Home

ABRITES Commander for VAG User Manual

1. OCs fap a ee fee fsa a2 New CS aD 41 6E 3B sa ed MAC Dg MAC 41 22 33 4 NewMAC 28 E 136 0D NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 3 Removing RB8 RB4 DEF error When you select ICP type Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 or Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 a button Repair RB8 DEF Repair RB4 DEF respectively will appear Pressing this button will initiate the procedure for removing the DEF string from the dashboards display NOTE It is recommended that you read and save the dashboards EERPOM and to make a note of the dashboards Login code before the procedure is started Instrument Cluster Immobilizer K Choose IPC type SUTILES Read Save to file Head BOM Flash Reset ECU Reset Comp Repair RBS Security DEF Login 9 Mileage O Skip neg responses Exit During the procedure the commander will read and write several times the EERPOM memory to the dashboard It is normal if on dashboards display appears
2. i Si j i Find 7th byte Component protection bytes dd all 3b Se Ob af Program from working i i key Login 1372 Trying bytes 022 Take key OUT and place into programmer IMPORTANT If you don t have a working key from the car you will need to short the fuses as described in the appendix to get communication with the ECU After the component security is read if you ve all 7 bytes then you can program the key directly If you have only the 6 bytes you have to choice a if you have working key from this car you can put it into the programmer and press the Find 7 byte from working key the 7 byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the
3. Choose ECU EDC16U31 y ECU type type help e Read EEPROM V7 oBjoooo00 01 25 ES AE 38 FF FF 31 35 2D 30 31 2D 30 37 FF 8 15 01 07 E Load from file 00000010 FF FF 31 38 2D 30 31 2D 30 37 08 10 14 80 03 82 18 01 07 00000020 18 01 07 08 15 21 31 30 33 37 33 38 32 30 38 33 11037382083 00000030 41 03 2F 2F 31 30 33 37 33 37 37 31 35 30 EF CA A 1037377150 00000040 00 04 02 00 00 00 00 00 01 30 33 47 39 30 36 30 0369060 Write EEPROM 00000050 32 31 41 4E 20 00 00 7F E4 BO 07 DO 00 00 FA 82 21AN 00000060 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 036906021K Save to file 00000070 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC 00000080 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 00000090 00 00 00 00 00 00 00 OG 00 00 OG 00 00 11 F8 A9 se ooo000A0 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 036906021K 000000B0 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC Mileage 000000C0 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 23775 no0000D0 00 00 00 00 00 00 00 OG 00 00 00 00 00 11 F8 A9 see 000000E0 99 17 ED 3D C5 28 DS 1A AD 00 00 00 56 57 SA 37 VWZ7 000000F0 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F6 BE Z0G7000000 p 00000100 99 17 ED 3D C5 28 DS 1A AD 00 00 00 56 57 SA 37 VWZ7 00000110 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F BE ZOG7000000 p 00000120 99 17
4. 01 03C 906 016 BC Long 0123EF8DCB056002FF New coding 0119EF9DCB055002FF value Coding Helper O Set coding type manually O 12 bit codin g O 20 bit coding O Long coding Bytes 10 Coding data read Pressing button Coding Helper will open a new window where you can see the corresponding coding information with an opportunity to change the appropriate settings ST i x FER 0 ees EP Gy e y EE a ah ae a 6 E GE TEL 20 ale al 22 an ql al te G SS TT TTTTTTTTTTTTTTTTTT Byte 03 Bit 4 Airbags installed Byte 05 Bit 0 Right Hand Drive RHD Byte 05 Bit 2 Anti Lock Breaking System ABS installed O Byte 05 Bit 4 Trailer installed O Byte 05 Bit 5 Cruise Control System CCS installed O Byte 06 Bit 0 Start Stop System installed O Byte 07 Bit 3 Flexible Service Interval LongLife active Byte 01 Bits 0 2 01 Transmission Type Manual Transmission 05 Transmission Type Direct Shift Gearbox Dual Clutch DSG Byte 01 Bits 3 7 10 Transmission Gear Ratio 5 Speed 18 Transmission Gear Ratio 6 Speed 20 Transmission Gear Ratio 7 Speed X Byte 03 Bits 1 2 00 No OR Manual Climate Control installed 04 Semi Automatic Climate Control Climatic installed 06 Automatic Climate Control Climatronic installed Byte 04 Bits 0 2 00 Fan Control not installed Byte 04 Bits 5 6 2 4 10 Basic settings Basic settings will expect from
5. Remote Control Matching Enter the total number of keys including existing Press button Learn and wait for the procedure to finish Press and hold the UNLOCK button on every remote that should be learned for at least 1 sec ATTENTION All the keys must be adapted in one procedure Adaptation of all keys must not exceed 15 seconds Remote Control Erasing Press button Erase All Additional settings Se Chn 03 Auto Lock The doors will lock automatically when the vehicle reaches a speed of 15 km h or 10 mph O 0 off 1 on se Chn 04 Auto Unlock The doors will unlock automatically when the key is removed from the ignition switch O 0 off o 1 on Status pae x Number of keys en In the Instructions window within the Remote adaptation section will be available directions what should be done to learn remote controls Additionally there might be a Additional settings table where there will be listed all the applicable adaptation channels with their current values and description which are related to the remote controls function You can select the desired settings and press button Change to save them This function is available for Audi A3 S3 1997 Audi A4 S4 RS4 1995 2008 Audi A6 1997 2006 Audi TT 1999 Seat Exeo 2009 Seat Leon 2006 Seat Altea 2004 Seat Toledo 2005 Skoda Octavia 1997 Skoda Octavia II 2005 V
6. 32 30 38 36 5K092086 48 31 30 FF OF H10 FF FE FF FF 230s cscs of pe from s Read EEPROM Read Flash Write EEPROM m Immo Data VIN WWZZZ1 KZAMWT 90001 Serial number 00000000000000 Transponder identificators Read Immo data HI Write Immo data Serial key CS 8111fda5022390 KeylD1 ba373bi4 KeylD5 MAC 522e2c28 KeylD2 ba37c062 KeylD6 Tim Status OOFF KeylD3 a621df33 Keylb7 Att Key count 4 KeylD4 3ccd32b Keppa fffffff Add key PIN 51144 Done For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license 2 5 1 4 Special functions JCI with NEC uC and 95320 EEPROM The JCI with NEC uC and 95320 EEPROM special function is dedicated for the Johnson Controls instrument clusters with NEC microcontroller 95320 EEPROM and UDS diagnostic protocol After starting the function a following dialog will be brought to the user in the example below immo data is read JA with NEC microcontroller and 95320 EEPROM Y x r Mileage 17 Read write EEPROM Immo data R Read Write EEPROM EEPROM Load from Save to file r Immo Data VIN WVWZZZ6RZAY 123456 Read Immo data Serial number oras KO Ma Serial key CS e5
7. You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of EDC16 In the example below we read a part of the flash of EDC16CP Custom memory download upload Choose ECU type EDC16U1 v EDC16U1 Read EDC16U31 EDC16U34 EDC16CP EDC16CP34 EDC16C4 Master EDC16C4 Slave EDC16U1 Master Load from file Save to file EDC16U1 Slave EDC16U31 Master m Connection EDC16U31 Slave St Address 800000 MED9 5 10 MED9 1 Master Len of req fO ee ae Total sise 100000 Step D Encryption Download Upload C Read Write mem Session 0 Pa Exit In this dialog is needed to clarify the diagnostic session which you want to be entered before start of read program memory In the example above it is used session 86 If you want to save currently running diagnostic session simply enter session 0 Diag session 2 5 11 Special functions with Airbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Airbag x M Connection type Manual AUDI BOSCH 1997 2000 EE og AVDI BOSCH 2001 2003 po 00 ee 00 AUDI BOSCH 2003 th 00 n eee eee oo yW SIEMENS ALL p 00 eee eee eee Write EEPROM sR RRR RR RR 0 RR R R 8 5 TT br ETAETA ci b e maar Sav
8. 00000100 5C 78 1C 2B D2 D4 CF 01 E4 3E BO 64 01 44 6D 46 x gt d DmF Login HN 00000110 54 C6 9D 43 72 ED 60 FO AB 97 A9 56 28 AG 79 9A T Cr V y 2199 00000120 00 01 B9 82 FC 01 2B 3F 2D 43 68 7E 53 5B DO 61 2 Ch S a M re 00000130 FB 1C 9E 78 9C 3C SF 03 A4 36 4E 01 AD 08 70 00 x lt _ 6N p 00000140 FD 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 5920 00000150 57 41 55 SA SA 5A 38 45 35 35 41 34 35 37 33 39 WAUZZZ8E55555739 00000160 39 00 01 00 BA 00 96 00 74 00 5D 00 DA 02 6D 01 9 t m Immo Status 00000170 01 00 00 00 00 00 00 00 00 80 FF 7F 00 00 02 Ol 008 E 00000180 00 4A 9B FF FF 14 3B 00 00 00 32 46 50 73 7B 82 J 2FPs 00000190 00 16 2D 2D 46 5A 00 00 00 00 00 38 FF 00 00 00 FZ Misa 000001A0 00 00 00 93 63 OF 1E 00 00 00 00 00 00 9B FF FF Conooooo 00000180 45 04 80 9A OF FF 06 FF 04 OF FF 1F FF 30 30 87 E n ooooo 00 RB8 Crypto data read In order to transfer the keys you have first to read the EEPROM of the source instrument and when pressing Read keys they are saved into file Then you have to go on the destination instrument read its EEPROM and pressing the Write keys button then you will prompted for the file where the source instrument keys were read After selecting the key file you will be asked what information to transfer Select key data to transfer xj V Transfer leamed key IDs IV Transfer learned key co
9. CAN Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN S Function Learn keys Je ae For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer Prepare dealer key 1 Select Program Key and press Next The following window will appear LY ABRITES Commander for VAG x lol x Get component security from Engine Control Unit ECU Get component security from EZS Kessy EEPROM dump Get component security from EZS Kessy by OBDII requires to give ignition ON with working key Login 0 Component Security Bytes coon Jes ta You need to put the login and the component security bytes as described above 2 Press the Next button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned Learn key 1 Select Learn Keys 2 Press Next follow the instructions See Special functions with EZS Kessy CAN for additional information 2 5 13 12 Procedure 10 fo
10. Immobilizer Diagnostic nec VDO NEC 2009 gt DSG Mileage 9512 UDS 9512 Custom Read Write nam Magneti dash Component Previous Connect x Exit M X Steering lock adaptation e protection A FIN Converter Service interval when pressing ECU EEPROM the same dialog as in the Engine control unit is brought to the user and is possible to read EEPROM read mileage and make immobilizer bypass from here Not needed to select any engine type it is made automatically pressing Key learning will bring the Key learning dialog the user is not required to select a model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trouble codes etc to the immobilizer NOTE If the car doesn t have any working key it is not possible to give ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you ve a car without any valid key you will need dismount the ECU and connect it on the table or to connect the CAN wires of the ECU directly to the interface NOTE
11. lt The button Scan all will generate a file with all measurement values from all groups Measured Yalues Immobilizer II Channel m K L Variable Code authorized yes Key Status Transponder Lock fee Fixed Code authorized yes Immobilizer Status 6 0 Some important measured values The most used measured value is the key recognition in the immobilizer The key recognition is made on channel 2 if the Immobilizer is by CAN or on channel 23 if the immobilizer is by K Line The only exception is the Q7 A6 Allroad where the recognition is made also on channel 23 UDS modules Measured values provide you a possibility to check measured values by selection from a list Measurement Values i x Parameter Value a O Security Access number of invalid keys O Terminal 58 status Display dimming terminal 58d O Terminal 58 status Switch dimming terminal 58s O Terminal 58 status Dimmer duty cycle terminal 58st O Terminal 58 status Sensor for detecting light in the instrument panel insert WIV Total fuel level differences S diff 382 8 Liter WIV Cum total of fuel level differences Zd 1107 WIV Theoretical service interval 27700 Kilo Meter WIV Year s amount of driving 15720 Kilo Meter WIV Short term average of fuel level differences 6350 0 Milli Liter MI wiv Cum total of fuel level values 0 Outside air temperature displayed value 50 0 Degree Celsius O
12. A MALAKAR eee es lt di o a Ed ye rl CO90000 O E c pp mo YT E Thread boot 1000 Q Ground MH peas 111 4 9 6 ECU Vag EDC17 CP24 TC1796 with Internal and External Flash 4 9 7 ECU Vag EDC17 U01 TC1766 with Internal Flash S141711 TELTET RES WN WM AN gt lt Thread boo y kit isi vr L F OJ ea i 74 gt ae PEE e 4 9 8 ECU Vag EDC17 U05 TC1796 with External Flash gt a Ground 4 9 9 ECU Vag MED 17 5 1 TC1796 with Internal and External Flash o L gt U e e ABRA da Ned K 1000 0 RIT 311 re E 3 om En ee w 4 9 10 ECU Vag MED 17 5 2 TC1767 Internal Flash 9 were 4 ung oi iS 6 4 1 a e BA c e Ak gt 4 9 11 ECU Vag MED 17 5 5 TC1766 Internal Flash i eT OE re ga or e LE BUDO tt R R P RT YR VE HT G pry Poe ee A Fe E Winun KAY III T unue gig er AGA MT Putman EV EE 6 EN DAA ADA AR BANKING 4 9 12 ECU Vag MED 17 5 20 TC1766 Internal Flash Pin 68 CAN H TA Thread boot 4 9 13 ECU Vag MED17 1 1 TC1796 Internal Flash Pin 62 CAN H 1111 9 RUNNEN ESPI qx gt gt gt gt L gt
13. By pressing OK all changes in dump s data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license AN009 This function allows viewing and or changing the component protection data found into the EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool x Type ECU EDC16 Set component protection data 95320 v 12 38 FF FF 2D 31 32 34 FF 8 16 12 04 amp 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 00000040 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 00000070 42 00000080 20 Old oF x 00000090 00 GE 124 50 8 n 000000A0 00 A oooooogo az New o o o o o o o die 000000E0 24 F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 SA 43 rT VWZC 000000F0 5A 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 8A CD DA 00 00 00 56 57 5A 43 rl VUZC y gt ECU EDC16 Immo bypass 95320 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immob
14. ECU MED 9 x Security Code 7 Checksum calculator 95160 00 8 05 07 29 b 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 6 Seal 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 Load dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2a Swap bytes L H 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B3 T Toloccco 00000060 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2 Login 24895 00000070 E4 37 AS OB 37 AG 3C 13 00 01 00 00 00 BC F7 B3 T Todoccco 00000080 02 04 00 00 10 57 56 57 SA 5A SA 33 43 SA 36 45 WVWZZZ3CZ6E 00000090 30 30 30 30 30 30 56 57 54 43 54 30 30 30 30 30 000000VWZCZ00000 00000040 30 30 30 30 57 56 57 SA 5A SA 33 43 54 36 45 30 O0000UVWZZZ3CZ6EO 00000080 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A 00000 00000000 02 04 00 00 10 57 56 57 54 SA 54 33 43 54 36 45 WVWZZZ3CZ6E 000000DO0 30 30 30 30 30 30 30 57 5A 43 54 30 30 30 30 30 0000000WZCZ00000 OOODODEO 30 30 30 30 57 56 57 5A 54 5A 33 43 54 36 45 30 O0000UVWZZZ3CZ6EO 000000FO 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A 00000 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 00 Antas y gt Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset component protect
15. Repair RB4 DEF During the procedure the commander will read modify and write back the EERPOM memory to the dashboard After the fixed EEPROM is written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait for some time The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards security access code on channel 50 After the procedure finishes you have to learn all keys using the Key learning special function 2 5 4 Special functions with Engine Control Unit Special functions with ECU can be Read Write of flash memory Read Write the flash counters Read Write EEPROM Extracting security code PIN Immobili
16. Skoda Roomster 2007 OBDK TP08 Skoda Fabia 2000 2007 OBD TP08 Skoda Fabia I 2007s OBDK TP08 OBD CAN Megamos 48 Skoda Fabia II RS 2011 UDS Key programmer dealer ke Procedure 11 OBD CAN Megamos 48 Skoda Fabia Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Superb 2008 OBD K TPO8 Procedure 1 OBD CAN Megamos 48 Skoda Superb II 2008 UDS Key programmer dealer ke Procedure 11 OBD CAN Megamos 48 Skoda Yeti 2009 UDS Key programmer dealer ke Procedure 11 Seat Alhambra 1997 Rp 106 Seat Altea 08 2006 OBD CAN TP22 Megamos 48 Seat Altea 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Seat Altea 2009 UDS Key programmer dealer ke Procedure 11 1998 204 ogo TP08 Seat Cordoba eane Ep Seat Ibiza 2008 onk K not needed ie Procedure 1 OBD CAN Megamos 48 Seat Ibiza 2009 UDS Key programmer dealer ke Procedure 11 Seat Leon 2003 OBD K not needed ea Procedure 1 08 2006 OBD CAN mea Megamos 48 Seat Leon 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Seat Leon 2009 UDS Key programmer dealer ke Procedure 11 Seat Toledo 203 oap a Seat Toledo 08 2006 OBD CAN PA HE 2 sete ez ope seem ie os Seat Toledo 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 tn ae senn ut Seat Toledo 2009 UDS Key programmer dealer ke Procedure 11 wu mos Procedure pg gs a E VW American Fox 2003 OBD CAN Key programmer dealer
17. This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Phaeton Porsche Cayenne and Bentley Continental The function also displays the learned keys and visualize change the immobilizer and VIN numbers Dump Tool Xx Type IMMO KESSY Audi 48 Yw Touareg VW Phaeton Porsche Cayenne Bentley Continental 93086 Load dump Save dump Swap bytes L H 00000040 00 OF OE 4B 33 44 30 39 30 39 31 33 35 46 20 D7 K3DO909135F 00000050 35 57 4B 34 37 30 32 31 DA 56 42 52 42 34 78 DA 5WK47021 VERB 4 h 4 00000060 56 42 52 42 34 78 DA 56 42 52 42 34 78 05 04 00 VBRB4x VBRB4 gt 00000070 00 FF 05 02 00 02 FF Ol FF FF FF FF Ol FF FF FF o oooocooo Login BER 00000080 FF 01 FF FF FF FF Ol FF FF FF FF OL FF FF FF FF o oooococo I 00000090 OL FF FF FF FF 01 FF FF FF FF OL FF FF FF FF 02 oooooocooo S O00000A0 01 70 56 57 5A 33 5A 30 43 31 30 33 34 34 39 30 p wz3z0C1034490 VWZ3Z0C1030000 00000080 01 00 00 00 OG 00 00 00 29 OG 23 05 OB 00 07 03 ES AA an 000000co 01 00 00 00 01 00 00 OG 01 00 OG 00 01 00 00 OG eee e ees R E 000000DO 01 OO OO OO 01 OO 00 OO 2D 7A AO FO 7B 9B FO 72 RLE WWGZZZ7LZ3D010000 000000E0 9C FO 83 A3 FO CE 65 90 FO 65 90 FO 00 00 00 00 EE Q00000FO 00 00 01 00 OG ES EB E3 7D 35 AE FO C2 2B 41 75 15 Au 00000100 F6 BO 80 4B 01 00 7F 7E 01 00 99 2C 6C 01 00 00 K 1
18. VW Polo 2006 Seat Ibiza 2006 Key Learning Standard Mode From Special functions Key Learning Standard Mode choose vehicle model Key learning xj Vehicle model Audi 44 46 1997 external immobilizer box Kw1281 v Seat Toledo CAN New key count ERR EI een Er et gets Skoda Octavia Il 2007 CAN Skoda Octavia Il 2007 CAN skoda Superb k ine diagnosis KW1281 Skoda Roomster k line diagnosis Kw1281 Skoda Scout CAN Skoda Fabia 1999 external immobilizer box Kw1281 1 1 Enter security access code and the number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining key stopping to work You will be asked whether you want to use this feature Please answer with yes no according to your wishes 1 5 Wait until adaptation finished is displayed 1 6 Remove the key and turn ignition off with all remaining keys NOTE The system will autodetect whether it is possible to add the key without erasing the remaing keys If possible and if 1 key is selected then and only then a message will appear where you ve to confirm that you want to add the key If you press No here the key will be learned normally other keys will be erased If you select other than 1 key to learn or if adding is not possible than the key will be learned normally with erasing other keys which a
19. that it is not available in all diagnostic sessions Urgent point for this diagnostic service is that most of electronic control units updating its internal memory when ignition is turned off and current diagnostic session is closed Example are engine control units BOSCH EDC16 2 4 15 Custom download upload Custom download upload allows direct reading from the address map of the device This option will be available only if you have some updates in your configuration like e g Reading writing the flash counters Take into account that in most cases a security authorization is required before you try to read write into the address map 2 4 16 Component security This special function allows managing of brand new units and immobilizer units where is allowed programming of PIN SKC BGW MAC Functions are under CAN TP2 0 2 4 17 Active diagnostic session Default diagnostic session established after connection to the unit is 89 User can request entering in a different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session 89 Take into account that in most cases different diagnostic sessions require security authorization Diagnostic session EJ Enter 2 5 Special Functions Special functions are some specific for electronic control units application which will allow you reading security access codes read program EEPROM flash content and so on Spe
20. transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC Press Next to start the key learning procedure 2 5 13 3 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN You must use Keys or transponders TP05 TP08 TP22 TP23 TP24 Note some of the new vehicles need to remain with ignition ON five minutes before starting of the key learning procedure VW Golf5 Skoda Octavia II VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with ignition ON until programming becomes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007
21. we m To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work 2 5 13 14 Procedure 12 for vehicles with Visteon dashboards Normally the Visteon dashboards are build in the VW Golf V models So if the car is with Visteon dashboard the software recognize the type automatically The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VN4 For this dashboard type normally the a Megamos 48 Crypto transponder should be prepared as a dealer key and then learned to the car Fortunately it is possible to read the PIN and all 7 bytes of CS from the Visteon dashboard Key Learning Standard mode If you press Autodetect Login Security code will read the PIN code And pressing the program dealer key will read the 7 bytes of CS and program the transponder without opening any other dialogs After the dealer key is ready you need to learn it to the car by pressing Learn button with the respective PIN code entered If by some reason the S
22. 2007 CAN Skoda Octavia I 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Skoda Scout 2007 CAN Porsche Cayenne CAN VW Crafter Audi A4 2002 KW2000 New Beetle KW2000 Function Produce TP22 TP23 TP24 TP25 transponder Back Next gt Exit Learn Keys Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key 1 Press Next 2 Follow the instructions 2 5 13 5 Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN Normally most of the newer cars require a transponder which is precoded with the VIN number from a dealer Fortunately it is also possible to precode the transponder by yourself using the Key programmer if you have available the 7 bytes of the component protection data and you need to use an Megamos 48 transponder as base for this operation NOTE The Set transponder type combo box specifies what kind of dealer key to make for VW Seat Skoda or Audi As base for this operation is used Meg
23. 30 33 47 39 30 36 30 32 31 41 u 036906021A O00000BO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 05 EDC 00000000 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 09 FR GE jris senasis n OOODODEO 24 F3 C5 72 49 E BA CD DA 00 00 00 56 57 54 43 rl VWZC OOOO0OFO SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 6A CD DA 00 00 00 56 57 5A 43 rl VUZC gt Checksums in the file updated Press the Save button to save the changes ECU MED 9 x Reset component protection data 95160 Required license AN009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool ra x Type ECU MED 9 x Reset component protection data 95160 v 97 ES 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 amp FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05
24. 47 05 07 29 1 6 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt eee 00000060 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 21 gt 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt eee 00000090 Q00000A0 Old D4 5 ES 37 las lB 0 ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool xi Type
25. 4F0905852B 31 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ooooo 000000BO 33 30 35 32 31 30 30 39 33 31 38 31 32 31 35 30 3052100931812150 v Load from file Al t This special function is dedicated for Q7 A6 Allroad models and the user has the following possibilities Learn a key Learning a key requires in most cases a preprogrammed using VIN key which normally should be purchased from the VW Audi dealer Only models with EZS Kessy with SW version till V2 0 2 it is possible to learn an empty clear key For models with EZS Kessy over this SW version it is required to have a dealer key purchased from the dealer or create with our programmer Read the EZS Kessy EEPROM 2KB Write the EZS Kessy EEPROM 2KB but without an area of 96 bytes with the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so it becomes like a dealer key IMPORTANT To make any activity with the EZS Kessy you need one of the following to know the login PIN of the car and the first 6 bytes of the component security bytes The component security is normally 7 bytes but the 7 byte is not required The login and the component security bytes can be read normally from the ECU This is true for all cars with EDC16x MED9x ME7x EDC17 MED17 ECUs The login and the component security bytes can be read manually from the ECU from the customer using the Engine cont
26. Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN S Function Learn keys Add Key Program Key Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key Vehicles before 2007 1 Press Next 2 Follow the instructions Vehicles after 2007 1 Press Next 2 The following window will appear giving you to select from few options lolx Select an option Manual Input of the Component Security Bytes Autodetect Component Security Bytes gt Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 ow Je em Sel
27. Fahrer amp Beifahrer C Generation 2 All other modules of Audi A6 2004 and A4 A5 Q5 2 5 5 1 Component protection generation 1 For the Component protection generation 1 the customer has to select the module which want to adapt im i Sa Select device to adapt Control Head MMT i 2004 2009 Central electric ILM Fahrer i 2004 2009 Media Player 1 MP3 CD Changer i 2004 2009 Auxilary Heater i 2004 2009 ILM Front passenger ILM Beifahrer i 2004 2009 Instrument Cluster i 2003 2006 Seat Memory Passenger i 2003 2010 Memory module driver s seat i 2003 2010 Currently for the most of the modules is needed first to read with a programmer the internal EEPROM for the MP3 CD Changer the internal flash If it is not necessary to read the flash the Load dump will be not active and the user can proceed with the next step A8 2003 2010 only If a module for A8 2003 2010 vehicles is selected there is one additional step The customer has to connect 3 wires from the AVDI DB25 connector to the vehicles CAN H CAN L and Ground There is wiring diagram how to connect exactly The user has to connect to the organge green CAN H and orange brown CAN L wires Additionally also the GND and 12V should be connected The most easiest way is to disconnect some connector e g the connector of the module under the driver s seat and to put there the two wires from the AVDI The ground of the AVDI can be connected
28. For the key learning it is needed to give ignition with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock but the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to make ignition ON with each key which you want to learn NOTE Sometimes during communication with the immobilizer it is possible to lost communication with it so you will need to repeat the procedure in this case 2 5 13 Special function Key learning Inside every key there is a small chip called a transponder In most cases this chip doesn t require an external power supply but is supplied from the magnetic field which induces electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general there are five different types of immobilizers transponders used They are called Immo I Immo II Immo III Immo IV and Immo V Systems from Immol till Immo III require simply that a transponder from the proper type is found inside the key and they are able to learn these transponders Starting from Immo4 it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside ther
29. Key and press Next The following window will appear ixi Select an option C Manual Input of the Component Security Bytes amp Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key aa Oo Component Security Bytes 0 0 0 0 0 aw Je et 2 Select the desired option and press Next If you have chosen Autodetect Component Security Bytes the commander will read the PIN and all 7 bytes of CS from the Visteon dashboard If by some reason the SW doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7n byte After all 7 bytes of CS are available the key will be programmed as dealer key To learn key 1 Select Learn Keys and press Next 2 Supply Login code and press Next 3 Follow the instructions 2 5 13 15 Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9S12 microcontroller These are typically some models
30. MMI up to July 2006 eAudi A8 S8 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A6 S6 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 eAudi A8 S8 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 x Speed Limit km h oter E Use the following rule when enabling TV if the car is before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is after 2007 it is better to try at first with edition 2 2 5 10 Special function Custom memory access Download Upload ReadMemory The Custom memory access Download Upload ReadMemory functionality is available from the Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access enter into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES Commander for VAG Using this application you can read program memory in some electronic control unit Requests sent from this application can be related for the currently running session of for some of electronic control units from the dialog
31. Production date G 16 10 03 Changes from supplier S as Number of validation status 1001 Current supplier s number E 3DEF Flash Programming succefull ready for driving Programming attempts O Succesful programming attempts 0 Status of conditions for programming 0 Flash Tool code 0x000000000000 Flash date 23 05 03 2 4 4 Read Diagnostic Trouble Codes Read DTCs will display all present errors in master and slave units Displayed errors can be together with freeze frame data this depends on the checkbox Read Freeze frame Status Permanent error 18038 Accelerator Position Sensor G79 Signal too Low Status Permanent error 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Sporadic error mechanical error 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Permanent error lower limit exceeded 2 4 5 Clear Diagnostic Trouble Codes Clear DTCs will clear all stored DTCs inside of the unit 2 4 6 Measured values Non UDS modules Measured values provide you a possibility to check measured values in different groups You can enter manual number of the group or use to increment or decrement the group number Measured Values Power Supply Voltage Terminal 30 Voltage Status Terminal 15 Status Terminal 15 ON S Contact Status activated Channel EN
32. Q5 after 2007 also A6 A7 A8 2010 Touareg 2010 In the beginning the customer has to select the model aars oom vis ae E Select car type C Audi A4 A5 Q5 ATTENTION Strongly recommend to have a working key from the car If you don t have a working key and want to add new key the new one Bee ea ES will be learnt but it is not sure that it will start the car Please first put working key in programmer and press Read working key The models are divided in two groups Audi A4 A5 Q5 not necessary to have a working key Audi A6 A7 A8 VW Touareg request to have a working key or key purchased from dealer If you will learn a blank key it is necessary to put the working key in the programmer and to press Read working key If you will re learn the existing keys or will learn a key purchased from dealer i e without programming blank keys it is not necessary the press Read working key After selecting the model the procedure is identical for both groups P REC oe ON ke Step 1 Check BCM type Connecting to EZS Kessy Entry And Start Autorization OK Reading identification VAG N 8K0907289C SW0253 Key count 1 Key authenticated Yes Key locked Yes Key learned Yes Read BCM2 by OBDII C Read BCM with programmer with ABPROG C Alarm OFF C Alarm ON K This special function offers following options Making keys for these vehicles requires to read the BCM2 mo
33. added aa ABRITES COMMANDER For VAG 18 x Document number 2 20071127 Date 01 06 2013 RA of Revisions Chapter 19 06 2012 27 11 2012 18 12 2012 pe __ Lo ta ME J m Dr vr Update to V18 0 of the software EDC17 MED17 bootmode added EDC17 MED17 readingby OBDII added Adaptation of EDC16 EDC17 MED9 MED17 description changed Adaptation of Passat B6 comfort module added EDC17 MED17 wiring diagrams added in appendix Version 2 31 3 ABRITES Commanper For VAG 18 x Document number 2 20071127 Date 01 06 2013 Te INTRODUCTION E EE T AAE soegasedenst son secseudsensdopeasesendusbecesassvedecs vvssnesassccsasecesesecseasced 8 1 1 INSTALLING ABRITES COMMANDER FOR VAG T 8 2 DIAGNOSTIC WITH ABRITES COMMANDER FOR VAG sseeneeeneenesnneenssnnennesnneenennneennennennsennennnenneennenneseneeneeene 9 2 ls CONFIGURATION 25 24 se rep cd id 10 DAT Used protocolskan skr Hs fot A Ga kabareten 10 21 2 Interface detect Oni eisai sis csc tech ee spisst a E 11 2 1 3 K Line baud rate Setinggi 11 DAASLIMINE parameters oni teea eatae eee eee aars 11 DADA Limes PIN a ES O 11 DAO SCAN T tddi dali ta 12 22 SCANNING UNS ee Hardee 12 2 3 BROADCAST REQUESTS he 13 2 4 STANDARD DIAGNOSTIC REQUESTS 43 csisesassicscetsvvepusstonrsodevcyuceessdfonvevecvedtca ZRI ER de alta 13 LALA dC ON sassanidene 14 2 4 2 Software and Hardware version of the unit srorronronrvnronnvnnnnrnrnnvnnnrnrennennenreneenesvernrrnneners
34. and read EEPROM Currently for the software versions we know the login can be located as described above and the mileage starts from address OxAA to address 0x1C8 marked in the picture below 00000000 00000010 00000020 00000030 00000040 00000050 00000060 00000070 00000080 00000090 00000040 00000060 000000C0 00000000 O00000E0 000000FO 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 00000180 00000190 00000140 000001B0 000001C0 40 FF OD 85 FF O00001D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF O00001E0 JEF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 4 1 3 VW Passat usually these Instruments are before year 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed mileage is displayed as 0 4 1 4 VW New Beetle First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 1 and read EEPROM The login is not displayed The mileage is displayed as 0 4 2 Porsche Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox 4 3 Audi A8 fusebox passenger side wakeup ECU sey ease
35. bytes but is 12 bytes The first 6 bytes are these which you read from the ECU or the EZS but the second 6 bytes are available only in the EZS So you should put here the values which are displayed when you read the EZS or it is more easily if you load the EZS dump for the car to which you will adapt the transmission gearbox 2 5 8 Special function Steering lock adaptation The window Steering lock adaptation can be used for adaptation of steering lock control module to the VW Touareg VWPhaeton Porsche Cayenne Bentley Continental Audi A8 This adaptation can be by CAN TP2 0 or K KWP2000 To perform this adaptation you need to know the security access code of the immobilizer and working aligned key from the car 6 ABRITES Commander for YAG 10 x Procedure Replace align Steering column lock using PIN The complete system consist of the following Steering column lock control element EZS Kessy control module Engine management control module master slave Up to 8 vehicle keys Only with this the procedure Steering columng lock control element can be aligned Do you want to continue Press NEXT to continue or EXIT to exit to leave the operation 2 5 9 Special function MMI TV activation Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF Covered vehicles are eAudi A3 S3 eAudi A6 S6 MMI up to July 2006 eAudi Allroad
36. code which is contained into the ME unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0x120 bytes because after that area the EEPROM sections are different for each different software version of the ME7x unit Fortunately the most of the interesting data are found in this section IM j x Type ECU ME 7 x Security Code Checksum calculator 9P08 95080 v Z 050203Z seine Ca i Swap bytes L H Login 44246 SA S 55 55 34 34 58 58 45 45 33 33 38 38 S 5A 33 33 30 30 30 30 31 31 30 30 33 33 37 37 31 31 39 39 34 34 35 35 34 34 41 41 33 33 00 oo 00 oo EC EC E4 E4 FC Z4E83N0075954 FC Z4E83N0075954 FC UX3Z0C1310443 FC UX3Z0C1310443 rf 43 43 Checksums in the file updated Press the Save button to save the changes ECU EDC15 Immo bypass 24C04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool p x Type ECU EDC15 Immo bypass 24004 v A Swap bytes L H Toggle Immo On Off Immo is now OFFI The Toggle Im
37. having a component protection e g DSP Climate Control the customer can adapt the component protection only if he have the Gateway EEPROM dump from the car from which the replacement module is taked Audi A4 A5 Q7 2007 In these vehicles the customer is able to adapt the instrument cluster When the special function Component protection generation 2 is started the system is examined and all modules with available component protection are displayed A ABRITES Commander for VAG This functinality allows the customer to adapt used parts on other cars In general this requires following steps 1 Reset the module to virgin state 2 Adapt the module to the vehicle you want A EEE NS EZS Kessy Entry And St Adapted to car Connecting to EZS Kessy Entry And Start Autorization OK Airbag Adapted to car Connecting to Airbag OK Instrument Cluster Adapted to car Connecting to Instrument Cluster OK Feste F rde Cam Prot M Connecting to Central Electic OK Connecting to Comfort module vehicle el System SG OK Comfort module vehicl Adapted to car Connecting to Memory module driver s seet Failed Climatronic Auto HVAC Adapted to car Connecting to Climatronic Auto HVAC Connecting to Auxilary Heater Failed Connecting to Seat memory passenger Failed Connecting to DSP Failed Scan finished From the displayed list of available modules the customer has to select the module whi
38. is able to send broadcast requests to all devices with request to enter into a desired transport mode to clear all DTCs in all devices to disable enable the communication of all devices This is done by pressing the corresponding button from the CAN Broadcast panel Available functions are Transport Mode Entering into or leaving the vehicle from Transport Mode that is used by the factory to put the cars into a sleep to conserve battery charge during long periods of inactivity Disable Normal Communication This function will disable all communication between units in the car This can help you to hold current state of the car and to prevent disturbing of communication while re flashing Enable Normal Communication Restore normal message transmission Clear All DTC s Sending requests to all units in vehicle to erase its DTCs 2 4 Standard diagnostic requests When double clicking on the desired device in the main ABRITES Commander for VAG window you connect to the device to proceed standard diagnostic requests The following dialog is opened Ix YIIG Engine Control Unit Master fewp2000 Rx Tx Establishment diagnostic session with selected unit electronic control unit identification Device N l 070906016BL lt VAG number PROGRAMMABLE Program status 7 data status OL Coding 11172 Part number 56823 Importeur s number
39. produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally when you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the Magneti dash UDS 9512 special function because the key functionality for that vehicles is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand MMT or MM5 So for such cars open the Magneti Dash UDS 9512 special function and the following dialog is brought to you Magneti Marelli UDS with 9512 Microcontroller x Magneti Marelli Dashboard with Motorola 9512 microcontroller and UDS diagnostic protocol To make a key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press Add key After several seconds the key will be ready The learned key will be added to position key_count 1 Le if you want to erase all existing keys and program one new key first put 0 for the key count and then make the key ABS coding gt Read write EEPROM Flash Set EEP me Read Flash I Mileage z Write Mileage fO ileage Immo Data J I Serial number pO Transpon
40. reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for the first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool 2 2 Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you ve to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer 2 3 Making the key in the case when the Autodetect button is not functioning It is possible that by some reason the Autodetect butto
41. string Error during the procedure is in progress Repair RB8 DEF After the fixed EEPROM is written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait for some time The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 and then will allow you to choose whether you like the commander to recover the old learned keys or you will learn all keys again by yourself using the Key learning special function Depending from your choice it will recover the old keys or not and finish the procedure If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards security access code on channel 50 After that you have to learn all keys using the Key learning special function
42. the case when Autodetect is not functioning It is possible that by some reason the Autodetect is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e g by dis soldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and press Next Learn keys 1 Turn ignition ON dealer key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next put down count of keys to leaern then follow strictly the recommendations 2 5 13 11 Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 It is possible to program a key for the Audi A6 Q7 Allroad but this function is not located in the key learning Standard mode It is available in the key learning Wizard mode The function is also available in the EZS Kessy A6 Q7 function from the Special functions list This is so because it requires separate license If not using key learning Wizard mode please refer to section Special functions with EZS Kessy CAN Key learning Wizard mode Y ABRITES Commander for VAG 0 x Select vehiclelimmobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 Program Key Audi A6 Allroard 2005 CAN Audi Q7 2005
43. you ll be shown list of possible long code coding to choose Vilt ABRITES Commander for VAG i loj x Select device Select coding Engine Control Unit 3C8 920 xxx 6 digits code value 4F0 920200 2 x 22 digits code value Gateway 4L0 920 xxx xxx 22 digits code value Central Electric 5K0 920 gt 00 lt xxx 6 digits code value Comfort System 8R0 920 gt 00xxx 22 digits code value Parking Assystant 8T0 920 xxx xxx 22 digits code value Door Control Audio System Radio Navigation Steering Control Trailer Recognition lt Back Next gt Exit Select the appropriate coding and press Next VIG ABRITES Commander for VAG I0 x I Select all Central Electric Seat Altea 42 digits code value Coding information CO Front Fog Lights installed O Xenon Headlights with Shutter installed O Lighting system PR Q0Q4 O Daytime Running Lights Scandinavia active O Daytime Running Lights North America O Driving lights O Driving lights O Coming Home active O Rear Seat Recognition installed O Headlight Washer installed PR 8x1 vi Coding information Headlamp washer delay after power on Default 51 ms 55 Headlamp washer time to excite the default 230 ms 00000 00000000 100000000000005c Show Coding Value Show Coding Value valua aow JJ em In the opened window you can check un check the desired features see list with check boxes in the above picture modify cer
44. 0 00 03 57 00 03 62 5A FF FC B2 56 FF 00 43 86 00 W bZ V C 00000080 43 82 00 ECU component protection data 00000090 FF 00 02 000000A0 AS FF FF Load ECU component protection data from dump 00000050 FF FF FF DODODOCO FF FF FF Load ECU dump 000000D0 FF FF FF DOOOODEO 57 34 32 Cancel 000000FO 30 50 30 Enter component protection data manually 00000100 FF FF FF 00000110 FF FF FF 00000120 FF FF FF 00000130 FF FF FF Load dump from EDC16 ME7x MED9x uncrypted Simos PPD Simos FSI 00000140 FF FF FF 00000150 FF FF FF 00000160 FF FF FF 00000170 FF FF FF 00000180 FF FF FF 00000190 FF FF FF 00000140 FF FF FF 00000150 FF FF FF E E EN umber The function also visualize change the immobilizer and VIN numbers Type Dump Tool xj Comfort module component protection data Passat B6 v oo 00 00 00 00 00 la 00000010 83 62 2D 2D 2E 2D 2D 2E 2D 2D 33 43 30 39 35 39 b 3C0959 00000020 34 33 33 48 20 20 30 34 35 33 33 43 30 39 35 39 433H 0453300959 00000030 34 33 33 48 20 20 20 FF FF FF FF 03 80 FF FF FF 4393H a Load dump 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF oooooooo 00000050 FF FF FF FF FF FF 7F FF FS 7F FF FF FF FD FF FF oooooo 00000060 5A 5A FE BS 47 14 FE 00 03 63 00 03 64 00 03 56 ZZ G C d V 00000070 00 03 57 00 03 62 SA FF FC B2 56 FF 00 43 86 00 W bZ V C Save dump 00000080 43 82 00 43 8
45. 00 00 56 57 54 43 rl VWZC y L Immo is now ON The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Security access code Checksum calculator 95320 Required license None This function displays the security access code which is contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section Dump Tool i e x Type ECU EDC16 Security access code Checksum calculator 95320 v FF 8 16 12 04 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 Swap bytes L7H 00000040 00 06 05 00 04 24 10 75 A6 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 00000060 00 04 24 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 03G906021A in 52698 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 01 EDC Login 2 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 Has 00000090 00 00 00 00 OG 00 00 00 00 00 OO 00 00 09 F 6E n 00000040 00 04 ZA 10 75 A6
46. 00 30 00 60 00 DS OO 50 01 B8 02 EO 02 0 P 00000160 EO 02 00 00 57 00 34 01 1C 02 FA 02 81 05 CB 05 W d 00000170 CB 05 27 08 18 00 30 00 60 00 CC 00 38 01 78 02 0 8 x SN 00000180 90 02 90 02 00 00 57 00 34 01 1C 02 FA 02 81 05 SEE pe RK WAUZZZ4DZYN002822 Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s data and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump You should use transponder TP08 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Keys data E x Status fou can enter manually a key in certain position or you can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to dump Cancel After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi A3 A4 A6 UKNSI 1995 1997 mileage and login code 93C56 displays t
47. 0000 Ox13fff OPT Protect 0x14000 0x17fff Protection installed YES Internal flash size 2048 KB EEPROM size 128 KB External flash not available Operation finished with SUCCESS Then you should select the proper microcontroller and connect to it Once connected the user has information about the flash EEPROM size and protection and has the ability to read write EEPROM Dflash read write Flash Pflash Get PIN CS MAC for the engine control unit ETS A AA Read PIN CS Fedje 7 06 09 17 0 rom dump 09 4 8 37501956 10 Read Write EEPROM EEPROM Read Int Write Int FLASH FLASH PP PP D Q G 7 z Read WVWZZZ1KZAW111 FLASH FL 1 VW2221KZAW1111 Gavate fa file os E Operation finished with SUCCESS If the user press Read PIN CS the PIN component security and MAC will be displayed to the customer PA EDC17 MED17 Flash EEPROM read write e _ Operation in progress please wait CS 36 67 4F 60 6C CE 00 PIN 50990 MAC AA D9 FB 64 Immo status Normal learned Operation finished with SUCCESS The Immo status can be Normal learend this is the normal operation mode of the engine control unit i e adapted to vehicle Bypassed This engine control unit has Immo bypass and can start no matter whether the immobilizer recognizes the engine Virgin This is brand new engine control unit whic
48. 000UVWZZZ OOO000A0 33 43 5A 36 50 31 31 31 31 31 31 57 56 57 54 SA 3CZ6P111111WVWZZ 00000050 54 33 43 SA 36 50 31 31 31 31 31 31 57 56 57 SA Z3CZ6P111111WVWZ 00000000 5A 5A 33 43 54 36 50 31 31 31 31 31 31 00 00 00 Z23CZ6P111111 O00000DO 7C 7C 37 30 31 30 30 33 47 39 30 36 30 31 38 20 7010036906018 000000E0 20 20 00 00 00 00 AF 50 AF 50 AF 50 98 24 85 AA POPES te OOOOOOFO 76 55 F4 8A 85 51 84 9B 80 3B 81 09 81 08 83 w Q 7 N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 y gt ECU Magneti Marelli Security Access Code 95320 Required license AN003 This function displays the security access code contained into the engine control unit from Magneti Marelli Dump Tool a x Type ECU Magneti Marelli Security Access Code 95320 Load dump Save dump Swap bytes L H Login 4152 ih 4 00000090 30 33 43 39 30 36 30 32 34 48 20 20 30 31 31 38 03C906024H 0118 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000000B0 00 00 00 00 00 00 00 00 55 AA 33 CC 50 90 09 08 U 3 P O00000CO 38 00 06 04 07 AA DS SF 27 70 FF FF 00 00 00 FF 8 B lt lt sss s DOOO00DO FE FF FF OFFSET FF FF FF FE FFOFF OFF FE FF FF FF coria Raa 000000E0 01 00 03 00 46 55 38 10 13 73 3C 8C CC 42 00 00 US 3 lt B O00000FO 10 73 38 10 13 73 3C 8C CC 42 00 00 10 73 38 10 s8 s lt B s8 00000100 13 73 3C 8C CC 42 00 00 10 73 53 45 54 37 54 30 3 B 85
49. 0190 00 00 00 00 00 00 00 00 00 00 00 00 00 F4 FC AD oooooooooo 00000140 07 02 00 00 OE 2C 7A B6 05 00 00 00 27 BF OO OO Zo o 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 F4 FC AD ooooooooo 5 gt Immo is now ON K ECU ME 7 x Set component protection data 9P08 95080 Required license AN009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool Type 05 05 04 04 07 oo 05 os 20 OL OL ol ol DZ 00 04 04 20 0l 0l D6 D6 80 67 22 22 20 oo 00 AC AC DZ DD 09 09 20 43 43 DS D8 EO 09 09 09 D8 DS oc oc 0l OE oo oo S 71 71 2D 2D 06 oo 06 06 EF oo 1C 1C Al Al oo oo os 05 12 oo oo BO BO 28 18 oo oo 30 oo oo 18 18 04 03 oo oo 35 69 69 5B 5B 58 oo FD FD 30 Cl Cl oo 00 OD oo 2D 2D ECU ME 7 x Set component protection data 9708 95080 32 oo 00 oo 00 07 oo oo oo 30 AS AS 00 00 00 00 46 46 33 81 80 Al AQ Fl 41 41 Component security data E H E fo fo j fo fre fs E EE EEE ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access
50. 2007 CAN Porsche Cayenne CAN New Beetle KW2000 Lamborghini Gallardo 2005 KW2000 Audi A4 2004 RB8 dashboard KW2000 Lamborghini Gallardo 2005 KW2000 VW Touareg K Line KW2000 VW Phaeton Bentley Cayenne K Line KW2000 Audi A2 1997 k line diag KW1281 Audi A3 1997 k line diaa KW1281 Function Learn keys Authomatic read of Login code Back Next gt Exit VW Crafter Audi A4 2002 KW2000 To learn a key you must either have a dealer key purchased by VIN number or prepare it To prepare a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Select Program Key function and press Next Enter key count x Key count 0 Put how many dealer keys you want to program and press OK The VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can learned it using Learn Keys To learn a key Select Learn Keys function and press Next Put how many dealer keys you want to program and press OK Follow the instructions Before the procedure is finished on the display of the instrument is displayed L7 x y where Xx is the number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the
51. 211 Supplier number 137 System description RS 2 5L EDC G0005G Diagnostic requests V Read Freeze frame Security S Diagnostic session Identification Read DTCs ewes SW IHW Gen Clear DTCs Adaptation Measured values This dialog provides you the possibility to execute the following diagnostic requests 2 2 4 1 Identification Identification will provide you the VAG part number and software coding 1 electronic control unit identification Device N l 4F0910401L lt VAG number PROGRAMMABLE Program status 00 data status 20 Coding 11772 Part number O Importeur s number 0 Supplier number 0 System description 3 0L V6 TDI GOOOAG 2 4 2 Software and Hardware version of the unit SW HW version displays if the service is supported by the corresponding controller the SW and HW version of the unit including all slave units of the master unit SU HW version SW version of module 1 K2 6 9 SW version of module 2 DZ 6 9 SW version of module 3 M2 6 9 SW version of module 4 44 7 6a SW version of module 5 XPQ35 V19 OZ Hardware number gt 1K0907951 2 4 3 Extended Unit Identification Extended identification VIN displays programming data flash status programming attempts flash date VIN number Part serial number Z100103AL63DEF Supplier identification A TF74035
52. 3 00 43 84 00 43 85 SA FE 79 62 44 C C C C Z ybJ 00000090 FF 00 02 69 00 07 65 NN N 66 NN n2 AT NN N 68 i e f a h ooooooao AS FF FF FF FF Fe s An x 00000050 FF FF FF FF FF F 000000C0 FF FF FF FF FF DOOOOODO FF FF FF FF FF DOODODEO 57 34 32 31 38 000000F0 30 50 30 30 33 00000100 FF FF FF FF FF 00000110 FF FF FF FF FF 00000120 FF FF FF FF FF O Component security bytes are D9 72 52 79 B2 E4 44 AA tt o a o a a oa Immo number VWZCZ000000000 00000170 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF seeeeeeseees se 00000180 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ccocoocco 00000190 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eseeeeeeeees O OO0001A0 FF FF FF FF FF FF FF FF FF 000001B0 FF FF FF FF FF FF FF FF FF Component security bytes are D9 72 52 79B2E4 44 Pressing the other data displays the learned keys and allows several operations if a programmer has been recognized allows to read current transponder s data add it to the dump and if transponder s type is appropriate allows to program it as dealer key allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition Comfort module keys E x Comfort module keys data write keys to comfort module dump You can enter manually a key in certain position With pressing OK keys data will be written to comfor
53. 3 07 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B SL Save dump h 4 Swap bytes L H Login 55 vannene 00000050 33 30 35 32 34 34 37 33 32 30 30 31 32 30 36 30 3052447320012060 0330101035330 vanner s s s s Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts an ECU dump from EDC16 PPD1x MED9x and ME7x ECUs Dump Tool y i x Type Comfort module component protection data Passat B6 v oo 00 00 00 00 00 00 00 00 AS 00000010 83 62 2D 2D 2E 2D 2D 2E 2D 2D 33 43 30 39 35 39 b 3C0959 00000020 34 33 33 48 20 20 30 34 35 33 33 43 30 39 35 39 433H 0453300959 00000030 34 33 33 48 20 20 20 FF FF FF FF 03 80 FF FF FF 433H ee eee eens 00000040 FEEF FF FE EF EE FF FE FEEF EE FE EF EE EF FE como ass 00000050 FE FP EF FE EEF FE UF FE FO GF EF OFF EF PD ET FE 0 0 0000 0 00000r000000 00 00000060 5A SA FE BS 47 14 FE 00 03 63 00 03 64 00 03 56 22 G c d 0000007
54. 37d3ffca6f01 KeylD1 ccfefc15 KeylD5 ffffffff daa MAC so2t0000 KeylD2 6fal2713 KeylD6 Tmn Status 140000fedd KeylD3 1ab48ef4 Keylb7 ftffffff iguration 210106330100 z lt mm mmm Configuration 01 YW KeylD4 KeylD8 Abd FIN 112345 E Done Press button Read mileage to read current mileage value Press button Read EEPROM Write EEPROM to read write EEPROM data Press button Read Immo data for reading the Immobilizer data After Immobilizer s data is read you can make modifications and write it back using Write Immo data button After Immobilizer s data is read you can add a new key Pressing button Add key will prepare dealer key add it to the immo data and write the new immo data to the immobilizer 2 5 1 5 Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM The A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM special function is dedicated for the A8 4H A7 4G A6 4G Touareg 7P instrument clusters with 95320 EEPROM and UDS diagnostic protocol After starting the function a following dialog will be brought to the user A8 4H A7 4G A6 4G Touareg 7P UDS dashboard 95320 Read EEPROM Load Dump Modify Dump Write EEPROM Save Dump Mileage jo Press button Read mileage to read current mileage value Press button Read EEPROM Write EEPROM to read write EEPROM data using ABPRO
55. 5 2 Component protection generation 2 2 5 53 Reset to VITCIN Sale eee ENES 25 9 RA AAA CN 2 5 6 Special functions with EDC17 MED17 Engine Control UIT 63 2 5 7 Special functions Immo III IV parts adaptation UIT Adapting engine control US cos saga aS ele eae E a iaa 2 5 7 2 Adapting Audi A8 VW Touareg immobilizer KeSSY ccecceesessceseceeeeseceseeesecsaeceeeseeeseeeseceaeeeseceaeeeseeeeeeaeeeeeeaa 68 2 5 7 3 Adapting comfort module on Passat B6 CC 2 5 7 4 Adapting Transmission gearbox on A6 Q7 Allroad 2 5 8 Special function Steering lock adaptation cccccecccccsccecsseeseesesseeseeseeseeseeseneeeeceeenesnesseeeeieseeseeseesesneeeeaeseaeens 2 5 9 Special function MMI TV activation ccccccccccccccsscsseeseeseeceescnseneceecseenessesieesecsesseeseeseeaseseeseneseesneenesneseeaeeaeeaees 2 5 10 Special function Custom memory access Download Upload ReadMemory 2 5 11 Special functions with Airbag sse 2 5 12 Special function VW Crafter rociera iii Reading 2 5 13 Special function Key learning ia sand ein ede kr tter 2 5 13 1 AM Keys LOS dica odia dic do add ET la dd a dd di dradd area 2 5 13 2 Key learning procedures s v 2 5 13 3 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 89 2 5 13 4 Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA 92 2 5 13 5 Procedure 3 f
56. 6 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP1 6 with baud 500KB s UDS when trying to connect to the device the commander will try to connect to it using UDS over ISO transport protocol with baud 500KB s K Line KWP2000 KWP1281 when trying to connect to the device the commander will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used for configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests they are not applied when auto scanning devices 2 1 2 Interface detection Normally the ABRITES Commander for VAG USB Interface is recognized automatically 2 1 3 K Line baud rate settings When trying to connect to the device over K Line the commander will try to connect to it using one baud rate and if it doesn t succeed it will switch to another baud rate and try again There are two baud rate values currently used 10427 and 9600 Using the 10472 9600 and 9600 10247 radio buttons within the options dialog one can set the order in which these two baud rate values will be used If 10472 9600 is selected then first the commander will try to connect to the device over K Line using baud rate 10472 and if it doesn t succeed it will switch to 9600 and try again with it If 9600 10472 is selected then first the commander will try to conne
57. 6 K Line Unit CDC32xx 2009 UDS 9512 protection adaptation b AF S HEN DE in o A BD A 2 Steering lock TV activation Key leaming Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter adaptation ED1 ED2 ReadAwrite X 4 gt If vehicle model is successfully detected it will be suggested to the user with the following message EY ABRITES Commander for VAG 16 0 NW 7 iol gt gear gt Unit name fvasmumber Description fore coding 00 01 Engine Control Unit Master 02 Transmisson Previous 03 ABS 04 Steering Angle 0S EZS Kessy Entry And Sta 06 seas senory p TE xi gt 07 Control head og climatronic ar Investiaatina vehicle Connect 09 Central Electi x oa Vehicle lmmobilizer type recognized as Audi A3 S3 0B Air heating 2004 CAN Slide door lef I o 71 Special functions Manual Selection OG ES CAN Instrument EZS Kessy Instrument Engine Control Micronas VDD NEC Magneti dash Component EDC16 MED9 CAN 07 46 K Line Unit CDC32xx 2009 UDS 9512 protection 4 adaptation b WV Q RE U DH pS Ah B amp Steering lock TV activation Key leaming Dump tool Airbag VW Crafter DSG Mileage Custom PIN Converter adaptation ED1 ED2 Head mie 4 gt NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish bet
58. 7 1J0 909 603 4BO 959 655 C 4B0 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L 2 5 12 Special function VW Crafter This special function gives the possibility read the engine control unit EEPROM together with the PIN code and component security read mileage into engine control unit make immobilizer ON OFF learn keys with prepared transponders perform diagnostic on the engine control unit and the immobilizer NOTE It is possible to connect only to the engine control unit and immobilizer for VW Crafter vehicles To connect to any other device you will need the ABRITES Commander for Mercedes Starting this special function brings a following dialog D ABRITES Commander for VAG 15 0 71 00 01 Engine Control Unit Master 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory passenger 07 Control head 08 Climatronic Auto HVAC VW Crafter ECU EEPROM Key learning iff Special functions ge Vehicle Selection TI Broadcast e Options CAN Y K Line a O EZS Kessy Engine Control 07 46 Unit A B Key learning Airbag Engine Control Unit Diagnostic Micronas CDC32xx VW Crafter Instrument K Line Instrument CAN a TW activation ED1 ED2 im ken 010110 Dump tool From these buttons is possible TS name fvasmumber Description fore coding
59. 7 A6 3C 13 00 01 00 00 00 BC F B2 7 7K eee 00000080 02 04 00 00 10 57 56 57 54 5A 54 33 43 54 36 45 WWWZZZ3CZ6E 00000090 30 30 30 30 30 30 56 57 54 43 54 30 30 30 30 30 000000VWZCZ00000 00000040 30 30 30 30 57 56 57 SA 5A 5A 33 43 54 36 45 30 DODOWWINZZZ3CZ6E0 00000050 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 AS 00000 00000000 02 04 00 00 10 57 56 57 5A 5A 54 33 43 54 36 45 WVWZZZ3CZ6E Q00000D0 30 30 30 30 30 30 56 57 5A 43 54 30 30 30 30 30 000000VWZCZO0000 OOOOODEO 30 30 30 30 57 56 57 SA 5A SA 33 43 54 36 45 30 0000UVWZZZ3CZ6EO 000000FO 30 30 30 30 30 18 00 00 00 00 00 00 00 BF F2 AS 00000 00000100 03 04 8B CS Al 7B 00 00 00 00 00 00 00 00 00 00 Lasses sss v L ih 4 Swap bytes L H Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset CRYPTED Login Component protection Required license AN009 The function allows changing the security access code and the component protection data into MED9 1 ECUs for which the EEPROM is encrypted As mentioned previously for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU req
60. 9 x Security Code Checksum calculator 95080 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool E x Type ECU MED 9 x Security Code 7 Checksum calculator 35080 oo 8 05 07 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 1 7H1037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 15 D405 2Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 0 00000060 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D405 21 gt 2a 00000070 E4 37 AS OB 3
61. ABRITES Commanper For VAG 18 x Document number 2 20071127 Date 01 06 2013 OND UO ABRITES Commander for VAG User Manual Version 2 31 issued by Abritus 72 Ltd Version 2 31 ABRITES COMMANDER ror VAG 18 x Document number 2 20071127 Date 01 06 2013 List of Revisions Description Release version of the document Update of the description of dongle installation HID driver Update of description regarding Audi A4 Bosch RB4 Crypto clusters Adaptation regarding SW version 4 1 Changes regarding setting of the working folder for the shortcuts Clarification of the Installation procedure Update to V5 0 of the ABRITES Commander for VAG oO 06 06 2008 Update to V5 1 of the ABRITES Commander for VAG 01 07 2008 Update to V5 2 of the ABRITES Commander for VAG 28 10 2008 Update to V6 0 of the ABRITES Commander for VAG 2 08 11 2008 17 Table with key learning procedures added 2 2 Chapter 27 11 2007 14 01 2008 01 02 2008 12 02 2008 18 02 2008 2 20 02 2008 2 4 5 14 03 2008 All 2 1 2 ke DO NN 2 DIN 01 12 2008 Dump tool described in details 12 12 2008 Update to V6 2 of the ABRITES Commander for VAG wo oo gt 06 01 2009 3 Update to V6 3 of the ABRITES Commander for VAG 23 03 2009 3 Update to V6 4 of the ABRITES Commander for VAG 2 8 25 05 2 3 3 Added descriptions 17 06 2009 Update to V7 0 of the ABRITES Commander for VAG 02 10 2009 Update to V7 1 of the ABRITES Co
62. D CAN Abrites programmer Q7 A6 Procedure 9 auias zoz omic gammer key Procedure Audi A8 2002 OBD CAN grammer ke Procedure 7 FEE oor grammer hey TE Audi A8 2007 grammer ke Procedure 8 FE a dale Audi S8 2007 grammer ke Procedure 8 airs 2006 08D GAN Koyprogrammer r Proceaure3 Audi R8 2006 OBD CAN Key programmer dealer ke Procedure 3 mitt gor ocan Keyprogrammer dederkey Procsdure32 Audi TT 2007 OBD CAN Key programmer dealer ke Procedure 3 2 mit one UDS keyprogrammer dederkey Procedureti Audi A1 2011 UDS Key programmer dealer ke Procedure 11 Skoda Octava 08 2006 208 OBD CAN key programmer deae key Skoda Octavia II 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 Skoda octava ame UDS keyprogrammer_ deserkey Provedum 11 Skoda Octavia II 2008 UDS Key programmer dealer ke Procedure 11 Skoda ociavars 2008 UDS keyprogrammer_ doalerkey Procsdurett Skoda Octavia RS 2009 UDS Key programmer dealer ke Procedure 11 Skoda Octavia Scout 20082008 OBD GAN Keyprogrammer desker key Procedues Skoda Octavia Scout 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Skoda Octavia Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Scout 08 2008 0BD CAN TP24 Megamos 48 Skoda Scout 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Skoda Scout 2009 UDS Key programmer dealer ke Procedure 11
63. ED 3D C5 28 DS 1A AD 00 00 00 56 57 SA 37 VNZ7 00000130 SA 30 47 37 30 30 30 30 30 30 00 ES 70 OE F6 BE Z067000000 p Eee ee S 00000140 01 B7 EB 34 45 57 56 57 SA SA 5A 31 4B 5A 37 50 4EWVWZZZ1KZ7P 00000150 34 34 34 34 34 34 73 00 00 00 B7 00 00 EC F7 83 4444443 Atfo Suc o Read Flash 00000160 01 B7 EB 34 45 57 56 57 SA 5A 5A 31 4B 5A 37 50 4EWVWZZZ1KZ7P Flash tool 1D 00000170 34 34 34 34 34 34 73 00 00 00 B7 00 00 EC F7 83 444444S 00000180 00 02 00 GF F4 44 20 83 01 03 50 00 00 FF 00 00 0 D P 00000190 01 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF oooccccoo 000001A0 FF FF FF FF FF FF 00 00 FF 00 00 00 A7 C7 7A 00 000e z Write Flash 00000180 00 00 FF FF FF FF FF FF FF FF 01 FF 00 36 F4 44 6 D gt Component security 99 17 ed 3d c5 28 d5 MAC 70 E5 BD 7F HINTS when reading writing EEPROM memory of ECUs 1 The whole EEPROM is possible to be read for EDC15 ME7 EDC16 For MED9 EDC17 and Simos engine control units only the PIN CS MAC is displayed 2 To read the EDC17 MED17 PIN CS MAC is required online connection 3 If you experience problems with reading ME7 x EEPROM better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing o
64. EZ720 y L Audi A8 2002 Security access code Program transponder 24c17 Required license AN006 to view security access code and ANO009 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Tool xi Type Audi A8 2002 Security access code Program transponder 24c1 7 v P 45 P d 00000080 64 14 1C 2D 50 18 1C 34 53 14 1C 2D 64 50 32 05 d P 45 dP2 Save dump 00000040 00 00 00 00 00 00 00 2D 00 4B 00 48 03 2C 01 00 KoHaga Swap bytes L H DO OF 14 03 OA OA OA OA OA OA OA OA OA FF FF FF o oooooo 000000CO FF FF FF FF FF FF FF FF FF FF F4 OF DS OE 03 08 ss esssss nee ss 000000D0 18 00 31 00 81 05 09 06 48 07 4E OA 46 OD BF 10 l H N F 000000E0 00 00 70 00 31 07 A2 07 84 08 BA OA F9 OC AQ OF 8 L 000000F0 08 18 00 31 00 81 05 09 06 48 07 4E OA 46 OD BF l H M F Login 3128 Other Data 00000100 10 00 00 50 00 AO 05 40 06 80 07 AO OA CO OD 80 P B 00000110 11 SE 4B FF 00 04 00 00 1E 03 9F OB 10 16 00 00 R 00000120 B3 01 EF 07 A9 OF 60 78 00 80 80 00 80 20 04 08 A Immo number 00000130 8D 00 BO 00 46 01 F4 01 SD 02 BA 02 DD 02 ED 02 F AUZ7Z0 1070699 00000140 EO 02 B8 02 70 02 EO 01 50 01 BO 00 60 00 00 00 p P 00000150 2A 08 18
65. F FE FF FF FF FE FF ccoo oc we od DODDSBZ FE PF FF FE FF EF FF PE FF EF FP OFF FF ER FE EE lena DDOOSB30 FE FF FF FF FF FF FF FF FF FF EF EE FE FF OG OF accuse wean o 00003B40 78 90 FF FF FF FF FF FF 00 00 FF FF FF FF FF OO x 00003B50 00 FF FF FF FF FF FF FF 00 01 uer S9 BA sansene ie AUZ DU00028560 125 SA 30 41 58 58 56 58 58 56 58 3B SA 79 SZOAXXXXXXX Z ZV 00003B70 96 B6 DO FF FF 42 20 93 9D 43 7F FF 30 42 DE BS B C DB 00003B80 57 42 20 EB 31 FF FF FF FF FF FF FF FF FF FF FF WB 1 OOOO3B90 FF FF FF FF FF 04 OD 2B 41 55 SA 35 SA 30 41 58 AUZ5SZOAX 00003BA0 58 58 56 58 58 58 11 1E 3B 5A 79 96 B6 00 FF FF XXXXXX 2Y 00003BB0 42 20 93 9D 43 7F FF 30 42 DE BS 57 42 20 E8 31 B C 0B WB 1 ODOOSECO PR FE FP FE FF FE FP FF EE FF FR FF FE EE FF BP iria 00003BD0 04 OD 2B 41 55 5A 35 SA 30 41 58 58 58 58 58 58 AUZ5ZDAXXXXXX 00003BE0 58 11 1E 3B 5A 79 96 B6 OO FF FF 42 20 93 9D 43 X Zy B E E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXX and the login is OD2B in hexadecimal or 3371 in decimal 2 If the immobilizer number is not present then the login is found somewhere in the region 0x0070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 FF FF FF FF FF FF FF FF F
66. F FF FF FF FF FF FF FF O0003B10 FF FF FE FE FF FF FE FF EF FF FF FF FF FF FE FF os seen sieeve 00009820 PE PY FF FE FF FF FF FF EA DODI 18 IF CC FF Fr sasossssbeasmees 00003830 FF EA D6 01 FD C1 1E FF FF FF 1E FF FF FF IE FF oo coooonssos 00003840 FF FF 06 06 F9 FF FF FF 10 00 47 45 36 35 54 54 GE65TT 00003850 31 30 30 30 31 10 FF FF FF FF FF FF FF FF FF 23 10001 00003860 07 23 03 02 00 00 1E 00 32 20 00 00 02 DO 32 FF 2 macs 00003870 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00003880 FF 4 7F 00 01 OF 14 FB 00 00 02 OO FF FF FF FE 00003890 FF FF FF FF 03 6D FF FF FF FF FE 63 1B FF FE 63 Wess ss c e 000038A0 1B FF FE 63 1B FF FE 63 1B FF FE 63 1B FF FE 63 C C C E g on the picture above starting from address 0x0080 of the EEPROM there are 17 bytes with OxFF then follows the login which is 0x047F in hexadecimal or 1151 in decimal The mileage consists of two blocks usually 0x90 bytes with the inverted mileage followed by 0x90 bytes with the real mileage but this may vary e g blocks with 0x98 bytes instead 0x90 or first is the real value and then the inverted 4 1 2 Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 3 TTT
67. G Special functions with EZS Kessy CAN When this function is opened the ABRITES Commander for VAG tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP2 0 EZS Kessy for Q7 A6 Allroad y xj m Component security Get component security from Engine Control Unit ECU Component protection bytes ad 32 dt PIN Login code 23242 Get component security from EZS Kessy EEPROM dump O Get component security from EZS Kessy by OBDII Load from requires to give ignition ON with working key OBDII m Learn keys Number of YIN l keys to 1 Make dealer key learn EZS EEPROM 00000000 24 68 10 02 00 10 FD BO FF FF 01 FF 36 33 36 37 Sfh 00000010 31 33 30 30 32 36 30 30 31 31 FF FF 37 33 38 37 1300260011 7387 00000020 30 33 30 30 30 34 30 36 30 31 FF FF 31 30 30 38 0300040601 1008 00000030 34 31 32 31 31 31 35 30 30 30 39 30 33 31 30 34 4121115000903104 00000040 34 32 34 37 35 FF FF FF 35 30 2E 31 31 2E 38 32 42475 50 11 82 00000050 33 32 30 31 57 41 55 SA 54 5A 34 46 58 36 34 31 3201WAUZZZAFX641 Read EEPROM Write EEPROM 00000060 32 31 31 33 31 FF FF FF 11 28 23 10 34 46 30 39 21131 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 01 01 00 10852 0220 00000080 OA A3 51 1A 5B 31 32 36 2E 30 32 2E 30 37 FF FF Q 126 02 07 Save to file 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF
68. Key programmer dealer ke Procedure 11 VW New Beetle 1998 OBD K not needed On MTT 1 VW Caddy VDO 2004 09 2006 OBD CAN russ a 7 2 Megamos 48 VW Cadd 2008 OBD CAN Key programmer EG ke Procedure 3 VW Multivan 2007 OBD K not needed Fe Procedure 2 VW T4 1998 FN K not needed Le Procedure 1 osx mos es re me rent VW T5 2009 UDS Key programmer dealer ke Procedure 11 VW Sharan 1997 2009 Lane K not needed Fn DO vm 1 te a omme mett VW Sharan 2009 UDS Key programmer dealer ke Procedure 11 Few epocas roen ri no VW Scirocco 2008 2009 OBD CAN Key programmer dealer ke Procedure 3 ae nemne i aa VW Scirocco 2009 UDS Key programmer dealer ke Procedure 11 ne eg ett VW Touran 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 rom aoe PE omme te mett VW Touran 2009 UDS Key programmer dealer ke Procedure 11 engen mene gapet seem itte penaoa VW Tiguan 2008 2009 OBD CAN Key programmer dealer ke Procedure 3 men Ime korsene rir betent VW Tiguan 2009 UDS Key programmer dealer ke Procedure 11 meter 1996 OBD K not needed TP08 Procedure 1 VW Passatsavoo 1997 osD TPo8 VW PassatB5vDO 2001 oBDx rra meter 2001 OBD K not needed TP08 Procedure 1 omme tenne romans VW Passat B6 2005 OBD CAN Key programmer dealer ke Procedure 3 zoos OBD CAN Keyprogammer demertey Procedureto VW Passat CC 2008 OBD CAN Key programmer dealer
69. Load EEPROM Enter Service Mode by Leave Service Mode by 24C032 24C64 dump OBDII OBDII ABS coding Read write EEPROM Flash 62 FD q pb Read 00000008 B 5B 7B 1D AC E1 6C 31 11 EEPROM Read Flash 00000010 81 DS Al SA CO 21 OB CO Z 00000018 28 D1 41 57 21 62 7B 49 AW b I Write Read mileage 00000020 AS CD 79 DA 67 DD 1C AB y g EEPROM 00000028 07 D9 BF 6A F4 FF 3B 65 j e Mileage 0 00000030 60 83 4D E4 DD 19 SF 8C M gt 00000038 CE FD 60 92 85 3C F8 F3 lt amp Laed from Save to file of ile Immo Data VIN IVWLW21668M111111 data Mileage Serial number m Transponder identificators AA Write Immo Serial key CS dba6573433d6b1 KeylD1 f07b970d KeylD5 9f37940d data MAC 3 bb3b20 KeylD2 9f37940d KeylD6 2bd3cc73 Status 1400006add KeylD3 453acd73 KeylD7 ttt Configuration 210106660100 01 VW gt KeylD4 acffoc73 Keylbg Hr Add key PIN 7752 For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license To make any operation on these dashboards it is required first to enter into service mode Without entering into service mode nothing is possible Entering into service mod
70. M you ve to make Ignition OFF then Ignition ON and press and hold the brake After that you can continue with the function from learning a key making a dealer key reading writing EEPROM or reading writing VIN NOTE To make any activity with the EZS Kessy you need to put the login and the component security bytes or to load the EZS Kessy EEPROM dump or to get the component security and CS by OBDII from EZS Kessy If this information is not made any attempt to make any activity with the EZS Kessy will result an error 2 5 1 6 Learning key with EZS Kessy To learn a key for the EZS Kessy You need to put the login and component security bytes as described above and to specify the number of keys which should be learned Then pressing the Learn button will learn the key IMPORTANT For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer 2 5 1 7 Reading changing VIN To read write the EZS Kessy VIN it is required to put the login and component security bytes as described above Then using the read write buttons you can change the VIN 2 5 1 8 Reading Writing EEPROM To read write the EZS Kessy EEPROM it is required to put the login and component security bytes as described above Then using the Read EEPROM button you can read the whole EEPROM This EEPROM is required to
71. RITES Commander for VAG So Step 2 2 Learn module to the vehicle Connecting to CAN Gateway OK Trying to set the component protection OK Connecting to Airbag OK Trying to set the component protection OK Module learned to vehicle with SUCCESS 2 5 6 Special functions with EDC17 MED17 Engine Control Unit This function is dedicated to read write the EEPROM and flash memories of the EDC17 MED17 engine control units Here not only VAG engine control units can be read but also engine control units from other producers like BMW Opel etc You need to connect the boot pin of the engine control unit to ground connect the CAN H of the ECU to PING of the AVDI OBDII Connector connect the CAN L of the ECU to PIN14 of the AVDI OBDII Connector connect the ignition of the ECU to PIN7 of the AVDI OBDII Connector connect the power supply 12V and Ground of the ECU to power supply source check which microcontroller in used in the ECU the Infineon TriCore type connect 5100hm resistance between power supple 12V and PIN7 of the AVDI OBDII Connector Connection diagrams you can find in the appendix r EDC17 MED17 Flash EEPROM read wri s TC1736 y Read Pines Get PIN CS from dump Read Write EEPROM EEPROM Read Int Write Int FLASH FLASH Load from file Operation in progress please wait Manufacturer ID 0000182000008A02 OPT Protect 0x1
72. Read Write immobilizer related data Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the instrument cluster Instrument cluster Immobilizer special functions x r Mileage m Read write EEPROM Immo data 0 57 56 57 SA SA SA 31 4B SA 35 Read 00000010 33 31 39 AS 04 57 56 57 SA SA SA 31 4B SA EEPROM 00000020 30 38 33 33 31 39 84 07 00 OD 70 ES 99 17 er 00000030 CS 28 DS 00 11 20 00 FE 58 FF 82 08 12 3D ea 00000040 FF FF FF FF FF FF FF FF F1 01 06 33 01 11 coed om Seo to fle 00000050 56 57 SA 37 5A 30 45 31 37 31 32 37 37 36 ln 00000060 12 30 21 A6 02 FO 21 A6 0D 1F 12 BE FF FF Mileage b seen 00000070 DC OD FF FF FF FF FF FF FF FF FF FF FF FF flash EEPROM dumps Micronas Immo Data VIN WwzZZ1 KZ5P083333 Read Immo Immo data by data flash EEPROM dumps Micronas Serial number VWZ7Z0E1712776 r Transponder identificators 1 S Serial key C5 9917ed3dc528d5 KeylD1 123021a5 KeylD5 Mt cats MAC 70851234 KeylD2 2102138 KeyiDe fff Status 2000fe58tt Power Class fe KeylD3 d1fl2be Keyl HEHE MO106330111 bmw y lant Make deal Configuration f10106330111 01 YW KeylD4 EE KeylDg_ Itftttt ae hang o to the immo FIN 3328 data Readlmmo Done For Micronas dashboards it is also possible to extract the mileage value by available EEPROM and flush dumps using
73. Service Key Master Counter Counter Key ID1 O Service Key Master Counter Counter Key ID2 O Service Key Master Counter Counter Key ID3 O Service Key Master Counter Counter Key ID4 O Service Key Master Counter Counter Key ID5 O Service Key Master Counter Counter Key ID6 O Service Key Master Counter Counter Key 1D7 O Service Key Master Counter Counter Key 1D8 O Service Key Master Counter Counter ID Geber O Service Key Master Counter Last Key O Service Key Master Counter Counter Trigger O Service Key Master Counter Error Counter O Service Key Master Counter State LJ Service Key Master Counter Immo Key of L 2 4 7 Security Access Security Access gives you the possibility to perform security authorization on different levels Ix Security Access Secutiy access parameters Standard Typ C User defined Security ccess Login m Security Access CS 2332 gic Value DEC Value HEX Security ccess System 2 4 7 1 Standard Security Access This type of security access can be e Security Access Login usually used in immobilizer systems e Security Access Component Security usually used during adaptation of different units parts e Security Access System Specific security access different from the previous two and different from authorization for programming session Hints When device to which you connect is using KWP1281 dia
74. W Caddy 2004 VW Eos 2006 VW Jetta 1998 VW Golf Bora IV 1998 VW Golf Golf Plus Bora V 2004 VW Golf Golf Plus Golf Variant 2009 VW Touran 2003 Skoda Fabia 2007 VW New Beetle Cabriolet 1998 2010 VW Fox Spacefox Sportvan Suran 2005 VW Passat 1997 2011 VW Transporter 1997 2009 VW Tiguan 2007 For Audi A8 VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 2 5 17 Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value applicable for the navigation controller function 2 5 18 Special function Cruise control system Using this application you can activate deactivate a cruise control system and change the related steering wheel electronics SWE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the commander will read and display it s current configuration After Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate cruise control system function and apply any changes of the SWE configuration to the SWE unit 2 5 19 Special function Brake pads change 6 Using this application you can Open rear parking brake for pad change Close rear park
75. W doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7 byte NOTE Some cars are equipped with Simos engine control unit instead of Mangeti Marelli If once again the SW doesn t succeed to read the PIN CS you need to read the Simos EEPROM dump with a programmer and from the dump tool to get the PIN CS Then you can prepare a dealer key and to learn in on the absolutely same way as for VW Seat Skoda 2007 Key Learning Wizard mode LY ABRITES Commander for VAG Select vehiclelimmobilizer type VAG vehicle VDO NEC 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 CAN Audi A8 CAN VW Golf V Micronas dash Mag VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Function Learn keys To prepare dealer key VAG vehicle MM Motorola 9512 2009 CAN Select function Program Key a Back Next gt Exit 1 Select Program
76. Write Immo Serial key CS dba6573433d6b1 KeylD1 f07b970d KeylD5 9f37940d data MAC 2fbb3b2c KeylD2 937340d KeplD6 2bd3cc73 Status 1400006add KeylD3 453acd73 KeylD7 Hm Configuration 210106660100 01 YW Sy KeylD4 acffoc73 Keylbg HEEE Add key PIN 7782 Service mode can be entered in two ways by OBDII if the car has working key and you give ignition with it by EEPROM dump if the car is not having working key So if you ve a working key from the car simply give ignition ON with it and press Enter Service Mode by OBDI If the procedure is completed successful a message Service mode OK will be displayed in the status bar If you don t have a working key from the car to enter service mode you need to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After the EEPROM is written back the service mode should be entered normally not needed to do nothing else Please not that if you press the Leave service mode by OBDII in this case if you want to enter the service mode again you will need to write back
77. amos 48 transponder If you have a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned If do not have a dealer key if you have chosen key learning standard mode press the Program dealer key button which will show the following dialog x Program dealer key k Megamos 48 Autodetect component security Program transponder from 7 bytes x s x x Posen 9 Find the 7th byte of the component security data Set transponder type All bytes of the component protection data component security are know Find 7th byte and program transponder Component 87 da eg 7d 63 Ma rev security bytes I Automatcial trying of the 7 byt utomal es tying of the 7 byte Find 7th Enn Manual trying of the 7 byte Vw Passat B6 CC from EG Key with transponder in ignition programmer over key Value for the autorization read by daignostic if you have chosen key learning wizard mode select function Program Key and press the Next button which will show the following dialog el Select an option Manual Input of the Component Security Bytes amp Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Wo
78. and new PIN code You can read them normally from the immobilizer or from the old ECU if it is present If the engine control unit is used you need the existing CS and PIN of this second hand engine control unit plus the new CS and new PIN code When starting this special function the following dialog is displayed Exchange ECU by OBDII e Specify manually the existing CS PIN of the engine control unit ld ES 7th byte not required Bld PIN 0 New immobilizer data Immo number WIN Power class ES For EDC16 MED9 ME7 EDC17 MED17 and Simos PPD engine control units the customer can press directly Read and the old CS PIN are displayed If engine control unit is virgin this is also automatically detected So after the successful read of the existing data they are filled automatically in the field below Please pay attention that the 7 byte of the CS is not required here Pressing the Read button will read the power class existing PIN CS also VIN and immobilizer number C Specify manually the existing CS PIN of the engine control unit New immobilizer data Immo number VIN WALUIZZZ4F85N111222 Power class 92 CS 14 Ce 25116 Also after successful reading the fields for the CS PIN VIN and Immo number become active and customer may specify the values he want Please pay attention that the power class for the engine control u
79. button Mileage by flash EEPROM dumps Micronas Reading Writing the Immobilizer data is made from the buttons Read Immo data and Write Immo data For Micronas dashboards it is also possible to extract the immo data by available EEPROM and flush dumps using button Immo data by flash EEPROM dumps Micronas If you want to make a key you need to read the immobilizer data first or to load it from flash and EEPROM dumps Then you should have a programmer connected and to put the transponder inside After that 1 key is added to the existing keys This means that existing keys continue to work NOTE It is possible to have 8 keys per car If all position are full the key is not added but replace the 8 position NOTE Pressing the Make dealer key and add it to the immo data button programs the transponder as a dealer key and puts the transponder ID into the immobilizer data But the data are not written in the microcontroller yet you ve to press the Write immo data button to write the data Or if you want since you ve a dealer key at this moment you can exit without writing data and later learn the transponder by diagnostic This application can be used with the following models VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda Octavia II Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the functio
80. byte is zero Dump Tool a xj Type ECU Simos PPD1x Reset component protection data 31 31 31 53 4E 30 49 30 46 31 30 00 48 1113N0I0F 10 Load dump 00000010 00 00 00 48 00 00 00 48 00 00 08 38 00 1C 00 00 H H 8 00000020 00 FF 80 80 80 80 80 80 96 80 80 80 80 00 80 80 oooooooooo Save dump 00000030 00 FF 19 9E 59 2C 59 2C 59 2C 94 50 94 50 94 50 Y Y Y P P P Swap bytes LAH 00000040 01 00 01 00 01 00 D9 72 52 79 B2 E4 D9 72 52 79 rRy rRy 00000050 B2 E4 D9 72 52 79 B2 E4 A4 00 A4 00 A4 00 00 00 4rRy 00000060 ON nn nn nn An nn an nn an nn 33 ra 33 ra 33 ra 3 3 00000080 5 ZLC ZZ Zz h 4 u fe fe fe i ps o o o o w o NJ oon an OOOODOFO 76 5B F4 84 85 51 84 9B 80 3B 81 09 81 08 83 v Q 7 N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 o03G90601 gt Canceled ECU Simos PPD1x Security Access Code Required license AN007 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Dump Tool x Type ECU Simos PPD1x Security Access Code 1115NOIOF710 H Load dump Save dump Swap bytes L H h 4 00000070 56 57 54 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZO00000000VW Login 1282 00000080 5A 43 54 30 30 30 30 30 30 30 30 30 56 57 54 43 ZCzo00000000VNZC 00000090 54 30 30 30 30 30 30 30 30 30 57 56 57 SA 54 5A ZO00000
81. ccepted from ECU is different Dump Tool xj Type ECU Simos 7 K line Login code 93076 93086 hg 1118N130L300 H lt 00000010 00 00 00 48 00 00 00 48 00 00 08 38 00 1C 00 00 H H 8 00000020 00 FF 00 00 00 00 00 00 00 OG OG OG 00 00 00 00 e eee eeee 00000030 00 00 00 00 9B B9 9B B9 9B B9 54 00 54 00 54 00 T T T 00000040 01 00 01 00 01 00 B3 6A 65 1B 66 D4 B3 6A 65 1B je f je 00000050 66 D4 B3 6A 65 1B 66 D4 00 01 00 01 00 01 14 C je f 00000060 14 C7 14 C7 00 00 00 00 00 00 AO B2 AO B2 AO B2 veceeeeecceceeee Logn 5308 0000070 56 57 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 VWZCZOOOOOOOOOVU ogin 00000080 54 43 54 30 30 30 30 30 30 30 30 30 56 57 54 43 ZCz000000000VNZC 00000090 54 30 30 30 30 30 30 30 30 30 57 56 57 SA 54 SA ZO00000000UVWZZZ 00000040 33 43 5A 33 33 33 33 33 33 33 33 33 33 33 33 33 3C0Z3333333333333 00000050 33 33 33 33 33 33 33 33 33 33 33 33 57 56 57 SA 333333333333WVvW2 00000000 5A 5A 33 43 54 33 33 33 33 33 33 33 33 00 00 00 2230233333333 000000DO 7C 7C 30 39 30 37 33 32 33 39 30 36 30 31 38 46 0907323g06018F 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF 01 18 Ol 84 G 000000FO 01 05 00 03 18 07 01 18 01 84 01 05 00 03 00 00 00000100 7C 7C 01 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G690601 y L ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license AN003 This function displays the secur
82. ch he want to adapt Then the procedure of adapting the component protection is performed in two steps reset to virgin state learn module to the vehicle 2 5 5 3 Reset to virgin state Reset to virgin state is possible to be made in three ways by reading the module by OBDII available for instrument cluster airbag comfort module and EZS Kessy by loading the module EEPROM dump available for airbag and EZS Kessy by loading the gateway EEPROM dump from the car from which the module is taked where it was originally build in Customer has to select from the following dialog in which way he want to proceed V A ABRITES Commander for VA Step 1 1 Reset to virgin state Please select how to reset to virgin state gt By OBDII available for EZS Kessy KOMBI AIRBAG and Comfort module C By module EEPROM dump available only for AIRBAG By gateway EEPROM dump available for all devices C requires the GATEWAY EEPROM dump from the car where module was originally equipped After selecting the operation way another dialog with the status of the operation is displayed A ABRITES Commander for VAG a Step 1 2 Reset to virgin state Connecting to Airbag OK Disabling security OK Reading Trying to reset component protection OK Component protection is reset with SUCCESS After the operation is completed the module is in virgin state and can be adapted to any car 2 5 5 4 Lear
83. cial functions are available from the main dialog of the application itt Special functions Vehicle Selection Y Broadcast Options D y ED ao h CAN T N K Line as EN PN Instrument EZS Kessy BCM2 Instrument Engine Control Component EDC16 MED9 A8 Touareg Steering lock CAN 07 46 AAAS K Line Unit protection adaptation b Kessy ada adaptation 3 nan D ED DSG M EE m ve 2 S A J at i E ba TY activation Key learning Dump tool Airbag Vw Crafter DSG Mileage Custom PIN Converter Remote ED1 ED2 Read Write control a ern A emn pb 6 Ee The appropriate special function is opened by selecting it in the list box and double clicking on it or by pressing the Open button NOTE For the purposes of the some special functions basically for the key learning there are buttons for auto detection of the PIN and component security Basically this will try to read these data from the engine control unit but it will try also first to read them from the instrument cluster if the instrument cluster supplier is VDO Please pay attention that for VDO version after end of 2006 it might be required that the part of the instrument cluster is re flashed This is also required for functions for the reading of the mileage As mentioned in the license agreement use these operations on your own risk 2 5 1 Special functions with Instrument CAN When this function is opened the ABRITES Commander for VAG tri
84. ct to the device using baud rate 9600 and if it doesn t succeed it will switch to 10472 and try again with it ATTENTION Some device working on baud 9600 cannot be waked up if they are first tried on baud 10472 so if you cannot connect to device through the K Line try to change the options so first to try on 9600 2 1 4 Timing parameters The protocols running under K Line require very precise byte timing Since Windows is not a real time operating system these times are not always respected so it is possible that the communication with some devices is unstable or it is not possible to connect In such cases you can try to change some of the times timing parameters from the Advanced button The timing parameters have the following meaning Wakeup echo delay time after slow init between receiving 55 xx yy and sending the inverted value of yy according the K Line wakeup procedure Communication echo delay time between reception of a byte under KWP1281 and sending it inverted back to the device Inter byte time time between sending two bytes under KWP2000 Time between messages time delay between reception of response from device and sending new request to it 2 1 5 K Line PINs Normally the K Line is output on PIN7 of the OBDII connector But some models e g Porsche Cayenne 2004 the K Line with some units might be on PIN3 or PIN15 For that reason there is a option on which PINs to try to connect to the
85. d gearbox You can extract it by reading the EZS Kessy or engine control unit from the car where you take the replacement Second hand module Starting this special function the following dialog is displayed S m gt Exchange ECU by OBDII C Load existing PIN CS from EZS Kessy dump Sone ea le Specify manually the existing CS PIN of the engine control unit Old cs 7B 99 C1 02 F7 33 7th byte not Write required Old PIN 15565 Exit Jk New immobilizer data VIN WAUZZ74F98N111111 Power class 51 N Load cs 76 78 6D 52 26 AB EZS Kessy dump to PIN 23232 jeep CS Part 2 87 88 76 AD DD 12 Connected Start transfer receive of data So you need to load the EZS Kessy EEPROM dump or to enter manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function Normally the power class of the comfort module is displayed automatically if you load EZS Kessy dump and the customer is able to change it if the ECU has different power class If you enter wrong power class and this is a working vehicle i e ECU and transmission are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the transmission will take the power class you enter Specific for this module is that the component security is not 7
86. der identificators Seralkey CS tC KeylD1 KeylD5 mor KeylD2 KeylD6 Status KeyDa KeyiD7 Key count 9 KeylD4 KeylD8 PN O o For these dashboards it is not needed that working key from the car is present You can directly read write EEPROM and read flash and also read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the Key count field If you want to erase all keys put O for the key count Key Learning Wizard mode After this type is selected auto detected pressing Next will show this window a 915 Immobilizer data Current key count j4 Transponder type OK NA Dealer key transponder No ECU responding N A Key transponder locked No Engine s
87. dule In general the procedure is split into three steps Step 1 Check BCM type Step 2 Read BCM either by OBDII or with ABPROG Step 3 Key learning procedure making dealer key and learning keys 2 5 2 1 Read BCM2 by OBDII This option will read the BCM2 module by OBDII If all keys are lost after the reading is started following message will appear At that moment the user should disconnect the BCM2 module from the power supply for 2 3 seconds and after that reconnect it again After the reconnection the user has to press the OK button If there is a valid key and the ignition is ON it is not necessary to disconnect the BCM2 module ABRITES Commander for VAG T ES Read BCM by OBDII Connecting to immobilizer OK Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN After the reading is finished the existing key count power class and VIN are displayed and the customer can continue with the key learning procedure Tibor i E E Read BCM by OBDII Connecting to immobilizer OK Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN Trying to reconnect to BCM OK Disabling security OK Transfer data Decoding data VIN WAUZZZ8T48A123456 Key count 1 Po
88. e are the following types of transponders Tp22 dedicated for use inside Seat vehicles Tp23 dedicated for use inside Volkswagen vehicles Tp24 dedicated for use inside Skoda vehicles Tp25 dedicated for use inside Audi vehicles especially A3 and A4 Such transponders can be used in all cars of the specific producer e g Tp24 can be used for all Skoda models The last immobilizer system used in VAG is the Immo V It requires that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car producer can deliver such keys and such keys are called dealer keys because only the dealer can supply them For some cars a special programmer is needed in order to prepare the key to be like an ordered from the authorized VAG dealer Currently following programmers are supported Hitag2 programmer used only to program keys with Hitag2 transponders PCF7936 PCF794x Such cars are VW Touareg VW Phaeton Porsche Cayenne Bentley Continental Audi A8 Abrites Key Tag programmer used to program Hitag2 Megamos 48 crypto transponder and Q7 A6 RS6 Allroad keys The Abrites key programmer is referred as key programmer in the following description Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car to which k
89. e is possible in two ways read the EEPROM 24C32 with a programmer then load it with the Load EEPROM dump button modify it then with Enter service mode by EEPROM dump and finally write back the resulting file with a programmer to the EEPROM lf the car has a working key from the car give ignition with it and then press enter service mode by OBDI ATTENTION If you use Enter service mode by EEPROM dump in the case of 24C64 it is possible that after the modified EEPROM dump is written with the programmer to the instrument cluster the ABS module loses it s coding That is why it is strongly recommended that you detach the dash and work with it on a desk not in the car Or you can switch off ABS module during your work with the dashboard If you prefer to work with the dash in the car and it happens that ABS module loses it s coding then we give you two options to recover it First option The commander will automatically try to read and save the ABS module coding when you load an EEPROM dump using button Load EEPROM 24C32 24C64 The interface should be connected to the car and ignition must be ON in this case If the ABS coding is successfully read it is saved into a file on your PC Press START windows button then go to folder ABRITES software for ID xxxxxx XXXXXX is your interface number Log Files VAG search there for file ABS _DD_MM_YYY_XXXXXXXXX bin where DD is current day MM is curre
90. e number of keys to learn and the security access code and the keys will be learned In case of Wizard mode If the 7 byte is not available you must choose one of the two options Find the 7th Byte of the Component Security Bytes Automatic Trying This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to give ignition ON and place the programmer ring over the key when the key is on the ignition Find the 7th Byte of the Component Security Bytes Find from Working Key You have to put the six bytes which are known and press Next 2 5 13 6 Procedure 4 No more applicable Use procedure 3 instead 2 5 13 7 Procedure 5 No more applicable Use procedure 3 instead 2 5 13 8 Procedure 6 for Audi A4 RB8 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require a different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason a different procedure is used Key Learning Standard mode You need to choose from Special functions Key learning Audi A4 2004 RB8 Instrument Cluster KW2000 The following buttons will be available Key learning l x Vehicle model udi 44 2004 RBS Instrument Cluster Kw 2000 New key count 0 Program dealer key Learn Login Security code 0 No login code is need for
91. e of the Component Security Bytes Find From Working Key Component Security Bytes If you have all 7 bytes of CS available select Manual Input of the Component Security Bytes put down the CS bytes and press Next The key will be programmed If you don t have the CS bytes available select Autodetect Component Security Bytes and press Next After the component security is read if you have all the 7 bytes then the key will be programmed directly If you have only the 6 bytes you have to choose a if you have working key from this car you can put it into the programmer and select the Find 7th byte of Component Security Bytes Find from working key and press Next the 7n byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then select the Find 7 byte of Component Security Bytes Automatic Trying and press Next you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so y
92. e to file bisnis Swe me eee RO a oa Load from file s s s s s s s ee Clear crash data vann s en en u ooonoo oss For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request but the crash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using Clear crash data function from device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units Read Write EEPROM 1 All Siemens CAN Airbags 2003 2008 like 4F0959655B Audi A6 Q7 Allroad 2003 2008 1K0909605AB 1K0909605C 1K0909605AD etc 2 K Line Airbags Siemens and Bosch 100 909 605 C 8LO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8L0 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L Clear crash data K Line Airbags Siemens and Bosch 1C0 909 605 C 8LO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 60
93. ead Flash oo Data read Component security 1b d4 05 e4 37 a8 Ob For CAN immobilizers till end of 2006 it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you ve to go to Special function then Instrument CAN and Read write immo data After you read the immobilizer data in the field Serial Key the 7 bytes of the component security will appear 2 5 13 5 1Programming a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In case of Standard mode In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button In case of Wizard mode After you have chosen Autodetect Component Security Bytes or Manual Input of Component Security Bytes press button Next If all 7 bytes are available the system will automatically proceed with dealer key preparation 2 5 13 5 2Finding the 7 byte In case of Standard mode If the 7 byte is not available you must choose Find the 7th byte of the component protection data and you have to put the six bytes which are known There are three possible ways to check whether the 7 byte is matched from working key if you ve a key which can star
94. ect an option and press Next 3 Follow the instructions 2 5 13 4 Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA For this type you will need a virgin key or transponder TP22 TP23 TP24 depending on the type of the car as follows For SEAT you must use Virgin key or Transponder TP22 For VW you must use Virgin key or Transponder TP23 For SKODA you must use Virgin key or Transponder TP24 Key Learning Standard Mode You need to choose from Special functions Key learning VW Seat Skoda 2007 CAN Key learning Detected car type ERI VW Seat Skoda 2007 CAN v New b t 0 Froduce op Learn TP22 1P23 1P Ke Login Security code 0 24 TP25 mala transnander s Lock timers Engine start permitted Dealer key transponder i Login acknowledge ECU Responding Key transponder locked min Transponder type OK Kep transponder learned Transponder acknowledge Key count min You can reach login code using special functions of instrument immobilizer main panel Another way to reach login code isto extract it from the ECU special function Engine Control Unit ATTENTION You can produce SeatAW Skoda Audi TP2x transponders using your Key programmer and pressing the button Produce TP22 TP23 TP24 TP25 transponder m Procedure 2 VW Seat Skoda after 09 2006 For SEAT you must use Virgin key or Transponder TP22 F
95. ensensersensensevsenesneennenerneessensnssrasenssensee 131 4 1 3 VW Passat usually these Instruments are before year 1995 133 4 14 VW NewBeetle a dd ie MATAR ieee cba do 133 4 2 PorscHE CAYENNE VW TOUAREG GASOLINE ENGINES ECU WAKEUP FUSES csscsccescereeecetcseesesseeaeeseesesseeaeeaeeaeeaeeneeaees 134 4 3 AUDI A8 FUSEBOX PASSENGER SIDE WAKEUP ECU 135 44 AUDI OTe bests doses added dus laiv A dain aaa Bie Ghee de HE ee 136 AS AubrA6 RS 6 EXCEPT di 139 E AR GER 139 4 7 VAG K CAN COMMANDER KEY LEARNING PROCEDURES s ssscsseseccesecsseeseesseeseesseeseceseesecssecsecesesseceseseeeeseseeseseeseeesaaees 140 4 8 DUMP TOOL SPECIAL FUNCTIONS peke pare E EEE E taa di 145 4 9 EDC17 MED17 WIRING DIAGRAMS FOR BOOT MODE sasvevervev evner evvavvenevvevevvrvarvevarvevsrvevsrvevsevevssvevervevsenesenessvernassresnaenee 165 EIA ECUEDCLF L A Kvakstad 166 4 92 E V g EDCITC46TELIOT vane seere 167 4 9 3 ECU Vag EDC1HCPO4 TCT Go a ia 168 4 9 4 ECU Vag EDC17 CP14 CPW TC1796 variant Z 1 ai ar iia aR a i AEEA To araa aoao nag 169 4 9 5 ECU Vag EDC17 CP14 CP20 TC1796 with Internal and External Flash 170 4 9 6 ECU Vag EDC17 CP24 TC1796 with Internal and External Flash sse 171 4 9 7 ECU Vag EDC17 UO1 TC1766 with Internal Fiag aada ATE nin 172 4 9 8 ECU Vag EDC17 U05 TC1796 with External Fas 173 4 9 9 ECU Vag MED 17 5 1 TC1796 with Internal and External Flash 174 4 9 10 ECU Vag MED 17 5 2 TC1767 Interna
96. ent Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 aw Je em 4 Press Next then follow strictly the recommendations 2 5 13 10 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 For vehicles after year 2007 or Audi A8 you need to prepare a Hitag2 key transponder before you use the key learning function You can use a virgin transponder PCF7936 or a virgin key Key Learning Standard mode 1 From Special functions Key Learning choose vehicle model Push Program dealer key The following dialog will appear 2 There are following possibilities 2 1 Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not Dealer key with Hitag2 x C Load component protection data from Kessy ECU dump Autodetect from ECU Program from Kessy ECU dump C All bytes of the component protection data component security are know Program transponder from 7 bytes omponent protection bytes dd a0 Find the 7th byte of the component protection data Find 7th byte and program transponder
97. er acknowledge 0 timeout timeout Press Next to start key learning procedure wo a The system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared
98. ersessessensesenesensssneeenn 14 24 3 Extended Unit Identifica a 15 2 4 4 Read Diagnostic Trouble Codes sss sees 15 E lear Diagnostic Trouble Codes a A id A i 15 2 4 0 gt Measured VAS a aE Ree 16 DAT CCU ACC is A S 17 2 4 7 1 Standard Security ACCESS c c ccscecessccsncevsaeetensncetcoeacesedarvencocetconeasatebsncedsoedssedstsed coadestedatebsacebcessdertebancedeovedeceadecsers 18 2 4 7 2 User d ftm d Security ACCESS si tooide iin aCA KAERRA EAER OERA REAK AEREA IAE ca 20 DAS Adaptation ide 20 2490 BT TA EA A kanes ate Boh east deh estes Teg Tae dees es cae oan aa a A eee tes ee 22 240 BASTESEN nn ee de 24 DEA Ved T eT T chats seein Eada a cade a ed iit duos aa rain era aci soi 24 2412 RESOLU AS A lat a hens A A A dea ele Reads se 24 2 4 13 CUSTOM reques iS cias avec eeu ek didnt dy alas Gul doves ebecd leech ove T SREE ENN EE ENE ES 25 DADAS Program VIN rad es Gesine entena ead 25 2 4 15 Custom Aownload Upload c ccccccccccecseeseeveeeeseesensenecsesseenessesseeeesesseeseeseeseesenseneceecnecnesnesesesesaeesessenseeeeessenees 25 E TTT T A AA A A A A ite es Greni 25 24 17 ACTIVE diagnostic SES O Ac 26 2 Ds SPECIAL FUNCTIONS seres ai edge ae 27 2 5 1 Special functions with Instrument CANT 28 2 5 1 1 Special functions with Instrument Cluster CAN over TP2 0 ernnnnnnnenervernrnnervnnrnnvnsnrevervarnarneeveessenvesveeververnesnesvesennen 28 2 5 1 2 Special functions with VDO NEC 31 2 5 1 3 Special functions wit
99. erval options With the opening of the special function window the commander will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have enabled Service reminder reset or and Service interval reset or and Change service options sections Together with these sections in the section Applicable adaptation channels you will see the adaptation channels which values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed column New value of the Applicable adaptation channels table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options The applicable and available adaptation channels from column New value are also available for editing so the user may put there any other values 2 5 16 Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the commander will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation Remote control adaptation Instructions
100. es to establish diagnostic session with the Instrument cluster using KWP2000 over TP2 0 or UDS If session is successfully established the commander reads module s identification and tries to automatically detect the instrument cluster type The following types can be detected VDO MM Visteon 2007 CAN TP2 0 VDO with NEC uC 2009 CAN UDS JCI with NEC uC and 95320 EEPROM CAN UDS Magneti Marelli with 9512 uC CAN UDS A8 4H A7 4G A6 4G Touareg 7P with 95320 EEPROM CAN UDS If connection to Instrument Cluster cannot be established or Instrument cluster s type cannot be automatically detected the following window will appear Select instrument cluster type VYDO MM Nisteon 2007 CAN TP2 0 VDO with NEC pC 2009 CAN UDS JCI with NEC uC and 95320 EEPROM CAN UDS Magneti Marelli with 9512 uC CAN UDS A8 4H A7 4G A6 4G Touareg 7P with 95320 EEPROM CAN UDS Here you can manually select the desired instrument cluster s type NOTE If you would like to manually to select instrument cluster s type disconnect AVDI from OBDII and open Instrument Cluster CAN special function If one of the above types is automatically detected commander opens corresponding function window 2 5 1 1 Special functions with Instrument Cluster CAN over TP2 0 Available functions are eReading current mileage value eRead Program EEPROM of instrument cluster immobilizer eReading security access code of the IMMOBILIZER e
101. ey learning procedure belongs Starting the key learning special function will bring the following dialog 0 x Standard Mode Wizard Mode Press Standard Mode to use key learning special function as till version 15 0 of the Abrites Commander for VAG Press Wizard Mode to use key learning special function in wizard mode which will guide you to the key learning procedure for the specific vehicle type Pressing Standard Mode will bring the following dialog Key learning Detected car type Cannot autodetect immobilizer type Please select it manually Gall VW Passat B6 CC with EDC17 MED17 CAN v New key count 0 E Ee ALL KEYS Login Security code 0 k Beda LOST Engine start permitted Dealer key transponder ee i Login acknowledge ECU Responding Kep transponder locked min Transponder type OK Key transponder learned Transponder acknowledge Key count min You can reach login code from the ECU of the vehicle special functions Engine Control Unip read eeprom Procedure 10 For the moment is not possible to read the Component security bytes from all EDC17 MED17 For Passat B6 CC with such engine control unit it is possible to decrypt the comfort module using the PIN of the car So you ve to read the PIN code from the ECU and to read the Comfort module EEPROM with a programmer Pressing the Program dealer key button will bring you wizard with will he
102. f communication from the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of the Engine Control Unit window Make a quick Ignition OFF ON at this point 2 In case of ME7 x or ECUs from Porsche you can read the flash memory like reading of the EEPROM the only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length If you experience problems with reading ME7 x memory better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please notice that the flash which was read is saved automatically in the Flash subfolder and can be used in case of any failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write it In case of failure during the flashing the device should enter into a boot loader mode which will allow to flash the device but not to read it The flash can be then restored with the Custom Read Write function 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flashing 6 Please take into account that the reading writing of the flas
103. functions Key Learning choose vehicle model Write how many keys you need to program enter security access and push the Learn button Then follow strictly the recommendations Key Learning Wizard mode lolx Select vehicle immobilizer type Select function Audi A4 2004 RB8 dashboard KW2000 Lamborghini Gallardo 2005 KW2000 Program Key VW Touareg K Line KW2000 VW Phaeton Bentley Cayenne K Line KW2000 Audi A2 1997 k line diag KW1281 Audi A3 1997 k line diag KW1281 Audi A6 Allroad 1997 k line diag KW1281 Audi TT 1997 k line diag KW1281 Audi A4 1997 ext inmobox KW1281 Audi A4 1997 2002 k line diag KW1281 Audi A6 1997 ext inmobox KW1281 Audi A8 1999 ext inmobox KW1281 Audi A8 1999 2002 k line diag KW1281 Seat Cordoba k line diag KW1281 El Function Learn keys Back Ext Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next then follow strictly the recommendations Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options EY ABRITES Commander for VAG 0 x Select an option C Component Security Bytes From Kessy ECU Dump Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Compon
104. ge No license required Jetta 1994 1996 mileage 93C46 calculates mileage No license required T4 MotoMeter 1996 1997 mileage 93C56 calculates mileage No license required 4 9 EDC17 MED17 Wiring diagrams for boot mode On the diagram below you can find how to connect the AVDI to the ECU to use the boot mode Please pay attention that connection 5100hm resistance between the ECU Ignition and 12V is mandatory to get communication with the ECU boot mode GROUND CAN H IGNITION 4 9 1 ECU EDC17 CP44 TC1797 Pin 79 CAN H_ MP in 50 Ignition EE o NS UN OR KO EV we aT DA e p p S c a E y L K pri Y Tr we 4 9 2 ECU Vag EDC17 C46 TC1767 e o o gt g ei gt ur 2 UA PI 98 K agoa De Os anni 5 DY 4 9 3 ECU Vag EDC17 CP04 TC1796 Pin 1 Ground e A wy H gt e gt gt a m e L U I n L h 4 9 4 ECU Vag EDC17 CP14 CP20 TC1796 variant 2 i cc 0 0 0 0 0 O 70000000 kd Y real e Bu c A gU s EE L P Peri eee RIS ESSE SETS 4 9 5 ECU Vag EDC17 CP14 CP20 TC1796 with Internal and External Flash Ignition LE E A ALL AA 985BUOBR RR A n RARA AAA
105. gnostic protocol then only Security Access Login If you want to put the security access to the ECU you should use Security access CS This will allow you access to adaptation channel 50 If you want to put the security access on the Immobilizer you should use Security access CS If you ve a error message that it is not supported you should use then Security access Login 2 4 7 2 User defined Security Access You need to clarify the type of the security access and then by using the buttons Request SEED Send KEY authorization can be performed Security Access x Secutiy access parameters C Standard Type User defined fi RequestSEED RequestSEED Value DEC Walue HEX Return KEY h Olaafeab 2 4 8 Adaptation Adaptation will open for you a separate window where you can check adaptation values Non UDS modules You need to enter the number of the channel where adaptation will be performed and then press the button Test If the specified value is accepted by the unit press the button Save x Channel 50 Personal Identification Number PIN Ad aptatio n CHANNEL Stored value 32000 Test value 2336 New value 2336 The button Scan all will generate a file with all channels and adapted values Some important channels used for adaptation Channel 50 is used for adaptation of new parts Usuall
106. h Magneti Marelli UDS 9812 rsrrnervnrnrrnvrvnnrnervernrenernernrensesveeververneenesvesneenessvseresvesnesvesveesenen 34 2 5 1 4 Special functions JCI with NEC uC and 95320 EEPROM 35 2 5 1 5 Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM 36 2 5 1 6 Learning key with EZS RES Von 38 225 1 7 Reading changing VIN vecina ASIA AAA TT TTT A AAA ASAS Ryan roan 39 2 30 18 Reading Writing BEPROM ii AA iaa 39 2 5 1 9 Program a blank key so it becomes like a dealer Key 39 2 5 2 Special functions with BCM2 4124505 40 2 3 2 1 Read BOM by OBD ML aaa 41 Version 2 31 4 ABRITES Commanper For VAG 18 x Document number 2 20071127 Date 01 06 2013 2 522 2 R ad BEM2 with ABPROG tosis cscs fick desse a inte dd tne dete A sen een Gets deme bones ektet 43 2 5 2 3 Key learning procedure s 25 24 Alar O FE Suena EE E E A E EE E E AE EENEN LIDO CAM ON a o e na eee 2 5 3 Special functions with instrument K Line 2 5 3 1 Transferring keys from one RB8 instrument to another see ee eee eee 48 2 5 3 2 Exchange RBS Instrument sunset aent eee eee ee ENESTE eee 2 5 3 3 Removing RB8 RB4 DEF error 2 5 4 Special functions with Engine Control UIF 52 2 5 5 Special functions Component protection c ccccccecccccsccsceseneessessesessesseeseesesseesceseesseeceseneseeserenesiesiesnsessaeeeaeens 55 2 5 5 1 Component protection generation 1 2 5
107. h was not build into a vehicle The information about the PIN CS MAC can also be obtained if you have the EEPROM and Flash dumps from the engine control unit 2 5 7 Special functions Immo III IV parts adaptation This special function is dedicated to adapt virgin or to reuse second hand immobilizer parts e g engine control units immobilizer Kessy transmission gear box from one vehicle to another In general some Immo III parts e g the earlier EDC16 and ME7 and all EDC15 allow to adapt parts using only PIN code and adaptation on channel 50 But for the VW Seat Skoda starting from 2007 and for Audi starting from 2003 2004 this is no more possible This special function is dedicated exactly for these parts which do not support the channel 50 adaptation E g for engine control units this also includes not only the Bosch EDC16 MED9 but also EDC17 MED17 and also Siemens VDO Simos PPD and Simos 9 x 6 x 7 x engine control units When the function is selected the customer has to choice what part what to adapt There are following possibilities engine control unit Audi A8 VW Touareg Phaeton Porsche Cayenne or Bentley continental immobilizer Kessy Passat B6 CC immobilizer comfort module Transmission gearbos for Audi A6 Q7 Allroad 2003 2 5 7 1 Adapting engine control units To adapt engine control unit to the car you need if the engine control unit is virgin you should only put the new CS 6 or 7 bytes
108. h will take a long time especially when CAN connection is used as result the battery may become flat 2 5 5 Special functions Component protection As part of the security strategy some parts of the modules build in the VAG vehicles implement the so called component protection This is a mechanism dedicated to prevent exchange of modules between different vehicles without central authorization from the VAG online database Such modules build in another vehicles activate the component protection active DTC and are with restricted functionality when build in another vehicle This special function allow to remove this component protection active trouble code and allows to the module to works with its full functionality The component protection start to be implemented first in the A8 2003 and in the A6 2004 vehicles Component security is not implemented in all VAG vehicles There are actually two types of component protection generation 1 and generation 2 Component protection generation 1 is implemented in the A8 2003 vehicles while the A6 Q7 Allroad 2004 is using component protection generation 2 for most of the modules and only few of the modules are using component protection generation 1 In the beginning the customer has to select which generation want to use Gina comma RE eee aaa Select component protection type C Generation 1 Audi A8 2003 2010 Audi A6 2004 2008 MMI CD Changer ILM
109. he ABRITES Commander for VAG will try to connect to the device using consecutively the following protocols KWP2000 over TP2 0 with baud 5000KB s CAN KWP2000 over TP1 6 with baud 5000KB s CAN UDS over ISO transport protocol CAN KWP1281 or KWP2000 over K Line the protocol is recognized automatically from the wake up pattern You can choose which of these protocols to try when attempting to connect as described in the Configuration section 2 1 Configuration The ABRITES Commander for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed Special functions amp Vehicle Selection 1 Broadcast Mo Options Used protocol for diagnostic K Line baud rates trying sequince r Language CAN TP 2 0 104721 9600 English Advanced Y 9600 4 10472 y ld E NES K Line used OBDII PINs E K Line KwP2000 KWP1281 Legging 1 03 M7 O15 Enable CAN log Antena factor 5 r CAN Resistor Test 120 Ohm v Apply DES Enable K Line log NOTE changes regarding interface detection and timing parameters which you made in this dialog will be applied after restarting the application Instant Logging 2 1 1 Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP2 0 with baud 500KB s CAN TP1
110. he PIN code after that to load the comfort module EEPROM dump and the Program button will become active After pressing the Program button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done When the transponder is ready you will have all the component security bytes displayed in the status bar After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MED9Y Key Learning Wizard mode D ABRITES Commander for VAG Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Function Program dealer key I0 x To learn a key to this car you should make first a dealer key Prepare dealer key 1 Select Program Key and press Next 2 The following window will appear D ABRITES Commande
111. he current key count E g in the example above they are 22 and this means two keys are present i e the identifiers in fields KeylD1 and KeylD2 will be used If you want to erase the keys you should put there 00 instead 22 if you want only 1 key to be active you ve to put there 11 and so on Key Learning Wizard mode After you choose Wizard mode the key learning special function will automatically detect this vehicle type lol Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia I 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN S Function Adds one key to the existing keys without erasing them Back Next gt Exit Learn keys 1 Select Add Key and press Next 2 After the window with immobilizer data appears press Next to start the key learning procedure For to make a key for this vehicle type it is required to enter into so called service mode The commander will automatically try to do this after you start the key learning procedure If you have a working key from the car service mode should be automatica
112. he login and calculates mileage No license required Audi A3 A4 A6 UKNSI 1997 1998 mileage and login code 93C56 displays the login and calculates mileage No license required Audi A3 A4 A6 UKNSI Japan mileage and login code 93LC56 displays the login and calculates mileage No license required Audi 100 VDO 1995 mileage 94C46 calculates mileage No license required Golf 3 VDO 1995 mileage 93C46 calculates mileage No license required Golf 3 VDO V3 9 mileage 93C46 calculates mileage No license required Golf 3 Diesel mileage 93C46 calculates mileage No license required Golf 3 Motometer V5 8 mileage 93C56 calculates mileage No license required Polo Motometer mileage 93C46 calculates mileage No license required Polo Motometer 1996 mileage 93C66 calculates mileage No license required Passat VDO 1991 mileage 93C56 calculates mileage No license required Passat VD202 1993 mileage 93C46 calculates mileage No license required Passat GT mileage 93C46 calculates mileage No license required Passat GT mileage 93C56 calculates mileage No license required Caddy mileage 93C56 calculates mileage No license required Corrado VDO 1993 mileage 93C46 calculates mileage No license required Corrado MotoMeter 1991 1995 mileage 93C56 calculates mileage No license required Corrado VDO 1991 1995 mileage 93C56 calculates milea
113. he number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press OK After pressing the OK the instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working 2 Preparing a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Put how many dealer keys you want to program and press the Program dealer key It is not required to enter anything the VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can proceed like in the case Learning dealer key purchased by VIN number NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 Key Learning Wizard mode eli Select vehicle immobilizer type Select function Seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Program Key Skoda Scout
114. hen you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the VDO NEC 2009 special function because the key functionality for that vehicles is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VDD or VDO So for such cars open the VDO NEC 2009 special function and the following dialog is brought to you To make keys read mileage for these cars it is necessary to enter first into the so called service mode VDO with NEC Microcontroller 2009 x r Service Mode order to enter it again Load EEPROM 24C032 24C64 dump Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the EEPROM content with programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the EEPROM dump in Enter Service Mode by Leave Service Mode by OBDII OBDII ABS coding Read write EEPROM Flash 15 Je om Mileage Write Mileage 0 00000030 60 83 4D E4 DD 19 SF 8C M _ 00000038 CE FD 60 92 85 3C F8 F3 lt L fom of ile Immo Data VIN 3VWLW2166BM111111 Read Immo data Serial number m Transponder identificators sea Pett
115. here is no working key then the service mode is entered and all changes should be done before the service mode is leaved Otherwise if the customer wants to enter once again into service mode he will need to modify the EEPROM once again with a programmer NOTE For the dashboards with the colored TFT display it is specific that the dashboard remains dark until the service mode is active 2 5 1 3 Special functions with Magneti Marelli UDS 9S12 The Magneti Marelli UDS 9512 special function is dedicated for the Magneti Marelli instrument clusters with 9512 microcontroller and UDS diagnostic protocol Typically these are produced after 2009 year After starting the function a following dialog will be brought to the user in the example below immo data is read Magneti Marelli UDS with 9512 Microcontroller m Magneti Marelli Dashboard with Motorola 9512 microcontroller and UDS diagnostic protocol To make key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press Add key After several seconds the key will be ready The learned key will be added to position key count 1 Le if pou want to erase all existing keys and program one new key first put 0 for the key count and then make the key x ABS coding Mileage Read mileage Mileage 0 Read write EEPROM Flash 35 30 FF 4B 30 39 46 20 FF FE EF EE FF eC
116. i 1 El 1 4 4 Audi Q7 To get communication with the ECU you need to short the fuses as shown on the picture below If not succeeded to communicate with the ECU then you should try as on the picture below If you re still not able to get communication with the ECU it is possible to make short of the external fusebox it is found under the front cover where also the engine is You ve to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you ve to use a bigger cable because if you use a small cable it can become hot 4 5 Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below 4 6 Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below 4 7 VAG K CAN Commander key learning procedures Programmer da needed Key Learnig procedure Audi A2 la ox reos AudiA3 2008 oBD tras Megamos 48 Audi A3 2003 2007 OBD CAN Key programmer dealer key Procedure 3 Megamos 48 Audi A3 2007 OBD CAN Key programmer dealer key Procedure 3 Audi A4 2003 oap TP08 Audi A4 2003 2008 OBD K Key programmer dealer ke Procedure 6 Audi Ad 2008 ma dagan 1 na Audi AS 2008 oBDK rro Audi A6 RS6 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Blank key for Audi Allroad 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 ar moro Audi Q7 2004 OB
117. ic 0B Air heating OD Slide door left 7 H Special functions Vehicle Selection T Broadcast Options gt y ca n S CAN Ed KLine a A PN Instrument EZS Kessy BCM2 Instrument Engine Control Component EDC16 MED9 A8 Touareg Steering lock CAN 07 46 AAAS K Line Unit protection A adaptation b Kessy ada adaptation BEN 05 Cy DSG tt D S A W e amp 4 ae TV activation Key leaming Dump tool Airbag VW Crafter DSG Mileage Custom PIN Converter Remote ED2 Read Write control a SAT imam DR dl ATTENTION Make sure you are running the ABRITES Commander for VAG from its folder If you are using a shortcut to the ABRITES Commander for VAG please be sure that the working folder parameter is set to the folder where the executable is placed If the working folder of the shortcut is not set the K Line may function incorrectly 2 Diacnostic witH ABRITES COMMANDER FOR VAG The ABRITES Commander for VAG consists basically of two parts Standard diagnostic functions like reading clearing trouble codes device identification adaptation measured values etc Special functions like reading login PIN reading EEPROM etc All devices which can be installed into the car are listed in the main screen of the ABRITES Commander for VAG with their VAS Number If you want to connect to some device please double click on it T
118. ilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool x Type ECU EDC16 Immo bypass 95320 v 8 16 12 04 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 Save dump 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 Swap bytes L7H 00000040 00 06 05 00 04 24 10 75 A6 30 32 38 31 30 31 32 u 0281012 scl te AAA 00000050 31 31 39 20 20 00 00 00 16 9C OF DS OA 18 FA Bl 119 00000060 00 04 ZA 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 036906021A Toggle Immo On Off 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 09 F GE n 000000A0 00 04 ZA 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 0369060214A O00000BO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC oooo00co 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 09 FR GE eee eee n OOODODEO 24 F3 C5 72 49 E BA CD DA 00 00 00 56 57 54 43 rl VWNZC OO0000FO SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72 49 E 8A CD DA 00
119. ing brake perform Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness 2 5 20 Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle called in the application active ECU and the EERPOM dump of the engine control unit with which you wish to replace it called in the application replacement ECU After opening the application load both dumps using buttons Load active ECU dump and Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in the replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device after that ECU Exchange Dump Tool x Choose ECU type EDC16 PM Load active ECU dump Y Load replacement ECU dump Change replacement ECU dump Save replacement ECU dump 2 5 21 Special function Door unlocking This function is dedicated to open the doors of the car when the car is in SAFE mode To use this function you
120. instrument will be reset and x value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 13 9 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne You must use a virgin transponder PCF7936 or a virgin key no need for some special preparation If you use a Transponder you need to switch it in Cipher Crypto mode You can use your Key programmeror HiTag2 programmer for that purpose if you have one This is done by replacing 0x06 with Ox0E in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already OxOE then the transponder is already in cipher mode After the transponder is switched into cipher mode the key learning procedure goes as follows Key Learning Standard mode From Special
121. ion data 95080 Required license AN009 This function allows to view and or change the component protection data found into the MED9x with ST95080 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Dump Tool 2 x Type ECU MED 9 x Reset component protection data 95080 s 97 ES 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 4 FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 G 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 5A 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 00000060 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 2i gt 2a 00000070 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt eee eee 0000080 component security data OOOO Poona ds 0 0 0 Cancel ECU MED
122. ion has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponder
123. ity access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through CAN for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool x Type ECU Simos 7 CAN Security Access Code 93CC76 93C86 00000070 56 57 54 43 54 30 30 30 33 33 33 33 30 30 56 57 vuzczo003333ovw Login 1138 00000080 54 43 54 30 30 30 33 33 33 30 30 30 56 57 54 43 ZCZ000333000VWZC 00000090 54 30 30 30 30 30 33 33 30 30 57 56 57 SA 54 SA ZO00003300UVWZZZ 00000040 33 43 5A 38 33 33 33 33 33 33 33 57 56 57 54 SA 3CZ83333333WVvUWZZ 000000BO 54 33 43 SA 38 50 31 33 33 33 33 33 57 56 57 SA Z3CZ8P133333WVWZ 00000000 5A 5A 33 43 54 38 33 33 33 33 33 33 33 00 00 00 2230283333333 O00000DO 7C 7C 30 39 30 37 30 33 47 39 30 36 30 31 38 46 090703G906018F 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF 01 18 Ol 84 G 000000FO 01 05 00 03 18 07 01 18 01 84 01 05 00 03 00 00 00000100 7C 7C 01 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G690601 y gt ECU Simos 7 CAN Reset component protection data 93C76 93C86 Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos 7x generation which are accessed through K Line or CAN for benzine engines Int
124. ke Procedure 10 come onp can Keyprogammer demertey Procedureto VW Passat 7 2011 OBD CAN Key programmer dealer ke Procedure 10 vw Phaeton o7 om ammer ty procedure VW Phaeton 2007 OBD grammer ke Procedure 7 k HITAG 2 Key pro PCF 7936 or VW Touareg 08 2007 OBD K grammer ke Procedure 7 HITAG 2 Key pro PCF 7936 or VW Touareg 08 2007 OBD CAN grammer ke Procedure 8 40812006 OBD CAN P23 Megamos 48 VW Touaran 08 2006 2009 OBD CAN Key programmer dealer ke Procedure 3 HITAG 2 Key pro PCF 7936 or VW Phaeton 2008 OBD grammer e Procedure 8 portas El pees VW Touaran 2009 UDS Key programmer dealer ke Procedure 11 EE am gt PO mz Porsche Cayenne 2007 OBD K grammer ke Procedure 7 team mere osoon te oe Porsche Cayenne 2007 OBD CAN grammer ke Procedure 8 vent or cana er Bentley Continental 2007 OBD K grammer ke Procedure 7 Bentley Continental 2007 OBD CAN grammer ke Procedure 8 4 8 Dump tool special function The dump tool receives as input a dump file from the corresponding unit input dump is loaded with the Load dump button The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is not possible As output the dump tool displays some data extracted from the input file and or makes some modifications to the input data If any modifications were made for some sub functions there are no modification
125. ke Procedure 3 rem ar omme seem ter os VW CrossFox 2005 OBD CAN Key programmer dealer ke Procedure 3 VW Suran Space Fox SportVan Fox Megamos 48 Plus 2006 OBD CAN Key programmer dealer ke Procedure 3 Megamos 48 VW Fox 2005 OBD CAN Key programmer rm ke ME 3 VW Polo 3 1997 2004 OBD K TA E 7 1 Megamos 48 VW Polo 4 2004 2009 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 VW Polo 5 2009 pen Key programmer dealer oe Procedure 11 VW Got 3 1988 ogpk meos VW Gott 4 ere a TP08 VW Golf 4 Cabrio 1998 OBDK TP08 Procedure 2 or VW Golf5 08 2006 OBD CAN not needed TP23 Procedure 12 Procedure 3 Megamos 48 or VW Golf5 08 2006 OBD CAN Key programmer dealer ke Procedure 12 Procedure 2 or VW Crossgolf 08 2006 OBD CAN not needed TP23 Procedure 12 Procedure 3 or VW oe 2006 OBD CAN not needed een E 12 VW rel Plus 2004 OBD CAN Key programmer Mirad ke S vn 12 Procedure 11 OBD CAN Megamos 48 or VW Golf 6 2009 UDS Key programmer MESA ke Procedure Lo eee VW Jetta 08 2006 OBD CAN Ba MIA 2 poro owes coca ne pos VW Jetta 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 Procedure 11 VW Jetta 2009 ae Ke ue ER ke Procedure eee El ok K not ke EG La 1 EE EO r VW Bora 2009 UDS Key programmer dealer ke Procedure 11 E nn VW EOS 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 lweos ame Ups keyprogrammer_ daslerker Provedum 11 VW EOS 2009 UDS
126. l Flash 175 4 9 11 ECU Vag MED 17 5 5 TC1766 Internal FLASH ccccccceccssecsssesessesenseseeseseneesensesensceeceeeseeseeeenseeeeneeeseens 176 4 9 12 ECU Vag MED 17 5 20 TC1766 Internal FlaShinau rriaire enari iiin E iiaa k eiia 177 4 9 13 ECU Vag MEDI7 1 1 TC1796 Internal Flash sese 178 Version 2 31 6 ABRITES COMMANDER for VAG 18 x Document number 2 20071127 Date 01 06 2013 Version 2 31 1 INTRODUCTION Abrites Commander for VAG is a Windows PC based diagnostic software for the vehicles from VAG With the help of this tool you can perform operations with vehicles from the VAG group which are in most cases unsupported from the producer diagnostic testers The Abrites VAG Commander provides you also a full diagnostic capabilities for VAG vehicles 1 1 Installing ABRITES Commander for VAG The ABRITES Commander for VAG is contained into the installation package so please run the setup program Now you are ready to start the ABRITES Commander for VAG When starting the software there is a splash screen appeared where the connection with the hardware is examined If no problem appear then a message Connection OK should appear The main screen looks like this Engine Control Unit Master 02 Transmisson eo 03 ABS 04 Steering Angle 05 EZ5 Kessy Entry And Sta 06 Seat memory passenger rE 07 Control head 08 Climatronic Auto HVAC Connect 09 Central Elect
127. lder Problem Some device cannot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file 4 APPENDIX 4 1 Programming instrument clusters from Magneti Marelli K line diagnostic link 4 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these type is possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending of the production year of the car So you have to select the one of the both types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are continue to be equipped with older instruments even if they are after year 2000 So the best way is to choose first the Instrument Cluster Magneti Marelli Direct 1996 2000 if not succeeded you have to make the ignition OFF and again ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If succeeded to read the PIN code and mileage are automatically recognized and displayed for Magneti Marelli direct types but in case of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number OOOUSB10 FF FF EF FF FE FF EP FE FE E
128. lly entered In other case if you don t have a working key from the car and service mode cannot be entered by OBDII the commander will ask you whether you want to enter service mode by EEPROM dump If you choose to enter service mode by EEPROM dump you have to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered Dashboard is equipped with 24C64 EEPROM you need to read the EEPROM with a programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered After service mode is entered 3 The following window will appear lolx Immobilizer Keys Key 1 68e4c4f1 Key 5 6d768ef4 Key 2 b704fdec Key6 5ca38efa Key 3 d2da21be Key 7 d4c12be Key 4 58ff4 Key 8 PEF Configuration 210103780600 Add Key
129. lp you to prepare the dealer key After obtaining the dealer key you can learn it normally as on normal Passat B6 The customer has to choice the vehicle model for which it wants to learn a key In the background the system tries to determine automatically what vehicle model is If succeeded the recognized model will be selected automatically If the system cannot recognize the model the user has to choice the model manually NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW CAN 2007 and VW CAN 2007 for that reason by default VW CAN 2007 is selected by default After the vehicle model is recognized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignit
130. mmander for VAG 06 01 2010 3 5 16 Update to V7 3 of the ABRITES Commander for VAG 21 01 2010 Update to V7 4 of the ABRITES Commander for VAG 15 02 2010 Update to V7 5 of the ABRITES Commander for VAG 25 03 2010 15 05 2010 3 Update to V8 0 of the ABRITES Commander for VAG added section 2 19 for the CDC32xx programmer 22 02 2010 Update to V7 6 of the ABRITES Commander for VAG Update to V7 7 and V7 8 of the ABRITES Commander for VAG 2 21 27 05 2010 3 7 Update to V8 0 of the ABRITES Commander for VAG added section 2 for VW Crafter 9 09 2010 Update to V8 4 of the ABRITES Commander for VAG Pape e002 et Update to V9 0 of the ABRITES Commander for VAG Teer NE Update to V12 0 of the ABRITES Commander for VAG i n Update to V13 0 of the ABRITES Commander for VAG E o o N o N id Added ECU adaptation by OBDII chapter Added Key learning wizard mode Loe Added BCM2 key learning procedure EEE Version 2 31 2 8 05 2012 r 13 06 2012 1 2 3 4 5 6 7 8 21 04 2009 3 Update to V6 5 of the ABRITES Commander for VAG Procedures 9 for Q7 A6 Allroad described 19 05 2009 2 3 7 Update to V6 6 of the ABRITES Commander for VAG 2 10 0 3 4 5 6 6 7 2 2 2 2 2 2 2 Component protection chapter added 2 Chapter Remote control adaptation updated Chapter Special functions with VDO NEC updated Chapter Coding of the unit updated Chapter Repair RB8 DEF
131. mo On Off button allows to switch on off alternatively the bypass function Steering lock VW Passat 6 Security code 68HC908 Required license AN003 to view security access code and AN009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola microcontroller the unit can be either with ELMOS or Motorola microcontroller The function displays also the component protection bytes by pressing the Other data button Dump Tool i x Type Steering lock Yw Passat 6 Security code 68HC908 A ir LEE Load dump b 00000030 33 33 33 33 30 30 30 30 30 30 30 30 30 30 30 30 3333000000000000 EN 00000040 30 30 DA DA DA CD CD CD 57 57 57 56 56 56 57 57 00 WWW AROS 00000050 57 5A 5A 5A 5A 33 33 33 33 33 33 33 33 33 33 33 UWZZZZ33333333333 00000060 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 3333333333333333 Login 52698 00000070 33 33 33 33 33 33 33 33 33 33 34 F F6 F6 AC AC 33333333334 ECU Simos 7 K line Login code 93C76 93C86 Required license AN006 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is a
132. n for reading current mileage value is not available ATTENTION Please take care that some instrument clusters from Audi A3 and Audi A8 are with blocked access to these special functions This can be recognized if after reading of current mileage value is displayed unreal value To restore instrument cluster to normal behavior need to be removed for one minute fuse of instrument cluster for example on Audi A8 can be used fuse number 5 Reason for blocking of security access is usage of bad diagnostic tools in the past ATTENTION ABRITES Commander for VAG is designed to calculate mileage values in KM units Please take this into account especially when using dump tool or when VAG Commander asks you about displayed value of instrument cluster Audi Q7 Audi A6 Audi Allroad 2 5 1 2 Special functions with VDO NEC The VDO NEC special function is dedicated for the VDO instrument clusters with NEC microcontroller Typically these are VW Seat Skoda Audi cars produced after 2009 year After starting the function a following dialog will be brought to the user VDO with NEC Microcontroller 2009 x r Service Mode Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the EEPROM content with programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the EEPROM dump in order to enter it again
133. n is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e g by dissoldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and proceed as described in step 2 1 3 After the key is programmed like a dealer key write how many keys you need to program write security access and push Learn button Key Learning Wizard mode lolx Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9812 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN S Function Program dealer key Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options EY ABRITES Commander for VAG JB S Select an option Component Security Bytes From Kessy ECU Dump Manual Input of the Component Security Bytes amp Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying A Find the 7th Byt
134. n module to the vehicle To learn the module to the vehicle it is necessary to have the Gateway EEPROM dump from the car where you install this module Step 2 1 Learn module to the vehicle To learn the specified module to the vehicle you need the EEPROM dump of the GATEWAY module from the car where you want to build the module You can read the dump by OBDII but this will reflash the gateway or you can load the EEPROM dump Please specify how to proceed Read by OBDII ATTENTION this might reflash gateway if it is not already reflashed C Load gateway EEPROM dump You have the option to read the Gateway EEPROM dump manually with a programmer or to read it by OBDII Reading by OBDII takes normally about 3 4min but requires a module reflash If the gateway is once reflashed further operations of the EEPROM reading don t need reflash So the customer has the option to select whether he wants to read the EEPROM dump by OBDII or to read it with a programmer If he selects to read by OBDII then the next dialog displays the status of the operation A ABRITES Commander for VAG Sox Reading gateway EEPROM by OBDII Connecting to CAN Gateway OK Checking EEPROM access OK Reading EEPROM OK Gateway EEPROM read with SUCCESS Once the EEPROM data are read loaded the adaptation of the component protection is performed Once this step is completed successfully the module should be fully functional TA AB
135. nit is displayed This is very important value which is stored inside the engine control flash and cannot be changed This value should be the same for the engine control unit and the immobilizer this means if the old broken engine control unit is from one power class and the new one is from other the car will not start even if the adaptation procedure was completed The meaning of the power class value is to prevent putting one engine control unit from e g 3 0TDI to car with 2 0TDI 2 5 7 2 Adapting Audi A8 VW Touareg immobilizer Kessy This special function is dedicated to adapt second hand immobilizers from one vehicle to another In general the earlier VW Touareg VW Phaeton Porsche Cayenne Bentley continental allow to adapt the immobilizer using only PIN code and adaptation on channel 50 But A8 and later VW models after 2007 require to use this special function To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car where you take the replacement second hand module Starting this special function the following dialog is displayed E Load Kessy dump Specify manually the existing CS PIN of the engine control unit New immobilizer data Immo number VIN Power class ES So you need to load the EZS Kessy EEPROM dump or to ente
136. nt month YYYY is current year and XXXXXXXXX is ABS part number example ABS 18 02 2013 1K0907372BL bin in this file you will find saved ABS coding and vehicle VIN number example VIN TMBAB73TXC9033333 Coding 113B200D092700FC880C04EC901F0040300000 Second option From special functions start Coding calculator Select device ABS left column Select ABS type by part number right column Press Next Select the proper options and fill in the VIN field Press button Calc New Coding If you already have coding value you can type it into field Coding and press Show coding info to see which options are checked selected Service Mode is leaved when if you entered the service mode using a programmer then Leave service mode will leave it If you want to enter again you need to modify the EEPROM dump again Pressing the Reset button will not leave the service mode if you entered the service mode by OBDII both the buttons Leave service mode and Reset will leave the service Once the service mode is entered you can Read Write the whole EEPROM Read the whole Flash Read the mileage Read Write the immobilizer data Make key for the car NOTE Sometimes writing of the data may fail In order not to lose the information all written data are backed up in the Dumps subfolder NOTE For the dashboards with the colored TFT display if t
137. o the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool S aa gt x Type ECU Simos 7 CAN Reset component protection data 93C76 93C86 M2 AC AZ AC AZ AC 54 00 54 00 54 00 01 00 01 OG T T T et 00000010 01 00 00 00 00 00 00 00 00 00 00 00 00 00 E OF e eee eee 00000020 E7 OF E OF 00 00 08 38 00 1C 00 00 00 04 00 00 stas 00000030 00 00 00 00 2D 2D 2E 2D 2D 2E 2D 2D 00 00 00 00 00000040 component security data e 00000060 P 00000070 og E 5 sc L a a jo 000 oo000090 New o o o o H 0 0 000000C0 70 7F 00 00 EB 02 80 80 80 80 80 80 80 7F 7F 80 D ccccooooo 000000D0 80 80 80 80 7F 80 80 80 80 80 80 80 80 80 80 80 oooooooomo 000000E0 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 oooooooooo 000000FO 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 00000100 80 80 80 80 80 80 80 80 80 7F 7E 80 80 80 80 FF ooooooto y b ECU Simos PPD1x Reset component protection data Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPD1x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7
138. ode Using Dump Tool Login Code 0 cox Je ta You can choose from three variants to obtain Login Autodetect If this option is selected by pressing Next the system will try to read login component security automatically lol Autodetect Login Code Write Login Code xi Load er i Investigating cluster Please wait Login Code 0 lt Back Next gt Exit If login is read successfully it will be put into field Login Code and the system will automatically proceed to the next step Write If Login is already available to the user he she can put it down directly into the field Login Code A ABRITES Commander for VAG E si C Autodetect Login Code Write Login Code C Load Login Code Using Dump Tool Login Code 36750 Next gt Exit Load using Dump Tool If this option is selected the button Dump Tool will be enabled Pressing this button will open the Dump Tool special function which you can use for the obtain Login code from a dump Load Login Code Using Dump Tool Select an option and press Next The following window will appear EY ABRITES Commander for VAG Jo x Immobilizer data Current key count 2 Transponder type OK No Dealer key transponder Yes ECU responding No Key transponder locked Yes Engine start permited No Key transponder learned No Login acknowledge 0 Transpond
139. ols will be used when scanning for the devices For all devices which the ABRITES Commander for VAG finds a detailed information is displayed in the main screen For each device the following information is shown VAS Number Unit name VAG Number returned by device in the device identification Description returned by device in the device identification Coding returned by device in the device identification Part Imp Supp N Part number Importer number Supplier number information is shown separated with spaces also returned from the device in the device identification DTC number of DTCs stored in the unit Instead of scanning all units which can take a while the user retrieves the list of the installed devices from the gateway by pressing the Gateway config list button Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing DTCs are not accepted from all units there is a possibility to scan all devices and if connection to the device is possible then its DTCs are cleared This is made by pressing the Clear all DTCs button from the Auto scan devices panel Once again the protocols used to connect to the devices are specified in the configuration options 2 3 Broadcast requests Broadcast requests are these requests which are sent to all or a group of devices simultaneously The ABRITES Commander for VAG
140. or CAN vehicles 2008 Passat B6 Audi A3 CAN 94 2 5 13 5 1 Programming a dealer key with all 7 bytes available 97 2 5 13 5 2 Finding the 7th byte In case of Standard Mode rica sea adios 97 2 5 13 6 Procedure 4 No more applicable Use procedure 3 instead eeseeeeseseseeeceeceseesessecseeneseeseeeneceaeesseessaeessas 99 2 5 13 7 Procedure 5 No more applicable Use procedure 3 instead sss 99 2 5 13 8 Procedure 6 ifor AudtA4 RB8 s naaa daa ii iii ea 99 2 5 13 9 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne simo rta cole nan eea e Ee eae pei 101 2 5 13 10 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 2 5 13 11 Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 2 5 13 12 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MEDI7 enrnnervrrnvrvvrvrervernnenernervernrensee 109 2 5 13 13 Procedure 11 for vehicles with VDO dashboard with the NEC microcontroller 113 2 5 13 14 Procedure 12 for vehicles with Visteon dashboards mservnrvervrvnvvrrervervrververerverersarvererversearversrverreservarservennne 116 2 5 13 15 Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9812 microcontroller AAA A ENE AAR A A iaa 118 2 5 14 Special function Dump Tool ccccccccceccccsssssseeses
141. or VW you must use Virgin key or Transponder TP23 f Exit NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer This is done by using the Produce TP22 TP23 TP24 TP25 transponder button This requires only a connection with the Key programmer no connection to the car is needed The key learning procedure when have a Tp2x transponder is the following 2 1 Enter the security access code and the number of keys 2 2 Turn ignition ON new or existing key 2 3 Press button Learn 2 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining keys to stop working You will be asked whether you want to use this feature Please answer with yes no according to your wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys Key Learning Wizard Mode NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer To do this choose the Program Key function and press Next This requires only a connection with the Key programmer no connection to the car is needed lolx Select vehicle immobilizer type Select function VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 VAG vehicle
142. ou can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7in byte at least when you prepare such keys for the first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU by selecting the Component Security Bytes Kessy ECU dump After pressing the Load button you ve to select the respective dump file Press Next to proceed with key programing NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer Making the key in
143. ove any shorts made in order to read the engine control unit After any shorts are removed the procedure continues and the keys are learned On the display you will see 0 1 and when you put key should change to 1 1 In that order you can make a key even if all keys are lost Starting from V18 0 is possible to re learn any dealer keys from this main dialog also for the Immo IV systems You should first autodetect PIN CS and then you put how many keys to learn In that way you can learn also keys for the UDS immobilizers but also for the A6 Allroad Q7 vehicles So if all keys are lost and you want to make 2 keys you can make the procedure for ALL KEYS LOST twice this will prepare 2 dealer keys and then to learn 2 keys 2 5 13 2 Key learning procedures Pressing Wizard Mode the system will try to detect automatically the vehicle model EY ABRITES Commander for VAG 16 0 ww s72 c Jod 4 Unit name fvasmumber Description fore coding 00 01 Engine Control Unit Master 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory pa see x 07 Control head 08 Climatronic ac Investigating vehicle 09 Central Electi Previous E gt Connect 0B Air heating Special functions CAN 1 Instrument E2S Kessy Instrument Engine Control Micronas VDD NEC Magnetidash Component EDC16 MED9 CAN 07 4
144. prepare a dealer key Pressing the Write EEPROM button respectively will write the EEPROM ATTENTION Now is possible also the area 100 to 15F to be written To write this area it is necessary to have a working key This is the area containing the immobilizer data Do any modifications here very carefully because if you modify some of the immobilizer data especially the component security in the range 100 123 the car might stop starting because key will be not recognized if you change the component security and it will be not possible to write this area again because there will be no more working key If this happened you might need to learn new key to the car in order to be able to write this area again e g learn brand new transponder or you can unlock the original key make it dealer key and learn it again then it will be possible to write this area 2 5 1 9 Program a blank key so it becomes like a dealer key You need to put the login and the component security bytes as described above and then to press the Make dealer key button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned with the learn button 2 5 2 Special functions with BCM2 A4 A5 Q5 This special function is dedicated to learn keys to the vehicles equipped with the so called BCM2 Normally these are A4 A5
145. r for VAG I0 x c Autodetect Login Code Write Login Code Load Login Code Using Dump Tool i 0 Login Code lt Back Ext 3 Choose an option to supply Login code and press Next 4 If Login is available the following window will appear BF S Find the 7th Byte of the Component Security Bytes Find From Working Key lt Find the 7th Byte of the Component Security Bytes Automatic Trying mx __ Load Comfort Module EEPROM Dump cox Je ts Here you ve to choose and option from the above two after that to load the comfort module EEPROM dump and the Next button will become active If Find the 7 Byte of the Component Security Bytes Automatic Trying is selected after pressing the Next button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 or MED9Y 2 5 13 13 Procedure 11 for vehicles with VDO dashboard with the NEC microcontroller These are typically the models produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally w
146. r manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function After pressing the read button the customer has to enter the power class manually If you enter wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the Immobilizer Kessy will take the power class you enter ATTENTION If you put the CS manually i e you put 6 bytes of the CS and there is a working key for the immobilizer Kessy after finishing with the reading the Kessy will no more recognize the key To start to recognize it again you should put the 7 byte and press Change 2 5 7 3 Adapting comfort module on Passat B6 CC This special function is dedicated to adapt second hand immobilizers from one vehicle to another To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car where you take the replacement second hand module Starting this special function the following dialog is displayed E Exchange ECU by OBDII Load existing PIN CS from Comfort module dump Load comfort dump Specify manuall
147. r vehicles VW Passat B6 CC equipped with EDC17 MED17 If such car is equipped with EDC17 MED17 then it is not possible to read the component security from the engine control unit Instead it is only possible to read the PIN code from it Fortunately it is possible to program a key for such car You need to read the PIN from the EDC17 MED17 and also to read the comfort module EEPROM with a programmer Key Learning Standard mode Then you ve to select VW Passat B6 CC with EDC17 MED17 CAN from the key learning dialog To learn a key to this car you should make first a dealer key This is made by pressing the Program dealer key button which brings the following dialog Program dealer key Set transponder ype Megamos 48 VW TA3 y G All 7 bytes of the component protection data component security are know Find 7th byte and program transponder L omponent protection bytes 0 0 0 U 0 0 G Automatcial trying of the 7 byte possible when you can check in measured values when key is recognized m Program transponder from 7 bytes Component protection bytes L E L o Find the 7th byte of the component protection data Manual trying of the 7 byte after each attempt you can try with the key on the ignition Value for the autorization read by daignostic m Passat B6 CC with EDC17 MED17 Login Security code 34269 Load comfort module EEPROM dump oxen Here you ve to put t
148. re not present For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 Please pay attention that during the autodetection whether adding is possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that Key Learning Wizard Mode If this model is autodetected selected the system will also autodetect whether it is possible to add the key without erasing the remaining keys Please pay attention that during the autodetection whether adding is possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that If possible the Add Key function will be available into the list with key learning functions If you choose Learn Keys the key s will be learned normally other keys will be erased If you choose Add Key the key will be added to the remaining other keys will NOT be erased For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 lo x Select vehiclelimmobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN
149. rking Key Component Security Bytes 0 0 0 0 0 0 0 aw Je em The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are stored always at least 6 of the component protection bytes sometimes also the 7 byte is contained There are several ways to extract the component security In case of Wizard mode Select Autodetect component security and press Next The system will try to read the CS bytes from ECU or if possible from Instrument Cluster It will also automatically decide whether you ve the 7 byte or you ve to search for it In case of Standard mode Simply press the Autodetect component security select Autodetect component security and press Next in case of Wizard mode and the component security bytes will be read from the ECU This will also automatically decide whether you ve the 7 byte or you ve to search for it Also the login will be displayed in the status bar The autodetection is not always possible it works basically for EDC16 and MED9x engines which are using CAN diagnostic connection The component protection bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit then VAG Commander will show you the component security bytes Q00001D0 00 000001E0 00 000001F0 00 L m j R
150. rn keys Make dealer key Key count 1 Key authenticated Yes Key locked Yes Key learned Yes 2 5 2 4 Alarm OFF This option is dedicated for the case where there are no keys from the car If there is an alarm installed after unlocking the driver s door the alarm is started after 15sec If in the meantime the customer activate this function the alarm will not start Than the customer can unlock all doors by unlocking the driver s door once again Some vehicles do not have installed alarm and after opening the driver s door all doors are unlocked 2 5 2 5 Alarm ON After the alarm was disabled and new key was learned to the car it is recommended to restore the alarm using this option 2 5 3 Special functions with instrument K Line When this function is opened the following dialog appears Instrument Cluster Immobilizer K Choose IPC type Instrument Cluster YD066 YD086 Motometer v Y Read Va Load from file Ei Instrument Cluster YDO66 Y4D086 Motometer og YW LT Immobilizer 0 Immobilizer box VW GOL N White immobilizer box Audi A4 AG AB Read ROM Flash ResetECU Virgin Factory New Login pe Mileage VW Phaeton Touareg Bentley Continental Porsche Cayenne Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 0l Instrument Cluster Laborghini Gallardo 2005 Instrument Cluster Laborghini Gallardo 2005 Skip neg responses From this dialog you need to choo
151. roard 2005 CAN Add Key Program Key Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN x Function Learn keys lt Back Exit The auto detected vehicle immobilizer is selected into the left list with supported vehicle types If not auto detected the user has to select the desired model into the left list with supported vehicle types After vehicle immobilizer type is selected in the right box appears a list with supported key learning functions At the bottom of the window appears a short description of the selected function Learn Keys To perform key learning choose Learn Keys Add Key For some models it is possible to add a key to the existing already learned keys without erasing them If available select Add Key function for this case Program Key Some models require a dealer key To prepare a dealer key select Program Key After the desired function is selected press button Next to proceed To perform the key learning in most cases you will need the Login If you have selected Learn Keys pressing Next will lead you to the following window al Autodetect Login Code C Write Login Code C Load Login C
152. rol unit special function or decoded from EEPROM dump which is read with programmer It is also possible that the VAG Commander reads the required information automatically when you press the Autodetect button In this case the VAG Commander connects to the ECU and reads the login and CS automatically and then fill the required fields Sometimes by some reason is not possible to read the ECU and to get the component security from there In this case if the car has working key you can read the CS and PIN from the EZS Kessy using the Get component security from EZS Kessy by OBDII function If the car doesn t have any working key you need to open the EZS Kessy and to read its EEPROM with a programmer Then you ve to select the Get component security from EZS Kessy and to load the EZS Kessy dump After that you can learn make a dealer key also from such cars IMPORTANT If the car doesn t have any existing working key it is not possible to give ignition ON in order to get communication with the ECU So to be able to communicate with the ECU you ve to make short with the fuses as described in the Appendix After the login and the component security bytes are read you can restore the fuses IMPORTANT If the car doesn t have a working key communication with the EZS Kessy is possible only if you press the brake pedal So if don t have a working key before learning keys making dealer keys read write VIN read write EEPRO
153. s This value is typically set when trying to make keys for Passat B6 CC To perform the key learning you will need the Login and for some models also a dealer key One way to obtain the login is to press the Autodetect Login Security code button This will read the login and also the component security If after that the option for making a dealer key is opened this login component security will be used there automatically 2 5 13 1 All Keys Lost Starting from V18 0 of the VAG Commander there is a special button called ALL KEYS LOST PLEASE USE THIS BUTTON ONLY IN CASE ALL KEYS ARE LOST After performing this procedure any existing keys will be no more possible to use Also keys purchased from the dealer will also not work The All keys lost button is available for most of the Immo III and all Immo IV systems This means that with this button you can learn keys also for the UDS immobilizers for the Audi Q7 till 2013 Passat B6 CC Passat 7 etc It is necessary first to give somehow ignition ON to be able to communicate with the engine control unit For vehicles with regular key you need simply to give ignition ON but for systems with electronic ignition e g Passat A6 Q7 you need to short PIN1 to PIN16 of the OBDII plug Then press the ALL KEYS LOST button and after 1 2 minutes you should be invited to put the new key transponder into the programmer After the key transponder is written there is a message to rem
154. s You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi A4 BOSCH RBx 2 Read the EEPROM 3 If the displayed mileage corresponds to the real value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH RBx otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 3 1 Transferring keys from one RB8 instrument to another Starting from V5 2 of the ABRITES Commander for VAG it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Instrument Cluster Immobilizer K Choose IPC type Instrument Cluster Audi AA BOSCH RB8 CRYPTO 2004 v van ODA EE EE s e d 2 2 2 22 222222 2 Head RGOM Flash Reset ECU Reset Comp Repair RBS Security DEF
155. s made only data are visualized the user has to write the modified dump to a desired file with the Save dump button and then this modified dump should be saved back to the device via OBDII or with a programmer If data are read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data on 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means that for the same unit two different programmers can produce different dumps Normally the software tries to autodetect the byte order of the dump but if it doesn t succeed then you may need to use the Swap bytes button This buttons changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data are not valid e g displayed PIN is not accepted from the car please try to swap bytes to get result For some functions the swapping is made automatically for example the decoding of the Kessy but for some function the user has to made this manually A more detailed description of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license AN003
156. se the type of your instrument cluster immobilizer and then you can read write EEPROM read mileage read PIN code and so on Please note that only connection via K Line will be made KWP1281 or KWP2000 and this doesn t depend on the configuration options ATTENTION All read EEPROM dumps are stored in the Dumps sub folder of the ABRITES Commander for VAG so it is possible to restore the EEPROM in case of unwanted changes For the most of instrument clusters is implemented automatic parsing of data from the EEPROM mileage immobilizer For instrument clusters from Magneti Marelli please refer Appendix A If connection to Momometer instrument is not succeeded please send the file motometers txt to moto abritus72 com and this instrument will be added to the database till three business days Latest database for Motometer instruments is available on www abritus72 com mmdata bin NOTE Sometimes if you try to access the instrument cluster by selecting the wrong type the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnecting from battery For example this always happens for the Bosch clusters which will be blocked if accessed as Instrument cluster VDO66 VDO86 Motometer type NOTE Please be very careful when selecting Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instrument
157. sessesseeseesceseeceeeeeecneeneeseseeessesseeeeseeseeseeseceaeeseerseeeeaeeeas 121 2 5 15 Special function Service Intervalo 121 Version 2 31 5 ABRITES Commanper For VAG 18 x Document number 2 20071127 Date 01 06 2013 2 5 16 Special function Remote control Adaptation ccccccccccscceseeseeseeseeseeseesensenseneeueenecnesueeneseseeeesessenseesentees 121 2 5 17 Special function Navigation socie nnii aa a a e a a oa aa e a a a eie 123 2 5 18 Special function Cruise control SVStem cccccccccecceccsssessesseeseuseeseeseuseeeeesenseneseesneseceseeesseeseeseeseeseesenaeeeas 123 2 5 19 Special function Brake pads change cccccccceccscsecsesseevessessessecsevseeseeseeseeseesensseeseeenesnesnesnesnesiesieeeeeeeeeneeees 123 2 5 20 Special function ECU Exchange Dump Taa 123 2 5 21 Special function Door unlocking cccccccecccecseseeesseeeensenecsesseesecieeseeseeseesenseesensenecesenecnesneeneseseseneseneesnaeees 124 2 5 22 Special function Coding calculator Janssens isete eneren a de 2 126 3 TROUBLESHO OTING E AEE T E sonavdesedebescadeaueen si csasdesscousassa hadpshescsesdusstostsaassesae aces 128 4 APPEN DEX Cu da 130 4 1 PROGRAMMING INSTRUMENT CLUSTERS FROM MAGNETI MARELLI K LINE DIAGNOSTIC UNKI sese ee esse ee eee 130 4 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle 130 4 1 2 Instrument cluster from Audi TT K rsronrrnnrnronronrenrenrennennennennennererrerners
158. t module dump For to delete key from certain position write 00000000 in the key position field You can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to comfort module dump Change immobilizer status By pressing Set you can set immobilizer status NOTE Normally immobilizer status should have the value 2 It is recommended to change it if it is different r Write keys to Comfort module dump Change immobilizer status OK CANCEL Keys with data O0000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied positions and represent the data of the learned at the respective positions keys With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if it s type is appropriate TA3 it is also allowed to program transponder as dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car should start without making any key learning procedure
159. t the car put it in the programmer and press Find 7 byte from working key after 70 80 seconds the 7 byte should be found Automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to give ignition ON and place the programmer ring over the key when the key is on the ignition NOTE The automatical check might be not possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference between the automatical and manual procedure is that by the manual procedure you should put the key into the programmer then make a ignition with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively invited to put the transponder into the program and than to give it to the ignition Normally for the most models it is required that the key is in the ignition and you change only the position of the transponder You will be invited to put the transponder into the programmer then to put it near ignition lock so it is read by the immobilizer Exception from this is e g the Passat B6 For it it is required that you put the key with the transponder is put into the programmer then the key with the transponder is put into the ignition lock BUT TILL FIRST POSITION than again into the programmer and again into the ignition lock un
160. tain value see the list with the two columns text and value in the above picture or select certain value by combo box selection Check Select all check box to mark as checked all the check boxes from the check boxes list The coding value is represented into the edit field at the bottom of the window next to button Show Coding Value When certain item is changed this is automatically reflected into the coding value If you would like to see certain coding value meaning you should write down the value into the edit field and press button Show Coding Value 3 TROUBLESHOOTING Below you can find a list of typical problems and how to solve them Problem When starting the ABRITES Commander for VAG on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port COMxx where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES Commander for VAG If the interface is not recognized the USB interface appear with yellow exclamation mark in the device manager then you can try to solve the problem by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface drivers and Uninstalling USB interface dri
161. tart permited N A Key transponder learned No Login acknowledge N A Transponder acknowledge N A timeout timeout Press Next to start key learning procedure wo m Press Next to start key learning procedure iix rImmobilizer Keys Key 1 ba379bf4 Key 5 ffffffff Key 2 ba37c062 Key 6 ffffffff Key 3 a621df33 Key 7 TTT Key 4 73ccd92b Key 8 ffffffff Key count A Add Key lt Back Nert Exit To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required 2 5 14 Special function Dump Tool Using this application you can calculate security access codes calculate mileage and so on This application needs the EEPROM dump from the corresponding unit After the dump is loaded some modification will be made and you need to store the dump as a new file which you can program into the device For more details about the concrete functions please refer to the appendix 2 5 15 Special function Service Interval Using this application you can perform reset of the service reminder reset of the service interval parameters or change service int
162. the key learning a You have to put only the number of the keys which will be adapted Procedure 6 Audi vehicles equipped with instrument cluster BOSCH RBS with integrated immobilizer require different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason separated procedure is used The Key learning procedure goes in the following steps 1 Learning dealer key purchased by VIN number If you have dealer key purchased by VIN number you ve to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument it is displayed L7 v v where x is number of successfully learned keys and y is the total number which has to be learned When L v v is displayed you will asked to put each next key and to press OK After pressing the OK the instrument will be reset and sx value should be incremented until it reaches the y value NOTE This is not adding of the key but programming of all keys which will be accepted from car If you have vi The Key learning procedure goes in the following steps 1 Learning a dealer key purchased by VIN number If you have dealer key purchased by VIN number you have to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument is displayed L7 x y where X is t
163. the modified EEPROM dump again Dashboard is equipped with 24C64 EEPROM you need to read the EEPROM with a programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Enter service mode by OBDII and the service mode should be entered Once the service mode is entered the customer has the possibility to read write EEPROM and read flash and also to read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the configuration field In the configuration the digits on position 7 and 8 specify t
164. til the byte is found NOTE If you get XXX is displayed you need to stop on the current position and wait 10minutes before you continue ATTENTION For the Passat B6 there are some cars for which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of the component security from the engine you can extract the 7 byte from the comfort module EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you ve attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand whether for the desired car is possible by performing the following procedure a Connect with 25 Immobilizer and go to Measured Vaues Channel 2 b Put the original key or key with Megamos 48 transponder in this case in the Measured values you should have yes or 1 on the second possition of channel 2 c Eject the key so there is no key in the ignition lock If the second positions changes to No or 0 you CANNOT search for the 7 byte If the second positions remains Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put th
165. to any metal part There is also a picture with example how to connect to these wires After the wires are connected the customer has to press Read component protection data nn a Read A8 component protection data For A8 it is necessary to connect the AVDI to the internal CAN Bus not to the OBDII Find orange green CAN H and orange brown wires CAN L and connect the AVDI as shown on the diagram One easy way to connect is to disconnect one plug from the device under the drivers seet and there to put the wires as shown on the picture NOTE After the component protection data are read you should reconnect the AVDI to the OBDII before you continue Connecting to vehicle OK Raad After the component protection data are read the customer can continue with the adaptations LD ABRITES Commander for VAG ls Aim Component protection generation 1 Connecting to EZS Kessy Entry And Start Autorization OK Reading EZS Kessy with Algo 1 please wait may 1 2min OK Connecting to Central Electic OK Programming component protection OK Component protection is reset with SUCCESS 2 5 5 2 Component protection generation 2 This special function currently works on Audi A6 Q7 Allroad 2004 2008 In these cars the customer is able to adapt completely by OBDII without any restrictions the component protection for the airbag instrument cluster comfort module and EZS Kessy For the remaining modules
166. uire only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Dump Tool Type ECU MED 9 x Immo Bypass v plL 8 07 02 08 s 07 02 08 1037384968 71037383785 Load dump 2q gt CDViw Save dump 00000090 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 000000A0 20 20 20 20 57 41 55 5A 5A SA 34 4C 33 37 44 30 WAUZZZ4L37D0 Swanton lH 00000080 39 31 32 31 30 11 00 00 00 OO 00 00 OO OO F5 62 91210 b 000000C0 02 04 00 00 10 57 41 55 5A 5A 5A 34 4C 33 37 44 WAUZZZ4L37D 000000D0 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 000000E0 20 20 20 20 57 41 55 5A 5A 5A 34 4C 33 37 44 30 WAUZZZ4L37D0 000000F0 39 31 32 31 30 11 00 00 00 00 00 00 00 OO FS 62 91210 b Toggle Immo On Off 00000100 03 04 4B D4 39 OB 00 00 00 00 00 00 00 00 00 00 K 9 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 OO FE 95 cooooooooo 00000120 04 03 48 30 35 2D 42 50 47 38 31 30 08 02 07 31 HOS BPG810 1 00000130 33 32 34 30 31 38 31 35 43 00 00 00 00 00 FB 8F 32401815C 00000140 05 03 30 33 48 39 30 36 30 33 32 47 20 30 30 30 03H906032G 000 00000150 30 30 00 00 00 00 00 00 00 00 00 00 00 00 FC Cl OO 00000160 06 02 00 07 02 7C 01 AO FF FF 04 32 11 AO OD 92 l Z2 00000170 OE 74 00 00 00 00 00 00 00 00 00 00 00 OO FA CB Coccccooo 00000180 07 02 00 00 OE 2C 7A B6 05 00 00 00 27 BF OO OO 2 0000
167. uires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the MED9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster Dump Tool lt x Type ECU MED 9 x Reset CAYPTED Login Component protection v YR Swap bytes L H 00000000 00 EC 8E 24 38 FF FF 30 36 2D 30 36 2D 31 35 00 8 06 06 15 DC i se Login oc Old uncrypted login 53234 EK DC DL DL oc Component security protection OC Oldtumepptedjes 12 ab 32 sa 34 re o ie New uncrypted CS 12 EN 34 AP DA ec fo O L Unerypted data can be read from the instrument or from the MED ECU through the OBDII A New uncrypted login 23413 ECU MED 9x Immo bypass Required license AN012 B This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED9x req
168. units ATTENTION If you check all PINs to be examined l e PIN3 PIN7 PIN15 then when scanning for units the time will will be significantly increased For that reason by default only PIN7 is selected 2 1 6 CAN resistance According the CAN specification there should be a resistance between CAN Low and CAN High Normally the gateway has this resistance but if you want to connect on some device on the table then you should use that resistance For that reason there is a option what resistance to use None 75 Ohme 100 Ohm 120 Ohm or 10 Kiloohme By default 120 Ohm is used Normally you should don t have any problems but if some problem appear you can try to change the CAN resistance 2 2 Scanning units After startup on the main screen of the ABRITES Commander for VAG a list of all possible units with their VAS Number is displayed The customer is able to connect to the listed devices by double clicking on the desired device Instead of displaying all possible units you can choose a configuration of devices corresponding to specific car model chassis type This is done by selecting the type e g 1T VW Touran from the Chassis type combo box Then pressing the Display button will show all devices which can be installed into this car type Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protoc
169. unt IV Transfer component protection data Y Transfer login Transfer learned keys Ids this are the key fixed code identifiers If they are not transferred you have to perform key learning on the new dash Transfer learned key count transfer the key count Transfer component protection data this transfer the key variable code Without this the key is not recognized and cannot be learned Please pay attention that in order to start the engine you ve also to adjust these component protection data in the ECU too Transfer login transfers the car login NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 2 Exchanging RB8 Instrument If you want to put used RB8 instrument into a car you ve to synchronize the ECU and the RB8 instrument For that reason you need to read the ECU component protection data and the ECU MAG Then after reading the the RB8 instrument a button Reset Comp Security After pressing this button the following dialog will appear Just put here the component security and MAC of the ECU Component security data f x
170. vers If there are some bluetooth device try to disable them Problem When starting the ABRITES Commander for VAG Interface not calibrated is displayed Solution Send all logs to a distributor Problem The device connects sometimes to the device under K Line and sometimes not Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instrument cluster is A4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found on addresses 0x00 0x100 and 0x200 If the immobilizer number is placed there then the instrument is not crypt otherwise Problem After reading the A4 RB8 instrument the instrument displays LO x x instead the mileage Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible to connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www abritus72 com mmdata bin into the ABRITES Commander for VAG fo
171. ween VW vehicle 2007 CAN and VW vehicle 2007 CAN If vehicle type is correctly recognized then press OK If you like to select from a list of vehicle immobilizer types then press Manual Selection If for some reason vehicle immobilizer type is not successfully recognized the following message will appear Engine Control Unit Master E ABRITES Commander for VAG 16 0 mi 5 xj 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 Seat memory passenger E 07 Control head AS Nx ae 08 Climatronic Auto Cannot autodetect immobilizer type Please select it S fl Special functions s Vi SECTION I BOSCO TT Up 2 i e E gt AA B 09 Central Electic I FR manually Instrument EZS Kessy Instrument Engine Control Micronas VDO NEC Magnet dash Component EDC16 MED9 CAN Q7 46 K Line Unit CDC32xx 2009 UDS 9512 protection A adaptation b 0B Air heating Slide door left Q 4 RERI pr Steering lock TV activation Key leaming Dump tool Airbag Vw Crafter DSG Mileage Custom FIN Converter adaptation ED1 ED2 ReadAwrite qi ID After vehicle investigation has finished and the user has made it s choice to proceed by pressing OK or Manual Selection the following dialog will appear alo Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 All
172. wer class 79 BCM2 read with SUCCESS 2 5 2 2 Read BCM2 with ABPROG If you select to read it with the ABPROG programmer you need to solder 6 wires on the BCM2 PCB and one resistance should be removed temporary after reading is finished restore this resistance There is also wiring diagram The wiring diagram is found in the program folder too Read BCM Z ABPROG should be K0907064AE0145H 23 _ cannecterdi mi 808K09070642E BCM2 connection 2 0 x 2 0 x diagram 81 2 x 90 SS See eee 10 U2isce ce d q y x L ee ee 28 k G R M fol Save BCM2 Dump Load BCM2 dump Initializing ABPROG OK Communicating with BCM2 OK Reading BGM ON Decoding data OK VIN WAUZZZ8K89A112122 Key count 1 Power class 9C If the BCM2 module is read OK you will see the VIN number the existing key count and the power class 2 5 2 3 Key learning procedure Once the BCM2 module is read you can make as many as you want dealer keys A brand new key is needed for the dealer key One brand new key can be made as a dealer key several times but if you learn this dealer key to the car it is locked during the key learning procedure and cannot be used on other car anymore Once you have the required count of pre coded dealer keys you can learn them Also the original keys should be learned in this step otherwise they stop working Step 3 Learn key Number of keys to learn 2 Lea
173. will need to connect manually some PINs of the VAG Interface OBDII connector with cables to the wiring of the CAR So you ve to find somewhere in the car the desired wires orange with green CAN H and orange with brown CAN L and you ve to connect them to OBDII connector PIN6 CAN H and OBDI Connector PIN14 CAN L Also you ve to connect OBDII Connector PIN4 Ground to any metal part of the car After you re ready you can call the Unlock doors special function Following dialog will be displayed Door unlocking Unlock Vy Touareg Phaeton Audi 48 Unlock 07 46 Allroad Unlock Porsche Cayenne OBDII Pin 6 lt gt CAN H forange green OBDII Pin 14 lt gt CAN H orange brown OBDII Pin 4 lt gt GND metal part of the car Unlock Vw Passat Unlock Vi EOS Unlock Audi 43 Unlock Audi 44 So for any of the desired model you ve to press the appropriate button ATTENTION In the most cases this only opens the doors It doesn t disable the alarm 2 5 22 Special function Coding calculator Using this function you can calculate long code coding value of different modules When you open the special function the following window appears lolx Select device Select coding Engine Control Unit Instrument Cluster Gateway Central Electric Comfort System Parking ssystant Door Control Audio System Radio Navigation Steering Control Trailer Recognition ua em By selecting a device
174. y the existing CS PIN of the engine control unit Exit New immobilizer data Immo number VIN Power class Est 50 you need to load the Comfort module EEPROM dump or to enter manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function Normally the power class of the comfort module is displayed automatically if you load comfort module dump and the customer is able to change it if the ECU has different power class If you enter wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the Immobilizer Comfort module will take the power class you enter ATTENTION After the reading is finished any working keys will stop to work and should be re learned to make them working again NOTE This special function can be used also for key learning If you have the comfort module dump you can load it here and all 7 bytes of CS will be displayed Then the customer can make dealer key using these 7 bytes 2 5 7 4 Adapting Transmission gearbox on A6 Q7 Allroad This special function is dedicated to adapt second hand transmission from one vehicle to another To adapt the transmission gearbox you need the existing PIN and CS of the second han
175. y to get access to this channel you should make a security access with the Login of the device to which you re connected and which you will adapt to the car After you gain access to the channel 50 you should put the Login PIN of the car to which you adapt the new part Channel 21 If the Immobilizer is by K Line then on channel 21 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made Channel 1 If the Immobilizer is by CAN then on channel 1 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made UDS modules x xi T Manual Data Identifier Select Language version in instrument panel insert control module v 0924 English v You have to select from a selection drop down list a certain item After item is selected it is automatically read and its current value can be found into column Current Column Unit shows the measurement unit of the selected item To change current value you have to write down or select a certain new value into the corresponding cell from column New 2 4 9 Coding of the unit Coding will open for you a separate window where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding Coding x N Device Codingtype Vee
176. yl gt Pressing the other data displays the learned keys and also allows changing the immobilizer status on some models changing the immobilizer status is used to put the Kessy e g into deliver condition Kessy keys xj Key 1 DC004426 Key 5 FFFFFFFF Key 2 5E 344320 Key 6 FFFFFFFF Key 3 FFFFFFFF Key 7 FFFFFFFF Key 4 FFFFFFFF Key 8 FFFFFFFF sa Immo status B Set EZS Kessy Security access code 9512 Required license AN003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola HC9S12 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Dump Tool xj Type EZS Kessy Security access code 9512 Krai ara Load dump 00000010 37 33 30 30 32 36 30 30 31 31 FF FF 30 35 37 37 7300260011 0577 00000020 36 33 30 30 30 34 30 36 30 31 FF FF 35 39 32 35 6300040601 5925 00000030 31 30 30 31 32 30 36 30 30 33 39 30 33 31 30 34 1001206003903104 00000040 34 32 34 37 35 FF FF FF 36 30 2E 32 30 2E 30 32 42475 60 20 02 00000050 36 36 33 30 57 41 55 SA SA SA 34 4C 30 37 44 30 6630WAUZZZ4L07D0 00000060 30 30 30 30 30 FF FF FF 02 20 66 03 34 46 30 39 00000 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 02 02 00 10852 0220 00000080 07 ED ZA 10 77 SF 30 38 2E 30 33 2E 30 37 FF FF w_08 0
177. you to enter a number of the group and to press the button ON or OFF 2 4 11 Actuator test Available are two types of tests Selective and Sequential In the selective test you have the possibility to enter a test code manually or to select it from a list box When a test is selected you just need to press Start x Choose test Selective test mode Selective test ATEEN Cancel test C Enter output code Sequential test Select output END of selective output test Relay for Horn Terminal 58 Bi xenon Shutter Solenoid F320 Bulb for Daytime Running Light Left EN 2 4 12 Reset of the unit Reset will request from the unit a SW reset Not all electronic control units support this service Please note that it is not available in all diagnostic sessions 2 4 13 Custom requests Using this function the user can send manually diagnostic requests to the corresponding unit The example below shows a request for identification of an Instrument Cluster ECU Custom requests x Request Trace list Tx 00 02 1A 9B Rx 00 30 SA 9B 34 46 30 39 31 30 39 33 30 41 20 20 30 36 33 30 03 20 3E 12 01 5B 38 DE 2B 67 4B 4F 4D 42 49 49 4E 53 54 52 2E 20 4D 37 33 20 48 31 36 2 4 14 Program VIN Program VIN requests the stored in the device VIN and tries to change it Not all electronic control units support this service Please note
178. zer Enable Disable EDC15 EDC16 ME7x Functions become available after pressing the button ECU from special functions of main dialog Engine Control Unit Special Functions x ecu Autodetect v e Read EEPROM ECU Autodetect VAGEDCI5x 0 ee eee eee ee eee ee Load from file IVAG ME7 1 117 517 8 wakeup pattern 01 JOO ee ee eee eee eee VAG ME7 1 117 517 8 wakeup pattern T1000 EE tert ttt ttre Porsche 5 2 7 8 De peng Choose ECU type Write EEPROM E Save to file EE TT Login 0 Mileage Immo ON mmo OFF AAA a m Flash counter PAPA AT AR 5 eee E e Read Flash See aaa ae wn ee Flash tool ID MED 9 1 Slave 000100 Lee eee eee eee MED 9 1 Single 00 Cnn ee eee eee ee ee o SIMOS PPD 1 1 1 5 Siemens een Fead Write Flash xX a IMPORTANT You need to clarify the type of Engine Control Unit in the car before proceeding There is also a Autodetect function implemented and will detect the ECU type in almost all cases but is possible that it is wrong and then is needed to select the type manually You can choose ECU type VAG EDC15x VAG ME7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCH VAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG Cartronic ME7 8 EDC16U1 EDC16U3x CP etc Extracting security code enable disable immobilizer and so on Example is 1 9 TDI EDC16 Engine Control Unit Special Functions

ABRITES Commander for VAG User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents