5A 34 57 233 WVGZZZITZAW 00000020 30 39 32 32 33 33 AG 09 20 09 FB DA BD FD 8D 6F 092233 o 00000030 C 2B DA OO 14 20 OG FE FS FE A OB OD 78 FF FF vaner Has S 00000040 FEEF EE FE EF FE FF FE Fle 01 0622501 LE 7C 003 s en 09 sale 00000050 56 57 SA 37 5A 30 43 38 36 39 32 32 33 33 BE OB VWZ720C8692233 00000060 89 2A 70 67 E8 12 DB 67 FF FF FF FF FF FF FF FF Spgd sv ds Se 69 5 00000070 FO OF FF FF FF FF FF FF FEFE FF FF FF OFF FF OFF srera RTS 00000080 FF FF 04 40 44 54 BDT Save 2 VIN WGZZZ1 TZ4W092233 WVGZZZ1 TZ4W092233 VW Update dump Serial number Vw272008632233 Transponder identificators S
98. ehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN S Function Learn keys Back New gt Exit For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer Prepare dealer key 1 Select Program Key and press Next The following window will appear D ABRITES Commander for VAG E lol x amp Get component security from Engine Control Unit ECU C Get component security from EZS Kessy EEPROM dump Get component security from EZS Kessy by OBDII requires to give ignition ON with working key Login 0 Component Security Bytes cox em You need to put the login and the component security bytes as described above 2 Press the Next button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned Learn key 1 Select Learn Keys 2 Press Next follow the instructions See Special functions with EZS Kessy CAN for additional information 2 5 15 10 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 If such car is equipped with EDC17 MED17 then it is not possible to read the component securi
99. elected wrong device type 2 5 6 Special functions with VDO NEC The VDO NEC special function is dedicated for the VDO instrument clusters with NEC microcontroller Typically these are VW Seat Skoda Audi cars produced after 2009 year After starting the function a following dialog will be brought to the user VDO with NEC Microcontroller 2009 J x r Service Mode Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the EEPROM content with a programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the EEPROM dump in order to enter it again Load EEPROM Enter Service Mode by Leave Service Mode by 24C032 24C64 dump OBDII OBDII ABS coding qr Read write EEPROM Flash P Mileage 7 AW b I White 00000020 AS CD 79 DA 67 DD 1C A8 y g EEPROM 00000028 07 D9 BF GA F4 FF 3B 65 j 7 Mileage jo 00000030 60 83 4D E4 DD 19 SF BC nr OEN 00000038 CE FD 60 92 85 3C F8 F3 lt Lond fom NE A es Immo Data VIN 3VWLW2166BM111111 aniline data Serial number m Transponder identificators SS Write Immo Serial key CS dba6573433d6b1 KeylD1 107b970d KeylD5 9f37940d data MAC 3fbb3b2e KeylD2 9137940d KeylD6 2bd3cc73 Status 1400006add KeylD3 453acd73 KeylD7 ttt Configuration 210106660100
100. erial key bdfd d6fc72bda KeylD1 8392a7067 KeylD5 MAC fbda0d78 KeylD2 e812db67 KeylD6 Status 2000fef8fe KeylD3 KeylD7 Configuration if 0106220111 KeylD4 KeylD8 PIN 2336 Program data in ECU EDC16 MED 9x Restore IPC Immobilizer to VIRGIN state Pressing the button Read will read immobilizer related data Pressing the button Write will program data from the HEX screen if the Update dump checkbox is NOT selected or from parsed data area if the above checkbox is selected Same data can be programmed in the EEPROM of the engine control unit From this dialog also is available function to reset immobilizer in virgin delivery condition where is allowed adaptation of this immobilizer to engine control unit 2 5 2 Special functions with EZS Kessy CAN When this function is opened the ABRITES Commander for VAG tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP2 0 EZ5 Kessy for Q7 A6 Allroad l x m Component security Get component security from Engine Control Unit ECU Component protection bytes ad 32 df vad a3 3d Autodetect from engine ECU PIN Login code 23242 Get component security from EZS Kessy EEPROM dump O Get component security from EZ5 Kessy by OBDII Load from E25 Kessy by requires to give ignition ON with working key OBDII m Leam keys Number
101. es time delay between reception of response from device and sending new request to it 2 1 5 K Line PINs Normally the K Line is output on PIN7 of the OBDII connector But some models e g Porsche Cayenne 2004 the K Line with some units might be on PIN3 or PIN15 For that reason there is a option on which PINs to try to connect to the units ATTENTION If you check all PINs to be examined l e PIN3 PIN7 PIN15 then when scanning for units the time will will be significantly increased For that reason by default only PIN7 is selected 2 1 6 CAN resistance According the CAN specification there should be a resistance between CAN Low and CAN High Normally the gateway has this resistance but if you want to connect on some device on the table then you should use that resistance For that reason there is a option what resistance to use None 75 Ohme 100 Ohm 120 Ohm or 10 Kiloohme By default 120 Ohm is used Normally you should don t have any problems but if some problem appear you can try to change the CAN resistance 2 2 Scanning units After startup on the main screen of the ABRITES Commander for VAG a list of all possible units with their VAS Number is displayed The customer is able to connect to the listed devices by double clicking on the desired device Instead of displaying all possible units you can choose a configuration of devices corresponding to specific car model chassis type This is done by selecting the
102. ey leaming Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter Service ED1 ED2 Read Write interval r 1 im ia aan dl The appropriate special function is opened by selecting it in the list box and double clicking on it or by pressing the Open button NOTE For the purposes of the some special functions basically for the key learning there are buttons for auto detection of the PIN and component security Basically this will try to read these data from the engine control unit but it will try also first to read them from the instrument cluster if the instrument cluster supplier is VDO Please pay attention that for VDO version after end of 2006 it might be required that the part of the instrument cluster is re flashed This is also required for functions for the reading of the mileage As mentioned in the license agreement use these operations on your own risk 2 5 1 Special functions with instrument CAN When this function is opened the ABRITES Commander for VAG tries to establish diagnostic session with the Instrument cluster using KWP2000 over TP2 0 Available functions are eReading current mileage value eRead Program memory of instrument cluster immobilizer eReading security access code of the IMMOBILIZER eRead Write immobilizer related data Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the ins
103. gin you should only put the new CS 6 or 7 bytes and new PIN code You can read them normally from the immobilizer or from the old ECU if it is present Especially for EDC17 MED17 you should read these data from immobilizer since EDC17 MED17 do not support reading the CS only PIN is read for EDC17 MED17 If the engine control unit is used you need the existing CS and PIN of this second hand engine control unit plus the new CS and new PIN code When starting this special function the following dialog is displayed C Specify manually the existing CS PIN of the engine control unit New immobilizer data Immo number VIN Power class ES For EDC16 MED9 ME7 and Simos engine control units the customer can press directly Read and the old CS PIN are displayed If engine control unit is virgin this is also automatically detected So after the successful read of the existing data they are filled automatically in the field below For EDC17 MED17 the old CS PIN should be put manually as displayed on the following dialog Exchange ECU by OBDII Autodetect engine control unit existing CS PIN Specify manually the existing CS PIN of the engine control unit Old Cs 14 ca 5F CA 29 90 7th byte not required Old PIN 65116 New immobilizer data Immo number VIN Power class Cs Please pay attention that the 7 byte of the CS is not required here Pressing the Read button
104. he EEPROM in case of unwanted changes For the most of instrument clusters is implemented automatic parsing of data from the EEPROM mileage immobilizer For instrument clusters from Magneti Marelli please refer Appendix A If connection to Momometer instrument is not succeeded please send the file motometers txt to moto abritus72 com and this instrument will be added to the database till three business days Latest database for Motometer instruments is available on www abritus72 com mmdata bin NOTE Sometimes if you try to access the instrument cluster by selecting the wrong type the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnecting from battery For example this always happens for the Bosch clusters which will be blocked if accessed as Instrument cluster VDO66 VDO86 Motometer type NOTE Please be very careful when selecting Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instruments You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi A4 BOSCH RBx 2 Read the EEPROM 3 If the displayed mileage corresponds to the real
105. icronas CDC32xx microcontroller This is possible using the CDC32xx programmer After starting the function a following dialog will be brought to the user Micronas CDC32xx r CDC32xx Programmer Type diagram r Configuration CDC32xx port Com10 USB Serial Port L v Device Audi 43 2007 v r Mileage Read write EEPROM Flash Mileage 897232 Mileage by flash EEPROM dumps Read mileage 00000008 31 4B SA 37 50 30 32 5A 35 1KZ7P025 58 972 XXX m Immo data VIN WWZZZ1KZ7P 011111 Serial number VWZ7Z0F8226004 Serial key CS 08e20fef153434 MAC 9d968d17 Status 000080fafe Configuration 10106220111 01 PIN 1788 POO m Transponder identificators KeylD1 Beba7a86 KeylD5 KeylD2 a8cadb86 KeylD6 KeylD3 if KeylD7 KeylD4 Ffff KeylD8 FEFERFEF Hm Hm FEFEFFEF Head Immo data Write Immo data Make dealer key and add it to the immo data Immo data by flash EEPROM dumps Export immo data to EEPROM NOTE Before starting any activity with the CDC32xx programmer it is important to set properly the communication port COM port used by the programmer This is made from the CDC32xx port combo box If the port is properly set after starting any activity the LEDs of the CDC32xx programmer will start to blink If they re not blinking this is probably indication that you don t selec
106. ilable ss a ease sas Ses a oe See ea esas aes Sea Deed sk T2 2 5 15 3 2 Finding the 7th byte ES a Sndo TTT 72 2 5 15 4 Procedure 4 No more applicable Use procedure 3 instead srenrenrenrassaverersensrnssnnensensssssvaserssnsrnssvnsnasenvassnvassnnee 74 2 5 15 5 Procedure 5 No more applicable Use procedure 3 instead ioc josie ve bond dad sed bk 74 25 156 Pps clr Toe Audi A4 RB Ej aa scrapes eva etme os stund be dj at dd he 74 2 5 15 7 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Corner Porsche TTT 76 2 5 15 8 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 25 159 Procedure 9 tor vehicles Andi AGOZ Allroad OUS 2 5 15 10 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 2 5 15 11 Procedure 11 for vehicles with VDO dashboard with the NEC microcontroller 25 15 12 Procedure 12 for vehicles with Visteon dashbo tds Lumsnnspendnineivnv va od ad 91 2 5 15 13 Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9812 microcontroller 93 2 5 106 Spedali fume ON Dump Tool msn dp tvneljnjej pne h ek ed bd ib LiL Special NEES L 4 H L RER SPE RER ore nT ETE 2 SJ Special RNC Remote CONT OL adalah OE sevje net sjeiesjpyjvsn jane sj met E
107. ileage No license required
108. in certain position With pressing DK keys data will be written to comfort module dump For to delete key from certain position write 00000000 in the key position field You can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to comfort module dump Change immobilizer status By pressing Set you can set immobilizer status NOTE Normally immobilizer status should have the value 2 It is recommended to change it if it is different r Write keys to Comfort module dump Change immobilizer status Key 1 21C2DC8F Program transponder Key 5 00000000 Program transponder _ g p g D Immo status 2 Set OK CANCEL Keys with data 00000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied positions and represent the data of the learned at the respective positions keys With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if it s type is appropriate TA3 it is also allowed to program transponder as
109. in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED9x require only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Dump Tool xi Type Ecu MED 9 x Immo Bypass v L 8 07 02 08 amp La 07 02 08 7 1037384968 1037383785 GUE 2q gt CDVEiw Save dump 00000080 02 04 00 OO 10 57 41 55 5A 5A 5A 34 4C 33 37 44 WAUZZZ4L37D 00000090 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 NO0000A0 20 20 20 20 57 41 55 SA SA SA 34 4C 33 37 44 30 WAUZZZ4L37D0 Swap bytes L H O00000BO 39 31 32 31 30 11 00 00 00 00 00 00 00 OO F5 62 91210 b 00000000 02 04 00 00 10 57 41 55 SA SA 5A 34 4C 33 37 44 WAUZZZ4L37D OO0000DO 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 OOOOO0EO 20 20 20 20 57 41 55 5A SA 5A 34 4C 33 37 44 30 WAUZZZ4L37D0 OOOOOOFO 39 31 32 31 30 11 00 00 00 00 00 OG 00 00 F5 62 91210 b Toggle Immo On Off 00000100 03 04 4B D4 39 OB 00 00 00 00 00 00 00 00 OG OO K 9 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE 95 sss eee ween 00000120 04 03 48 30 35 2D 42 50 47 38 31 30 08 02 OF 31 HO05 BPG810 1 00000130 33 32 34 30 31 38 31 35 43 00 00 00 00 00 FB SF 32401815C 00000140 05 03 30 33 48 39 30 36 30 33 32 47 20 30 30 30 03H906032G 000 00000150 30 30 00 00 00 00 00 00 00 00 00 0
110. is after you start the key learning procedure If you have a working key from the car service mode should be automatically entered In other case if you don t have a working key from the car and service mode cannot be entered by OBDII the commander will ask you whether you want to enter service mode by EEPROM dump If you choose to enter service mode by EEPROM dump you have to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered Dashboard is equipped with 24C64 EEPROM you need to read the EEPROM with a programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered After service mode is entered 3 The following window will appear er Immobilizer Keys Key 1 68e4c4f1 hone 6d768ef4 Key 2 b70
111. ith EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia II 2007 CAN Skoda Octavia I 2007 CAN Seat Altea Toledo 2007 CAN E Function Learn keys Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key Vehicles before 2007 1 Press Next 2 Follow the instructions Vehicles after 2007 1 Press Next 2 The following window will appear giving you to select from few options LY ABRITES Commander for VAG 5 x Select an option C Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key f Component Security Bytes 0 0 0 o 10 0 aT OST em Select an option and press Next 3 Follow the instructions 2 5 15 2 Procedure 2 for CAN vehicles after 09
112. ity Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are stored always at least 6 of the component protection bytes sometimes also the 7 byte is contained There are several ways to extract the component security In case of Wizard mode Select Autodetect component security and press Next The system will try to read the CS bytes from ECU or if possible from Instrument Cluster It will also automatically decide whether you ve the 7 byte or you ve to search for it In case of Standard mode Simply press the Autodetect component security select Autodetect component security and press Next in case of Wizard mode and the component security bytes will be read from the ECU This will also automatically decide whether you ve the 7 byte or you ve to search for it Also the login will be displayed in the status bar The autodetection is not always possible it works basically for EDC16 and MED9x engines which are using CAN diagnostic connection The component protection bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit then VAG Commander will show you the component security bytes Data read Component security 1b d4 05 e
113. king brake perform Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness 2 5 22 Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle called in the application active ECU and the EERPOM dump of the engine control unit with which you wish to replace it called in the application replacement ECU After opening the application load both dumps using buttons Load active ECU dump and Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in the replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device after that ECU Exchange Dump Tool x Choose ECU type EDC16 mu Load active ECU dump o mu Load replacement ECU dump Change replacement ECU dump placement ECU dump 2 5 23 Special function Door unlocking This function is dedicated to open the doors of the car when the car is in SAFE mode To use this function you
114. lective test mode Selective test ATEEN Cancel test C Enter output code Sequential test Select output END of selective output test Relay for Horn Terminal 58 Bi xenon Shutter Solenoid F320 Bulb for Daytime Running Light Left E 2 4 12 Reset of the unit Reset will request from the unit a SW reset Not all electronic control units support this service Please note that it is not available in all diagnostic sessions 2 4 13 Custom requests Using this function the user can send manually diagnostic requests to the corresponding unit The example below shows a request for identification of an Instrument Cluster ECU Custom requests x Request Trace list Tx 00 02 1A 9B Rx 00 30 SA 9B 34 46 30 39 31 30 39 33 30 41 20 20 30 36 33 30 03 20 3E 12 01 5B 38 DE 2B 67 4B 4F 4D 42 49 49 4E 53 54 52 2E 20 4D 37 33 20 48 31 36 2 4 14 Program VIN Program VIN requests the stored in the device VIN and tries to change it Not all electronic control units support this service Please note that it is not available in all diagnostic sessions Urgent point for this diagnostic service is that most of electronic control units updating its internal memory when ignition is turned off and current diagnostic session is closed Example are engine control units BOSCH EDC16 2 4 15 Custom download upload Custom download upload allows direct reading from the ad
115. n Key leaming Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter adaptation ED1 ED2 Head mie If vehicle model is successfully detected it will be suggested to the user with the following message EY ABRITES Commander for VAG 16 0 EEE 00 01 Engine Control Unit Master 02 Transmisson 03 ABS 04 Steering Angle 05 EZ5 Kessy Entry And Sta 06 Seat memory SS xi 07 Control head 08 Climatronic Au Investiaatina vehicle Connect 09 Central Electi x re Eel fs Flt oA Vehicle lmmobilizer type recognized as Audi A3 S3 0B Air heating 2004 CAN fl Special functions L ae Instrument EZS Kessy Instrument Engine Control Micronas VDONEC Magnetidash Component EDC16 MED9 Q7 A6 K Line Unit CDC32xx 2009 UDS 9512 protection A adaptation b Steering lock TV activation Key leaming Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter adaptation ED1 ED2 Head mie SEE fl CAH Q A BP X Q a 1 gt NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW vehicle 2007 CAN and VW vehicle 2007 CAN If vehicle type is correctly recognized then press OK If you like to select from a list of vehicle immobilizer types then press Manual Selection If for some reason vehicle immobilizer t
116. n it to the car by pressing Learn button with the respective PIN code entered If by some reason the SW doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7 byte NOTE Some cars are equipped with Simos engine control unit instead of Mangeti Marelli If once again the SW doesn t succeed to read the PIN CS you need to read the Simos EEPROM dump with a programmer and from the dump tool to get the PIN CS Then you can prepare a dealer key and to learn in on the absolutely same way as for VW Seat Skoda 2007 Key Learning Wizard mode injxi Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 CAN Audi A8 CAN Program Key VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia II 2007 CAN Skoda Octavia I 2007 CAN Seat Altea Toledo 2007 CAN zl Function Learn keys Back Next gt Exit To prepare dealer key
117. n set the order in which these two baud rate values will be used If 10472 9600 is selected then first the commander will try to connect to the device over K Line using baud rate 10472 and if it doesn t succeed it will switch to 9600 and try again with it If 9600 10472 is selected then first the commander will try to connect to the device using baud rate 9600 and if it doesn t succeed it will switch to 10472 and try again with it ATTENTION Some device working on baud 9600 cannot be waked up if they are first tried on baud 10472 so if you cannot connect to device through the K Line try to change the options so first to try on 9600 2 1 4 Timing parameters The protocols running under K Line require very precise byte timing Since Windows is not a real time operating system these times are not always respected so it is possible that the communication with some devices is unstable or it is not possible to connect In such cases you can try to change some of the times timing parameters from the Advanced button The timing parameters have the following meaning Wakeup echo delay time after slow init between receiving 55 xx yy and sending the inverted value of yy according the K Line wakeup procedure Communication echo delay time between reception of a byte under KWP1281 and sending it inverted back to the device Inter byte time time between sending two bytes under KWP2000 Time between messag
118. ne start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool p x Type ECU EDC15 Immo bypass 24C04 v A Swap bytes L H Toggle Immo On Off Immo is now OFFI The Toggle Immo On Off button allows to switch on off alternatively the bypass function Steering lock VW Passat 6 Security code 68HC908 Required license AN003 to view security access code and AN009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola microcontroller the unit can be either with ELMOS or Motorola microcontroller The function displays also the component protection bytes by pressing the Other data button Dump Tool i x Type Steering lock Yw Passat 6 Security code 68HC908 A Eoinn T Be Load dump b 00000030 33 33 33 33 30 30 30 30 30 30 30 30 30 30 30 30 3333000000000000 ETT 00000040 30 30 DA DA DA CD CD CD 57 57 57 56 56 56 57 57 00 WMIVYVU eu 00000050 57 5A 5A 5A 5A 33 33 33 33 33 33 33 33 33 33 33 UWZZZZ33333333333 00000060 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 3333333333333333 Login 52698 00000070 33 33 33 33 33 33 33 33 33 33 34 F6 F6 F6 AC AC 33333333334 ECU Simos 7 K line Login code 93C76 93C86 Required license AN006 This function displays the security access code contained into the engin
119. nized and cannot be learned Please pay attention that in order to start the engine you ve also to adjust these component protection data in the ECU too Transfer login transfers the car login NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 2 Exchanging RB8 Instrument If you want to put used RB8 instrument into a car you ve to synchronize the ECU and the RB8 instrument For that reason you need to read the ECU component protection data and the ECU MAC Then after reading the the RB8 instrument a button Reset Comp Security After pressing this button the following dialog will appear Just put here the component security and MAC of the ECU x OCs ap fa ee f sa 62 NewCS Ap 10 lee fa 54 fed MAC DldMAC 7 NewMAC 28 EA 3 oD NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from th
120. nterface detection and timing parameters which you made in this dialog will be applied after restarting the application 2 1 1 Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP2 0 with baud 500KB s CAN TP1 6 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP1 6 with baud 500KB s UDS when trying to connect to the device the commander will try to connect to it using UDS over ISO transport protocol with baud 500KB s K Line KWP2000 KWP1281 when trying to connect to the device the commander will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used for configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests they are not applied when auto scanning devices 2 1 2 Interface detection Normally the ABRITES Commander for VAG USB Interface is recognized automatically 2 1 3 K Line baud rate settings When trying to connect to the device over K Line the commander will try to connect to it using one baud rate and if it doesn t succeed it will switch to another baud rate and try again There are two baud rate values currently used 10427 and 9600 Using the 10472 9600 and 9600 10247 radio buttons within the options dialog one ca
121. o oo 46 46 33 81 80 Al AQ Fl 41 41 Component security data E H Er p po pe E EE EEE ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access code which is contained into the ME7 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0x120 bytes because after that area the EEPROM sections are different for each different software version of the ME7x unit Fortunately the most of the interesting data are found in this section IM j x Tupe ECU ME 7 x Security Code Checksum calculator 9P08 95080 v Z 050203Z seine Ca i Swap bytes L H Login 44246 S S 55 55 34 34 58 58 45 45 33 33 38 38 S 5A 33 33 30 30 30 30 31 31 30 30 33 33 37 37 31 31 39 39 34 34 35 35 34 34 41 41 33 33 00 oo 00 oo EC EC E4 E4 FC Z4E83N0075954 FC Z4E83N0075954 FC UX3Z0C1310443 FC UX3Z0C1310443 rf 43 43 Checksums in the file updated Press the Save button to save the changes ECU EDC15 Immo bypass 24C04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engi
122. o it might be needed to wait for some time The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards security access code on channel 50 After the procedure finishes you have to learn all keys using the Key learning special function 2 5 4 Special functions with Engine Control Unit Special functions with ECU can be Read Write of flash memory Read Write the flash counters Read Write EEPROM Extracting security code PIN Immobilizer Enable Disable EDC 15 ME7x Functions become available after pressing the button ECU from special functions of main dialog Engine Control Unit Special Functions x Choose EC Ecu Autodetect S ee elp type Py ECU Autodetect Read EEPROM Ie VAG EDCISx 00 Load from fi qVAG ME 7 1 1 7 5 7 8 wakeup pattern 01 JOO e eee ee eeee JVAG ME7 1 1 7 5 7 8 wakeup pattern 1100 00 sree reer eee ee eee Porsche 5 2 7 8 l EDC16U1 ae
123. oda or Audi As base for this operation is used Megamos 48 transponder If you have a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned If do not have a dealer key if you have chosen key learning standard mode press the Program dealer key button which will show the following dialog r Program dealer key Set transponder type Megamos 48 VW Autodetect component security All bytes of the component protection data component security are know Program transponder from 7 bytes Find the 7th byte of the component security data Find 7th byte and program transponder Component 187 da e8 70 Pre security bytes Automatcial trying of the 7 byt Automal ae tying of the 7 byte Find 7th Eg Manual trying of the 7 byte VM Passat B6 CC from EG Key with transponder in Value for the autorization read by daignostic i ignition programmer over key if you have chosen key learning wizard mode select function Program Key and press the Next button which will show the following dialog CY ABRITES Commander for VAG loj x Select an option C Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Secur
124. of VIN keys to 1 Make dealer key learn EZS EEPROM 00000000 24 68 10 02 00 10 FD BO FF FF Ol FF 36 33 36 37 h 00000010 31 33 30 30 32 36 30 30 31 31 FF FF 37 33 38 37 1300260011 7387 00000020 30 33 30 30 30 34 30 36 30 31 FF FF 31 30 30 38 0300040601 1008 00000030 34 31 32 31 31 31 35 30 30 30 39 30 33 31 30 34 4121115000903104 00000040 34 32 34 37 35 FF FF FF 35 30 2E 31 31 2E 38 32 42475 50 11 82 00000050 33 32 30 31 57 41 55 54 SA SA 34 46 58 36 34 31 3Z01WAUZZZAFX64L 00000060 32 31 31 33 31 FF FF FF 11 28 23 10 34 46 30 39 21131 4FO9 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 01 01 00 10852 O220 00000080 OA A3 51 1A 5B 31 32 36 2E 30 32 2E 30 37 FF FF Q 126 02 07 Save to file 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B 31 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF sss s sss sss sese 00000080 33 30 35 32 31 30 30 39 33 31 38 31 32 31 35 30 3052100931812150 v Load from file Al L Read EEPROM Write EEPROM This special function is dedicated for Q7 A6 Allroad models and the user has the following possibilities Learn a key Learning a key requires in most cases a preprogrammed using VIN key which normally should be purchased from the VW Audi dealer Only models with EZS Kessy with SW version till V2 0 2 it is possible to learn an empty clear key For models with EZS Kessy over this SW version it is required to have a dealer key
125. of keys to learn and the security access code and the keys will be learned In case of Wizard mode If the 7 byte is not available you must choose one of the two options Find the 7th Byte of the Component Security Bytes Automatic Trying This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to give ignition ON and place the programmer ring over the key when the key is on the ignition Find the 7th Byte of the Component Security Bytes Find from Working Key You have to put the six bytes which are known and press Next 2 5 15 4 Procedure 4 No more applicable Use procedure 3 instead 2 5 15 5 Procedure 5 No more applicable Use procedure 3 instead 2 5 15 6 Procedure 6 for Audi A4 RB8 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require a different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason a different procedure is used Key Learning Standard mode You need to choose from Special functions Key learning Audi A4 2004 RB8 Instrument Cluster KW2000 The following buttons will be available Key learning x Vehicle model udi 44 2004 RBS Instrument Cluster Kiw 2000 New key count 0 vr Program dealer key Login Security code 0 No login code is need for the key learning a
126. olumns text and value in the above picture or select certain value by combo box selection Check Select all check box to mark as checked all the check boxes from the check boxes list The coding value is represented into the edit field at the bottom of the window next to button Show Coding Value When certain item is changed this is automatically reflected into the coding value If you would like to see certain coding value meaning you should write down the value into the edit field and press button Show Coding Value 3 TROUBLESHOOTING Below you can find a list of typical problems and how to solve them Problem When starting the ABRITES Commander for VAG on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port COMxx where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES Commander for VAG If the interface is not recognized the USB interface appear with yellow exclamation mark in the device manager then you can try to solve the problem by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface drivers and Uninstalling USB interface drivers If there are some bluetoo
127. om EZS Kessy by OBDII function If the car doesn t have any working key you need to open the EZS Kessy and to read its EEPROM with a programmer Then you ve to select the Get component security from EZS Kessy and to load the EZS Kessy dump After that you can learn make a dealer key also from such cars IMPORTANT If the car doesn t have any existing working key it is not possible to give ignition ON in order to get communication with the ECU So to be able to communicate with the ECU you ve to make short with the fuses as described in the Appendix After the login and the component security bytes are read you can restore the fuses IMPORTANT If the car doesn t have a working key communication with the EZS Kessy is possible only if you press the brake pedal So if don t have a working key before learning keys making dealer keys read write VIN read write EEPROM you ve to make Ignition OFF then Ignition ON and press and hold the brake After that you can continue with the function from learning a key making a dealer key reading writing EEPROM or reading writing VIN NOTE To make any activity with the EZS Kessy you need to put the login and the component security bytes or to load the EZS Kessy EEPROM dump or to get the component security and CS by OBDII from EZS Kessy If this information is not made any attempt to make any activity with the EZS Kessy will result an error 2 5 2 1 Learning key with EZS Kessy
128. ontroller These are typically some models produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally when you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the Magneti dash UDS 9512 special function because the key functionality for that vehicles is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand MM7 or MM5 So for such cars open the Magneti Dash UDS 9512 special function and the following dialog is brought to you Magneti Marelli UDS with 9512 Microcontroller x m Magneti Marelli Dashboard with Motorola 9512 microcontroller and UDS diagnostic protocol To make key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press dd key After several seconds the key will be ready The learned key will be added to position key count 1 i e if you want to erase all existing keys and program one new key first put 0 for the key count and then make the key ABS fe Read write EEPROM Flash i Read M Ea Wak tite Mileage 0 PET m Immo Data S Serialnumber m Transponder iden
129. ot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file 4 APPENDIX 4 1 Programming instrument clusters from Magneti Marelli K line diagnostic link 4 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these type is possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending of the production year of the car So you have to select the one of the both types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are continue to be equipped with older instruments even if they are after year 2000 So the best way is to choose first the Instrument Cluster Magneti Marelli Direct 1996 2000 if not succeeded you have to make the ignition OFF and again ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If succeeded to read the PIN code and mileage are automatically recognized and displayed for Magneti Marelli direct types but in case of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number OOOUSB10 FF FF EF FF FE FF EP FE FE EF FE FF FF FF FE FF s asasnasi
130. ould appear The main screen looks like this EY ABRITES Commander for VAG 15 0 www abritus72 com lol x unit name fvasmumber Description fore Coding HE 9 01 Engine Control Unit Master n Previous 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory passenger gt 07 Control head 08 Climatronic Auto HVAC Connect 09 Central Electic OA 0B Air heating 4 OD Slide door left Le Options ea i 2 W gt 5 a Instrument E2S Kessy Instrument Engine Control Micronas VDONEC Magnetidash Component Steering lock CAN i if Special functions Vehicle Selection Broadcast 07 46 K Line Unit CDC32xx 2009 UDS 9512 protection adaptation o A EB R oft PL TV activation Key learing Dump tool Airbag VW Crafter DSG Mileage Custom PIN Converter Service ED1 ED2 Read Write interval 4 im amma anim ann ATTENTION Make sure you are running the ABRITES Commander for VAG from its folder If you are using a shortcut to the ABRITES Commander for VAG please be sure that the working folder parameter is set to the folder where the executable is placed If the working folder of the shortcut is not set the K Line may function incorrectly 2 Diacnostic with ABRITES Commanper For VAG The ABRITES Commander for VAG consists basically of two parts Standard diagnostic functions like reading
131. ould be connected to the car After several seconds the dealer key should be ready and can be learned with the learn button 2 5 3 Special functions with instrument K Line When this function is opened the following dialog appears Instrument Cluster Immobilizer K Choose IPC type Instrument Cluster D066 D086 Motometer v nstrument Cluster YDO66 YD086 Motometer w Read Load from file Read ROM Flash PesetECU Virgin Factory Hew Instrument Cluster Magneti Mareli Shadow 2 Passat Instrument Cluster Magneti Mareli Shadow 3 TT Login 0 Instrument Cluster Mangeti Mareli Direct 1996 2000 Instrument Cluster Mangeti Mareli Direct 2000 Instrument Cluster Sharan Galaxy up to year 2000 K Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 Instrument Cluster YY Golf4 BOSCH RBx Instrument Cluster Audi A4 BOSCH RBx Mileage 0l Instrument Cluster Laborghini Gallardo 2005 Instrument Cluster Laborghini Gallardo 2005 O Skip neg responses Exit From this dialog you need to choose the type of your instrument cluster immobilizer and then you can read write EEPROM read mileage read PIN code and so on Please note that only connection via K Line will be made KWP1281 or KWP2000 and this doesn t depend on the configuration options ATTENTION All read EEPROM dumps are stored in the Dumps sub folder of the ABRITES Commander for VAG so it is possible to restore t
132. played in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from
133. ponder learned No Login acknowledge N A Transponder acknowledge N A timeout timeout Press Next to start key learning procedure wo Press Next to start key learning procedure EX aserrescommanderforvaG Loix Immobilizer Keys Key 1 ba379bf4 Key 5 ffffffff Key 2 ba37c062 Key 6 ffffffff Key 3 a621df33 Key 7 ffffffff Key 4 73ccd92b Key 8 ffffffff Key count 4 Add Key lt Back Next Exit To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required 2 5 16 Special function Dump Tool Using this application you can calculate security access codes calculate mileage and so on This application needs the EEPROM dump from the corresponding unit After the dump is loaded some modification will be made and you need to store the dump as a new file which you can program into the device For more details about the concrete functions please refer to the appendix 2 5 17 Special function Service Interval Using this application you can perform reset of the service reminder reset of the service interval parameters or change service
134. r put it in the programmer and press Find 7 byte from working key after 70 80 seconds the 7 byte should be found Automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to give ignition ON and place the programmer ring over the key when the key is on the ignition NOTE The automatical check might be not possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference between the automatical and manual procedure is that by the manual procedure you should put the key into the programmer then make a ignition with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively invited to put the transponder into the program and than to give it to the ignition Normally for the most models it is required that the key is in the ignition and you change only the position of the transponder You will be invited to put the transponder into the programmer then to put it near ignition lock so it is read by the immobilizer Exception from this is e g the Passat B6 For it it is required that you put the key with the transponder is put into the programmer then the key with the transponder is put into the ignition lock BUT TILL FIRST POSITION than again into the programmer and again into the ignition lock until the
135. ration field In the configuration the digits on position 7 and 8 specify the current key count E g in the example above they are 22 and this means two keys are present i e the identifiers in fields KeylD1 and KeylD2 will be used If you want to erase the keys you should put there 00 instead 22 if you want only 1 key to be active you ve to put there 11 and so on Key Learning Wizard mode After you choose Wizard mode the key learning special function will automatically detect this vehicle type CY ABRITES Commander for VAG lol x Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN FETS VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN El Function Adds one key to the existing keys without erasing them Back Next gt Exit Learn keys 1 Select Add Key and press Next 2 After the window with immobilizer data appears press Next to start the key learning procedure For to make a key for this vehicle type it is required to enter into so called service mode The commander will automatically try to do th
136. read EEPROM Currently for the software versions we know the login can be located as described above and the mileage starts from address OxAA to address 0x1C8 marked in the picture below 00000000 00000010 00000020 00000030 00000040 00000050 00000060 00000070 00000080 00000090 00000040 00000060 000000C0 00000000 O00000E0 000000FO 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 00000180 00000190 00000120 00000180 000001C0 40 FF OD 85 FF O00001D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF O00001E0 JEF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 4 1 3 VW Passat usually these Instruments are before year 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed mileage is displayed as 0 4 1 4 VW New Beetle First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 1 and read EEPROM The login is not displayed The mileage is displayed as 0 4 2 Porsche Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox 4 3 Audi A8 fusebox passenger side wakeup ECU sey ease i 1
137. s programmer Q7 A6 Procedure 9 auias zoos ospean rammer er Procedure7 Audi A8 2002 OBD CAN grammer ke Procedure 7 aaas e a oe B Procedures Audi A8 2007 grammer ke Procedure 8 fuss oor u er a Process Audi S8 2007 grammer ke Procedure 8 auis 08D GAN Kopprogrammer ar Procedures Audi R8 2006 OBD CAN Key programmer dealer ke Procedure 3 aan zoor 08D GAN Keyprogrammer Ta Proceawes2 Audi TT 2007 OBD CAN Key programmer dealer ke Procedure 3 2 nan ame al Pd EE Audi A1 2011 UDS Key programmer dealer ke Procedure 11 Skoda Octavia o672006 2008 OBD CAN key programmer dealer ey Skoda Octavia II 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 noo UDS Kopprogrammer dederiey Procedurett Skoda Octavia II 2008 UDS Key programmer dealer ke Procedure 11 ene 7 mett Skoda Octavia RS 2009 UD Key programmer dealer ke Procedure 11 2008 2008 OBD CAN Key programmer L Procedures Skoda Octavia Scout 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Skoda Octavia Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Scout 08 2006 0BD CAN TP24 Megamos 48 Skoda Scout 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Skoda Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Roomster 2007 OBD K TP08 Skoda Fabia 2000 2007 OBD TP08 Skoda Fabia I 2007 gp TP08 OBD CAN Megamos 48 Skoda
138. sesnse DODDSBZ FE PF FF FE FF EF FF PE FF EF FP OFF FF OFF FE FR ss cree si wears DOO03B3OD FE FF FF FF FF FF FF FF FF FF EF EE FE FF OG OF accuse wean a 00003B40 78 90 FF FF FF FF FF FF OO 00 FF FF FF FF FF OO x 00003B50 00 FF FF FF FF FF FF FF UD OIL A ee S9 BA sansene ie AUZ 00003B60 125 SA 30 41 58 58 56 58 58 56 58 3B SA 79 SZOAXXXXXXX Z ZV 00003B70 96 B6 OO FF FF 42 20 93 9D 43 7F FF 30 42 DE BS B C DB 00003B80 57 42 20 EB 31 FF FF FF FF FF FF FF FF FF FF FF WB 1 OOOO3B90 FF FF FF FF FF 04 OD 2B 41 55 SA 35 SA 30 41 58 AUZ5SZOAX 00003BA0 58 58 56 58 58 56 11 1E 3B 5A 79 96 B6 OO FF FF XXXXXX 3Zy 00003BBO 42 20 93 9D 43 7F FF 30 42 DE BS 57 42 20 E8 31 B C 0B WB 1 OOUUSBCO PF FE FP FE FF FE FP FF EE FF EF FF FE EE FF BP eae casa RRR 00003BD0 04 OD 2B 41 55 5A 35 SA 30 41 58 58 56 58 58 56 AUZSZOAXXXXXNK 00003BEO 58 11 1E 3B 5A 79 96 B6 OO FF FF 42 20 93 9D 43 X 2Zy Bs E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXX and the login is OD2B in hexadecimal or 3371 in decimal 2 1f the immobilizer number is not present then the login is found somewhere in the region 0x0070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 FF FF FF FF FF FF FF FF FF
139. short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e g by dis soldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and press Next Learn keys 1 Turn ignition ON dealer key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next put down count of keys to leaern then follow strictly the recommendations 2 5 15 9 Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 It is possible to program a key for the Audi A6 Q7 Allroad but this function is not located in the key learning Standard mode It is available in the key learning Wizard mode The function is also available in the EZS Kessy A6 Q7 function from the Special functions list This is so because it requires separate license If not using key learning Wizard mode please refer to section Special functions with EZS Kessy CAN Key learning Wizard mode 3 ABRITES Commander for VAG lol x Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 Program Key Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG v
140. strictly the recommendations 2 5 15 8 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 For vehicles after year 2007 or Audi A8 you need to prepare a Hitag2 key transponder before you use the key learning function You can use a virgin transponder PCF7936 or a virgin key Key Learning Standard mode 1 From Special functions Key Learning choose vehicle model Push Program dealer key The following dialog will appear 2 There are following possibilities 2 1 Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not Dealer key with Hitag2 x C Load component protection data from Kessy ECU dump Autodetect from ECU r Program from Kessy ECU dump C All bytes of the component protection data component security are know Program transponder from 7 bytes Component protection byte dd l af 7 3b 5e b af ej Find the 7th byte of the component protection data m Find th byte and program transponder r i i Find 7th byte Component protection bytes dd al 3b Be Ob af Program from working key Login 11372 Take key OUT and place into programmer Trying bytes 022 IMPORTA
141. t case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool xi Type ECU MED 9 x Security Code 7 Checksum calculator 95160 00 8 05 07 29 b 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 6 Seal 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 Load dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 0l 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2a Swap bytes L H 00000050 E4 37 AS OB 37 A6 3C 13 00 Ol 00 00 00 BC F B3 7 7 lt oveuaunn 00000060 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2a Login 2485 00000070 E4 37 A8 OB 37 AG 3C 13 00 Ol 00 00 00 BC F7 B3 7 7 lt oveuaunne 00000080 02 04 00 00 10 57 56 57 SA 5A SA 33 43 SA 36 45 WVWZZZ3CZ6E 00000090 30 30 30 30 30 30 56 57 54 43 54 30 30 30 30 30 000000VWZCZ00000 00000040 30 30 30 30 57 56 57 SA 5A SA 33 43 5A 36 45 30 O0000UVWZZZ3CZ6EO 00000080 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A OO000 00000000 02 04 00 00 10 57 56 57 5A SA 54 33 43 54 36 45 WVWZZZ3CZ6E 000000DO0 30 30 30 30 30 30 30 57 5A 43 5A 30 30 30 30 30 0000000WZCZ00000 000000E0 30 30 30 30 57 56 57 SA 5A 5A 33 43 5A 36 45 30 O0000UVWZZZ3CZ6EO 000000FO 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A OOOO0
142. ted the port properly From the Type and Device combo boxes the user has to select the car type or the microcontroller type For each selection there is a possibility to view the wiring PIN outs using the Connection diagram button If the user wants to read the whole Flash EEPROM he have to select Micronas Secured from the Type combo and then the microcontroller sub type from the Device combo Type Micronas Secured z Device CDC3217G secured v CDC3217G secured i CDC3272G secured Mileage CDC3297G secured CDC32x G secured gt 24032 If CDC3217G CDC3272G or CDC3297G is selected the user will be able to read write the flash memory If CDC32xxG secured gt 24C32 is selected the user will be able to read write the EEPROM memory Read mileage is made from the Read mileage button It is also possible to extract the mileage value by available EEPROM and flush dumps With Mileage by flash EEPROM dumps you can extract the mileage value Reading Writing the Immobilizer data is made from the buttons Read Immo data and Write Immo data When reading immo data you will be asked first to read EEPROM and then flash memory Immo data will be correctly read only by successful reading of EEPROM and flash memory Please pay attention that the writing the invalid immobilizer data may causes the car to stop working For that reason it is better always to make a backup of the
143. th device try to disable them Problem When starting the ABRITES Commander for VAG Interface not calibrated is displayed Solution Send all logs to a distributor Problem The device connects sometimes to the device under K Line and sometimes not Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instrument cluster is A4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found on addresses 0x00 0x100 and 0x200 If the immobilizer number is placed there then the instrument is not crypt otherwise Problem After reading the A4 RB8 instrument the instrument displays LO x x instead the mileage Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible to connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www abritus72 com mmdata bin into the ABRITES Commander for VAG folder Problem Some device cann
144. the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool 2 2 Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you ve to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer 2 3 Making the key in the case when the Autodetect button is not functioning It is possible that by some reason the Autodetect button is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e g by dissoldering the ECU EEPRO
145. the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC To perform the key learning you will need the Login and for some models also a dealer key One way to obtain the login is to press the Autodetect Login Security code button This will read the login and also the component security If after that the option for making a dealer key is opened this login component security will be used there automatically Pressing Wizard Mode the system will try to detect automatically the vehicle model 3 ABRITES Commander for VAG 16 0 www abritus72 com lolx Engine Control Unit Master 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta os seat nenory pe TE xi 07 Control head o8 Climatronic ax Investigating vehicle 09 Central Electi 0B Air heating e aer d Special functions CAN T Instrument EZS Kessy Instrument Engine Control Micronas VDO NEC Magnet dash Component EDC16 MED9 CAN Q7 46 K Line Unit CDC32xx 2009 UDS 9512 protection A adaptation b xo R B 2 fl ay ar i Open Steering lock TY activatio
146. there are five different types of immobilizers transponders used They are called Immo I Immo II Immo III Immo IV and Immo V Systems from Immol till Immo III require simply that a transponder from the proper type is found inside the key and they are able to learn these transponders Starting from Immo4 it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside there are the following types of transponders Tp22 dedicated for use inside Seat vehicles Tp23 dedicated for use inside Volkswagen vehicles Tp24 dedicated for use inside Skoda vehicles Tp25 dedicated for use inside Audi vehicles especially A3 and A4 Such transponders can be used in all cars of the specific producer e g Tp24 can be used for all Skoda models The last immobilizer system used in VAG is the Immo V It requires that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car producer can deliver such keys and such keys are called dealer keys because only the dealer can supply them For some cars a special programmer is needed in order to prepare the key to be like an ordered from the authorized VAG dealer Currently following programmers are supported Hitag2 programmer used only to program keys with Hitag2 tr
147. this dialog is needed to clarify the diagnostic session which you want to be entered before start of read program memory In the example above it is used session 86 If you want to save currently running diagnostic session simply enter session 0 2 5 13 Special functions with Airbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Airbag i x Connection type Choose ECU type L canes Read EEPROM AUDI BOSCH 1997 2000 Automatic go AUDI BOSCH 2001 2003 oo AUDI BOSCH 2003 Do oo vanuuununanenmer ool WW SIEMENS ALL 00 00 ee ee eee eee eee Write EEPROM see PE Save to file sann s s ss ss s For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request but the crash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using Clear crash data function from device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units Read Write EEPROM 1 All Siemens CAN Airbags 2003 2008 like 4F0959655B Audi A6 Q7 Allroad 2003 2008 1KO909605AB 1K0909605C 1K0909605AD etc 2
148. tificators Serial key CS l KeylD1 i MAC KeyiD2 Status KeylD3 l Key count 0 KeylD4 FIN 0 For these dashboards it is not needed that working key from the car is present You can directly read write EEPROM and read flash and also read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the Key count field If you want to erase all keys put 0 for the key count Key Learning Wizard mode After this type is selected auto detected pressing Next will show this window lei Immobilizer data Current key count 4 Transponder type OK N A Dealer key transponder No ECU responding N A Key transponder locked No Engine start permited N A Key trans
149. tion also displays the learned keys and visualize change the immobilizer and VIN numbers Dump Tool xj Type IMMO KESSY Audi 48 Yw Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Load dump Save dump Swap bytes L H 00000040 00 OF OE 4B 33 44 30 39 30 39 31 33 35 46 20 D7 K3D0909135F 00000050 35 57 4B 34 37 30 32 31 DA 56 42 52 42 34 78 DA 5WK47021 VBRB4x h 4 00000060 56 42 52 42 34 78 DA 56 42 52 42 34 78 05 04 00 VBRB4x VBRB4 gt 00000070 00 FF 05 02 00 02 FF Ol FF FF FF FF Ol FF FF FF eeecececeeees Login BER 00000080 FF OL FF FF FF FF Ol FF FF FF FF OL FF FF FF FF eeeeeececeeees I 00000090 OL FF FF FF FF OL FF FF FF FF OL FF FF FF FF 02 eseeecececeeees S O00000A0 01 70 56 57 5A 33 5A 30 43 31 30 33 34 34 39 30 p wz3z0C1034490 VWZ3Z0C1030000 00000080 01 00 00 00 OG 00 00 00 29 OG 23 05 OB 00 07 03 Vignes an QOO000CO 01 00 00 00 01 00 00 OG OL 00 OG 00 01 00 00 OG eee e ees R E 000000D0 O1 OO OO OO Ol OO OO OO 2D 7A AO FO 7B 9B FO 72 RLE WWGZZZ7LZ3D010000 000000E0 9C FO 83 A3 FO CE 65 90 FO 65 90 FO 00 00 00 00 EE Q00000FO 00 00 O1 00 OG ES EB E3 7D 35 AE FO C2 2B 41 75 15 Au 00000100 F6 BO 80 4B 01 00 7F 7E 01 00 99 2C 6C 01 00 00 K 1 v gt Pressing the other data displays the learned keys and also allows changing the immobilizer status on some models changing the immobilizer status is used
150. tionality Component security is not implemented in all VAG vehicles The first vehicles starting with the component protection are Audi A6 Q7 Allroad 2004 and Audi A8 2003 This special function currently works on Audi A6 Q7 Allroad 2004 2008 In these cars the customer is able to adapt completely by OBDII without any restrictions the component protection for the airbag instrument cluster comfort module and EZS Kessy For the remaining modules having a component protection e g DSP Climate Control the customer can adapt the component protection only if he have the Gateway EEPROM dump from the car from which the replacement module is taked Audi A4 A5 Q7 2007 In these vehicles the customer is able to adapt the instrument cluster When the special function Component protection is started the system is examined and all modules with available component protection are displayed A ABRITES Commander for VAG This functinality allows the customer to adapt used parts on other cars ln general this requires following steps 1 Reset the module to virgin state 2 Adapt the module to the vehicle you want re fe a al a EZ5 Kessy Entry And St Adapted to car Connecting to EZS Kessp Entry And Start Autorization OK Airbag Adapted to car Connecting to Airbag OK Instrument Cluster Adapted to car Connecting to Instrument Cluster OK z Connecting to Central Electic OK Central Electic Comp Prot
151. to put the Kessy e g into deliver condition Kessy keys x Key 1 DC004426 Key 5 FFFFFFFF Key 2 5E344320 Key 6 FFFFFFFF Key 3 FFFFFFFF Key 7 FFFFFFFF Key 4 FFFFFFFF Key 8 FFFFFFFF se Immo status L Set EZS Kessy Security access code 95121 Required license AN003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola HC9S12 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Dump Tool x Type EZS Kessy Security access code 9512 Korean ara Load dump 00000010 37 33 30 30 32 36 30 30 31 31 FF FF 30 35 37 37 7300260011 0577 00000020 36 33 30 30 30 34 30 36 30 31 FF FF 35 39 32 35 6300040601 5925 00000030 31 30 30 31 32 30 36 30 30 33 39 30 33 31 30 34 1001206003903104 00000040 34 32 34 37 35 FF FF FF 36 30 2E 32 30 2E 30 32 42475 60 20 02 00000050 36 36 33 30 57 41 55 SA SA SA 34 4C 30 37 44 30 6630WAUZZZ4L07D0 00000060 30 30 30 30 30 FF FF FF 02 20 66 03 34 46 30 39 00000 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 02 02 00 10852 0220 455 00000080 07 ED ZA 10 77 SF 30 38 2E 30 33 2E 30 37 FF FF w 08 03 07 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B SL Save dump h 4 Swap bytes L H Login 55 vannene 00000050 33 30 35 32
152. trument cluster This application can be used with the following models D ABRITES Commander for VAG 15 0 abritus72 com SU Instrument cluster Immobilizer special functions 01 Engine Control Unit Mast Mileage r Read Write memory 02 Transmisson 03 ABS Read current mileage value Read write EEPROM 04 Steering Angle D5 TZE er ae ee eee Current mileage value Read wiite RAM Read ROM FLASH 06 Seat memory passenger 07 Control head 08 Climatronic Auto HVAC 09 Central Electic 0B Air heating Immobilizer WEST oc OD Slide door left 0 SECURITY ACCESS CODE Read Security Access Code T 11 Special functions Vehicle Select Read Write IMMO data K Lir eae EZ2S Kessy Instrun Q7 A6 K Lir 101 S 1100 LC 101 my TV activation Key leaming Dump ED1 ED2 JM Reset cluster ea nite maim L VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda Octavia II Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the function for reading current mileage value is not available ATTENTION Please take care that some instrument clusters from Audi A3 and Audi A8 are with blocked access to these special functions This can be recognized if after reading of current mileage value is displayed unreal value To restore instrument cluster to normal b
153. ty from the engine control unit Instead it is only possible to read the PIN code from it Fortunately it is possible to program a key for such car You need to read the PIN from the EDC17 MED17 and also to read the comfort module EEPROM with a programmer Key Learning Standard mode Then you ve to select VW Passat B6 CC with EDC17 MED17 CANY from the key learning dialog To learn a key to this car you should make first a dealer key This is made by pressing the Program dealer key button which brings the following dialog Program dealer key Set transponder ype Megamos 48 VW TA3 v AN 7 bytes of the component protection data component security are know m Program transponder from 7 bytes Component protection bytes L 0 0 0 0 Find the 7th byte of the component protection data m Find 7th byte and program transponder Component protection bytes L o E o L o Program G Automatcial trying of the 7 byte possible when you can check in measured values when key is recognized Manual trying of the 7 byte after each attempt you can try with the key on the ignition Value for the autorization read by daignostic m Passat B6 CC with EDC17 MED17 Login Security code 34269 Load comfort module EEPROM dump Ball Here you ve to put the PIN code after that to load the comfort module EEPROM dump and the Program button will become active After pressing the
154. ut of the Component Security Bytes put down the CS bytes and press Next The key will be programmed If you don t have the CS bytes available select Autodetect Component Security Bytes and press Next After the component security is read if you have all the 7 bytes then the key will be programmed directly If you have only the 6 bytes you have to choose a if you have working key from this car you can put it into the programmer and select the Find 7th byte of Component Security Bytes Find from working key and press Next the 7t byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then select the Find 7 byte of Component Security Bytes Automatic Trying and press Next you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key
155. utton Scan all will generate a file with all channels and adapted values Some important channels used for adaptation Channel 50 is used for adaptation of new parts Usually to get access to this channel you should make a security access with the Login of the device to which you re connected and which you will adapt to the car After you gain access to the channel 50 you should put the Login PIN of the car to which you adapt the new part Channel 21 If the Immobilizer is by K Line then on channel 21 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made Channel 1 If the Immobilizer is by CAN then on channel 1 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made 2 4 9 Coding of the unit Coding will open for you a separate window where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding xl 01 03C 906 016 BC Long 0123EF8DCB056002FF New coding 0119EF9DCBO56002FF value O Set coding type manually 12 bit coding 20 bit coding Long coding Bytes jo Coding data read Pressing button Coding Helper will open a new window where you can see the corresponding coding information with an opportunity to change the appropriate settings
156. value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH RBx otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 3 1 Transferring keys from one RB8 instrument to another Starting from V5 2 of the ABRITES Commander for VAG it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Instrument Cluster Immobilizer K Choose IPC type Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 v e se d 2 2 2 22 222222 2 Head ROM Flash Reset ECU Reset Comp Repair RBS Security DEF 00000100 5C 78 1C 2B D2 D4 CF 01 E4 3E BO 64 01 44 6D 46 x gt d DmF Login EES 00000110 54 C 9D 43 72 ED 60 FO AB 97 A9 56 28 AG 79 9A T Cr V y SI 00000120 00 01 B9 82 FC 01 2B 3F 2D 43 68 7E 53 5B DO 61 2 Ch S a Men 00000130 FB 1C 9E 78 9C 3C SF 03 A4 36 4E 01 AD 08 70 00 x lt _ 6N p 00000140 FD 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cs 5920 00000150 57 41 55 5A 5
157. you want to enter the service mode again you will need to write back the modified EEPROM dump again Dashboard is equipped with 24C64 EEPROM you need to read the EEPROM with a programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Enter service mode by OBDII and the service mode should be entered Once the service mode is entered the customer has the possibility to read write EEPROM and read flash and also to read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the configu
158. ype is not successfully recognized the following message will appear EY ABRITES Commander for VAG 16 0 britus PSE avrItus C 4 Unit name fvasmumber Description fore Coding 00 01 Engine Control Unit Master 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory passenger gt 07 Control head ABRITES Commander for VAG x 08 Climatronic Auto Connect 29 centre lectia Cannot autodetect immobilizer type Please select it manually 0B Air heating OD Slide door left fl Special functions e V m j 2 W gt 5 A amp E Instrument EZS Kessy Instrument Engine Control Micronas VDD NEC Magnet dash Component EDC16 MED9 CAN 07 46 K Line Unit CDC32xx 2009 UDS 9512 protection A adaptation b x ou RBB DQ Steering lock TV activation Key leaming Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter adaptation ED1 ED2 Read Write v el After vehicle investigation has finished and the user has made it s choice to proceed by pressing OK or Manual Selection the following dialog will appear lol Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Add Key Program Key Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN

ABRITES Commander for VAG User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents