Home

ABRITES COMMANDER FOR VAG USER MANUAL

1. 2007 Key Audi S8 2011 OBD CAN programmer PCF7936 or key Procedure 5 Key Hitag2 Extended Audi S8 2012 OBD CAN programmer dealer key Procedure 8 Key Megamos 48 Audi R8 2006 OBD CAN programmer dealer key Procedure 3 Audi TT 2005 OBD K Not needed TP08 Procedure 1 Key Megamos 48 Audi TT 2007 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 Audi A1 2011 UDS programmer dealer key Procedure 7 1997 Skoda Octavia 2003 OBD K not needed TP08 Procedure 1 2003 Skoda Octavia II 08 2006 OBD CAN not needed TP24 Procedure 2 08 2006 Key Megamos 48 Skoda Octavia II 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 Skoda Octavia II 2008 UDS programmer dealer key Procedure 7 Skoda Octavia OBD CAN Key Megamos 48 RS 2009 UDS programmer dealer key Procedure 7 Skoda Octavia 2006 Key Megamos 48 Scout 2008 OBD CAN programmer dealer key Procedure 3 Skoda Octavia OBD CAN Key Megamos 48 Scout 2009 UDS programmer dealer key Procedure 7 Skoda Scout 08 2006 OBD CAN not needed TP24 Procedure 2 08 2006 Key Megamos 48 Skoda Scout 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 Skoda Scout 2009 UDS programmer dealer key Procedure 7 Skoda Roomster 2007 OBD K not needed TP08 Procedure 1 2000 Skoda Fabia 2007 OBD K not needed TP08 Procedure 1 Skoda Fabia II 2007 OBD K not needed TP08 Procedure 1 Skoda Fabia II OBD CAN Key Megamos 48 RS 2011 UDS programmer dealer k
2. The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are always at least 6 of the component protection bytes stored sometimes also the 7 byte is contained There are several ways to extract the component security Simply press the Autodetect component security select Autodetect component security and press Next in case of Wizard mode and the component security bytes will be read from the ECU This will also automatically decide whether you have the 7 byte or you will need to search for it Also the login will be displayed in the status bar The autodetection is not always possible it basically works for EDC16 and MED9x engines which are using a CAN diagnostic connection The component security bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit the ABRITES Diagnostics for VAG will show you the component security bytes Issued by Abrites ltd Manual Version 3 02 November 10 2014 00 00 DU LT ReadFlash Flash Data read Component security 1b d4 05 e4 37 a8 Ob For CAN TP2 0 immobilizers in most of the cases it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you have to go to Special function then
3. List of Revisions Description Revision er Ba evle Added Key learning wizard mode mag Lanas Added BCM2 key learning procedure 227 EZS Kessy A6 Q7 Allroad write EEPROM changes l TOA Added BCM2 key learning procedure by OBDII gaa ALANA Update to V17 0 of the software mee ndai Update to V17 1 of the software 00 eee Update to V18 0 of the software 29 EDC17 MED17 bootmode added EDC17 MED17 readingby OBDII added Adaptation of EDC16 EDC17 MED9 MED17 description changed Adaptation of Passat B6 comfort module added EDC17 MED17 wiring diagrams added in appendix 27 09 2013 T Keylearning functions completely revised 30 Updated Manual design Complete revision of the manual 12 03 2014 2 4 18 added 3 01 2 5 1 5 changed according the new implementation 02 10 2014 2 2 Scanning of the modules changed 3 02 2 4 Standard diagnostic reworked 2 5 Reworked 2 5 7 added 2 5 12 added Issued by Abrites ltd Manual Version 3 02 November 10 2014 Table of Contents Introduction 8 1 lInstalling the A brites Diagnostics Tor VAG eee 8 2Diagnostics with the Abrites Diagnostics for VAG 9 2 Eas Ra e aoe al cence ge sen ed cetera cc sates on ace sate ava ane aT ee a 9 R TSEC eae 9 RR Ea c eae T 10 S Re ea LINE GU fate SET T 10 2 R 9 KIT AAI TES oq ues ciesac sie ternaehesdacaish woes sou i E EE KE RE E E Ea EE teases 10 T K LINE PINS ceee neern eere rre rae EE EAER eae oa ayaa nase ra
4. The VDO NEC is dedicated to the VDO instrument clusters with a NEC micro controller Typically these instrument clusters are installed in VW Seat Skoda Audi cars produced after the year 2009 After starting this function you will see the following dialog box M N VDO with NEC Microcontroller 2009 E E SS en E E Service Mode Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible or by modifying the ConfData content with a programmer by dump Service mode can be leaved always by OBDII but once leaved you may need to modify the ConfData dump in order to enter it again Load ConfData Enter Service Mode by Leave Service Mode by Reset 24C32 24C64 dump OBDII ee Mileage Read write EEPROM Immo data 0 Read Update ConfData ConfData Read mileage Recalibrate Load from lt ewe Save to file Read Flash Immo Data ID WVW2ZZ25K 332566733 Read Immo data 5 n b Oa eral number Transponder identificators Me Serial key CS dba6573433d6b1 KeylD1 f07b970d KeyID5 f46acd73 data MAC 3tbb3b2c KeylD2 9f37940d KeylID6 fSe08ef4 Status 1401006add Power Class 6a KeylD3_ de7al abe KeylD7__ ffffffff iguration 210106660100 faa321be HHT Configuration 01 YW KeylD4 KeylD8 Radke PIN 7752 Done Exit This special function can be used to read mileage and m
5. ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as an indication whether the key in the ignition has the correct transponder type For example for Audi A3 the immobilizer expects a Megamos 48 transponder but if you use dedicated for Audi A8 which uses Hitag2 transponder then the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponders were successfully coded to the specific car After making a dealer key the position should change to Yes when you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as a valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if an invalid login was input several times to the immobilizer the immobilizer rejects further attempts to input the login This timer indicates how many attemps remain until new login attempt can be accepted Lock timers transponder acknowledge If you turn ig
6. Manufacturer ID 0000182000008A02 OPT Protect 0x10000 0x13fff OPT Protect 0x14000 0x17fff Protection installed YES Internal flash size 2048 KB ConfData size 128 KB External flash not available Then you should select the appropriate microcontroller and connect to it Once connected the user has information about the flash EEPROM size and protection and has the ability to read write EEPROM Dflash read write Flash Pflash Get PIN CS MAC for the engine control unit Make immobilizer bypass of the in the EEPROM applicable for the ECUs till 2012 Make immobilizer bypass of the in the Flash applicable for all ECUs Fix the checksums in the flashing Clone the PIN CS of and ECU immo data section only of the EEPROM dumps is changed Issued by Abrites ltd Manual Version 3 02 November 10 2014 r frci 796 CONNECT 31 a 8 0 1 2D 7 06 09 17 06 30 09 4 810 37 37501956 1037 00 397037 00 00 4B Load f J 00 D Q G 7 z 31 WVWZZZ1KZAWOS111 31 VWZZZ1KZAW051111 rom dump asl 48 4 3 Fix feast eS ae eee errr ae i NEG Neage ake bini Operation finished with SUCCESS If the user presses Read PIN CS the PIN component security and MAC will be displayed Issued by Abrites Itd Manual Version 3 02 November 10 2014 B EDC17 MED17 Flash ConfData read wr
7. Connect again the dashboard in the car and recalibrate the mileage 2 5 2 Special functions with EZS Kessy CAN When you select this function the Abrites Diagnostics for VAG tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP 2 0 Issued by Abrites ltd Manual Version 3 02 November 10 2014 EZS Kessy for 07 A6 Allroad f x m Component security Get component security from Engine Control Unit ECU Component protection bytes ad 32 df Autodetect from engine ECU PIN Login code 23242 Get component security from EZS Kessy EEPROM dump O Get component security from E2S Kessy by OBDII requires to give ignition ON with working key m Learn keys Number of o YIN id S ie Rn learn EZS EEPROM 00000000 24 68 10 02 00 10 FD BO FF FF 01 FF 36 33 36 37 h 6367 00000010 31 33 30 30 32 36 30 30 31 31 FF FF 37 33 38 37 1300260011 7387 Read EEPROM 00000020 30 33 30 30 30 34 30 36 30 31 FF FF 31 30 30 38 0300040601 1008 00000030 34 31 32 31 31 31 35 30 30 30 39 30 33 31 30 34 4121115000903104 00000040 34 32 34 37 35 FF FF FF 35 30 2E 31 31 2E 38 32 42475 50 11 82 Write EEPROM 00000050 33 32 30 31 57 41 55 SA SA SA 34 46 58 36 34 31 3201WAUZZZ4FxX641 00000060 32 31 31 35 31 FF FF FF 11 28 23 10 34 46 30 39 21131 4F09 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 01 01 00 1085
8. Session 0 x Diag session In this dialog it is needed to clarify the diagnostic session which you want to be entered before starting of the read program memory In the example above we use session 80 If you want to save currently running diagnostic session simply enter session 0 2 5 16 Special functions with Airbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Issued by Abrites ltd Manual Version 3 02 November 10 2014 Airbag E Choose ECU type FO AUDI_BOSCH_1997_2000 AUDI BOSCH 2001 2003 oofAUDILBOSCH_20038 00 00 Ce eeeeeceeeeeeee oo yW SIEMENS ALL 00 eee ee Write EEPROM Connection type T Manual Read EEPROM Automatic eenecacenencaven Save to file coocnce 7 eseme Clear crash data For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request and the crash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using the Clear crash data function from the device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where the crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units Re
9. 00003880 FF 04 7F 00 01 OF 14 FB 00 OO 02 OO FF FF FF FF 5 00003890 FF FF FF FF 03 6D FF FF FF FF FE 63 1B FF FE 63 m G C O00038A0 1B FF FE 63 TR FF FE 63 1B FF FE 63 1B FF FE 63 c c c E g on the picture above starting from address 0x0080 of the EEPROM there are 17 bytes with OxFF then comes the login which is 0x047F in hexadecimal or 1151 in decimal The mileage consists of two blocks usually 0x90 bytes with the inverted mileage followed by 0x90 bytes with the real mileage it may vary e g blocks with 0x98 bytes instead 0x90 or first comes the real value and then the inverted Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if successful proceed as described above If not successful select type Magneti Marelli Shadow 3 TT and read EEPROM Currently for the software versions we know the login can be located as described above and the mileage starts from address OxAA to address 0x1C8 marked in the picture below Issued by Abrites ltd Manual Version 3 02 November oo000000 00000010 00000020 00000030 00000040 00000050 oo000060 D 000007 0 D 0000050 D 0000090 D 0 0000A 0 D 0000 0P 0 D 0000 0C 0 D 0000 0D 0 D 0000 0E 0 00000 0E 0 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 000001860 00000190 00000140 O00001B0 oo0001C0
10. 2 5 7 Special functions with EDC17 MED17 Direct PIN CS The function is dedicated explicitly to read the PIN and CS of the EDC17 MED17 engine control units With this function is possible to read even engine control units 2012 which are with updated software and is not possible to read normally by OBDII With this special function the EDC17 MED17 is not read through OBDII you should have direct connection to the engine control unit It is possible to make this on the table you need to connect only 12V GND Ignition CAN H and CAN L It is possible to read the ECU also in the car but you need to find somewhere the CAN H orange black and CAN L orange brown wires So connect them to the AVDI and you will be able to read the engine control units Dialog ATTENTION This function require direct connection to the E CUI This means it should be not connected through gateway It is possible to read ECU also in the car without dismounting it For that purpose find the orange black and orange brown CAN wires and make the following connection of the AVDI orange black lt gt CAN H PINE of the OBDII orange brown lt gt CAN L PIN14 of the OBDII Ground lt gt GND PIN4 of the OBDII 123 lt gt 12 PIN16 of the OBDII CS 36 67 4F 60 6C CE DA PIN 50990 Read immo MAC AA D9 FB 64 len Immo status Normal learned s NOTE This function requires internet access 2 5 8 Special func
11. Abrites ltd Manual 151 Version 3 02 Document November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 10 2014 number 2 20071127 ECU Vag MED 17 5 5 TC1766 Internal Flash tia 7 PAT DIRT OLN RL TATI Ta G Los see Te Ze gt S a KAYIT T X imn le Pia E d S a HD COS 6 6 2 68 oo C8 we 8 6 0 706 wee OS 669 9 Manual 152 Version 3 02 Issued by Abrites Itd November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag MED 17 5 20 TC1766 Internal Flash Ignition Ground Issued by Abrites Itd Manual 153 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag MED17 1 1 TC1796 Internal Flash Pin 62 CAN H s 5 eee eeeeeee O 0 0 0 0 0 0 herd g 0000099 T KLL y mrn NEEE a b Thread boot onee00ee086 6668 640 o DE U E gt E LE gt gt gt gt gt gt L Issued by Abrites Itd Manual 154 Version 3 02 November 10 2014 For any further questions please contact support Abritus72 com Issued by Abrites ltd Manual Version 3 02
12. Issued by Abrites Itd Manual Version 3 02 November 10 2014 pump root lt E Type ECU Simos PPD 1x Reset component protection data 48 l11SNOIOF710 H Load dump Save dump 7 4 Swap bytes L H OOOOOOFO 76 5B F4 8A 85 51 84 9B 80 3B 81 09 81 08 83 4E mr n s s s N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 v b Canceled ECU Simos PPD1x Security Access Code Required license AN007 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Issued by Abrites ltd Manual Version 3 02 November 10 2014 Dump Tool xj Type ECU Simos PPD1x Security Access Code v 111SNOIOF710 H lt 00000010 00 00 00 48 00 00 00 48 00 00 08 38 00 1C 00 00 H H 8 00000020 00 FF 80 80 80 80 80 80 96 80 80 80 80 00 80 80 00000030 00 FF 19 9E 59 2C 59 2C 59 2C 94 50 94 50 94 50 Y Y Y P P P 00000040 0l 00 0l 00 O1 00 D9 72 52 79 B2 E4 D9 72 52 79 rRY rRY 00000050 B2 E4 D9 72 52 79 B2 E4 A4 OO A4 OO A4 OO 00 00 rRy 00000060 00 00 00 00 80 00 80 00 80 00 33 C4 33 C4 33 C4 3 3 3 00000070 56 57 54 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCz000000000vN 00000080 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 5a 43 ZCz000000000VIIZC 00000090 54 30 30 30 30 30 30 30 30 30 57 56 57 SA 5A SA ZOOODO00000WVIZZZ Oo0000A0 3
13. ME7x EDC17 MED17 ECUs You can read the login and component security using the Engine control unit special function or from a decoded EEPROM dump using a programmer It is also possible for the software to read all this information automatically when you press the Autodetect button In this case the software will connect to the ECU and read the component security and login filling the required fields automatically It is possible that the component security cannot be read from the ECU In such cases you can use the car s working key provided you have one and obtain the component security and PIN from it This is done using the Get component security from EZS Kessy by OBDII function If the car has no working key you will need to open the EZS Kessy and read its EEPROM with a programmer Then you have to select Get component security from EZS Kessy and load the EZS Kessy dump Once that is done you can learn or create a dealer key IMPORTANT Provided that the car has no working key and you can not turn the ignition ON in order to get the ECU to communicate you will need to short the fuses as described in the appendix After obtaining the component security bytes you can restore the fuses IMPORTANT If the car has no working key communication with the EZS is only possible if you press the brake pedal NOTE In order to perform any functions with the EZS Kessy you will need to input the login and the component security
14. etc Extracting security code enable disable immobilizer etc The example shows 1 9 TDI EDC16 Issued by Abrites ltd Manual Version 3 02 November 10 2014 r hl Engine Control Unit Special Functions lll Choose ECU FDC16U31 v ECU type type help ry Read ConfD atal d 2D FF 8 15 01 07 a Load from file FF 31 38 2D 30 31 2D 30 37 08 10 14 80 03 82 18 01 07 01 07 08 15 21 31 30 33 37 33 38 32 30 38 33 11037382083 03 2F 2F 31 30 33 37 33 37 37 31 35 30 EF CA A 1037377150 06 03 37 37 31 31 32 33 30 33 47 39 30 36 30 77112303G9060 31 41 4E 20 00 00 7F E4 BO 07 DO 00 00 F9 4B 21AN K 37 31 30 34 33 30 33 47 39 30 36 30 32 31 4B 77104303G906021K Save to file 8 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H Login 52698 00 00 00 00 00 00 00 00 00 00 00 00 1A F7 6B k 37 31 30 34 39EEPROM memory data 30 32 31 4B 77104303G906021K 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC Mileage 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 11111 Recalibrate 00 00 00 00 00 00 00 00 00 00 00 00 1A F7 6B 005 k F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 5A 37 rI VWZ7 30 47 37 30 33 31 31 31 31 00 E5 70 1B F5 70 Z0G7031111 p p F3 C5 72 49 E7 8A CD DA 00 00 00 56 57 5A 37 rI VWZ7 eon 30 47 37 30 33 31 31 31 31
15. i 05 EZS Kessy Entry And Sta 06 Seat memory passenger I 07 Control head ng Climatmenio fate NIMA el fa gt 4 gt Next L P 1 Special functions le Vehicle Selection Y Broadcast 199 Options CAN E K Line Instrument E2S Kessy BCM2 Instrument Engine Control EDC1 and EDC MED17 DPF OFF Component O7 A6 44 55 05 Unit MED1 Boot Direct PIN CS protection TA hS V q a an 3 G F gt 78 A E A fer Open Immo parts Immo Steering lock TY Key learning Theft Dump tool Airbag Vw Crafter f adaptation adaptation adaptation configuration protection ey farm n La A Attention Make sure you are running the Abrites Diagnostics for VAG from its folder If you are using a shortcut to the Abrites Diagnostics for VAG please make sure the working Issued by Abrites ltd Manual Version 3 02 November 10 2014 folder parameter is set to the folder where the executable file is placed If the working folder is not set the K LINE may not function correctly 2 DIAGNOSTICS WITH THE ABRITES DIAGNOSTICS FOR VAG The Abrites Diagnostics for VAG basically consists of two parts Standard diagnostic functions such as reading clearing trouble codes device identification adaptation measured values etc Special functions such as reading log in Reading EEPROM etc All devices available to the car are listed on the main screen of the Abrites Diagnostics
16. 00 00 00 00 00 OO 00 BF F2 A OOOO0 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 OO HOIST ROS TOL lt gt h 4 Swap bytes L H 24895 Login Checksums claculated up to address 02280 Press the Save button ot save the changes ECU MED 9 x Reset component protection data 95080 Required license AN009 This function allows to view and or change the component protection data found in the MED9x with ST95080 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data is encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Issued by Abrites Itd Manual Version 3 02 November 10 2014 Dump Tool E i x Type ECU MED 9 x Reset component protection data 95080 E5 81 36 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 16 49 05 47 05 07 29 1 6 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7HL037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 54 69
17. 00 ES 70 1B F5 70 Z0G7031111 p p F3 C5 72 49 E7 BA CD DA 00 00 00 56 57 5A 37 rI VWZ7 30 47 37 30 33 31 31 31 31 00 E5 70 1B F5 70 Z0G7031111 p p Flashicauriter A4 Fl 9A F9 57 56 57 5A 5A 5A 31 4B 5A 37 50 WVWZZZ1KZ7P 31 31 31 31 31 73 00 00 01 B7 00 00 OE F6 FE 111111s Att 0 Suc jo Read Flash A4 Fl 9A F9 57 56 57 5A 5A 5A 31 4B 5A 37 50 WVWZZZ1KZ7P Flash tool ID 31 31 31 31 31 73 00 00 01 B7 00 00 OE F FE 11111ls 02 00 6F F4 44 FO 83 00 03 28 00 00 FF 00 00 0 D 00 FF FF FF FF FE FF FF FF FF FF FF FF FF FF cccccccccccccccs FF FF FF FF FF 00 00 FF 00 00 00 AD CF 7A 00 T Read Update l 00 FF FF FF FF FF FF FF FF 01 61 01 SE 68 88 a R a P Component security 24 f3 c5 72 49 e7 8a MAC 70 E5 BD 7F Ea x xi HINTS when reading writing EEPROM memory of ECUs 1 The whole EEPROM could be read for EDC15 ME7 EDC16 For MED9 EDC17 and Simos engine control units only the PIN CS MAC is displayed 2 To read the EDC17 MED17 PIN CS MAC is required to have internet connection 3 If you experience problems with reading ME7 x EEPROM it is better to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication fro
18. 29 Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 I G 00000020 29 O7 O5 10 37 46 31 30 33 37 33 37 37 34 33 39 j 7H1037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 A5 5A 69 96 Cl 3E 00 00 00 3F 61 1B D405 2Zi gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt ee 00000060 01 03 A5 5A 69 96 Cl 3E 00 00 00 SF 61 1B D405 2i gt 2a 00000070 E4 37 A8 OB 37 A6 3C 13 00 O1 00 00 00 BC F B2 7 7 lt 0 00000080 02 04 00 00 10 57 56 57 54 BA 5A 33 43 54 36 45 WVWZZZ3CZ6E 00000090 30 30 30 30 30 30 56 57 54 43 5a 30 30 30 30 30 O00000VWZCz00000 oo0000a0 30 30 30 30 57 56 57 SA 5A SA 33 43 5A 36 45 30 OOOOWVWZZ23CZ6E0 OoooooBO 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 Ad OOO000 ooooo0co 02 04 00 00 10 57 56 57 5A SA 54 33 43 SA 36 45 WVWZZZ3CZ6E 000000DO 30 30 30 30 30 30 56 57 5A 43 5A 30 30 30 30 30 O00000VWZCzZ00000 000000E0 30 30 30 30 57 56 57 SA 5A 5A 33 43 5A 36 45 30 OOOOWVWZZ23CZ6E0 000000F0 30 30 30 30 30 ifl 00 00 00 00 00 00 00 BF F2 A5 OO000 00000100 03 04 8B C8 Al 7B 00 00 00 00 00 00 00 00 00 00 Lees Rasa 7 gt Swap bytes L H h 4 Checksums claculated up to address 0x280 Press the Save button ot save the changes ECU MED 9 x Reset CRYPTED Login Component protection Required license AN009 The function allows changing
19. 35 6300040601 5925 00000030 31 30 30 31 32 30 36 30 30 33 39 30 33 31 30 34 1001206003903104 00000040 34 32 34 37 35 FF FF FF 36 30 2E 32 30 2E 30 32 42475 60 20 02 00000050 36 36 33 30 57 41 55 5A SA 5A 34 4C 30 37 44 30 6630WAUZZZ4L07D0 00000060 30 30 30 30 30 FF FF FF 02 20 66 03 34 46 30 39 00000 4F09 P m 00000070 31 30 38 35 32 20 20 20 30 32 32 30 00 02 02 00 10852 0220 ogn ai 00000080 07 ED 2A 10 77 5F 30 38 2E 30 33 2E 30 37 FF FF w_08 03 07 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4F0905852B 31 00000080 33 30 35 32 34 34 37 33 32 30 30 31 32 30 36 30 3052447320012060 0330101035330 Cr ea Save dump h 4 Swap bytes L H s s s s s Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component Issued by Abrites ltd Manual Version 3 02 November 10 2014 protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts an ECU dump from EDC16 PPD1x MED9x and ME7x ECUs Dump Tool a x Type Comfort module component protection dat
20. 58 FE 60 OB 12 3D 00000040 FF FF FF FF FF FF FF FF Fl 01 06 11 01 11 coadkom Save to fle 00000050 56 57 SA 37 SA 30 47 37 30 33 31 31 31 31 e Fez 00000060 37 33 22 BE FF FF FF FF FF FF FF FF FF FF 7 Custom flash ConfData 00000070 FO OF FF FF FF FF FF FF FF FF FF FF FF FF Read Maren dumps Micronas 4 FLASH Read Update Immo Data ID Ww2771K27P111111 Read Immo Immo data by data flash ConfD ata dumps Micronas Serial number W27Z0G7031111 Transponder identificators Update Immo m Serial key CS 24f3c57249e78a KeylD1 373322be KeylD5 ffffffff data MAC 70e5123d KeylD2 ffffffff KeyID6 ffffffff Status 0000fe58fe Power Class fe KeyiD3 H KeyiD7 ttt TS eee Make dealer Configuration 10106110111 01 YW v KeylD4 tffffffF Keuips ffffffff key and add it Risstore to the immo IPC Immobilizer to PIN 52698 data VIRGIN state k Exit Memory reading completed Note If you would like to select the instrument cluster manually you need to disconnect your AVDI from the OBDII and open the Instrument cluster CAN special function If one of the above types of instrument cluster is automatically detected the Abrites Diagnostics for VAG will not open the corresponding function window 2 5 1 1 Special functions with instrument cluster CAN over TP2 0 Issued by Abrites Itd Manual Version 3 02 November 10 2014 Available functions are Reading current mileage value Read Program EEPROM of instrument
21. 96 Cl 3E 00 00 00 3F 61 1B D4 05 2i gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 00 BC F B2 7 7 lt 0 00000060 01 03 A5 54 69 96 Cl 3E 00 00 00 SF 61 15 D4 05 21 gt a 00000070 E4 37 As OB 37 46 3C 13 00 01 00 00 OO BC F B2 F F Lecescccce BEEE x 00000090 H S ooo00040 o HR D4 IR E 37 AR fe Cancel Swap bytes L H ih 4 0 ECU MED 9 x Security Code Checksum calculator 95080 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Issued by Abrites Itd Manual Version 3 02 November 10 2014 xi Type ECU MED 3 x Security Code 7 Checksum calculator 95080 00 8 05 07
22. Cluster Audi A4d BOSCH RB8 CRYPTO 2004 v RGM Flash Reset ECU Reset Comp Repair RBS Security DEF 00000100 5C 78 1C 2B D2 D4 CF 01 E4 3E BO 64 01 44 6D 46 x gt d DmF Login iam 00000110 54 C6 9D 43 72 ED 60 FO AB 97 A9 56 28 A6 79 9A T Cr V y 2199 00000120 00 01 B9 82 FC 01 2B 3F 2D 43 68 7E 53 5B DO 61 2 Ch S a Y 00000130 FB 1C 9E 78 9C 3C SF 03 A4 36 4E 01 AD 08 70 00 x lt _ 6N p G 00000140 FD 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 5920 00000150 57 41 55 5A 5A 5A 38 45 35 35 41 34 35 37 33 39 WAUZZZ8E55555739 00000160 39 00 01 00 BA 00 96 00 74 00 5D 00 DA 02 GD 01 9 t m Immo Status 00000170 01 00 00 00 00 00 00 00 00 80 FF 7F 00 00 02 Ol 00e Be 00000180 00 4A 9B FF FF 14 3B 00 00 00 32 46 50 73 7B 82 J 2FPs 00000190 00 16 2D 2D 46 5A 00 00 00 00 00 38 FF 00 00 00 FZ Rack 000001A0 00 00 00 93 63 OF 1E 00 00 00 00 00 00 9B FF FF c 005 Z 00000180 45 04 80 9A OF FF 06 FF 04 OF FF 1F FF 30 30 87 E 00 v gt O Skip neg responses HB9 Crypto data read Exit In order to transfer the keys you already have you have to first read the EEPROM of the source instrument and then by pressing the Read keys button you save them into a file Once you do that you need to go to the destination instrument read its EEPROM and then after pressing the Write keys button you will be prompted to show the location where the sou
23. ECU Vag EDC17 U05 TC1796 with External Flash sese eee ECU Vag MED 17 5 1 TC1796 with Internal and External Flash sss sese ECU Vag MED 17 5 2 TC1767 Internal Flash sese eee ECU Vag MED 17 5 5 TC1766 Internal Flash sese eee ECU Vag MED 17 5 20 TC1766 Internal Flash sese eee ECU Vag MED17 1 1 TC1796 Internal Flash sese Issued by Abrites ltd Manual Version 3 02 November 10 2014 November 10 2014 1 INTRODUCTION Abrites Diagnostics for VAG is a Windows based PC based diagnostic software for the vehicles from the VAG group which are in most cases unsupported by the Manufacturers diagnostics tester The Abrites VAG Diagnostics also provides you full diagnostic capabilities for VAG vehicles 1 1 Installing the Abrites Diagnostics for VAG The Abrites Diagnostics for VAG is contained in the installation package so please run the setup Once you have done that you are ready to start the Abrites Diagnostics for VAG When starting the software a splash screen appears where the connection to the hardware is examined Should there be no problem with it a message should appear saying CONNECTION Ok The main screen looks like this f A ABRITES Diagnostics for VW Audi Seat Skoda 24 0 www abritus72 com U S Unit name VAG Number Description DIC Coding 00 01 Engine Control Unit Master Previous 02 Transmisson 03 ABS 04 Steering Angle
24. Instrument CAN and Read write immo data After you read the immobilizer data in the field Serial Key the 7 bytes of the component security will appear b Preparing a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button c Preparing a dealer key by finding the 7 byte If the 7 byte is not available you must choose Find the 7th byte of the component security data and you have to put the six bytes which you already have There are three possible ways to check whether the 7 byte is correct from working key if you have a key which can start the car put it in the programmer and press Find 7 byte from working key after 70 80 seconds the 7 byte should be found Automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you have to turn the ignition ON and place the programmer ring over the key when the key is in the ignition NOTE The automatic check might not be possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference bet
25. Jetta 08 2006 OBD CAN not needed TP23 Procedure 2 08 2006 Key Megamos 48 VW Jetta 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Jetta 2009 UDS programmer dealer key Procedure 7 VW Bora 1997 OBD K not needed TP08 Procedure 1 OBD CAN Key Megamos 48 VW Bora 2009 UDS programmer dealer key Procedure 7 VW EOS 08 2006 OBD CAN not needed TP23 Procedure 2 08 2006 Key Megamos 48 VW EOS 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW EOS 2009 UDS programmer dealer key Procedure 7 VW New Beetle 1998 OBD K not needed TP08 Procedure 1 2004 VW Caddy VDO 09 2006 OBD CAN not needed TP23 Procedure 2 Key Megamos 48 VW Caddy 2008 OBD CAN programmer dealer key Procedure 3 VW Multivan 2007 OBD K not needed TP08 Procedure 2 VW T4 1998 OBD K not needed TP08 Procedure 1 2002 VW T5 2009 OBD K not needed TP08 Procedure 1 OBD CAN Key Megamos 48 VW T5 2009 UDS programmer dealer key Procedure 7 1997 VW Sharan 2009 OBD K not needed TP08 Procedure 1 OBD CAN Key Megamos 48 VW Sharan 2009 UDS programmer dealer key Procedure 7 2008 Key Megamos 48 VW Scirocco 2009 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Scirocco 2009 UDS programmer dealer key Procedure 7 Issued by Abrites ltd Manual Version 3 02 November 10 2014 2004 VW Touran 2006 OBD CAN not needed TP23 Procedur
26. Kessy and the EZS Kessy will be automatically adapted 2 5 11 Special functions Immo V adaptation The function is dedicated to adapt engine control unit or BCM2 unit on the A4 A5 Q5 A6 A7 A8 vehicles 2 5 11 1 Adapting engine control unit To adapt the engine control unit you need to know the existing immobilizer data of the ECU There are three possibilities how can you get these data By OBDII Not all engine control units are able to be read by OBDII By flash EEPROM dump If necessary to synchronize only the ID of ECU with this of the BCM2 NOTE Some engine control units don t support the possibility to change the immobilizer data by OBDII In such cases the procedure for adapting the ECU is finished with success but the car is not starting In such cases it is necessary to make modification in Issued by Abrites ltd Manual Version 3 02 November 10 2014 the ECU EEPROM using boot mode First need to use the Clone ECU function where to prepare the ECU EEPROM then write it then use the function for the synchronization of the ID only 2 5 11 2 Adapting BCM2 To adapt BCM2 module it is necessary to have the old one and the new First the old one should be connected in order to be read then the new one is connected NOTE It recommended before adapting the new BCM2 module first to disable the ELV This is made when you connect the original BCM2 and use the BCM2 special function with the Re
27. Manual Version 3 02 November 10 2014 Adaptation Adaptation channel f Channel 2 Service Reminder ha ser Stop Service Reminder Service reminder closed Reset Stored value 0 Newvalue p Test Help n Some important channels used for adaptation Channel 50 typically used for adaptation of new parts Usually to get access to this channel you should do a security access with the log in of the device to which you are connected and the one you will adapt to the car After gaining access to channel 50 you should input the log in PIN of the car to which you will adapt the new part Channel 21 If the immobilizer is by K LINE then the adaptation of the keys is done in channel 21 To gain access to it you need to make a security access with the immobilizer Channel 1 If the immobilizer is by CAN then key adaptation is done in Channel 1 To gain access to it it is necessary to do a security access with the immobilizer UDS modules Issued by Abrites Itd Manual Version 3 02 November 10 2014 E Adaptation UDS T Manual Data Identifier Select Language version v oF owen SS 2233 Spanish gt no language lt German z French Italian Spanish Portuguese without text Czech S You have to select certain items from a drop
28. OF 14 03 OA OA OA OA OA OA OA OA OA FF FF FF eeeeeeeeee 000000C0 FF FF FF FF FF FF FF FF FF FF F4 0E D8 OE 03 08 eeeeeeee 000000D0 18 00 31 00 81 05 09 06 48 07 4E OA 46 OD BF 10 1 H N F 7 000000E0 00 00 70 00 31 07 AZ 07 84 08 BA OA F9 OC AS OF 8 L 000000F0 08 18 00 31 00 81 05 09 06 48 07 4E OA 46 OD BF l H N F Login 3125 Other Data 00000100 10 00 00 50 00 AO 05 40 06 80 07 AO OA CO OD 80 P 00000110 11 8E 4B FF 00 04 00 00 1E 03 9F OB 10 16 00 00 K 045 00000120 B3 0l EF 07 A9 OF 60 78 00 80 80 00 80 20 04 08 as zi Immo number 00000130 8D 00 BO 00 46 0l F4 01 SD 02 BA 02 DD 02 ED 02 F J s auz7z01070699 00000140 EO 02 BS 02 70 02 EO Ol 50 0l BO 00 60 00 00 OO p P 00000150 2A 08 18 00 30 00 60 00 D8 00 50 0l BS 02 EO 02 0 P 00000160 EO 02 00 00 57 00 34 0l 1C 02 FA 02 81 05 CB OOS W 4 00000170 CB 05 27 08 18 00 30 00 60 00 CC 00 38 0l 78 02 0 8 x an 00000180 90 02 90 02 00 00 57 00 34 O1 1C 02 FA 02 8l 05 Rr cres 00000190 CB 05 CB 05 07 06 C3 00 E9 00 4C Ol CF Ol B4 02 berre rs WAUZZZ4DZYN002822 00000140 3D 03 10 04 CO 03 20 03 80 02 90 O1 FO 00 06 90 s s s 00000180 01 80 02 20 03 B8 03 14 04 14 04 15 00 1A 02 lA e K R Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s d
29. Q5 If you don t have a working key and want to add new key the new one will be learnt but it is not sure that it will start the car Please first put working key in programmer and press Read working key ATTENTION Strongly recommend to have a working key from the car i Read working key The models are divided in two general groups Audi A4 A5 Q5 for this group it is not necessary to have a working key Audi A6 A7 A8 VW Touareg this group requires to have a working key a key purchased from a dealer is also an option If you would like to learn a blank key it is necessary to place the working key in the programmer and press the Read working key option If you plan on re learning existing keys or learn a key purchased from a dealer i e without programming blank keys it is not necessary to press the Read working key option After the model selection is complete the procedure is identical for both groups Issued by Abrites ltd Manual Version 3 02 November 10 2014 l TA ABRITES Commander far VAG E m r Step 1 Check BCM type Connecting to EZS Kessy Entry And Start Autorization OK Reading identification VAG N 8K0907064DP SW0327 Key count 1 Key authenticated Yes Key locked Yes Key learned Yes Y Learn keys in BCM2 completely by OBDII C Learn keys in BCM2 using programmer with ABPROG C Alarm OFF C Alarm ON C Re adapt BCM2 module to dif
30. Read Write the flash counters Read Write EEPROM Extracting security code PIN Immobilizer Enable Disable EDC 15 EDC16 ME7x The functions are available after pressing the button ECU from the special functions tab of the main dialog Issued by Abrites ltd Manual Version 3 02 November 10 2014 r Engine Control Unit Special Functions E ECU Autodetect v Choose ECU type ECU Autodetect YAG EDC15x VAG ME 1 1 7 5 7 8 wakeup pattern 01 VAG ME 1 1 7 5 7 8 wakeup pattern 11 Porsche 5 2 7 8 EDC16U1 EDC16U31 EDC16U34 EDC16CP EDC16CP34 EDC16CP34 Slave EDC16C4 Master EDC16C4 Slave EDC16U1 Master EDC16U1 Slave EDC16U31 Master EDC16U31 Slave EDC17 MED17 MED 9 5 10 MED 9 1 Master MED 9 1 Slave MED 9 1 Single SIMOS PPD 1 1 1 5 Siemens SIMOS 7 1 Siemens _ ECU type help Flash counter Att fn Suc ln Flash tool ID IMPORTANT You need to specify the type of Engine Control Unit in the car before proceeding There is also an Auto detect function implemented which will detect the ECU type in almost all cases however it is possible that it is wrong and then you need to select the type manually You can choose the ECU type VAG EDC15x VAG ME7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCH VAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG Cartronic ME7 8 EDC16U1 EDC16U3x CP
31. Required license AN009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Issued by Abrites Itd Exit Manual Version 3 02 November 10 2014 Dump Tool 9 x Type ECU ME 7 x Set component protection data 9P08 95080 20 20 20 20 BA FF 00 12 30 35 30 32 30 0502032 00000010 05 01 01 00 43 D8 71 1C OO 00 69 Cl OO AS 81 FC C q i 00000020 05 01 0l 00 43 D 71 1C OO 00 69 Cl OO A5 80 FC C q 7 00000030 04 01l D6 AC DS OC 2D Al BO 18 SB 00 00 00 Al FB ans 00000040 04 O01 D6 AC DS OC 2D Al BO 18 SB 00 OO OO AO FB H issna 00000050 OF 02 80 02 EO 01 06 00 26 04 58 OD OF OO Fl FD X 00000060 00 00 67 OD 09 OE 00 00 16 03 00 00 00 00 54 FF g Ts 00000070 05 A 22 09 09 00 06 05 00 00 02 2D 00 46 41 ne veas aR ets FA 00000080 05 04 22 09 09 00 06 05 00 00 FD 2D 00 46 41 cs ee ega Re FA 00000090 C5 Doooooao TTT SI pongngca 4 c a IM o 18 se 000000D0 ooooooro New fo fo fo ifo fo fo fo Load dump Save dump Swap bytes L H y 4 ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access cod
32. Show Coding Value 2 6 Key learning Inside every key there is a small chip called a transponder In most cases this chip does not require an external power supply it is supplied by a magnetic field which induces an electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general there are five different types of immobilizers transponders used They are called Immo I Immo II Immo III Immo IV and Immo V Systems from Immol up to Immo III require that a transponder from the appropriate type is located inside the key and they are able to learn these transponders Issued by Abrites Itd Manual Version 3 02 November Starting from Immo III it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside there are the following types of transponders Tp22 dedicated for use in Seat vehicles Tp23 dedicated for use in Volkswagen vehicles Tp24 dedicated for use in Skoda vehicles Tp25 dedicated for use in Audi vehicles especially A3 and A4 Such transponders can be used in all cars of the specific manufacturer e g Tp24 can be used for all Skoda models The lastest immobilizer systems Immo IV and Immo V requi
33. TAT aana ervas R LR This functinality allows the customer to adapt used parts on other cars In general this requires following steps 1 Reset the module to virgin state 2 Adapt the module to the vehicle you want pie a aa EZS Kessy Entry And St Adapted to car Connecting to EZS Kessy Entry And Start Autorization OK 15 Airbag Adapted to car Connecting to Airbag OK 17 Instrument Cluster Adapted to car Connecting to Instrument Cluster OK S Connecting to Central Electic OK 09 Central Electic Comp Prot N A Connecting to Comfort module vehicle el System SG OK 46 Comfort module vehicl Adapted to car Connecting to Memory module driver s seet Failed 08 Climatronic Auto HVAC Adapted to car Connecting to Climatronic Auto HVAC OK Connecting to Auxilary Heater Failed Connecting to Seat memory passenger Failed Connecting to DSP Failed Scan finished From the displayed list of available modules the customer has to select the module which they want to adapt Then the procedure of adapting the component protection is performed in two steps reset to virgin state learn module to the vehicle 2 5 9 2 1 Reset to virgin state Reset to virgin state is performed in three ways by reading the module by OBDII available for instrument cluster airbag comfort module and EZS Kessy by loading the module EEPROM dump available for airbag and EZS Kessy by loading the gateway EEPRO
34. The JCI with NEC uC and 95320 EEPROM special function is dedicated to the Johnson Controls instrument cluster with NEC micro controller 95320 EEPROM and UDS diagnostic protocol Issued by Abrites Itd Manual Version 3 02 November 10 2014 After starting this function you will see the following dialog box on your screen In the example below the data is already read r hl JCI with NEC microcontroller and 95320 ConfData B E Mileage Read write EEPROM Immo data Read Update ConfData ConfD ata Read mileage Recalibrate Load from file Save to file Read Flash Immo Data ID WVWZZZ6RZAY 255555 data Serial number Transponder identificators Update Immo Serial key CS e537d3ffca6f01 KeyID1 ccfefc15 KeyID5 373322ff ata MAC 502f0000 KeyID2 6fal2713 Keylb6 fffffffF Status 140000fedd KeylD3 1ab48ef4 KeylD7 HIH Configuration 210106550100 01 YW KeylD4 f29c12be Keylbg ffffffff Add key PIN 112345 Done Exit x d Press the Read mileage button to read the current mileage value Press the Read EEPROM and Write EEPROM to read or write the EEPROM data Press the Read Immo data button to read the immobilizer data After you have read the immobilizer data you can modify and write it by using the Write Immo data button After reading the immobilizer data you could add a new key P
35. adapt BCM2 function there put the same VIN without changes but when asked whether you want to disable ELV answer with yes After the new BCM2 is adapted you can restore the ELV using the same procedure 2 5 12 Special functions Theft protection This function is dedicated to disable learning of additional keys for a vehicle by OBDII This function is only relevant to OBDII functions This protection can be installed or removed but for both operations you need to have a working key If the protection is installed and all keys are lost you may need to read the immobilizer with a programmer For the moment the following protection can be installed A6 Allroad 2005 2010 Q7 2005 2014 A4 A5 Q5 2007 A6 A7 A8 VW Touareg 2010 Almost all VDO dashboards with NEC 24C32 24C64 EEPROM 2 5 13 Special function Steering lock adaptation This function works with a NEW steering rack ONLY or if the original is out of sync The window Steering lock adaptation can be used for adaptation of steering lock control module to the VW Touareg Phaeton Porsche Cayenne Bentley Continental Audi A8 This adaptation can be by CAN TP2 0 or K KWP2000 To perform this adaptation you need to know the security access code of the immobilizer and working aligned key from the car Issued by Abrites ltd Manual Version 3 02 November 10 2014 ioj x Procedure Replace align Steering column lock using PIN The complete system consi
36. bytes or to load the EZS Kessy from the EEPROM dump or to get the component security by OBDII from EZS Kessy If that is not done any attempts to perform any actions will result in an error 2 5 2 1 Learning keys with EZS Kessy In order to learn a key for the EZS Kessy you need to have the login and the component security bytes as described above and to specify the number of keys which are to be learned Once you have that you need to select the Learn button and the keys will be learned Key learning is done with dealer keys They can be obtained at a VW Audi dealer or can be made if you have the respective key programmer 2 5 2 2 Reading and changing VIN In order to read or write the EZS Kessy VIN you need to have the login and the component security component bytes as described above Once you have that you can use the read write buttons to change the VIN 2 5 2 3 Reading Writing EEPROM Issued by Abrites Itd Manual Version 3 02 November 10 2014 ATTENTION It is now possible to write areas 100 to 15F In order to be able to write this area you need to have a working key This is the area that contains the Immobilizer data Please be very careful when performing modifications here because modifying some areas of the immobilizer data might lead to the car not being able to start because it will not be able to recognize the key this is very much so in the component security range between 100 and
37. cluster immobilizer Reading security access code of the immobilizer Read Write immobilizer related data Please note that the provided security access code from this application is immobilizer related and will not be accepted by the instrument cluster For Micronas dashboards it is also possible to extract the mileage value by available EEPROM and flash dumps using the mileage by flash EEPROM dumps Micronas Reading Writing the immobilizer data is done from the Read IMMO data and Write IMMO data For Micronas dashboards it is also possible to extract the immobilizer data by available EEPROM and flash dumps by using the Immo data by flash EEPROM dumps Micronas If you would like to make a key you will need to read the immobilizer data first or to load it from flash and EEPROM dumps After that you should have a transponder programmer connected and then you should place the transponder inside Once that is done the new key is added to the existing keys allowing them to still function Note It is possible to have up to 8 keys per car If all positions are already taken when you create a key you have to substitute the 8 key position Note The Make dealer key and add it to the immo data button programs the transponder as a dealer key and adds its transponder ID to the immobilizer data The data however is not yet written in the micro controller You will need to select the Write immo data button
38. for VAG with their appropriate VAS number If you would like to connect to one of the devices just double click on it The Abrites Diagnostics for VAG will try to connect to the device using the following protocols consecutively KWP2000 over TP2 0 with a 5000kb s CAN baud KWP2000 over TP1 6 with a5000kb s CAN baud UDS over ISO transport protocol CAN KWP1281 or KWP 2000 over K line the protocol is recognized automatically from the wake up pattern You can choose which of these protocols to use when attempting to connect as described in the Configuration section 2 1 Configuration The Abrites Diagnostics for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed Specialfunctiors te Vehicle Selection Broadcast Oplions r Used protocol ter diagnestic J K Line baud rates tying sequnce Language E CAN TP 20 1047249600 English fu Advanced Z 4 i SeU U 9600 4 10472 rKLine used OBDII PINs da C r Logging A K Line KWP2000 KWP1281 Erea PROE 0 7 O15 ups is a CAN Resistor Enable k Lire log es 120 Ohm S Instant Loggng NOTE Changes regarding the interface and timing parameters made in this dialogue box will be applied after restarting the application 2 1 1 Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the Di
39. for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Issued by Abrites Itd Manual Version 3 02 November 10 2014 xi Type ECU Simos 7 CAN Security Access Code 93CC76 93C86 00000070 56 57 54 43 54 30 30 30 33 33 33 33 30 30 56 57 vuzczo003333ovw 00000080 5A 43 54 30 30 30 33 33 33 30 30 30 56 57 BA 43 ZCZ000333000VWZC 00000090 5A 30 30 30 30 30 33 33 30 30 57 56 57 SA 5A SA Z0000O0SSOOWVUWZZZ OO0000A0 33 43 5A 36 33 33 33 33 33 33 33 57 56 57 BA SA 3CZ83333333UVUZZ 00000050 54 33 43 SA 38 50 31 33 33 33 33 33 57 56 57 SA Z3CZ8P133333WVWZ 00000OCO 5A 5A 33 43 54 38 33 33 33 33 33 33 33 00 00 00 2230283333333 000000DO 7C 7C 30 39 30 37 30 33 47 39 30 36 30 31 38 46 090703G906018F 000000E0 47 20 00 O00 00 00 01 05 00 03 18 OF O1 16 Ol GAG 000000F0 01 05 00 03 I8 OF 01 16 01 64 01 05 00 03 OO OO ssssssss sse ses s 00000100 7C 7C 01 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G690601 lt gt ECU Simos 7 CAN Reset component protection data 93C76 93C86 Required license AN009 This function allows viewing and or changing the component protection data found in the Siemens ECUs Simos 7x generation which are accessed through K Line or CAN for benzine engines Into the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7
40. of the Kessy but for some function the user has to do this manually A more detailed description of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license AN003 This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Phaeton Porsche Cayenne and Bentley Continental The function also displays the learned keys and visualizes changes the immobilizer and VIN numbers Dump Tool x Type IMMO KESSY Audi 48 Yw Touareg Yw Phaeton Porsche Cayenne Bentley Continental 93C86 Load dump 00000010 00 00 00 00 AB AA CA 30 33 30 36 C2 30 30 30 3l 0306 0001 00000020 85 32 31 2E 30 31 2E 30 33 6A 30 39 85 32 31 2E 21 01 03909 21 Save dump 00000030 30 31 ZE 30 33 01 00 00 O1 00 00 01 FF Or O00 O1 O1 03 00000040 00 OF OE 4B 33 44 30 39 30 39 31 33 35 46 20 D K3D0909135F 00000050 35 57 4B 34 37 30 32 31 DA 56 42 52 42 34 78 DA SWK47021 VBRB4x Swap bytes L H ih 4 00000060 56 42 52 42 34 78 DA 56 42 52 42 34 78 05 04 00 VBRB4x VBRB4x Logn 6767 Bier Daa 00000070 00 FF 05 02 00 02 FF Ol FF FF FF FF Ol FF FF FF eeeeeeeeees 00000080 FF Ol FF FF FF FF 0l FF FF FF FF 0l FF FF FF FF sseeeeeeeeeees T 00000090 O1 FF FF FF FF Ol FF FF FF FF Ol FF FF FF FF 02 seeeeeeeeeeees S 00000040 01 70 56 57 5A 33 5A 30 43 31 30 33 34 34 3
41. should start without making any key learning procedure By pressing OK all changes in the dumps data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license ANO09 This function allows viewing and or changing the component protection data found in the Issued by Abrites ltd Manual Version 3 02 x November 10 2014 EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Dump Tool xj Type ECU EDC16 Set component protection data 95320 A 34 FF 8 16 12 04 a 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 9 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 771037372667 00000040 00 06 3 00 04 2A 10 75 a 30 32 b 31 30 31 32 u 02681012 00000050 31 31 20 20 00 00 00 16 9C 07 DS OA 16 FA Bl 119 p B ONION security data xj S Load dump Save dump Swap bytes L H Fi 4 000000E0 24 F3 C5 72 49 E BA CD DA 00 00 00 56 57 SA 43 4rI VUZ C OOOO00FO 5A 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 zZo00000000 U 24 F3 C572 49 E 8A CD DA 00 00 00 56 57 5A 43 4rI ECU EDC16 Immo bypass 95320 Required
42. the data is already read Magneti Marelli UDS with 9512 Microcontroller mami x Magneti Marelli Dashboard with Motorola 9512 microcontroller and UDS diagnostic protocol To make a key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press Add key After several seconds the key will be ready The learned key will be added to position key count 1 i e if you want to erase all existing keys and program one new key first put 0 for the key count and then make the key Mileage Read write EEPROM Immo data 0 Read Update ConfData ConfData Read mileage Recalibrate Load from gt Ro Save to file Read Flash Immo Data ID SVWJW11K 4M111117 Read Immo data Serial number Transponder identificators Update Immo Serial key CS 51334300a2661b KeylD1 bebSbSte KeylD5 T data MAC 4782294c KeylD2 be21f3a9 KeylD6 ffffffff Status O4FC KeyID3 be223337 KeyiD7 fttttttt ae G 73cd1 bef fl fff Key count KeylD4 KeylD8 ripen PIN 117210 Done Exit Ne eee eee The special function is used for mileage reading and key making Part exchanging and adaptation as well as identification and configuration is also possible The mileage function requires a separate license while dealer key making requires the dealer key license 2 5 1 4 Special Functions JCI with NEC uC and 95320 EEPROM
43. the vehicle model for which they want to learn a key to In the background the system tries to determine automatically what vehicle model it is connected to If the model recognition is successful it will be selected automatically If the Issued by Abrites Itd Manual Version 3 02 November 10 2014 system cannot recognize the model the user has to choose the model manually NOTE It is possible that the system does not recognize the model correctly In this case you have to select the model manually For example it is not possible to distinguish between VW CAN 2007 and VW CAN 2007 for that reason by default VW CAN 2007 is selected NOTE Please pay attention that for some models the key learning and dealer key prepration are made in separate special functions So if the SW detects such case you will have a hint to go the respective special function where to make the key After the vehicle model is recognized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified by the immobilizer A reason for that might be an invalid key or engine control unit not adapted to the car or for some models there is a waiting time Yes here means that the immobilizer recognizes the key properly and the engine is allowed to start i e everything is OK
44. to do that Alternatively you could exit without writing data since you already have have a dealer key Of course you could always teach the transponder by diagnostics This application could be used with the following models VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda Octavia II Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the function for reading current mileage value is not available ATTENTION Please take into consideration that some instrument clusters of the Audi A3 and A8 have the access to the special functions blocked The blocked access ones can be recognized by the unreal value they display when you read them If you need to restore normal behavior to the instrument cluster you need to remove the fuse of the instrument cluster for one minute e g in the Audi A8 you could remove fuse number 5 The most common Issued by Abrites ltd Manual Version 3 02 November 10 2014 reason for the blocking of the security access is the usage of low quality diagnostic tools in the past ATTENTION The Abrites Diagnostics for VAG is designed to calculate mileage values in metric units Please take this into account Especially when using a dump tool or when the Abrites Diagnostics for VAG asks you about the displayed value of the instrument cluster 2 5 1 2 Special functions with VDO NEC
45. to give ignition ON with a working key to put the PIN CS of the transmission to place the transponder programmer over the working key when it is on the ignition the transmission will be automatically adapted 2 5 10 5 Adapting EZS Kessy on A6 Q7 Allroad This special function is dedicated to adapting second hand EZS Kessy from one vehicle to another To adapt the EZS Kessy you need the existing PIN and CS of the second hand EZS Kessy You can extract it by reading the EZS Kessy with a programmer or by reading the engine Issued by Abrites ltd Manual Version 3 02 November 10 2014 control unit from the car from which you have taken the replacement second hand module Without having the PIN CS of the transmission you cannot adapt When starting this special function the following dialog is displayed A6 Q7 Transmission 4F0 4L0 Preconditions 1 ECU TCU are matched each other 2 Blank key in the ignition and PIN 1 16 of OBDII are shorted 3 Programmer antenna is over the key which is in the ignition New EZ2S Kessy PIN CS me Enter PINACS of the E25 Kessy manually EZS Kessy PIN Es Load ECU or EZ2S Dump Exit lr Old EZS Kessy dump is available EAER EZS Kessy dump The procedure is automated all you need to do is to put brand new empty key in the ignition to place the transponder programmer over the working to put the PIN CS of the EZS
46. to the car it is locked during the key learning procedure and cannot be used on other cars Once you have the required count of pre coded dealer keys you can learn them Also the original keys should be learned in this step otherwise they will no longer function Issued by Abrites ltd Manual Version 3 02 November 10 2014 TA ABRITES Commander for VAG Step 3 Learn key Number of keys to learn 2 Learn keys Make dealer key Key count 1 Key authenticated Yes Key learned Yes Key locked Yes 2 5 3 4 Alarm OFF This option is dedicated to a case where there are no keys for the particular car If there is an alarm installed after unlocking the driver s door the alarm will be set off in 15sec If in the meantime you activate this function the alarm will not start Then you could unlock all doors by unlocking the driver s door once again Some vehicles do not have an alarm installed and after opening the driver s door all doors are unlocked 2 5 3 5 Alarm ON After the alarm is disabled and a new key is learned to the car it is recommended to restore the alarm using this option 2 5 4 Special functions with instrument K Line When you open this function the following window appears Issued by Abrites ltd Manual Version 3 02 November 10 2014 Instrument Cluster Immobilizer K E x Choose IPC ype Instrument Cluster YDO66 YDO86 Motometer
47. v 0 00 0000020 00 0 ao000030 00 aer in Black immobilizer box Siemens 6 PIN HCOS Immo1 9 oo o Black immobilizer box Siemens 6 PIN HCO5 2400 Immo1 000079 00 ofBlack immobilizer box Siemens 6 PIN TMS Immo1 00 Ofinstrument Cluster Audi A4 B5 with Board Computer 19971 Read p 0090 00 esel ECU d Instrument Cluster Audi A4 B5 without Board Computer 19971 ROM Flash 3 oo of fstrument Cluster Audi A8 10 1996 o oo of nstrument Cluster Audi A8 11 1996 coo000D0 00 ojinstrument Cluster Audi Ab B45 1997 000000E0 00 Of nstrument Cluster Magneti Mareli Shadow 1 dK 2s E Instrument Cluster Magneti Mareli Shadow 2 Passat 00000110 00 0 Instrument Cluster Magneti Mareli Shadow 3 TT Login 9 00000120 00 oq nstrument Cluster Mangeti Mareli Direct 1996 2000 oo ojinstrument Cluster Mangeti Mareli Direct 2000 7 00 Oflnstrument Cluster Sharan Galaxy up to year 2000 19 00 Olinstrument Cluster Audi 44 BOSCH RB4 CRYPTO 2001 a Instrument Cluster VW Golf4 BOSCH RBx oo oq nstrument Cluster Audi Ad BOSCH RBx oo of W Phaeton Touareg Bentley Continental Porsche Cayenne 0 00 O4lnstrument Cluster Audi A4 BOSCH RB amp CRYPTO 2004 2 1 lnstrument Cluster Laborghini Gallardo 2005 Instrument Cluster Laborghini Gallardo 2005 E Mileage LS 6 6769 CO Skip neg responses Ext From this dialog box you will need to choose your instrument cluster type or the immobilizer and then you could read write
48. vehicles To connect to any other device you will need the ABRITES Diagnostics for Mercedes Starting this special function brings the following dialog _ _ _ _ A ABRITES Diagnostics for VW Audi Seat Skoda 20 0 www abritus72 com xs e unit name VAG umber 00 01 Engine Control Unit Master a Previous 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Kessy Entry And Sta 06 0 VW Crafter Engine Control Immobilizer Remote Control SESI opening Unit Diagnostic Diagnostic Diagnostic eo ff S EE Ss KF Seat memory passenger Instrument EZS Kessy BCM2 Instrument Engine Control EDC17 and Component Immo parts Steering lock O7 AB 44 45 05 Unit MED17 Boot protection adaptation adaptation Aa BY ose e dels k S aA eer s Ea D Open TV Key learning Dump tool Airbag VW Crafter DSG Custom PIN Converter Remote configuration Calibration Read Update control iam iam a N From these buttons it is possible to perform the following actions when pressing ECU EEPROM the same dialog as in the Engine control unit is brought to the user and it is possible to read EEPROM read mileage and bypass the immobilizer from here You do not need to select any engine type it is done automatically pressing Key learning will bring the Key learning dialog the user is not required to select a Issued by Abrites Itd M
49. 0 00 00 00 00 00 00 OO 00 00 09 F 6E n ooooodad 00 04 ZA 10 75 AG 30 33 47 39 30 36 30 32 31 41 u 036906021A OOOOO0BO 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC oooo00co 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H oooo00DO 00 00 00 00 00 00 00 00 00 00 00 OO 00 09 F GE ee eee n 000000E0 24 F3 C5 72 49 E BA CD DA OO 00 00 56 57 5A 43 4rI VUZ C OOOO00FO SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Zo00000000 U 00000100 24 F3 C5 72 49 E 84 CD DA OO 00 O0 56 57 5A 43 4rI VUZC lt Checksums in the file updated Press the Save button to save the changes ECU MED 9 x Reset component protection data 95160 Required license AN009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Issued by Abrites Itd Manual Version 3 02 November 10 2014 Dump Tool S J x Type ECU MED 9 x Res
50. 0 1 Adapting engine control uniS sss sees eee eee eee 68 2 5 10 2 Adapting Audi A8 VW Touareg immobilizer KeSsy cesceeeeseeeteeeeeeees 69 2 5 10 3 Adapting comfort module on Passat BOICC sese 70 2 5 10 4Adapting Transmission gearbox on A6 Q7 Alr0ad 0 cee eeceeseeeeeeeneeeneeeeeneees 12 2 5 10 5Adapting EZS K essy on Ap O7 AIFoad sese 12 2 5 11Special functions Immo V adaptation sese sese 73 2 5 11 1 Adapting engine control units sees eee 73 2 5 11 2 Adapting BCM 2 sinnser a E EE E A E E SE 74 2 5 12Special functions Theft protecHOn sese eee 74 2 5 13Special function Steering lock adaptation eee eee 74 2 5 14Special function MMI TV connguration sese eee ee eee eee 75 2 5 15Special function Custom memory access Download Upload ReadMemory 76 2 5 16Special functions With AMIDES sciiiecceieniiietie nee ees 71 2 5 17Special function VW Caer sese eee 80 2 5 18Special function Dump TOG vcciacinztiaesasentecsndesuauiacesscesestvisasadestessetesnaiidensiyavesteeasiinds 81 2 5 19Special function Service Interval 81 2 5 20Special function Remote control adaptation sss eee eee 81 2 5 2 Special function Navigati n say ccistivestepicdesatnts este naimaeu etn 83 2 5 22Special function Cruise control SYSTEM ssissisicavesvsdensincceciaasecvusssaxnedastaasoenadseencavoavdecys 83 2 5 23Special function Brake pads change eee 83 2 5 24Special function ECU E
51. 003BA0 56 58 56 56 58 56 11 1E 3B SA 79 96 B6 OO FF FF XXXXXX 3Zy 00003BB80 42 20 93 9D 43 7F FF 30 42 DE BS 57 42 20 E8 31 B C 0B WB 1 OOO0SBCO FE FF FF FF FE FF FF FE FE FE PF PF FP PP EF ERA aaa cn aa ese 3 00003B8BD0 04 OD 2B 41 55 5A 35 5A 30 41 58 56 56 58 56 56 AUZSZOAXXXXXX OOOO3BEO 56 11 1E 3B 5A 79 96 B6 OO FF FF 42 20 93 9D 43 X 2Zy Be sail E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXxX and the login is OD2B in hexadecimal or 3371 in decimal 2 If the immobilizer number is not present then the login is located somewhere in the region Issued by Abrites ltd Manual Version 3 02 November 10 2014 of 0x0070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFl eeeeee 00003810 FE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF COG03620 FF FF FF FF FF FF FF FF EA 00 D1 18 IF CO FF FF mat aaan nanea OOOO03830 FF EA D6 O1 FD Cl 1E FF FF FF 1E FF FF FF 1E FF 00003840 FF FF 06 06 F9 FF FF FF 10 00 47 45 36 35 54 54 GE65TT 00003850 31 30 30 30 31 10 FF FF FF FF FF FF FF FF FF 23 10001 00003860 07 23 03 02 00 00 1E 00 32 20 00 OO 02 00 32 FFI CHH 00003870 FF FE EE FF FF FF FF FF FF FF FF FF FF FF FF EEF
52. 123 Another thing is that if you modify this area and have the error above it will not be writable again due to the lack of a working key Should such events occur you will have to create and learn a new key to the car in order to restore the ability to write this section again There are a few ways you could approach this situation You can learn a brand new transponder You can unlock the original key make it a dealer key and learn it again making the area writable again 2 5 2 4 Programming a blank key so that it becomes a dealer key First you need to input the login and the component security bytes as described above After that you need to press the Make dealer key button At this point you should have a blank key inside the key programmer and the ABRITES Diagnostics should be connected to the car A few seconds later you should have a dealer key ready Then you can learn the key by selecting the Learn button 2 5 3 Special functions with BCM2 A4 A5 Q5 This special function is dedicated to key leaning for the vehicles equipped with the so called BCM2 Normally these are the A4 A5 Q5 vehicles produced after the year 2007 and also A6 A7 A8 produced after 2010 and Touareg produced after 2010 Once you start the special function you need to select the model Issued by Abrites ltd Manual Version 3 02 November 10 2014 E A ABRITES Commander for VAG E Select car type C Audi A4 A5
53. 2 0220 00000080 OA AZ 51 1A 5B 31 32 36 2E 30 32 2E 30 37 FF FF Q 126 02 07 00000090 34 46 30 39 30 35 36 35 32 42 20 20 20 33 31 FF 4F0905652B 31 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF sssssssss ennn s 00000080 33 30 35 32 31 30 30 39 33 31 38 31 32 31 35 30 3052100931812150 r X Load from file al gt This special function is dedicated to the Q7 A6 Allroad models and provides the following functions Key learning In most cases it requires a pre programmed key one using VIN which can normally be purchased from a VW Audi dealership This function can also be performed without a dealer key however you will be required to create a dealer key You can do that with the Abrites dealer key special function and a programmer Read the EZS Kessy EEPROM 2KB Write the EZS Kessy EEPROM 2KB containing the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so that it becomes a dealer key IMPORTANT In order to perform any functions with the EZS Kessy you need to have one of the following The login PIN of the car and the first 6 bytes of the component security The component security is normally 7 bytes however the 7 byte is not required The login Issued by Abrites ltd Manual Version 3 02 November and component security bytes can normally be read from the ECU This applies for all cars with EDC16x MED9x
54. 3 43 5A 36 50 31 31 31 31 31 31 57 56 57 BA SA 3CZ6P1111110VUZZ 00000050 54 33 43 5A 36 50 31 31 31 31 31 31 57 56 57 SA Z3CZ6P1111110VIZ 00000OCO 5A 5A 33 43 5A 36 50 31 31 31 31 31 31 00 00 00 223C26P111111 000000DO 7C 7C 37 30 31 30 30 33 47 39 30 36 30 31 38 20 701003G906018 OOOOO0EO 20 20 00 00 00 00 AF 50 AF 50 AF 50 98 2A 85 AA a P OOOO0OFO 76 55 F4 8A 85 51 84 9B 80 3B 81 09 81 08 83 v Q 7 N 00000100 83 4F 82 1B F4 80 DE 30 30 33 47 39 30 36 30 31 0 003690601 7 d ECU Magneti Marelli Security Access Code 95320 Required license AN003 This function displays the security access code contained in the engine control unit from Magneti Marelli Dump Tool xj Type ECU Magneti Marelli Security Access Code 95320 03 saraaa 00000010 Es 03 8 03 E8 037 ES 03 E3 03 E8 03 El 03 E9 22 cwwwcvcvcewcece 00000020 EREE FF FF FF FF FF FF EREE FF FF FF FF FF FF wencnanenananene O OOOOOSD 2046 91 TETI Ta Ty LTL AL LLP TEP IE dU ang grnanp gvg n s 00000040 11 11 11 11 iB 41 FF FF FF FF FF FF FF FF FF FF c sds cs esecces OOO000SO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF iinoa aa uaa 00000060 FF FF FF FF FF FF FE FF FF FE FEFE FF FEO FRO FE Sega Na Lod pasa DUU0DD270 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eiee an oddeu Sik S 00000080 00 06 46 22 19 02 4B 2B AA 00 00 00 00 OO OA FS F K 00000090 30 33 43 39 30 36 30 32 34 46 20 20 30 31 31 38 O03C90602
55. 40 FF OD 85 FF QOOOO1IDO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF QOOOO1IEO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Issued by Abrites Itd Manual Version 3 02 November 10 2014 VW Passat usually these Instruments are before 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if successful proceed as described above If not select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed mileage is displayed as 0 VW New Beetle First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if successful proceed as described above If not select type Magneti Marelli Shadow 1 and read EEPROM The login is not displayed The mileage is displayed as 0 Issued by Abrites ltd Manual Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 Porsche Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox Issued by Abrites Itd Manual 111 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 Audi A8 fusebox passenger side wakeup ECU Issued by Abrites Itd Manual 112 Version 3 02 November 10 2014 Audi Q7 To get communication with the ECU you ne
56. 49 E 8A CD DA 00 00 00 56 57 5A 43 rI VUZC y Toggle Immo On Off Immo is now ON The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Security access code Checksum calculator 95320 Required license None This function displays the security access code which is contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section Issued by Abrites Itd Manual Version 3 02 November 10 2014 xj Type ECU EDC16 Security access code Checksum calculator 95320 ing 8 16 12 04 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 00000040 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 00000060 00 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 03G906021A in 52698 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC Login 2 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 SBT HZ 00000090 00 00 00 0
57. 4H 0118 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OO 00000080 00 00 00 00 00 00 00 OO 55 AA 33 CC 50 90 09 08 e Ja Pioa 000000CO 38 OO 06 04 OF AA DS SF 27 70 FF FF 00 OO 00 FF 8 oe Disses OOOOOODO FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF cosine oauan QOOOOOCEO 01 00 03 00 46 55 38 10 13 73 3C 8C CC 42 00 00 US 0 Be 000000F0 10 73 38 10 13 73 3C 8C CC 42 00 00 10 73 38 10 38 s lt B 38 00000100 13 73 3C BC CC 42 00 00 10 73 53 45 5A 37 5A 30 3 lt B s5E2720 7 gt Load dump Save dump Swap bytes L H ih 4 Issued by Abrites Itd Manual Version 3 02 November 10 2014 Audi A8 2002 Security access code Program transponder 24c17 Required license AN006 to view security access code and AN009 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Tool 9 E k xj Type Audi A8 2002 Security access code Program transponder 24c17 v 00000070 50 1E 23 34 53 00 2D FF 50 00 ZA FF 64 00 25 FF P 45 P d lel 00000080 64 14 1C 2D 50 18 1C 34 53 14 1C 2D 64 50 32 05 d P 45 dP2 00000090 25 39 00 00 00 00 00 00 00 00 OF 1E Ol DA 02 FF 29 00005 000000A0 00 00 00 00 00 00 00 2D 00 4B 00 48 03 2C O1 00 K H Swap bytes L H 00000080 00
58. 4L37D 00000090 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 00000040 20 20 20 20 57 41 55 5A 5A SA 34 4C 33 37 44 30 WAUZZZ4L37D0 en rey 00000080 39 31 32 31 30 11 00 00 00 00 OO 00 OO OO F5 62 91210 E lt 000000C0 02 04 00 OO 10 57 41 55 5A 5A 5A 34 4C 33 37 44 WAUZZZ4L37D 000000D0 30 39 31 32 31 30 20 20 20 20 20 20 20 20 20 20 091210 000000E0 20 20 20 20 57 41 55 5A 5A 5A 34 4C 33 37 44 30 WAUZZZ4L37D0 000000F0 39 31 32 31 30 11 00 00 00 00 00 00 00 00 FS 62 91210 b Toggle Immo On Off 00000100 03 04 4B D4 39 OB OO 00 00 OO OO 00 OO OO OO 00 K 9 ee 00000110 00 00 00 00 00 00 00 00 00 OO 00 00 00 00 FE 95 wo eee cece eee 00000120 04 03 48 30 35 2D 42 50 47 38 31 30 08 02 07 31 HO5 BPG810 1 00000130 33 32 34 30 31 38 31 35 43 00 00 00 00 00 FB SF 32401815C 00000140 05 03 30 33 48 39 30 36 30 33 32 47 20 30 30 30 03H906032G 000 00000150 30 30 00 00 00 00 00 00 00 OO OO 00 OO OO FC Cl OO 00000160 06 02 00 07 02 7C Ol AO FF FF 04 32 11 AO OD 92 oe ean 00000170 OF 74 00 00 00 00 00 00 00 OO OO 00 OO OO FA CB t 008 00000180 07 02 00 OO OE 2C 7A B6 05 OO OO OO 27 BF 00 OO eee L 00000190 00 00 00 OO 00 00 OO OO 00 OO OO 00 OO F4 FC AD eee eee 00000140 07 02 00 OO OF 2C 7A B6 05 OO OO OO 27 BF 00 00 AR 669 aa 00000180 00 00 00 OO 00 00 00 OO 00 OO OO OO OO F4 Immo is now ON ECU ME 7 x Set component protection data 9P08 95080
59. 6 of the ABRITES Diagnostics for VAG 2 10 25 05 2 3 Added descriptions 2 11 17 06 2009 All Update to V7 0 of the ABRITES Diagnostics for VAG 2 12 02 10 2009 3 7 Update to V7 1 of the ABRITES Diagnostics for VAG 2 13 06 01 2010 3 5 16 Update to V7 3 of the ABRITES Diagnostics for VAG 2 14 21 01 2010 7 7 Update to V7 4 of the ABRITES Diagnostics for VAG 2 15 15 02 2010 3 5 7 Update to V7 5 of the ABRITES Diagnostics for VAG 2 16 22 02 2010 3 Update to V7 6 of the ABRITES Diagnostics for VAG 2 17 25 03 2010 3 Update to V7 7 and V7 8 of the ABRITES Diagnostics for VAG 2 18 15 05 2010 3 Update to V8 0 of the ABRITES Diagnostics for VAG added 2 19 section for the CDC32xx programmer 27 05 2010 3 7 Update to V8 0 of the ABRITES Diagnostics for VAG added 2 20 section for VW Crafter 9 09 2010 Update to V8 4 of the ABRITES Diagnostics for VAG 2 21 AA e a00 Update to V9 0 of the ABRITES Diagnostics for VAG Bee Ta Update to V12 0 of the ABRITES Diagnostics for VAG gag 22 06 ZUTU i AN Update to V13 0 of the ABRITES Diagnostics for VAG mak TREE Component protection chapter added 229 Chapter Remote control adaptation updated Chapter Special functions with VDO NEC updated Chapter Coding of the unit updated Chapter Repair RB8 DEF added APUR 2012 Added ECU adaptation by OBDII chapter ias Issued by Abrites Itd Manual Version 3 02 November 10 2014
60. 9 30 pVWZ3Z0C1034490 Na 1030000 00000080 01 00 00 00 00 00 00 00 29 00 23 05 OB 00 07 03 oe T 000000C0 O1 00 OO 00 0l OO 00 OO 01 OO 00 00 O1 00 00 OD eee 000000D0 O1 OO OO OO 01 OO OO OO 2D 7A AO FO 7B 9B FO 72 Zaf E WVGZZZ7LZ3D010000 000000E0 9C FO 83 A3 FO CE 65 90 FO 65 90 FO 00 00 00 00 EOR 000000F0 00 00 0l 00 00 ES EB E3 7D 35 AE FO C2 2B 41 75 J5 AU 00000100 F BO 80 4B 0l 00 7F 7E 01 00 99 2C 6C O1 00 00 K l wf d Pressing the other data displays the learned keys and also allows changing the immobilizer status on some models changing the immobilizer status is used to put the Kessy e g into delivery condition Issued by Abrites ltd Manual Version 3 02 November 10 2014 Kessy keys x Key 1 DC004426 Key 5 FFFFFFFF Key 2 5E344320 Key 6 FFFFFFFF Key 3 FFFFFFFF Key 7 FFFFFFFF Key 4 FFFFFFFF Key 8 FFFFFFFF Immo status 8 EZS Kessy Security access code 95121 Required license AN003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola HC9S12 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Dump Tool x Type EZS Kessy Security access code 9512 7300260011 0577 00000020 36 33 30 30 30 34 30 36 30 31 FF FF 35 39 32
61. Abrites ltd Manual 146 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 CP24 TC1796 with Internal and External Flash l 1164444471 LRRL E A Samana Na Mat S Issued by Abrites ltd Manual 147 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 U01 TC1766 with Internal Flash F r 7 RE lt e P ntin ILII 1 T 4 g OZA 7 Issued by Abrites ltd Manual 148 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 U05 TC1796 with External Flash Ground oe maa Issued by Abrites Itd Manual 149 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag MED 17 5 1 TC1796 with Internal and External Flash Thread boot oj 1000 O Issued by Abrites ltd Manual 150 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag MED 17 5 2 TC1767 Internal Flash 73 ee 8 0 6 Oe ore E 20 CHESS O22 9 0 Me 05 S 3 i R Teo i i Issued by
62. FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU EDC17 CP44 TC1797 L RIEG ND 2 S AE A k WA 41171991 k Issued by Abrites Itd Manual 142 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 C46 TC1767 Oran Ol tHe lee a 7 ONSONTETYRURNSRUONAOUY A UNRRRRRRUNRNAH ALAA ore lt os AMIN se PZ eos R b e ea eo os N KJ Z ORRILA ALISA RG dhe C azoa Issued by Abrites ltd Manual 143 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 CP04 TC1796 Ignition gt we me HTHH ee t ay SA RA P 4 Be NC a 7 MBB R k L Pa Issued by Abrites Itd Manual 144 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 CP14 CP20 TC1796 variant 2 Ignition ia 1000 Q J ECOUTE ddd Issued by Abrites Itd Manual 145 Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 ECU Vag EDC17 CP14 CP20 TC1796 with Internal and External Flash Ignition gt g d dibu ECA Ea Ag CEOE OOOOOO O o te ar N ET S Issued by
63. Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in the replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device later on ECU Exchange Dump Tool x Choose ECU type EDC16 00000000 Sa 00000010 00000020 Load active ECU dump 00000030 00000040 00000050 00000060 00000070 00000080 00000090 00000000 N 00000010 00000020 Load replacement ECU dump Change replacement ECU dump Save replacement EEU dump 2 5 25 Special function Door unlocking This function is dedicated to opening car doors when the car is in SAFE mode To use this function you will need to connect some Pins of the DB25 interface of the AVDI with cables to the wiring of the car manually Issued by Abrites ltd Manual Version 3 02 November You have to find the desired wires in the car orange with green CAN H and orange with brown CAN L and you have to connect them to OBDII connector PING CAN H and OBDI Connector PIN14 CAN L Also you have to connect OBDII Connector PIN4 Ground to a metal part of the car After you are ready you can call the Unlock doors special function The following dialog will be displayed FP ail y Door unlocking Unlock WW Unlock Q7 A6 Allroad Touareg Phaeton Audi A AVD umm Unlock Porsche Cayenne i Unlock VW Passat Unloc
64. M dump from the car from which the module is taken where it was originally built in The customer has to select from the following dialog in which way they want to proceed Issued by Abrites Itd Manual Version 3 02 November 10 2014 TA ABRITES Commander for VAG Step 1 1 Reset to virgin state Please select how to reset to virgin state By OBDII available for EZS Kessy KOMBI AIRBAG Comfort module and Climatronic r By module ConfData dump available only for airbag DSP EZS etc C requires the GATEWAY ConfData dump from the car where module was originally equipped By gateway ConfData dump available for all devices sate By gateway ConfData read by OBDII available for all devices requires the GATEWAY from the car where module was originally equipped to be connected in the car After selecting the operation manner another dialog with the status of the operation is displayed Issued by Abrites Itd Manual Version 3 02 November 10 2014 a Step 1 2 Reset to virgin state Connecting to Airbag OK Disabling security OK Reading Trying to reset component protection OK Component protection is reset with SUCCESS After the operation is completed the module is in a virgin state and can be adapted to any car 2 5 9 2 2 Learn module to the vehicle To learn the module to the vehicle it is necessary to have the Gateway EEPROM dump from the car on whi
65. N FA i e fah 00000050 FF FF FF FF FF b 000000C0 FF FF FF FF FF b 000000D0 FF FF FF FF FF OOOOO0EO 57 34 32 31 38 000000F0 30 50 30 30 33 00000100 FF FF FF FF FF 00000110 FF FF FF FF FF 00000120 FF FF FF FF FF Swap bytes L H Other Data HG F M aA aA f a a Immo number vwzczoo0000000 OOOOOL7O FEEF FF FF OFF FF EE EE FEEF FF FF OFFOFF CFF FF oo tuoanoooatano 00000180 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF seeeeeeeees S 00000190 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF seeeeeeseees O 00000140 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF eeeseeeeeees O00001B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ssseseeeeeees gt Component security bytes are D9 7252 79B2E4 44 Pressing the other data displays the learned keys and allows several operations lf a programmer has been recognized it allows to read current transponder s data add it to the dump and if transponder s type is appropriate allows to program it as dealer key lt allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition Issued by Abrites Itd Manual Version 3 02 November 10 2014 i Comfort module keys i Comfort module keys data Write keys to comfort module dump You can enter manually a key in certain position With pressing OK keys data will be written t
66. November 10 2014 Abrites Diagnostics for VAG User Manual Issued by Abrites Itd Manual Version 3 02 November 10 2014 List of Revisions Date Chapt Description Revision er 27 11 2007 Release version of the document 1 0 14 01 2008 2 Update of the description of dongle installation HID driver 1 1 01 02 2008 3 2 1 Update of description regarding Audi A4 Bosch RB4 Crypto 1 2 2 clusters 12 02 2008 Adaptation regarding SW version 4 1 1 3 18 02 2008 2 Changes regarding setting of the working folder for the 1 4 shortcuts 20 02 2008 2 4 5 Clarification of the Installation procedure 1 5 14 03 2008 All Update to V5 0 of the ABRITES Diagnostics for VAG 2 0 06 06 2008 3 6 7 Update to V5 1 of the ABRITES Diagnostics for VAG 2 1 01 07 2008 3 6 7 Update to V5 2 of the ABRITES Diagnostics for VAG 2 2 28 10 2008 All Update to V6 0 of the ABRITES Diagnostics for VAG 2 3 08 11 2008 7 Table with key learning procedures added 2 4 01 12 2008 3 7 Dump tool described in details 2 5 12 12 2008 All Update to V6 2 of the ABRITES Diagnostics for VAG 2 6 06 01 2009 3 Update to V6 3 of the ABRITES Diagnostics for VAG 2 7 23 03 2009 3 Update to V6 4 of the ABRITES Diagnostics for VAG 2 8 21 04 2009 3 Update to V6 5 of the ABRITES Diagnostics for VAG 2 9 Procedures for Q7 A6 Allroad described 19 05 2009 2 3 7 Update to V6
67. OSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instruments You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi A4 BOSCH RBx 2 Read the EEPROM 3 If the displayed mileage corresponds to the real value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH RBx otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 4 1 Transferring keys from one RB8 instrument to another Starting with a V5 2 of the ABRITES Diagnostics for VAG onwards it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Issued by Abrites ltd Manual Version 3 02 November 10 2014 Instrument Cluster Immobilizer K Choose IPC type instrument
68. WE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the software will read and display it s current configuration After the Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate the cruise control system function and apply any changes of the SWE configuration to the SWE unit 2 5 23 Special function Brake pads change Using this application you can Open rear parking brake for pad change Close rear parking brake perform Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness Issued by Abrites Itd Manual Version 3 02 November 10 2014 2 5 24 Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle application name active ECU and the EERPOM dump of the engine control unit with which you wish to replace referred to as replacement ECU After opening the application load both dumps using buttons Load active ECU dump and
69. a Passat B6 v oo 00 00 00 00 00 00 00 00 31 2D 2E 2D 2D 2E 2D 2D 33 43 39 b 3C0959 48 20 20 30 34 35 33 33 43 39 433H 0453300959 48 20 20 20 FF FF FF FF 03 FF 433H FE EF FE FF FE FF EF EY FF FF FF FF UF FE Pa 2P EF OFF BS 47 14 FE 00 03 63 00 03 00 03 62 5A FF FC B2 56 FF ECU component protection data Load ECU component protection data from dump Load ECU dump Enter component protection data manually LH H H H 1 Other Data Load dump from EDC16 ME x MED Sv uncrypted Simos PPD Simos FSI The function also visualizes changes the immobilizer and VIN numbers Issued by Abrites Itd Manual Version 3 02 November 10 2014 ane roo x _ Type Comfort module component protection data Passat B6 v oo 00 00 00 00 00 a 00000010 83 62 2D 2D 2E 2D 2D 2E ZD 2D 33 43 30 39 35 39 b 3C0959 lr 00000020 34 33 33 48 20 20 30 34 35 33 33 43 30 39 35 39 433H 04533C0959 00000030 34 33 33 48 20 20 20 FF FF FF FF 03 80 FF FF FF 433H E 00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF OFF FF wccscccccccmeces OOOO0OSO FF FF FF FF FF FF 7F FF EO F FF FF FF FD FF FF w csccccncencnes 00000060 SA 54 FE BS 47 1A FE 00 03 63 00 03 64 00 03 56 22 G c d 00000070 OO 03 57 00 03 62 54 FF FC B2 56 FF 00 43 86 00 W b2 C Save dump 00000080 43 82 00 43 83 00 43 84 00 43 85 SA FE 79 62 44 C C C C 2 ybd 00000090 FF 00 02 69 00 02 65 nn N 6A NN N2 67 NN
70. able from the Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access enter into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES Diagnostics for VAG Using this application you can read program memory in some electronic control unit Requests sent from this application can be related to the currently running session of some of the electronic control units from the dialog You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of an EDC16 In the example below we read a part of the flash of EDC16CP Issued by Abrites ltd Manual Version 3 02 November 10 2014 Custom memory download upload Choose ECU tpe EDC16U1 EDC16U1 EDC16U31 EDC16U34 EDC16CP EDC16CP34 EDC16C4 Master EDC16C4 Slave EDC16U1 Master EDC16U1 Slave EDC16U31 Master m Connection EDC16U31 Slave St Address 800000 MED9 5 10 MED9 1 Master Len of req 0 ae Slave Total size 100000 Save to file Step 0 Encryption Download Upload C Read Write mem
71. ack Next gt Exit Select the appropriate coding and press Next Issued by Abrites ltd Manual Version 3 02 November 10 2014 BZD f Select al Central Electric Seat Alies 42 digits code value Coding information O Front Fog Lights installed O Xenon Headlights with Shutter installed O Lighting system PR QQ4 O Daytime Running Lights Scandinavia active O Daytime Running Lights North America O Driving lights O Driving lights O Coming Home active O Rear Seat Recognition installed O Headlight Washer installed PR 8x1 lt Coding information Headlamp washer delay after power on Default 51 ms a Headlamp washer time to excite the default 230 ms aiaa Show Coding Value cok tt In the opened window you can check un check the desired features see list with check boxes in the above picture modify certain value see the list with the two columns text and value in the above picture or select certain value by combo box selection Check Select all check box to mark as checked all the check boxes from the check boxes list The coding value is represented into the edit field at the bottom of the window next to button Show Coding Value When a certain item is changed this is automatically reflected into the coding value If you would like to see certain coding value meaning you should write down the value into the edit field and press button
72. ad Write EEPROM 1 All Siemens CAN Airbags 2003 2008 like 4F0959655B Audi A6 Q7 Allroad 2003 2008 1KO909605AB 1KO909605C 1KO909605AD etc 2 K Line Airbags Siemens and Bosch 1C0 909 605 C BLO 959 655 A 1J0 909 609 6Q0 909 605 C 6Q0 909 605A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8D0 959 655 C 8D0 959 655 L Clear crash data Issued by Abrites Itd Manual Version 3 02 November 10 2014 K Line Airbags Siemens and Bosch 1C0 909 605 C 8LO 959 655A 1J0 909 609 6Q0 909 605 C 6Q0 909 605 A 6Q0 909 605 B 3B0 959 655 B 1C0 909 605 F 1C0 909 605 H 1J0 909 607 1J0 909 603 4B0 959 655 C 4B0 959 655 J 4D0 959 655 C 8LO 959 655 F 8A0 959 655 C 8A0 959 655 K 8A0 959 655 K 4D0 959 655 H 8DO 959 655 C 8D0 959 655 L Issued by Abrites ltd Manual Version 3 02 November 10 2014 2 5 17 Special function VW Crafter This special function gives the possibility to read the engine control unit s EEPROM together with the PIN code and component security read and modify mileage of the engine control unit Turn the immobilizer ON OFF learn keys with prepared transponders perform diagnostic on the engine control unit and the immobilizer NOTE It is only possible to connect to the engine control unit and immobilizer for VW Crafter
73. agnostics will try to connect to it using KWP2000 over TP2 0 with baud 500KB s Issued by Abrites ltd Manual Version 3 02 November CAN TP1 6 when trying to connect to the device the software will try to connect to it using KWP2000 over TP1 6 with baud 500KB s UDS when trying to connect to the device the software will try to connect to it using UDS over ISO transport protocol with baud 500KB s K Line KWP2000 KWP1281 when trying to connect to the device the software will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used only for configuring the used protocols when trying to connect to the device in order to perform standard diagnostic requests They are not applicable when auto scanning devices 2 1 2 Interface detection Normally the Abrites Diagnostics for VAG USB interface is recognized automatically If not please contact support Abritus72 com 2 1 3 K LINE baud rate settings When trying to connect to the device over K LINE the Abrites Diagnostics for VAG will try to connect using one baud rate and if it does not succeed it will switch to another baud rate and attempt to connect once again There are two baud rates currently in use the 10472 and the 9600 Using the 10472 9600 and 9600 10472 in the dialogue box you could set the order in which these two baud rates will be used If the 10472 9600 is selected then the softwa
74. aking keys It is also possible to use it Issued by Abrites Itd Manual Version 3 02 November 10 2014 for exchanging parts and adapting the identification and configuration The key making function requires a dealer key license while the mileage function requires a separate license In order to perform any operations on these dashboards you will be required to enter the car into service mode The dashboard cannot be worked on without entering service mode Entering the car in service mode is performed in two ways If the car has a working key you could put it in ignition and then press Enter service mode by OBDII reading the EEPROM 24C32 or 24C64 with a programmer then loading it using the Load EEPROM dump button then modifying it with the Enter service mode by EEPROM dump and finally writing the resulting file back to the EEPROM using the programmer This is why we recommend that you detach the dashboard from the car and work with it separately not in the car Another thing you could do is switch the ABS module OFF during your work with the dashboard If you prefer to work with the dashboard in the car and the ABS coding is losed it is possible to calculated it with the coding calculator special function Exiting service mode If you have entered the service mode with a programmer you can exit it by selecting Leave service mode To reenter service mode you need to modify the EEPROM dump agai
75. anual Version 3 02 November 10 2014 model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trouble codes etc to the immobilizer NOTE If the car doesn t have any working key it is not possible to turn ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you have a car without any valid key you will need dismount the ECU and connect it on a table or to connect the CAN wires of the ECU directly to the interface NOTE For the key learning it is needed to turn ignition ON with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to turn ignition ON with each key which you want to learn NOTE Sometimes during communication with the immobilizer it is possible to lose communication with it so you will need to repeat the procedure 2 5 18 Special function Dump Tool Using this application you can calculate security access codes calculate mileage and others This application need
76. ata Immo number VIN WAUZZ74F85N 111222 Power class EE Also after successful reading the fields for the CS PIN VIN and Immo number will become active and the customer may specify the values they want Please pay attention that the power class for the engine control unit is displayed This is a very important value which is stored inside the engine control flash and cannot be changed This value should be the same for the engine control unit and the immobilizer this means that if the old broken engine control unit is from one power class and the new one is from another the car will not start even if the adaptation procedure was completed The meaning of the power class value is to prevent putting one engine control unit from for example a 3 0TDI to a car with a 2 0TDI 2 5 10 2 Adapting Audi A8 VW Touareg immobilizer Kessy This special function is dedicated to adapt second hand immobilizers from one vehicle to another In general the earlier VW Touareg VW Phaeton Porsche Cayenne Bentley continental allow to adapt the immobilizer using only PIN code and adaptation on channel 50 But A8 and later VW models after 2007 require to use this special function To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car from which you have taken
77. ata and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump You should use transponder TP08 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Issued by Abrites Itd Manual Version 3 02 November 10 2014 After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi A3 A4 A6 UKNSI 1995 1997 mileage and login code 93C56 displays the login and calculates mileage No license required Audi A3 A4 A6 UKNSI 1997 1998 mileage and login code 93C56 displays the login and calculates mileage No license required Audi A3 A4 A6 UKNSI Japan mileage and login code 93LC56 displays the login and calculates mileage No license required Audi 100 VDO 1995 mileage 94C46 calculates mileage No license required Golf 3 VDO 1995 mileage 93C46 calculates mileage No license required Golf 3 VDO V3 9 mileage 93C46 calculates mileage No license required Golf 3 Diesel mileage 93C46 calculates mileage No license required Golf 3 Motometer V5 8 mileag
78. box for Audi A6 Q7 Allroad 2003 Issued by Abrites Itd Manual Version 3 02 November 10 2014 2 5 10 1 Adapting engine control units To adapt an engine control unit to the car you need the following if the engine control unit is virgin you should only put the new CS 6 or 7 bytes and new PIN code You can read them from the immobilizer or from the old ECU if it is present Ifthe engine control unit is used you need the existing CS and PIN of this second hand engine control unit plus the new CS and new PIN code When starting this special function the following dialog is displayed S Exchange ECU by OBDII C Specify manually the existing CS PIN of the engine control unit 0 New immobilizer data Immo number VIN Power class 6S For EDC16 MED9 ME7 EDC17 MED17 and Simos PPD engine control units the customer can press Read directly and the old CS PIN are displayed If the engine control unit is a virgin state this is automatically detected After the successful read of the existing data they are filled automatically in the field below Please pay attention that the 7 byte of the CS is not required here Pressing the Read button will read the power class existing PIN CS also VIN and immobilizer number Issued by Abrites Itd Manual Version 3 02 November 10 2014 l Specify manually the existing CS PIN of the engine control unit 0 New immobilizer d
79. byte manually You will have message when to put the new key transponder in the ignition lock to first position and when to put it in the programmer Procedure may takes till 30min Find 7th byte automatic trying by OBDII Passat B6 CC B7 with EDC17 MED17 the pocedure is the same as on the other Passat B6 CC but it is necessary to read the comfort module dump with a programmer and to enter the Login PIN code Get component security from Kessy dump only for vehicles with the Hitag2 key Issued by Abrites ltd Manual Version 3 02 November 10 2014 Touareg Phaethon Cayenne A8 Bentley Continental additionally to the options above there is one more option to get the information from the Kessy EEPROM dump 93C86 if it is read with a programmer Find 7th byte automatic trying by OBDII only for vehicles with the Hitag2 key Touareg Phaethon Cayenne A8 Bentley Continental for these vehicles it is necessary to enter also the PIN code The procedure of finding the 7th byte is manual and the user will have message when to put the new transponder key in the programmer only put in the ignition without rotate and when to put it in the programmer A6 Q7 Allroad with EZS Kessy only for the preparation of the dealer key is required the PIN and the 6 bytes of the component security which can be typed manually automatically detected from engine control unit detected from EZS Kessy EEPROM dump if rea
80. bytes If there are 6 bytes contained then the 7 byte is zero Issued by Abrites Itd Manual Version 3 02 November 10 2014 Dump Tool ps x Type ECU Simos 7 CAN Reset component protection data 93C76 93086 M2 AC Az AC A2 AC 54 00 54 00 54 00 01 00 01 00 Teas Fraghtate apata 00000010 O01 OO O00 OO OO OO 00 OO OO OO OO OO OO BU EP OF 00000020 E OF E OF 00 00 08 38 00 1C 00 00 00 04 00 00 aasre Save dump 00000030 00 00 00 00 2D 2D 2E 2D 2D 2E 2D 2D 00 00 00 00 Swap bytes L H RA T U x 00000050 Component security data 7 PP Load dump h 4 ooo Of RIR fe A fA 20 000000C0 70 7F OO 00 EB 02 80 80 80 80 80 80 80 7F 7F 80 P ssssssssse 0000000080 80 60 80 7F 80 680 80 80 80 80 80 80 80 80 BO swiss e resres sse 000000E0 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 BO eee ee eee 000000F0 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 40 00000100 80 80 80 80 80 80 80 80 80 7F 7E 80 80 80 80 FF ensen x b ECU Simos PPD1x Reset component protection data Required license AN009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPD1x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero
81. cation when to put the key into the ignition and when to put it into the programmer Issued by Abrites ltd Manual Version 3 02 November 10 2014 IMPORTANT You only need to put the key inside please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for the first time If for some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Tag key tool Making a key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you have to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte as described above NOTE Please pay attention that if you have the Kessy dump you will have all the 7 byt
82. ch you install this module Issued by Abrites Itd Manual Version 3 02 November 10 2014 TAT aana ervas Uae Step 2 1 Learn module to the vehicle To learn the specified module to the vehicle you need the EEPROM dump of the GATEWAY module from the car where you want to build the module You can read the dump by OBDII but this will reflash the gateway or you can load the EEPROM dump Please specify how to proceed Read by OBDII ATTENTION this might reflash gateway if it is not already reflashed C Load gateway EEPROM dump Ea You have the option to read the Gateway EEPROM dump manually with a programmer or to read it by OBDII Reading by OBDII normally takes about 3 4min but requires a module reflash If the gateway is once reflashed further operations of the EEPROM reading do not need a reflash So the customer has the option to select whether they want to read the EEPROM dump by OBDII or to read it with a programmer If they select reading it by OBDII then the next dialog displays the status of the operation Issued by Abrites Itd Manual Version 3 02 November 10 2014 rais U l Reading gateway EEPROM by OBDII Connecting to CAN Gateway OK Checking EEPROM access OK Reading EEPROM OK Gateway EEPROM read with SUCCESS Once the EEPROM data are read loaded the adaptation of the component protection is performed Once this step is completed successfully the module shoul
83. comes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007 VW Polo 2006 Seat Ibiza 2006 Procedure 2 for CAN vehicles till 09 2006 year VW SEAT SKODA via CAN Learning of a transponder key to the car requires only the PIN code and after the key learning procedure actually adaptation on channel 1 is finished it is necessary to turn ignition ON with each key you want to learn No preparation of the transponder key is needed instead a new transponder key TP22 TP23 TP24 depending on the type of the car should be used For SEAT you must use a Virgin key or a Transponder TP22 For VW you must use a Virgin key or a Transponder TP23 For SKODA you must use a Virgin key or a Transponder TP24 Issued by Abrites Itd Manual Version 3 02 November 10 2014 Procedure 3 for VW Seat Skoda CAN vehicles 2006 Passat B6 Audi A3 CAN Learning of a transponder key to the car requires only the PIN code and after the key learning procedure actually adaptation on channel 11 is finished it is necessary to turn ignition ON with each key you want to learn Preparation of the transponder key is needed so called dealer key using the component security CS and the car type VW Seat Skoda Audi should be used Procedure 4 for Audi A4 RB8 Audi vehicles equipped with an instrument cluster BOSCH RB8 with integrated immobilizer require a pre coded key using the 12 byte CS Using this procedure the data
84. ctivated Measured values Non UDS modules Measured values provides you the possibility to check measured values in different groups The group of the data you want to check is selected in a combo box and normally some short description for the group is also available Live data C i Measured values ex Actuators T Basic settings Measured values channel 2 Channel 2 Entry and Start Authorisation Buttons Channel 23 Keys II Authentication no Engine Control Unit authorized no Key ID authorized no Immobilizer Status 6 0 Channel 1 Terminal Status Status Terminal 15 Terminal 15 OFF without unit 2 8 Status Terminal 75X off Status Terminal 50 Terminal 50 OFF Add selected to oscilloscope Some important measured values The most commonly used value is the key recognition in the immobilizer The key recognition is at channel 2 if the immobilizer is by CAN or at channel 23 if the immobilizer is by K LINE The only exception is the Audi Q7 A6 Allroad where the recognition is at channel 23 UDS modules The Measured values provides you the opportunity to check the measured values by selecting features from a list Issued by Abrites ltd Manual Version 3 02 November 10 2014 Measurement Values e m M e C Communication status of data bus 1 Communication status of data bus 1 C Time Out R
85. d Manual Version 3 02 November 10 2014 sending a new request to it 2 1 5 K LINE PINs Normally the K LINE output is at the seventh pin of the OBD2 connector However in some models e g 2004 Porsche Cayenne the K LINE may be located on pin 3 or 15 Because of that there is an option to choose the pin where the connection is to be attempted ATTENTION If you check all pins to be examined i e pin3 pin7 pin15 the time for scanning all units will be significantly increased Due to this the default pin selected is only one pin7 2 1 6 CAN resistance According to the CAN specifications there should be a resistance between CAN LOW and CAN HIGH Normally the gateway has this resistance however if you would like to connect to a device on a table bypass connection without a gateway then you should use a resistor between the Abrites Diagnostics for VAG and the separate device itself e g ECU dash immobilizer etc For that reason you have the option to choose what resistance to use None 75 Ohm 100 Ohm or 10 Kilo ohm The default value used is 120 Ohm Normally there should not be any issues however should an issue appears you can try changing the CAN resistance 2 2 Scanning units After starting the application in the main screen of the Abrites Diagnostics for VAG you will see a list of all possible units with their appropriate VAS number Once you have that you are able to connect to the listed devic
86. d be fully functional Issued by Abrites Itd Manual Version 3 02 November 10 2014 E TANTS Commander a L Step 2 2 Learn module to the vehicle Connecting to CAN Gateway OK Trying to set the component protection OK Connecting to Airbag OK Trying to set the component protection OK Module learned to vehicle with SUCCESS 2 5 10 Special functions Immo parts adaptation This special function is dedicated to adapting a virgin or to reuse a second hand immobilizer parts e g engine control units immobilizer Kessy transmission gear box from one vehicle to another In general some Immo III parts e g the earlier EDC16 and ME7 and all EDC15 allow to adapt parts using only a PIN code and adaptation on channel 50 However for the VW Seat Skoda starting from 2007 and for Audi models starting from 2003 2004 this is not possible This special function is dedicated exactly for these parts which do not support the channel 50 adaptation E g For engine control units this includes not only the Bosch EDC16 MED9 but also EDC17 MED17 and also Siemens VDO Simos PPD and Simos 9 x 6 x 7 x engine control units When the function is selected the customer has to choice what part what to adapt There are the following possibilities engine control unit Audi A8 VW Touareg Phaeton Porsche Cayenne or Bentley continental immobilizer Kessy Passat B6 CC immobilizer comfort module Transmission gear
87. d with a programmer or detected from EZS Kessy EEPROM by OBDII if working key is available Programmer Key Learnig Model Year Solution needed Transponder Key procedure Audi A2 all OBD K not needed TP08 Procedure 1 Audi A3 2003 OBD K not needed TP08 Procedure 1 Key Megamos 48 Audi A3 2003 OBD CAN programmer dealer key Procedure 3 Audi A4 2003 OBD K not needed TP08 Procedure 1 2003 Key Megamos 48 Audi A4 2008 OBD K programmer dealer key Procedure 4 Key Hitag2 Extended Audi A4 2008 OBD CAN programmer dealer key Procedure 8 Key Hitag2 Extended Audi A5 S5 Q5 2008 OBD CAN programmer dealer key Procedure 8 Audi A6 2004 OBD K not needed TP08 Procedure 1 Key Audi A6 RS6 2004 OBD CAN programmer Megamos 8E Procedure 6 Key Hitag2 Extended Audi A6 2010 OBD CAN programmer dealer key Procedure 8 Key Hitag2 Extended Audi A7 2010 OBD CAN programmer dealer key Procedure 8 Audi Allroad 2004 OBD K not needed TP08 Procedure 1 Key Audi Allroad 2004 OBD CAN programmer Megamos 8E Procedure 6 Key Audi Q7 2004 OBD CAN programmer Megamos 8E Procedure 6 Audi A8 2002 OBD K not needed TP08 Procedure 1 2002 Key Audi A8 2009 OBD CAN programmer PCF7936 or key Procedure 5 Key Hitag2 Extended Audi A8 2010 OBD CAN programmer dealer key Procedure 8 Issued by Abrites ltd Manual Version 3 02 November 10 2014
88. down list When an item is selected it is automatically read and its current values are displayed in the Current column The Unit column shows the measurement unit of the selected item To change a current value you need to input or select a certain new value into the corresponding cell from the New column 2 4 7 Coding of the unit Coding will open a separate a separate window for you where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding Issued by Abrites Itd Manual Version 3 02 November 10 2014 Coding 01 5C69208506 Long 170600 New coding 170800 value CO Set coding type manually O O 0 C E E E Coding Helper Coding data read s Pressing the Coding helper button will open a new window where you can see the corresponding coding information with an opportunity to change the appropriate settings Issued by Abrites ltd Manual Version 3 02 November 10 2014 r lt rrr Long coding help gos Bytes e El ft Un Ue ae eS aa a e E E e e e T us eRe Ea ae frelon Tt Tt D B TTT TT tte ye eT tty yet ee Byte 01 Bit 0 Brakepad Warning activejinstalled Byte 01 Bit 1 Seatbelt Warning activejinstalled O Byte 01 Bit 2 Washer Fluid Warning activejinstalled Byte 01 Bit 3 Multi Funct
89. dure Issued by Abrites Itd Manual Version 3 02 November 10 2014 i Instrument Cluster Immobilizer K w Choose IPC type EATA ETES a TT e S115119 d ad KORPALE E v Read 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ceeeeeeeees 00 00 00 00 00 00 00 00 paan oins a 00 00 00 00 00 00 00 00 cce 00 00 00 00 00 00 00 00 2 eee 00 0O Gd 00 00 00 Go 60 o 00 00 00 00 00 00 00 00 o0 00 00 00 00 00 00 00 00 YOE 00 00 00 00 00 00 00 00 00 Reset ECU 00 00 00 00 00 00 00 00 00 ssssssseeses 00 00 00 00 00 00 00 00 00 L e 00 00 00 00 00 00 00 00 00 00 00 1 BG 0000 EE E ss ee Repair RBS 00000E0 00 00 00 00 00 00 00 00 DEF 000000F0 00 00 00 00 00 00 00 00 ENEA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sssessssesses Login 00 00 00 00 00 Of Mil leage o D 0 o0 00 00 00 00 00 00 eeseseseseeseee eee s U oo oo o0 0 DO o0 00 00 00 00 00 00 oo oo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eseeesesesesesec sees oo oo 00 00 00 00 00 00 s e 00000 oo 00 00 00 00 00 00 00 lt seseseesesees ees O Skip nea responses Repair RB8 DEF During this procedure the software will read and write the EEPROM memory to the dashboard several times It is normal for the dashboard to display a string saying Er
90. e Abrites Diagnostics for VAG Pressing Standard Mode will bring the following dialog i m e Key learning eee Detected car type VAW Seat Skoda CAN immobilizer year unknown recognized Vehicle model YW Seat Skoda 2007 CAN X E New key count Prepare dealer L a ALL KEYS Login Security cade g key code kaal i S Engine start permitted No Dealer key transponder No pica aad L Login acknowledge ECU Responding No Kep transponder locked No 0 min Transponder type OK No Key transponder learned No I Transponder acknowledge Key count 2 0 min You can reach login code from the ECU of the vehicle special functions Engine Control Unit read eeprom L For this vehicle procedure 3 is used You ve to proceed with procedure 3 and after obtaining a prepared transponder then you ve to put the login and number of keys to learn and to press Learn button Procedure 3 Dedicated for Vw Seat Skoda CAN vehicles 2006 Passat B6 Audi 43 CAN Learning of a transponder key to the car requires only the PIN code and after the key learning procedure actually adaptation on channel 1 is finished it is necessary to give ignition ON with each key you want to learn Preparation of the transponder key is needed so called dealer key using the component security CS and the car type VW Seat Skoda Audi should be used KEY LEARNING STEPS The customer has to choose
91. e 93C56 calculates mileage No license required Polo Motometer mileage 93C46 calculates mileage No license required Polo Motometer 1996 mileage 93C66 calculates mileage No license required Passat VDO 1991 mileage 93C56 calculates mileage No license required Passat VD202 1993 mileage 93C46 calculates mileage No license required Passat GT mileage 93C46 calculates mileage No license required Passat GT mileage 93C56 calculates mileage No license required Caddy mileage 93C56 calculates mileage No license required Corrado VDO 1993 mileage 93C46 calculates mileage No license required Corrado MotoMeter 1991 1995 mileage 93C56 calculates mileage No license required Corrado VDO 1991 1995 mileage 93C56 calculates mileage No license required Jetta 1994 1996 mileage 93C46 calculates mileage No license required T4 MotoMeter 1996 1997 mileage 93C56 calculates mileage No license required Issued by Abrites ltd Manual Version 3 02 November 10 2014 EDC17 MED717 Wiring diagrams for boot mode On the diagram below you can find how to connect the AVDI to the ECU to use the boot mode Please pay attention that connection 510Ohm resistance between the ECU Ignition and 12V is mandatory to get communication with the ECU boot mode GROUND CAN H IGNITION Issued by Abrites ltd Manual Version 3 02 November ABRITES Diagnostics
92. e 2 2006 Key Megamos 48 VW Touran 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Touran 2009 UDS programmer dealer key Procedure 7 2008 Key Megamos 48 VW Tiguan 2009 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Tiguan 2009 UDS programmer dealer key Procedure 7 VW Passat B4 Motometer 1996 OBD K not needed TP08 Procedure 1 VW Passat B4 VDO 1997 OBD K not needed TP08 Procedure 1 VW Passat B5 VDO 2001 OBD K not needed TP08 Procedure 1 VW Passat B5 Motometer 2001 OBD K not needed TP08 Procedure 1 Key Megamos 48 VW Passat B6 2005 OBD CAN programmer dealer key Procedure 3 Key Megamos 48 VW Passat CC 2008 OBD CAN programmer dealer key Procedure 3 Key Megamos 48 VW Passat 7 2011 OBD CAN programmer dealer key Procedure 3 HITAG 2 Key VW Phaeton OBD programmer PCF7936 or key Procedure 5 HITAG 2 Key VW Touareg 2010 OBD CAN programmer PCF7936 or key Procedure 5 VW Touaran 08 2006 OBD CAN not needed TP23 Procedure 2 08 2006 Key Megamos 48 VW Touaran 2009 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Touaran 2009 UDS programmer dealer key Procedure 7 Key Porsche Cayenne 2010 OBD CAN programmer PCF7936 or key Procedure 5 Porsche Cayenne 2011 n a Bentley Key Continental 2010 OBD CAN programmer PCF7936 or key Procedure 5 Bentley Continental 2011 n a 3 TROUBLESHOOTING Below you can find a list of typical issues and how to solve them I
93. e component security Choosing the Prepare dealer key function you need to put the component security Issued by Abrites ltd Manual Version 3 02 November 10 2014 a A ABRITES Commander for VAG eoe ka Select an option C Manual Input of the Component Security Bytes L Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes i Find From Working Key Component Security Bytes Possibilities for this are Manual input of the component security if it is already known you can put it manually Autodetect the component security The autodetected component security is displayed in the field in the bottom of the dialog Please pay attention that autodetection may find only 6 of the bytes in this case the 7th byte need to be found in the way described below Find 7th byte automatic trying by OBDII requires to make ignition ON with new transponder key and to place the programmer over this new transponder key Finding the 7th bytes takes till 15min Find 7th byte from working key if a working key is available it is much faster to find the 7th byte from it just put the working key in the programmer and in one minutes the 7th byte will be found Find 7th byte automatic trying by OBDII Passat B6 CC only it is required to search the 7th
94. e is introduced into V24 and is the default scan mode It is scanning extremely fast for CAN Bus vehicles but also for the K Line there is improvement The found modules at the end of the scan should be the same as with the standard scan For all devices found by the Abrites Diagnostics for VAG a detailed information is displayed in the main screen The following information is displayed for each device VAS number Unit Name VAG number returned by the device in the device identification Description returned by the device in the device identification Coding returned by the device in the device identification Part IMP Supp N Part number Importer number Supplier number the information is shown separated with spaces also returned from the device with in the device identification DTC number of Diagnostic Trouble Codes stored in the unit Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing of all DTCs are not accepted from all units there is a possibility to scan all devices and then if a connection to the device is possible to clear its DTCs This is done by clicking on the Clear all DTCs button on the Auto scan devices panel Once again the standard or smart mode is applied 2 3 Broadcast requests Broadcast requests are the requests sent to all or a group of devices simultaneously The Abrites Diagn
95. e which is contained into the ME7 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0x120 bytes because after that area the EEPROM sections are different for each different software version of the ME7x unit Fortunately the most of the interesting data are found in this section Issued by Abrites Itd Manual Version 3 02 November 10 2014 x x Type ECU ME 7 x Security Code 7 Checksum calculator 9P08 95080 ni Z 0502032 N G E Swap bytes L H Login 44246 00000080 05 07 00 00 10 57 41 55 5A 5A 00 00 00 00 38 FE WAUZZ 8 ooooooco 0S OF OO OO 10 57 41 55 54 5A 00 00 00 00 38 FE WAUZZ 8 Oooo00DO SA 34 45 36 33 4E 30 30 37 35 39 35 41 00 EC FC Z24E83N007595a OOOOO0EO 5A 34 45 36 33 4E 30 30 37 35 39 35 41 00 EC FC Z24E63N007595a OOOO00FO 55 56 33 5A 30 43 31 33 31 30 34 34 33 00 E4 FC UX3Z0C01310443 00000100 55 58 33 5A 30 43 31 33 31 30 34 34 33 00 E4 FC UX3Z0C01310443 7 d Checksums in the file updated Press the Save button to save the changes ECU EDC15 Immo bypass 24CC04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization b
96. ecial function Repair RB4 DEF During this procedure the software will read modify and write the EEPROM memory to the dashboard After the fixed EEPROM is written to the dashboard the software will try to automatically adapt the dashboard to the vehicle i e to perform adaptation on channel 50 In order to do this a security access login is needed with a login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait some time The software will ask you whether you would like to wait and let it finish the procedure automatically or you would like to choose to cancel the procedure and finish it manually If you choose the automatic manner when the waiting finishes the dashboard will allow you to login The software will automatically adapt the dashboard s security access code at channel 50 If you choose to finish the procedure manually you have to wait for some time with the Ignition in the ON position then connect to the Instrument cluster through standard diagnostics perform security access Login with ogin code 13861 and then perform adaptation of the dashboards security access code on channel 50 After the procedure finishes you have to learn all keys using the Key learning special function 2 5 5 Special functions with Engine Control Unit The Engine Control Unit special function provides the following options Read Write of the flash memory
97. ecognition Time Out Recognition C Immobilizer Challenge Transponder ID of the current key f4 Se el f8 Transponder ID of Key 1 Od 97 7b f0 Transponder ID of Key 2 Od 94 37 9f Transponder ID of Key 3 be 12 7a dc Transponder ID of Key 4 be 21 a3 fa Transponder ID of Key 5 73 cd Ba f4 Transponder ID of Key 6 f4 Se e0 f8 C Transponder ID of Key 7 C Transponder ID of Key 8 C Status of the Immobilizer live status C Status of the Immobilizer Mark ID Status of the Immobilizer P Klasse Status of the Immobilizer Actual Keys Status of the Immobilizer Set Keys Status of the Immobilizer Slaves Key status Klemme 15 Status of the Immobilizer Slaves Key status S Kontakt Status of the Immobilizer Slaves Key status Key locked Status of the Immobilizer Slaves Key status Key learned Status of the Immobilizer Slaves Key status Key Authenticatable C Status of the Immobilizer Slaves MSG 1 Status MSG1 password was va C Status of the Immobilizer Slaves MSG 1 Status MSG1 signature was valid C Status of the Immobilizer Slaves MSG 1 Status MSG1 Inquired C Status of the Immobilizer Slaves MSG 1 Status MSG1 Password learned m Go Back Actuator test There are two types of tests available Selective and Sequential Issued by Abrites ltd Manual Version 3 02 November 10 2014 FP Live data Measured values 9 Actuators Y Basic settings r Actuato
98. ed to short the fuses as shown in the picture below If you cannot communicate with the ECU then you should try as on the picture below Issued by Abrites ltd Manual Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 If you are still not able to get communication with the ECU it is possible to make short of the external fusebox it is found under the front cover where the engine is You have to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you have to use a bigger cable because if you use a small cable it can heat up Manual 114 Issued by Abrites ltd Version 3 02 November ABRITES Diagnostics FOR VAG USER MANUAL for software version 24 0 Document 10 2014 number 2 20071127 N E tiok 21T Dain Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below Issued by Abrites Itd Manual 115 Version 3 02 November 10 2014 4 Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below Dump tool special function The dump tool receives a dump file from the corresponding unit input dump is loaded with the Load dump button as an input The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is no
99. ent or from the MED ECU through the OBDII ECU MED 9x Immo bypass Required license AN012 B This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED9x require only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Issued by Abrites Itd Manual Version 3 02 November 10 2014 Dump Tool x Type ECU MED 9 x Immo Bypass v L 8 07 02 08 a 00000010 00 00 30 37 2D 30 32 2D 30 38 08 10 13 24 0l 81 07 02 08 l 00000020 08 02 07 02 20 02 31 30 33 37 33 38 34 39 36 38 1037384968 Load duno 00000030 02 02 2F 2F 31 30 33 37 33 38 33 37 38 35 F4 OF 1037383785 00000040 01 03 AS SA 71 96 AS 3E 00 00 00 43 44 56 66 77 2q gt CDVEw 00000050 AS A5 14 OO C8 44 DB FO 00 O1 00 00 OO FF F5 16 D k 00000060 0l 03 AS SA 71 96 AS 3E 00 00 00 43 44 56 66 77 Zq gt CDVfw 00000070 As aS 14 00 C8 44 DB FO 00 O1 00 OO OO FF FS 16 D Save dump 00000080 02 04 OO OO 10 57 41 55 5A SA SA 34 4C 33 37 44 WAUZZZ
100. ent protection data are read you should reconnect the AVDI to the OBDII before you continue Connecting to vehicle OK Reading After the component protection data are read you can continue with the adaptation Issued by Abrites Itd Manual Version 3 02 November 10 2014 Rae EES Component protection generation 1 Connecting to EZS Kessy Entry And Start Autorization OK Reading EZS Kessy with Algo 1 please wait may 1 2min OK Connecting to Central Electic OK Programming component protection OK Component protection is reset with SUCCESS 2 5 9 2 Component protection generation 2 This special function currently works with Audi A6 Q7 Allroad 2004 2008 In these cars the customer is able to adapt completely by OBDII Without any restrictions the component protection for the airbag instrument cluster comfort module and EZS Kessy can be adapted For the remaining modules with a component protection e g DSP Climate Control you can adapt the component protection only if you have the Gateway EEPROM dump from the car from which the replacement module is removed Audi A4 A5 Q7 2007 In these vehicles the customer is able to adapt the instrument cluster When the special function Component protection generation 2 is started the system is examined and all modules with available component protection are displayed Issued by Abrites Itd Manual Version 3 02 November 10 2014
101. es But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrectly decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer The best way to check whether the Kessy dump is decrypted correct is to get the PIN code from the dump tool and to try to put it in the immobilizer If it accepted than the decryption of the EEPROM dump is OK Making a key if the CS is already known If you have already read the component security bytes prior to that e g by dissoldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and proceed as described above After the key is prepared as a dealer key write how many keys you need to program write the security access and press the Learn button 2 6 2 2 Wizard mode Like in the standard mode the software tries to autodetect the vehicle model but the customer has the ability to select the model also manually If the vehicle model is not autodetected a respective message will appear and user have to select it manually Issued by Abrites Itd Manual Version 3 02 November 10 2014 r A ABRITES Commander for VAG E m 6 m Select vehicle immobilizer type Select function VAG vehicle Johnson Controls NEC CAN Audi A6 A
102. es by double clicking on them There is a possibility to scan for all installed modules in the vehicle There are two modes of scanning smart scan and standard scan ff Special functions Vehicle Selection 1 Broadcast Options Smart scan for modules fast Standard scan for modules slow Gateway config l S General All units list i op standard scan the software is iterating through all possible units and is trying to establish Issued by Abrites ltd Manual Version 3 02 November 10 2014 connection to them This was the only one scanning mode prior software version V24 You can also choose a configuration of devices corresponding to the specific car chassis type instead of displaying all possible units This is done by selecting the type e g 1T VW Touran from the Chassis type combo box If you then select the Display button it will show all devices that can be installed into the chassis type in question Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protocols will be used when scanning for the devices Instead of scanning all units which can take a while you can retrieve the list of the installed devices from the gateway by selecting the Gateway config list button and then to press the Scan all button smart scan this scan mod
103. et component protection data 95160 00000000 00 97 E5 81 38 FF FF 30 35 2D 30 37 2D 32 39 00 8 05 07 29 a Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 I G 00000020 29 OF 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7H1037377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 AS 54 69 96 Cl 3E 00 00 00 SF 61 1B D405 2i gt 2a 00000050 E4 37 AS OB 37 A6 3C 13 00 01 00 00 OO BC F B2 7 7 lt ee eee 00000060 01 03 AS 54 69 96 Cl 3E 00 00 00 3F 61 1B D4 05 2i gt 2a 00000070 E4 37 As OB 37 A6 3C 13 00 O1 00 00 OO BC F B2 7 7 lt 00000090 Ee ale joa s fee ar fas fe Cancel h 4 Swap bytes L H ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately most of the interesting data is found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data a
104. etween the immobilizer and the ECU Dump Tool xj Type ECU EDC15 Immo bypass 24C04 axei L986 02 oa Swap bytes L H Toggle Immo On Off Immo is now OFF Issued by Abrites Itd Manual Version 3 02 November 10 2014 The Toggle Immo On Off button allows to switch on off alternatively the bypass function Steering lock VW Passat 6 Security code 68HC908 Required license AN003 to view security access code and AN009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola microcontroller the unit can be either with ELMOS or Motorola microcontroller The function displays also the component protection bytes by pressing the Other data button Dump Tool Load dump 2333333333333333 00000030 33 33 33 33 30 30 30 30 30 30 30 30 30 30 30 30 3333000000000000 00000040 30 30 DA DA DA CD CD CD 57 57 57 56 56 56 57 57 OO Lp VO 00000050 57 SA SA SA SA 33 33 33 33 33 33 33 33 33 33 33 W2Z222233333333333 00000060 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 3333333333333333 33333333334 Save dump Swap bytes L H ii 4 s s s s s sZZZs s ECU Simos 7 K line Login code 93C76 93C86 Required license AN006 This function displays the security access code contained into the engine control unit from Siemens ECU
105. ey Procedure 7 Skoda Fabia OBD CAN Key Megamos 48 Scout 2009 UDS programmer dealer key Procedure 7 Skoda Superb 2008 OBD K not needed TP08 Procedure 1 OBD CAN Key Megamos 48 Skoda Superb II 2008 UDS programmer dealer key Procedure 7 OBD CAN Key Megamos 48 Skoda Yeti 2009 UDS programmer dealer key Procedure 7 Seat Alhambra 1997 OBD K not needed TP08 Procedure 1 Seat Altea 08 2006 OBD CAN not needed TP22 Procedure 2 Issued by Abrites ltd Manual Version 3 02 November 10 2014 08 2006 Key Megamos 48 Seat Altea 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 Seat Altea 2009 UDS programmer dealer key Procedure 7 1998 Seat Arosa 2004 OBD K not needed TP08 Procedure 1 1996 Seat Cordoba 2004 OBD K not needed TP08 Procedure 1 Seat Ibiza 2008 OBD K not needed TP08 Procedure 1 OBD CAN Key Megamos 48 Seat Ibiza 2009 UDS programmer dealer key Procedure 7 Seat Leon 2003 OBD K not needed TP08 Procedure 1 Seat Leon 08 2006 OBD CAN not needed TP22 Procedure 2 08 2006 Key Megamos 48 Seat Leon 2008 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 Seat Leon 2009 UDS programmer dealer key Procedure 7 Seat Toledo 2003 OBD K not needed TP08 Procedure 1 Seat Toledo 08 2006 OBD CAN not needed TP22 Procedure 2 08 2006 Key Megamos 48 Seat Toledo 2008 OBD CAN programmer dealer key Proced
106. f the module is with UDS diagnostic protocol it is necessary to have internet connection in order to get the data from the file 2 5 Special functions Special functions are specific applications allowing you to read security access codes read program EEPROM flash content etc The Special functions are available in the main dialog window of the Abrites Diagnostics for VAG i Special functions e Vehicle Selection Y Broadcast on Options 2 j SA S BEB Instrument E2S Kessy BCM2 Instrument Engine Control EDC17 and EDC MED17 O7 46 44 45 05 Unit MED17 Boot Direct PIN CS Immo parts Immo Y Steering lock TV Key learning Theft adaptation adaptation adaptation configuration protection Ca h MAIM DPF OFF Component protection v A B Open Airbag VW Crafter a The needed special function is opened by double click or by marking and clicking the Open button Note For the purposes of some special functions mostly key learning there are buttons for PIN auto detection and component security This means that they will try to gather the needed information from the ECU and also from the instrument cluster if the cluster is supplied by VDO Please be informed that for VDO units manufactured after the end of 2006 some parts of the instrument cluster needs to be re flashed The same applies for millage reading functions As mentioned in the license agreement you will need to perform t
107. ferent vehicle Change mileage in key The special function offers the following options Making keys for these vehicles requires to read the BCM2 module In general the procedure is split into three steps Step 1 Check BCM type Step 2 Read BCM either by OBDII or with an ABPROG Step 3 Key learning procedure making dealer keys or learning keys 2 5 3 1 Read BCM2 by OBDII This option will read the BCM2 by OBDII If all keys are lost you will see the message below At that time you should disconnect the BCM2 module from the power supply for around 2 3 seconds and then reconnect it again After doing that you should select the OK button If there is a valid key and the ignition is ON you do not have to disconnect the BCM2 module from the power supply Issued by Abrites Itd Manual Version 3 02 AJ ABRITES Commander forvac E me Read BCM by OBDII Connecting to immobilizer OK Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN p After the reading is finished the existing key count power class and VIN are displayed and you can proceed to learning the key Issued by Abrites ltd Manual Version 3 02 November 10 2014 Tiss Commana orvs ln Read BCM by OBDII Connecting to i
108. h with a programmer first If it is not necessary to read the flash the Load dump to read flash or EEPROM will not be active and the user can proceed with the next step A8 2003 2010 only If a module for A8 2003 2010 vehicles is selected there is one additional step You have to connect 3 wires from the AVDI DB25 connector to the vehicles CAN H CAN L and Ground There is a wiring diagram on exactly how to connect them The user has to splice into the organge green CAN H and orange brown CAN L wires Additionally the GND and 12V should also be connected The easiest way is to disconnect a connector e g the connector of the module under the driver s seat and to place the two wires from the AVDI there The ground of the AVDI can be connected to any metal part There is also a picture with example on how to connect to these wires After the wires are connected you need to press Read component protection data Issued by Abrites ltd Manual Version 3 02 November 10 2014 an corm bie NE ice s 3 Read A8 component protection data For A8 it is necessary to connect the AVDI to the internal CAN Bus notto od component the OBDII Find orange green CAN H and orange brown wires CAN L protection data and connect the AVDI as shown on the diagram One easy way to connect is to disconnect one plug from the device under the drivers seet and there to put the wires as shown on the picture NOTE After the compon
109. hese operations at your own risk 2 5 1 Special functions with Instrument CAN Issued by Abrites ltd Manual Version 3 02 November 10 2014 When this function is opened the Abrites Diagnostics for VAG tries to establish diagnostic with the instrument cluster using KWP2000 over TP2 0 or UDS If the session is established successfully the software will read the module s identification and will try to automatically detect the instrument cluster type The following types can be detected VDO MM Visteon 2007 CAN TP2 0 VDO with NEC uC 2009 CAN UDS JCI with NEC uC and 95320 EEPROM CAN UDS Magneti Marelli with 9512 uC CAN UDS A8 4H A7 4G A6 4G Touareg 7P with 95320 EEPROM CAN UDS If connection to the instrument cluster cannot be established or the instrument cluster s type cannot be detected automatically you will see the following window In this window you can manually select the desired instrument cluster from the ones listed i S _ _ S Instrument cluster Immobilizer special functions x iaae _ S Reset Mileage Read write ConfD ata Immo data 0 00000000 95 04 57 56 57 5A SA 5A 31 4B 5A 37 50 31 Read 00000010 31 31 31 D2 OS 58 58 58 58 58 58 58 58 58 ConiData 00000020 58 58 58 58 58 58 6C 09 DA CD 70 ES 24 F3 Read RTE 00000030 49 E7 6A 00 14 00 00 FE
110. in Code C Type Login Code manually C Load Login Code Using Dump Tool When the Login code is available and the Next button is pressed an informational dialog is displayed where the key recognition and engine start conditions are checked The meaning of the fields is the same as the described in the standard key learning mode Issued by Abrites Itd Manual Version 3 02 November 10 2014 lolx Immobilizer data Current key count 2 Transponder type OK No Dealer key transponder Yes ECU responding No Key transponder locked Yes Engine start permited No Key transponder learned No Login acknowledge 0 Transponder acknowledge 0 timeout timeout Press Next to start key learning procedure Next gt Exit Pressing the Next button here will start the adaptation procedure and after finishing it the user should give ignition ON with all available keys NOTE Immo V A4 A5 Q5 and A6 A7 A8 VW Touareg 2010 only a different dialog is displayed to the customer which is the same as described in the standard key learning 2 6 2 2 2 Add one key This function the same as the mentioned above with the difference that it is not required to have all keys available at the moment The keys which are not available will continue to work 2 6 2 2 3 Prepare dealer key For the pre coding of the key transponder the so called preparation of the dealer key is required to have the 7bytes of th
111. ing 6 Please take into account that the reading writing of the flash will take a long time especially when CAN connection is used as result the battery may go flat 2 5 6 Special functions with EDC17 and MED17 Boot This function is dedicated to reading writing of the EEPROM and flash memories of the EDC17 MED17 engine control units Here not only VAG engine control units can be read but also engine control units from other manufacturers such as BMW Opel etc You need to connect the boot pin of the engine control unit to ground connect the CAN H of the ECU to PING of the AVDI OBDII Connector connect the CAN L of the ECU to PIN14 of the AVDI OBDII Connector connect the ignition of the ECU to PIN7 of the AVDI OBDII Connector connect the power supply 12V and Ground of the ECU to a power supply source check which microcontroller in used in the ECU the Infineon TriCore type connect a 5100Ohm resistance between power supply 12V and PIN7 of the AVDI OBDII Connector Connection diagrams can be found in the appendix Issued by Abrites ltd Manual Version 3 02 November 10 2014 R EDC17 MED17 Flash ConfData read write s m n TC1796 z Read Update ConfData ConfData Read Int Update Int FLASH FLASH i Load from file EDC1 tool Read PIN CS SetPIN Cs from dump Clone ECU f Operation in progress please wait
112. into a car you have to to synchronize the ECU and the RB8 instrument To do that you need to read the ECU component protection data and the ECU MAC Then after reading the RB8 instrument a button Reset Comp Security will be available After pressing this button the following dialog will appear All you have to do here is to input the component security and MAC of the ECU x Oldcs fap a ee eB sa a2 OO Gel Ga Ge aa MAC Old MAC ji 1 39 33 44 NewMAC 28 sa fse 0D NOTE There are two types of RB8 instrument clusters those that have a 7 bytes component protection and those that have a 12 bytes one The procedure above is valid for the 12 byte component protection versions Almost all RB8 Instrument clusters have a 12 byte component protection Those that have a 7 byte component protection are mainly found in A4 gasoline models however the RS4 is also a 12 byte component protection car 2 5 4 3 Removing RB8 RB4 DEF error When you select the ICP type of Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 or Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 a button Repair RB8 DEF Repair RB4 DEF respectively will appear Pressing this button you will initiate the procedure of removing the DEF string from the dashboard display NOTE It is recommended that you read and save the dashboards EERPOM and to make a note of the dashboard s Login code before starting the proce
113. ion Display activejinstalled Byte 00 Bits 0 3 00 Distance Impulse Number 0 01 Distance Impulse Number 1 Seat Ibiza 6J Leon 1P Skoda Octavia 12 Superb 3T V W 02 Distance Impulse Number 2 Skoda Fabia Roomster 5J Skoda Yeti 5L Skoda Octavia 03 Distance Impulse Number 3 04 Distance Impulse Number 4 VW Polo 6R 05 Distance Impulse Number 5 W Amarok 2H 06 Distance Impulse Number 6 VW Transporter Multivan 7E 7F 07 Distance Impulse Number 7 YW Eos FI VW GolffJetta 52 5K AJ VW Scirocco 13 08 Distance Impulse Number 8 Byte 00 Bits 4 7 00 Country Germany ID 10 Country Rest of World RoW 20 Country USA US OOOMODOOONO0OM 2 4 8 Custom requests Using this function you can manually send diagnostic requests to the corresponding unit The next example shows a request for identification of an instrument cluster Issued by Abrites Itd Manual Version 3 02 November 10 2014 fa Custom requests Request UDS Save to file Pause Clear Trace list gt 22 FL 8 DE 62 F1 87 35 43 36 39 32 30 38 35 30 42 20 L 22 Fl 89 gt OF 62 F1 89 320 34 J0 36 2 4 9 Custom download upload Custom download upload allows direct read from the address map of the device This option will only be available if you have some updates in your configuration such as Reading writing the flash counters Please note that in mo
114. ion of the this transponder key and the user should give ignition on with each key Procedure 7 UDS dashboards For these vehicles there is a separate special function where the key learning is performed Please refer the the Instrument CAN special function manual These are typically the models produced after 2009 The immobilizer is integrated into the dashboard and the required transponder for that cars is a Megamos 48 Crypto Procedure 8 A4 A5 Q5 2007 and A6 A7 A8 VW Touareg 2010 For these vehicle there is a separate special function called BCM2 A4 A5 Q5 where the key learning procedure is performed Hitag2Ext key is used which is pre coded The key learning procedure starts adaptation of the this transponder key and the user should give ignition on with each key Issued by Abrites ltd Manual Version 3 02 November 10 2014 2 6 2 Key learning modes There is standard and wizard mode for the key learning The standard mode requires more user interaction when performing the key learning procedure while the wizard mode tries to perform most of the operation automatically However in some models it is not possible properly to detect the different parts for that reason the standard mode is present in the SW to give the user better control of the dealer key preparation and key learning procedure 2 6 2 1 Standard mode Press Standard Mode to use key learning special function as before version 15 0 of th
115. ite lt lt TC1796 S CONNECT Read Update ConfD ata ConfD ata Read Int Update Int FLASH FLASH i i Load from file EDC1 tool L Read PIN CS PGetPINZLS Clone ECU Load EDC17 ConfData or EDC17U05 VW Polo flash OK Load EDC17 Flash OK CS 36 67 4F 60 6C CE 00 PIN 50990 MAC AA D9 FB 64 Immo status Normal learned i HERBR SEER BGES BBP BRB 9958 S29695B9NSSDS81 ae The Immo status can be Normal learned this is the normal operation mode of the engine control unit i e adapted to the vehicle Bypassed This engine control unit has an Immo bypass and can start no matter whether the immobilizer recognizes the engine Virgin This is a brand new engine control unit which was not build into a vehicle The information about the PIN CS MAC can also be obtained if you have the EEPROM and Flash dumps from the engine control unit NOTE For engine control units with installet TProt8 and higher the procedure of reading is a little bit different When trying to connect to them after the initial connection the user should restore the boot pin to its original state message box will indicate when to do this then after some time the user should restore the boot pin another message box will indicate this too Issued by Abrites ltd Manual Version 3 02 November 10 2014
116. k WW EOS R l Unlock Audi A3 Unlock Audi A4 So for any of the desired model you will have to press the appropriate button ATTENTION In most cases this only opens the doors It doesn t disable the alarm 12V Electric current should also be supplied for a later HW model 2 5 26 Special function Coding calculator Using this function you can calculate long code coding value of different modules When you open the special function the following window appears Issued by Abrites ltd Manual Version 3 02 November 10 2014 Mi ABRITES CommanderforVAG RIS Select device Select coding Engine Control Unit Instrument Cluster Gateway Central Electric Comfort System Parking Assystant Door Control Audio System Radio Navigation Steering Control Trailer Recognition wo o m By selecting a device you ll be shown a list of possible long code coding to choose Issued by Abrites Itd Manual Version 3 02 November 10 2014 5 x Select device Select coding Engine Control Unit 3C8 920 xxx 6 digits code value AF0 920 xxx0 22 digits code value Gateway AL0 920 xxx xxx 22 digits code value Central Electric 5K0 920 xxx xxx 6 digits code value Comfort System 8R0 920 xxx xxx 22 digits code value Parking Assystant 8T0 920 xxx xxx 22 digits code value Door Control Audio System Radio Navigation Steering Control Trailer Recognition lt B
117. key by finding the 7th bye sese 95 d Preparing dealer key on vehicles with Hitag2 ransponder sss sese eee eee 96 2 622 Wizatd MOd Ereren a e E aar a r Orat 98 26 221 Learn KySersrnraee caeeun ease er i es Erra renee 99 210 2 2 2Add one K Yacsonirei ennio ar a LERA EEEE ETES 101 2 6 2 2 3 Prepar SALT Keyesa a ea E 101 3Troubleshooting 107 4Appendix 109 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle 109 Instrument cluster from Audi TK 110 VW Passat usually these Instruments are before 19098 112 VW New S saeco adress sion cet ov eo epee emcee ee ee 112 Porsche Cayenne VW Touareg gasoline engines ECU wakeup Ses see eee eee eee 113 Audi A8 fusebox passenger side wakeup ECU 114 Adr O Toces ioniene pa eae ee oa E R 115 Audi A6 RS6 except 3 2L1 ee 117 Audi AG 32L THT 118 Dump t olsp cial MMC HG Myc sssezsszss seiz 29 27 rays 2 29T SRTR 2222952592 RO Teo 118 EDC17 MED17 Wiring diagrams for Boot mod sss sese eee eee 145 SFRS R 61 L CP44 TOIVOT ieee O er rene tree en eter a ener 146 ECU Vag EDC17 C46 a 147 ECU Vag EDCI7 CPU TC179 6 rererere nea nE o RES Eara NEISES ENS OEOD S 148 ECU Vag EDC17 CP14 CP20 TC1796 variant 2 sss sese eee 149 Issued by Abrites ltd Version 3 02 ECU Vag EDC17 CP14 CP20 TC1796 with Internal and External Flash sss sese ECU Vag EDC17 CP24 TC1796 with Internal and External Flash sss ECU Vag EDC17 U01 TC 17606 with Internal Flash sees
118. l give you the respective hints E g for Touareg Phaeton Bentley Cayenne A8 amp it is necessary that you hold each key in CRANK position until the steering is unlocked For Passat B6 CC B7 it is required that you put each key only to the first position instead of putting the key to the normal ignition position 2 6 2 1 2 Preparing dealer key If the respective procedure requires pre coding of the key transponder before it is learned to the car the button Prepare dealer key will be available Preparing the dealer key require the 7bytes of the CS The preparation of a dealer key is a little bit different for vehicles using the Megamos 48 transponder and the Hitag2 transponder a Preparing dealer key on vehicles with Megamos 48 transponder Pressing the button will show the following dialog Issued by Abrites ltd Manual Version 3 02 November 10 2014 Program dealer key Te b Autodetect component security 91 All bytes of the component protection data component security are know Program transponder from 7 bytes Find the 7th byte of the component security data Find 7th byte and program transponder Component 87 3a ad e6 53 Prepare security bytes Automatcial trying of the 7 byte S S d Find 7th byte j Manual trying of the 7 byte w Passat B6 CC from pons Key with transponder in Rate i 2 T Value for the autorization read by daignostic ss ignition programmer over key
119. license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Issued by Abrites Itd Manual Version 3 02 November 10 2014 x x Type ECU EDC16 Immo bypass 95320 v 8 16 12 04 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO E3 B 1037372667 00000040 00 06 05 00 04 2A 10 75 A6 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS OA 18 FA Bl 119 00000060 00 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 03G9060Z1A 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 0L EDC 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 7871 H 00000090 00 00 00 00 00 00 00 OO 00 00 00 00 00 09 F7 6E oo sees sees n 000000A0 00 04 2A 10 75 A6 30 33 47 39 30 36 30 32 31 41 u 03G906021A 00000080 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 01 EDC p00000C0 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 Wile His 000000D0 00 00 00 00 00 OO 00 00 OO OO OO OO 00 09 F7 6E esse eee n 000000E0 24 F3 C5 72 49 E 8A CD DA 00 00 00 56 57 5A 43 rI VES 00000050 SA 30 30 30 30 30 30 30 30 30 00 AC F6 02 F5 55 Z000000000 U 00000100 24 F3 C5 72
120. llroard 2005 CAN Add One Key Prepare Dealer Key VW Golf V Micronas dash CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VW Golf Golf Plus Jetta Bora V 2004 CAN Skoda Octavia 2007 CAN Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Function Adapts all keys to vehicle s immobilizer NOTE Depending on the vehicle type there are 1 or more functions available A hint for their meaning is displayed in the bottom of the dialog Here is a more detailed description of the functions Learn keys this means that all available keys will be learned Any already working keys that are not available will stop to work after this function Add One Key this function will add one key to existing key count This means that also the key which are not available at the moment will continue to work Prepare dealer key for the vehicles types which accept only pre coded key it is mandatory first to prepare the so called dealer key before proceed with the Learn keys 2 6 2 2 1 Learn keys Learning the keys requires to put the Login PIN code PIN code can be automatically detected can be retrieved from dump or can be typed manually if it is already known to the customer Issued by Abrites Itd Manual Version 3 02 November 10 2014 r s s A ABRITES Commander for VAG ei snl dS 7 Autodetect Log
121. m the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of the Engine Control Unit window Turn the ignition OFF and ON at this point 2 In case of ME7 x or ECUs from Porsche you can read the flash memory as if you are reading the EEPROM the only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length If you experience problems with reading ME7 x memory it is better to remove fuse 11 and fuse Issued by Abrites Itd Manual Version 3 02 November 10 2014 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please note that the flash which was read is saved automatically in the Flash subfolder and can be used in case of failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write flash In case of failure during the flashing the device should enter into a boot loader mode which will allow you to flash the device but not to read it The flash can be then restored with the Custom Read Write function 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flash
122. mmobilizer OK Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN Trying to reconnect to BCM OK Disabling security OK Transfer data Decoding data VIN WAUZZZ8T48A123456 Key count 1 Power class 79 BCM2 read with SUCCESS 2 5 3 2 Read BCM2 with ABPROG If you select to read the BCM2 with the ABPROG programmer you need to solder 6 wires on the module s PCB and you should temporary remove one resistance after reading is finished restore the resistance There is also a wiring diagram applied The wiring diagram is located in the program folder too Issued by Abrites Itd Manual Version 3 02 November 10 2014 Timo i 2 Step 2 Read BCM microcontroller with ABPROG 8K0907064AE0145H 808K0907064AE BCM2 connection diagram 90 E o selcccecscscns Save BCM2 Dump K G R M fE Load BCM2 dump Initializing ABPROG OK Communicating with BCM2 Reading BCM Decoding data OK VIN WAUZZZ8K89A112122 Key count 1 Power class 9C If the BCM2 module is read OK you will see the VIN number the existing key count and the power class 2 5 3 3 Key learning procedure Once the BCM2 module is read you can make as many dealer keys as you want A brand new key is needed for the dealer key Such a key can be made as a dealer key several times but if you learn this dealer key
123. mponent protection data component security are know Program transponder from 7 bytes Find the 7th byte of the component security data Find 7th byte and program transponder Find 7th byte Prepare from working key Component security bytes ae de 38 aa 43 99 Login 1321 There are following possibilities for preparing the dealer key Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not IMPORTANT If you do not have a working key from the car you will need to short the fuses as described in the appendix to get communication with the ECU After the component security is read if you have all 7 bytes you can program the key directly If you have only 6 of the bytes you have to choose a if you have working key from the car you can put it into the programmer and press the Find 7 byte from working key button the 7 byte will be found in several seconds b if you do not have a working key you have to search for the 7 byte manually The procedure takes approximately 20 25 min but can last up to 45min You have to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notifi
124. n 10 06 06 Vehicle information Coding 131 ID WAUZZZ4F85N062111 Serial number 10601000464276 FAZIT identification FAZIT Identification MDW RTH 10 06 06 2503 0234 Flash information Programming APPLICATION attempts 1 Programming APPLICATION successfull 1 Flasher info 21 04 06 337015 0786 30899 Flash status OK Reflash preconditions Waiting time not expired Transmission RPM is not nul 2 4 2 Read diagnostic trouble codes Read DTCs will display all errors present in the master and slave units The errors displayed can be together with the freeze frame data depending on the Read Freeze frame checkbox Status Permanent error 18038 Accelerator Position Sensor G79 Status Permanent error Signal too Low 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Sporadic error mechanical error SSS SSSS SESS SESS SSS SS SES SSS ESS SES ES SESS SSEESS 19804 Control Circuit for Controller for Turbocharger 1 J724 Electrical Malfunction Status Permanent error 2 4 3 Clear diagnostic trouble codes Clear DTCs will clear all DTCs stored in the unit Issued by Abrites Itd Manual Version 3 02 November 10 2014 2 4 4 Live data In the Live data section the user is able to observe the measured data to stimulate actuators and to activate the basic settings It is possible to observe the measured data while the actuators are a
125. n Pressing the Reset button will not exit the service mode in the cases where 24C32 is used If you have entered service mode by OBDII both the Leave service mode button and the Reset button will exit the service mode Once serviced mode is entered you can Read Write the whole EEPROM Read the whole flash Read the mileage Read Write immobilizer data Create a key for the car Note Sometimes writing of the data may fail In order not to lose the information all written data is backed up in the Dumps sub folder Note For dashboards with a colored TFT and other late model cars display with no working key you should enter the service mode and perform all changes before exiting the it Should you need to enter service mode once more you will need to modify the EEPROM yet again with a programmer Note For the colored TFT and other late model cars display dashboards the specifics dictate that the dashboard remains dark while the service mode is active 2 5 1 3 Special functions with Magneti Marelli UDS 9812 Issued by Abrites ltd Manual Version 3 02 November 10 2014 The Magneti Marelli UDS 9512 special function is dedicated to the Magneti Marelli instrument clusters with a 9S12 micro controller and UDS diagnostic protocol These are typically produced after the year 2009 After starting this function you will see the following dialog box on your screen In the example below
126. necessary for the preparation of the transponder key are read from the immobilizer automatically Also the PIN code needed for the key adaptation is read automatically Procedure 5 For vehicles with Hitag2 Key transponder VW Touareg VW Phaeton Bentley Continental Porsche Cayenne Audi A8 Learning of a transponder key to the car requires only the PIN code and after the key learning procedure actually adaptation on channel 1 is finished it is necessary to hold each key in CRANK position until the steering is unlocked For vehicles till 2007 you must use a virgin transponder PCF7936 or a virgin key no need for other special preparation If you use a Transponder you only needed to switch it in Cipher Crypto mode You can use your Key programmer for that purpose if you have one This is done by replacing 0x06 with OxOE in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already OxOE then the transponder is already in cipher mode For vehicles after 2007 and Audi A8 2002 the transponder should be pre coded using the CS Procedure 6 for vehicles Audi A6 Q7 Allroad 2005 For these vehicle there is a separate special function called EZS Kessy A6 Q7 where the key learning procedure is performed Megamos 8E based transponder key is used which is pre coded using 12 byte CS The key learning procedure starts adaptat
127. nition OFF ON cyclically the immobilizer stops to recognize the transponder and even a valid transponder will not start the car This timer shows when the immobilizer will recognize the transponders This value is typically set when trying to make keys for Passat B6 CC 2 6 2 1 1 Key learning To perform the key learning you will need the Login If pre coding of a transponder is necessary the button Program dealer key will be also available The Autodetect Login security code button is available in order to search the PIN CS automatically The key learning is performed as follows Enter security access code or autodetect it with the respective button and the number of keys Turn ignition ON new or existing key Issued by Abrites Itd Manual Version 3 02 November Press the Learn button For some VW Seat Skoda vehicles it is possible to add a new key without the remaining keys being deactivated If the software recognize that the immobilizer supports this option you ll be promted whether you want to add key or erase all keys and learn only the available keys If the immobilizer is not supporting this option this step is skipped Wait until adaptation finished is displayed Remove the key and turn ignition off with all remaining keys Normally you need only the make ignition on but for some models with electronic ignition there might be a little difference The software recognize such cases and wil
128. o because the Immobilizer Comfort module will take the power class you enter ATTENTION After the reading is finished any working keys will stop working and should Issued by Abrites ltd Manual Version 3 02 November 10 2014 be re learned to make them working again NOTE This special function can also be used for key learning If you have the comfort module dump you can load it here and all 7 bytes of CS will be displayed Then the customer can make a dealer key using these 7 bytes 2 5 10 4 Adapting Transmission gearbox on A6 Q7 Allroad This special function is dedicated to adapting second hand transmissions from one vehicle to another To adapt the transmission gearbox you need the existing PIN and CS of the second hand gearbox You can extract it by reading the EZS Kessy or engine control unit from the car from which you have taken the replacement second hand module Without having the PIN CS of the transmission you cannot adapt When starting this special function the following dialog is displayed m A6 Q7 Transmission 4F0 4L0 Preconditions 1 ECU E2S Kessy Key are matched each other 2 Ignition is ON 3 Programmer antenna is over the key which is in the ignition Transmission PIN CS v ae Adapt Enter PINZCS of the transmission manually PIN 13423 CS lad 33 4f d9 39 la Load ECU or EZS Dump Exit The procedure is automated all you need to do is
129. o comfort module dump For to delete key from certain position write 00000000 in the key position field You can press Program transponder to read current transponder with programmer to certain position With pressing OK keys data will be written to comfort module dump Change immobilizer status By pressing Set you can set immobilizer status NOTE Normally immobilizer status should have the value 2 It is recommended to change tt if it is different Fe r Write keys to Comfort module dump Change immobilizer status Key 1 21C2DC8F Key 5 00000000 Immo status 2 Set OK CANCEL Keys with data 00000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied and represent the data of the learned at the respective positions keys By pressing the Program transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if its type is appropriate TA3 it is also allowed to program transponder as dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car
130. ostics for VAG is able to send broadcast requests to all devices with a request to enter a desired transport mode to clear all DTCs in all devices or to disable enable the communication of all devices You can do this by selecting the corresponding button in the CAN Broadcast panel Here are the available functions Transport mode Issued by Abrites ltd Manual Version 3 02 November 10 2014 Entering or exiting the vehicle from transport mode is used by the factory to place the cars into a sleep mode in order to conserve the battery charge during long periods of inactivity Disable normal communication This function will disable the communication between units in the car This can help you hold the current state of the as well as preventing disturbances in communication while performing a re flash Enable normal communication Restoring the normal message transmition Clear all DTCs Sending requests to all units in the vehicle in order to erase their DTCs 2 4 Standard diagnostic requests When double clicking on a device in the Abrites Diagnostics for VAG window you connect to the device in order to proceed standard diagnostic requests The following dialog box is then opened Ke A EZS Kessy Entry And Start Autorization T 9 Diagnostic channel is open Device identification VAG Number SW VAG Number HW System description Workshop Part Imp Supp Date of
131. production Vehicle information Serial number FAZIT identification FAZIT Identification Flash information Programming APPLICATION attempts Programming APPLICATION successfull Flasher info Flash status Reflash preconditions Diagnostic requests Establishment diagnostic session with selected unit eR e resore g aor l nre laa s Clear log Update log MDW RTH 10 06 06 2503 0234 1 1 21 04 06 337015 0786 30899 OK Waiting time not expired Transmission RPM is not nul 4F0910852 4F0910131E 0080 4F0909131E FBSAUDIC ELV FBSAUDIC6 EZS 00200 0785 06402 10 06 06 H31 H45 131 WAUZZZ4F85N062111 10601000464276 e e session pe DTCs Adaptation Flasher SW Update V Read Freeze frame Custom requests Issued by Abrites Itd Manual Version 3 02 November 10 2014 This dialog box allows you to execute the following diagnostic requests 2 4 1 Identification Identification will provide you the VAG part number and software coding software and hardware version short module description date of production VIN Immobilizer number the identification for the FAZIT database and also the flash programming information Device identification VAG Number SW 4F0910852 0220 4F0910131E 0080 VAG Number HW 4F0909131E System description FBSAUDIC6 ELV H31 FBSAUDIC EZS H45 Workshop Part Imp Supp 00200 0785 06402 Date of productio
132. r programming Hints When the device you connect to is using a KWP1281 diagnostic then the only applicable option is Security Access log in Issued by Abrites ltd Manual Version 3 02 November 10 2014 If you would like to input security access to the ECU you should use Security access Component Security This will allow you access to the adaptation channel 50 If you would like to input the security access to the immobilizer you should use Security access Component Security If you receive an error message saying that it is not supported you should use Security Access log in 2 4 5 2 User defined security access In order for the authorization to be performed you need to clarify the type of security access by using the Request seed Send seed buttons E Security Access Secutiy access parameters O Standard Type User defined 5 320527021 131adaad Value DEC Value HEX Return KEY SEED 033723e6 2 4 6 Adaptition Adaptation will open a separate window for you where you could check the adaptation values Non UDS modules You need to enter the number of the channel where the adaptation will be performed and then press the test button If the specified value is accepted by the unit press the Save button The Scan all button will generate a file with all channels and the adapted values Issued by Abrites ltd
133. r test type Selective test C Sequential test Chime Buzzer Gong Switch and Instrument Lighting Segment Test Analog Indicators Instrument Cluster Lamp Test In the selective test mode you have the possibility to enter a test code manually or to select it from a list box When a test is selected all you need to do is press the Start button But not all modules are supporting the selective mode so for them a sequential test should be used sequential test means that each actuators are activated one after the other Basic settings Basic settings will expect you to select a number of the group and press the START or STOP button Issued by Abrites Itd Manual Version 3 02 November 10 2014 2 4 5 Security access Security access provides you the option to perform security authorization on different levels R Security Access Secutiy access parameters Standard User defined Security Access Login cdda Value HEX 52698 Value DEC E Security Access System Key CS OK 2 4 5 1 Standard security access This type of security access can be Security access log in Typically used in immobilizer systems Security access Component Security Typically used during adaptation of different units or parts Security Access System Specific T Security access different from the previous two types and from the authorization fo
134. rce keys were read and saved After selecting the file you will be asked to specify what information you would like to transfer from the source instrument to the destination one Select key data to transfer xi I Transfer learned key IDs I Transfer learned key count I Transfer component protection data I Transfer login Transfer learned key IDs these are the fixed code identifiers If you do not transfer them you will need to perform key learning on the new dashboard Transfer learned key count transfer the amount of keys learned Transfer component protection data this transfers the key variable code Without this the Issued by Abrites Itd Manual Version 3 02 November 10 2014 keys are not recognized and cannot be learned Please note that in order to start the engine you need to adjust the component protection data in the ECU too Transfer login transfers the car s login NOTE There are two types of RB8 instrument clusters those that have a 7 bytes component protection and those that have a 12 bytes one The procedure above is valid for the 12 byte component protection versions Almost all RB8 Instrument clusters have a 12 byte component protection Those that have a 7 byte component protection are mainly found in A4 gasoline models however the RS4 is also a 12 byte component protection car 2 5 4 2 Exchanging RB8 Instrument If you want to install a used RB8 instrument
135. re also available for editing so the user may put any values there Issued by Abrites Itd Manual Version 3 02 November 10 2014 2 5 20 Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the software will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation Remote control adaptation x l Number of keys Instructions Remote Control Matching Enter the total number of keys including existing Press button Learn and wait for the procedure to finish Press and hold the UNLOCK button on every remote that should be learned for at least 1 sec ATTENTION All the keys must be adapted in one procedure ba Adaptation of all keys must not exceed 15 seconds Erase All Remote Control Erasing Press button Erase All Additional settings e Chn 03 Auto Lock The doors will lock automatically when the vehicle reaches a speed of 15 km h or 10 mph 0 off 1 on Chn 04 Auto Unlock The doors will unlock automatically when the key is removed from the ignition switch 0 off 1 on Status epe In the Instructions window within the Remote adaptation section directions what should be done to learn remote controls will be available Additionally there might be an Additional set
136. re encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Issued by Abrites Itd Manual Version 3 02 November 10 2014 xi Type ECU MED 9 x Security Code 7 Checksum calculator 95160 00 8 05 07 29 I Load dump 00000010 FF FF 30 35 2D 30 37 2D 32 39 08 10 18 49 05 47 05 07 29 1 6 00000020 29 07 05 10 37 48 31 30 33 37 33 37 37 34 33 39 7HLO37377439 Save dump 00000030 02 02 2F 2F 31 30 33 37 33 37 32 34 39 36 FO AB 1037372496 00000040 01 03 A5 5A 69 96 Cl 3E 00 00 00 SF 61 1B D405 2Zi gt 2a 00000050 E4 37 48 OB 37 A6 3C 13 00 O1 00 00 00 BC F BS 7 7 lt 0 00000060 01 03 A5 5A 69 96 Cl 3E 00 00 00 SF 61 1B D405 2i gt 2a 00000070 E4 37 A8 OB 37 A6 3C 13 00 O1 00 00 00 BC F B3 F F L cesses 00000080 02 04 00 00 10 57 56 57 5A SA 5A 33 43 SA 36 45 WVWZZZ CZ6E 00000090 30 30 30 30 30 30 56 57 54 43 54A 30 30 30 30 30 000000YUZCZ00000 000000AO 30 30 30 30 57 56 57 SA 5A SA 33 43 5A 36 45 30 000OWVWZZZ3CZ6E0 00000080 30 30 30 30 30 11 00 00 00 00 00 00 00 BF F2 A 00000 00000OCO 02 04 00 OO 10 57 56 57 5A SA 54 33 43 SA 36 45 WVWZZZ CZ6E 00000ODO 30 30 30 30 30 30 30 57 5A 43 54A 30 30 30 30 30 000000OWZCZO0O0O 000000E0 30 30 30 30 57 56 57 SA 5A 5A 33 43 5A 36 45 30 OOOOWVWZZ23CZ6E0 000000FO 30 30 30 30 30 11
137. re that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car manufacturer can deliver such keys and they are called dealer keys because only the dealer can supply them But the ABRITES Diagnostics for VAG is also able to pre code the transponders keys so they becomes the same as the ones purchased from the dealer 2 6 1 Key learning procedures Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car belongs to which key learning procedure All key learning procedures are listed below Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line Learning of a transponder key to the car requires only the PIN code and after the key learning procedure actually adaptation on channel 21 is finished it is necessary to turn ignition ON with each key you want to learn No preparation of the transponder key is needed instead a new transponder key should be used You must use the following Keys or transponders TP05 TP08 Note some of the new vehicles need to remain with the ignition ON for five minutes before starting the key learning procedure VW Golf5 Skoda Octavia Il VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with the ignition ON until programming be
138. re will try to connect over the K LINE using the 10472 and if the connection is not successful it will switch to the 9600 and try to connect over it If the 9600 10472 is selected the software will try to connect using a 9600 baud rate and if that proves unsuccessful it will switch to 10472 and make another attempt ATTENTION Some of the devices using baud 9600 cannot be woken up if they have been tried with 10472 If you cannot connect to a device through K LINE try to change the options so that the software tries to connect through 9600 first 2 1 4 Timing parameters The protocols running under K LINE require very precise byte timing Since Windows is not a real time operational system these times are not always respected and the connection to some devices is unsuitable or it is impossible to connect to them In such cases you can try and change some of the timing parameters from the Advanced button The timing parameters have the following meanings Wake up echo delay time after slow initialization between receiving 55 xx yy and sending the inverted value of yy according to the K LINE wake up procedure Communication echo delay time between reception of a byte under KWP1281 and sending it back to the device in an inverted form Inter byte time time between sending two bytes under KWP2000 Time between messages time delay between reception of a response from a device and Issued by Abrites It
139. ressing the Add key button will prepare a dealer key Then add it to the immo data and write the new immo data to the immobilizer 2 5 1 5 Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM The A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM special function is dedicated to the A8 4H A7 4G A6 4G Touareg 7P instrument clusters with 95320 EEPROM and UDS diagnostic protocol After starting this function you will see the following dialog box Issued by Abrites Itd Manual Version 3 02 November 10 2014 R SS A8 4H A7 4G A6 4G Touareg 7P UDS dashboard 95320 Procedure Step1 Read dashboard data by OBDII Step2 Open and read 95320 ConfData with a programmer Modfy the dump and write it back to the dashboard Step3 Calibrate the dashboard by OBDII Step 1 Mileage Read dashboard y by OBDII Step 2 Prepare 95320 Prepare 95320 ConfData with aR TE ABPROG pea tease ail Step 3 Mileage g Read mileage Recalibrate mileage L Normally the procedure is goint in three steps Read the dashboard by OBDII to do this the dashboard should be connected to the carefully After the information is read by OBDII you should read the EEPROM dump with ABPROG or any other programmer and make modifications in it After the modifications are made the updated EEPROM dump should be written back to the dashboard
140. rom one vehicle to Issued by Abrites Itd Manual Version 3 02 November 10 2014 another To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car from which you have taken the replacement second hand module When starting this special function the following dialog is displayed ft _ e Exchange ECU by OBDII Load existing PIN CS from Comfort module dump Ea dump C Specify manually the existing CS PIN of the comfort Update Exit New immobilizer data Immo number Vw2720G 7031111 ID WY W2221K27P111111 Power class FE H CS 24 F3 c5 72 49 E7 BA PIN 52698 So you need to load the Comfort module EEPROM dump or to enter manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function Normally the power class of the comfort module is displayed automatically if you load the comfort module dump Then you are able to change it if the ECU has different power class If you enter a wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is s
141. ror during the time the procedure is in progress After writing the fixed EEPROM to the dashboard the software will try to automatically adapt the dashboard to the vehicle i e performing adaptation on channel 50 In order for this to be performed there will be a requirement for you to input a security access login The login code needed is 13861 In most cases dashboards are not ready for the security access login right away and you will need to wait a little The software will then ask you if it is to complete the procedure automatically or if you would like to do this yourself manually If you select the automatic manner once the waiting time is over the software will automatically adapt the new dashboard s security code to channel 50 and will then ask you if you would like to transfer the old keys or if you would like to learn a new set using the Key learning special function Depending on your choice the software will transfer the keys or not and complete the procedure Issued by Abrites Itd Manual Version 3 02 November 10 2014 If you choose to complete the procedure manually you will have to wait some time with the key in the ON position in the ignition then connect to the instrument cluster through standard diagnostics perform the security access Login with the 13861 login code and then adapt the dashboard s access code on channel 50 After doing this you need to learn new keys using the Key learning sp
142. s Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs is that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Issued by Abrites Itd Manual Version 3 02 November 10 2014 xj Type ECU Simos 7 K line Login code 93CC76 93CC86 5 ns 00000070 56 57 54 43 54 30 30 30 30 30 30 30 30 30 56 57 VWZCZ0O00O000000OYW Login 5313 00000080 5A 43 5A 30 30 30 30 30 30 30 30 30 56 57 5A 43 ZCz000000000VNZC 00000090 54 30 30 30 30 30 30 30 30 30 57 56 57 SA 5A SA Z0O00OOO0OQOWVWZZZ 00000040 33 43 5A 33 33 33 33 33 33 33 33 33 33 33 33 33 3C023333333333333 00000050 33 33 33 33 33 33 33 33 33 33 33 33 57 56 57 SA 333333333333UVWZ 00000OCO 5A 5A 33 43 5A 33 33 33 33 33 33 33 33 00 00 00 2230233333333 ooooooDO 7C 7C 30 39 30 37 33 32 33 39 30 36 30 31 38 46 0907323 0601eF 000000E0 47 20 00 00 00 00 01 05 00 03 18 OF O1 16 Ol GAG 000000F0 01 05 00 03 I8 OF O1 16 01 64 01 05 00 03 OO OO ssssssss sse ses s 00000100 7C 7C 01 84 B7 2D 3D AS 30 33 47 39 30 36 30 31 03G690601 lt gt ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license AN003 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through CAN for benzine engines Interesting
143. s EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you have attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand if this is possible for the car you are working on by performing the following procedure a Connect with 25 lmmobilizer and go to Measured Vaues Channel 2 b Put the original key or key with a Megamos 48 transponder in this case in the Measured values you should have a yes or 1 on the second position of channel 2 c Eject the key so there is no key in the ignition lock If the second position is changes to No or 0 you CANNOT search for the 7 byte If the second position remains at Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning Simply put the number of keys to learn and the security access code and the keys will be learned d Preparing dealer key on vehicles with Hitag2 transponder Pressing the button will show the following dialog Issued by Abrites Itd Manual Version 3 02 November 10 2014 l Dealer key with Hitag2 oc ne Autodetect from ECU Load component security data from Kessy ECU dump Program from Kessy ECU dump All bytes of the co
144. s ltd Manual Version 3 02 November 10 2014 2 5 2Special functions with EZS Kessy CANT 34 2 5 2 1Learning keys with EZS K GRV 36 2 5 2 2Reading and changing VIN sese eee 36 2 5 2 3Re ding Writing EEPROM T 36 2 5 2 4Programming a blank key so that it becomes a dealer Key sse eee 37 2 5 3Special functions with BUM 2 Ad ASI 05 37 2 5 3 1Read BCM2 by OBDIL e 39 20 32 Read BCM2 With AIP RO GH lt cuccicztetsxstacenscansantarmuncbtcisesetsasenessseiatienequcncsoateinceteess 4 2 5 3 3Key l atnimg PROCCU HT 42 S A O ert psist E pase nies ere AA ea ee 43 E Alarm ON 5 wcsecndsctg soni eve in aacou E tanta ate 43 2 5 4Special functions with instrument K en eee eee 43 2 5 4 1 Transferring keys from one RB8 instrument to anoher sees esse ee eee ee eee 45 2 5 4 2Exchanging RB8 Instruments sese eee eee eee 47 2 5 4 3Removing RB8 RB4 DEF Grote sese 47 2 5 5Special functions with Engine Control Un sese eee eee 49 2 5 6Special functions with EDC17 and MED17 Boot sese 52 2 5 7Special functions with EDC17 MED17 Direct PINICS ee 56 2 5 8Special functions with DPF OE 56 2 5 9Special functions Component ProtectiOM sex sese eee 57 2 5 9 1Component protection generation l 58 2 5 9 2Component protection generation 2 sese eee eee 61 2 5 0 2 1Resct to virgin Sat 62 2 5 9 2 2Learn module to the vehicle 64 2 5 10Special functions Immo parts adaptation sese sees eee 67 2 5 1
145. s the EEPROM dump from the corresponding unit After the dump is loaded modifications will be made and you need to store the dump as a new file which you can program into the device afterwards For more details about these functions please refer to the appendix 2 5 19 Special function Service Interval Using this application you can reset the service reminder reset the service interval parameters or change service interval options With the opening of the special function window the software will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have Service reminder reset or and Service interval reset or and Change service options sections enabled Together with these sections in the section Applicable adaptation channels you will see the adaptation channels whose values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed the column New value of the Applicable adaptation channels table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options The applicable and available adaptation channels from column New value a
146. s veneers 11 Zl OCANTESISTANCO irsini iiis oes roeines ieoi a e E E EESE 11 STET T csere ia EO EE EE E E E 11 2 3Broadcast reduces sees 12 2 4Standard diagnostic reducests sss 13 2 4 I Tee T 14 2 4 2Read diagnostic trouble codes sss sese 14 2 4 3Clear diagnostic trouble codes 14 S H data seisoin eee arona Eaa o ee 15 IVES AR UES val s rseson os ie aaie aE vedi Raa EEEa A EEEE ai 15 VenO riro a TOS E seual ce ccensasuswiched cube iota itaaetteacequbeeaueebonclaenaavaacs 16 Basie TTT 17 RE Kee Te ACESS ear E E eo NE EOE E 18 E S Ren Taa a Security ACCES Sissies E EAEE EERE 18 2 4 5 2User CET EE ee He TT 19 R Ea Eel T 19 2 4 7Coding of the TIAN TTT 21 2 4 S Custom MSHS US sss iies resres by unaamaiosissauntanacanandmscanswssanedauausisqutae bonaodenndeed abuseamceoniaanieoteses 23 2 4 9Custom download upload sss see 24 2 4 10Active diagnostic ScSSIOn see eee 24 2 4 11Flash er SW Upar sentiasa an iriiri a E EN EE tunes wert a EEE 25 ST Ie TET TTT 25 2 5 1Special functions with Instrument CANT 25 2 5 1 1Special functions with instrument cluster CAN over TP2 0 sese 27 2 5 1 2Special functions with VDO NEC 29 2 5 1 3Special functions with Magneti Marelli UDS 9S12 sese 31 2 5 1 4Special Functions JCI with NEC uC and 95320 EEPROM 32 2 5 1 5Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM sireiencnsa nenes n E I E EES 33 Issued by Abrite
147. ssued by Abrites ltd Manual Version 3 02 November Problem When starting the ABRITES Diagnostics for VAG on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port COMxx where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES Diagnostics for VAG If the interface is not recognized the USB interface appears with a yellow exclamation mark in the device manager then you can try to solve the issue by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface drivers and Uninstalling USB interface drivers If there are bluetooth devices try to disable them Problem When starting the ABRITES Diagnostics for VAG Interface not calibrated is displayed Solution Send all logs to a distributor Problem The device connects under K Line on a random basis Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instr
148. st cases there will be a security authorization required before you write or read the address map 2 4 10 Active diagnostic session Default diagnostic session established after connection to the unit is number 89 You could request entering a different diagnostic where performing of diagnostic activities in the standard session 89 is not allowed Please take into account that in most cases different diagnostic sessions require security authorization Diagnostic session fo ea Issued by Abrites ltd Manual Version 3 02 November 10 2014 2 4 11 Flasher SW Update There is a possibility to update the software of the modules The files with the updates are not provided from Abrites it is responsibility of the customer to find such files Typically these files are provided with the original OEM software These files are normally with SGO extension for modules using under TP2 0 or KWP2000 or with FRF extension for the modules using UDS Please pay attention that update of the software is risky operation if incorrect SW is uploaded to the module it might stop work Normally if the process is interrupted e g because the battery is flat or the lap top is restarted etc it is possible to start the process again When the customer start this function information about the current SW number and version is displayed then the customer has to select the file which he wants to flash I
149. st of the following Steering column lock control element EZS Kessy control module Engine management control module master slave Up to 8 vehicle keys Only with this the procedure Steering columng lock control element can be aligned Do you want to continue Press NEXT to continue or EXIT to exit to leave the operation 2 5 14 Special function MMI TV configuration Using this special function you can change speed limit of MMI compatible vehicles to change the speed at which the TV is turned OFF Covered vehicles are eAudi A3 S3 eAudi A6 S6 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A8 S8 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A6 S6 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 eAudi A8 S8 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 Issued by Abrites ltd Manual Version 3 02 November 10 2014 TY Activation x Speed Limit 0 km h Edition 1 Edition 2 Use the following rule when enabling TV if the car is built before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is built after 2007 it is better to try edition 2 first 2 5 15 Special function Custom memory access Download Upload ReadMemory The Custom memory access Download Upload ReadMemory functionality is avail
150. t possible As an output the dump tool displays data extracted from the input file and or makes modifications to the input data If any modifications were made for some sub functions there are no modifications made only data is visualized the user has to write the modified dump to a desired file with the Save dump button and then this modified dump should be saved back to the device via OBDII or with a programmer If data is read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data in 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means that for the same unit two different programmers can produce Issued by Abrites Itd Manual Version 3 02 November different dumps Normally the software tries to autodetect the byte order of the dump and if it does not succeed then you may need to use the Swap bytes button This button changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data is not valid e g displayed PIN is not accepted from the car please try to swap bytes to get a result For some functions the swapping is made automatically for example the decoding
151. the EEPROM read mileage PIN etc Please be informed that the special function will only establish a connection via K line KWP1281 or KWP2000 and this does not depend on the configuration options ATTENTION All read EEPROM dumps will be stored in the Dumps sub folder of the Abrites Diagnostics for VAG so you could restore the EEPROM in case of any unwanted changes Automatic parsing of data from the EEPROM mileage and immobilizer is implemented for most instrument clusters For instrument clusters from Magneti Marelli please refer to Appendix A If a connection to the Motometer instrument is not successful please send the text file motometers txt to the following e mail address moto Abrites com and the instrument will be added to the database within a three business day period The latest Motometer database is available at www Abrites com mmdata bin Issued by Abrites ltd Manual Version 3 02 November 10 2014 NOTE Sometimes if you try accessing the instrument cluster by selecting the wrong type of cluster from the dialog the cluster may block or reject future diagnostic requests until it is reset by disconnecting the power supply either from the battery or the fuse For example this is a common issue which appears always with the Bosch clusters being blocked when being accessed as Instrument cluster VDO66 VDO86 Motometer NOTE Please be very careful when selecting Instrument Cluster Audi A4 B
152. the one of the types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are equipped with older instruments even if they are built after the year 2000 Choose the Instrument Cluster Magneti Marelli Direct 1996 2000 if not successful you need to turn the ignition OF and ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If the read is successful the PIN code and mileage are automatically recognized and displayed for Magneti Marelli direct types in case of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number D00 2R1TU FE FF FE EF FF FF FF EF FE FF EF ER EE FEFE FPF FP xe 5 RRR ER DO00SBZ0 FE EF FF FE PE EF FE EF FF PE EF PE FF PPE PE BP e aeaa oc seins es 000038530 FF FF FF FF FF EF FF PF FF FF EF FE FF FF 67 BE laa coc eee a 00003B40 75 90 FF FF FF FF FF FF OO U0 FF FF FF FF FF OO x 00003850 00 FF FF FF FF FF FF FF OO O1 ee he Bo J forsira anai AUZ 00003B60 35 SA 30 41 58 56 56 56 56 56 58 3B 5A 79 SZOAXXXXXXX Z ZN 00003B70 96 B6 OO FF FF 42 20 93 9D 43 7F FF 30 42 DE BS B C OB OOO03SBG0 S 42 20 E8 J1 EF FF FF FF FF EF FF FF FE FF FE WR 1 cs gg cree OOOO3B90 FF FF FF FF FF 04 OD 2B 41 55 SA 35 SA 30 41 58 AUZSZOAX OO
153. the replacement second hand module When starting this special function the following dialog is displayed Issued by Abrites ltd Manual Version 3 02 November 10 2014 Exchange ECU by OBDII _ S o 7 Load existing PIN CS from Kessy dump Coad Kees dump C Specify manually the existing CS PIN of the Kessy Exit D New immobilizer data Immo number ID Power class CS So you need to load the EZS Kessy EEPROM dump or to enter the PIN and CS of the second hand module manually ATTENTION You should know the power class of the engine control unit before you execute this function After pressing the read button the customer has to enter the power class manually If you enter the wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the Immobilizer Kessy will take the power class you enter ATTENTION If you put the CS manually i e you put 6 bytes of the CS and there is a working key for the immobilizer Kessy after finishing with the reading the Kessy will no more recognize the key To start recognizing it again you should put the 7 byte and press Change 2 5 10 3 Adapting comfort module on Passat B6 CC This special function is dedicated to adapting second hand immobilizers f
154. the security access code and the component protection data into MED9 1 ECUs for which the EEPROM is encrypted As mentioned previously for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU requires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the MED9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster Issued by Abrites Itd Manual Version 3 02 November 10 2014 Dump Tool x Type ECU MED 9 x Reset CRYPTED Login Component protection 00000000 OO EC 8E 24 38 FF FF 30 36 2D 30 36 2D 31 35 00 8 06 06 15 OC s DC Login K oc 53234 oc Old uncrypted login Cancel OC DL oc oc r Component security protection a Old uncryptedjcs 12 fas 32 sa s4 FB oo 9 New uncypted CS 12 oq 34 AP DA BC o A Load dump Save dump Swap bytes L H h 4 New uncrypted login 23413 Unerypted data can be read from the instrum
155. tings table where all the applicable adaptation channels with their current values and description which are related to the remote controls function will be listed You can select the desired settings and press button Change to save them This function is available for Audi A3 S3 1997 Audi A4 S4 RS4 1995 2008 Audi A6 1997 2006 Audi TT 1999 Seat Exeo 2009 Issued by Abrites Itd Manual Version 3 02 November Seat Leon 2006 Seat Altea 2004 Seat Toledo 2005 Skoda Octavia 1997 Skoda Octavia Il 2005 VW Caddy 2004 VW Eos 2006 VW Jetta 1998 VW Golf Bora IV 1998 VW Golf Golf Plus Bora V 2004 VW Golf Golf Plus Golf Variant 2009 VW Touran 2003 Skoda Fabia 2007 VW New Beetle Cabriolet 1998 2010 VW Fox Spacefox Sportvan Suran 2005 VW Passat 1997 2011 VW Transporter 1997 2009 VW Tiguan 2007 For Audi A8 VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 2 5 21 Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value applicable for the navigation controller function 2 5 22 Special function Cruise control system Using this application you can activate deactivate the cruise control system and change the related steering wheel electronics S
156. tions with DPF OFF This function will deactivate the DPF in the EDC16 EDC17 engine control unit flash dump Abrites doesn t warranty that the changes will not have some side effects so use this function on your responsibility Issued by Abrites Itd Manual Version 3 02 November 10 2014 DPF Remove Function to execute guni DPF Remove EDC17 v ect DPF Remove EDC16 DPF Remove EDC17 2 5 9 Special functions Component protection As part of the security strategy some parts of the modules build in the VAG vehicles implement the so called component protection This is a mechanism dedicated to prevent exchange of modules between different vehicles without central authorization from the VAG online database Such modules placed in another vehicle activates the component protection active DTC and have restricted functionality This special function allows to remove this component protection active trouble code and allows the module to work with its full functionality The component protection is first implemented in the A8 2003 and in the A6 2004 vehicles Component security is not implemented in all VAG vehicles There are actually two types of component protection generation 1 and generation 2 Component protection generation 1 is implemented in the A8 2003 vehicles while the A6 Q7 Allroad 2004 use component protection generation 2 for most of the modules and very few mod
157. ules use component protection generation 1 In the beginning you have to select which generation want to use Issued by Abrites ltd Manual Version 3 02 November 10 2014 ii a F A ABRITES Commander for VAG E e G Select component protection type C Generation 1 Audi A8 2003 2010 Audi A6 Q7 Allroad 2004 2008 MMI MP3 CD Changer Auxilary heater Central electric ILM Beifahrer C Generation 2 All other modules of Audi A6 2004 and A4 A5 Q5 2 5 9 1 Component protection generation 1 For the Component protection generation 1 you have to select the module which want to adapt Issued by Abrites Itd Manual Version 3 02 November 10 2014 x A ABRITES Commander for VAG E Select device to adapt Control Head MMI2G i A4 A5 Q5 2008 Media Player 1 MP3 CD Changer 2G i A4 A5 Q5 2008 Control Head MMI2G i A6 Q7 2004 2009 Central electric ILM Fahrer i A6 Q7 2004 2009 Media Player 1 MP3 CD Changer 2G i A6 Q7 2004 2009 Auxilary Heater i A6 Q7 2004 2009 ILM Front passenger ILM Beifahrer i A6 Q7 2004 2009 Seat Memory Passenger i A6 Q7 2004 2009 Memory module driver s seat i A6 Q7 2004 2009 Instrument Cluster i A8 2003 2006 Climatronic Auto HVAC i A8 2003 2010 Seat Memory Passenger i A8 2003 2010 Memory module driver s seat i A8 2003 2010 Currently for most of the modules it is needed to read the internal EEPROM for the MP3 CD Changer the internal flas
158. ument cluster is A4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found at addresses 0x00 0x100 and 0x200 If the immobilizer number is placed there then the instrument is not crypted Problem After reading the A4 RB8 instrument the instrument displays LO x x instead the mileage Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible to connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www Abrites com mmdata bin into the ABRITES Diagnostics for VAG folder Problem Some device cannot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file Issued by Abrites ltd Manual Version 3 02 November 10 2014 4 APPENDIX Programming instrument clusters from Magneti Marelli K line diagnostic link Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these is possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending on production year of the car So you have to select
159. ure 3 OBD CAN Key Megamos 48 Seat Toledo 2009 UDS programmer dealer key Procedure 7 1998 VW Lupo 2005 OBD K not needed TP08 Procedure 1 Key Megamos 48 VW American Fox 2003 OBD CAN programmer dealer key Procedure 3 Key Megamos 48 VW CrossFox 2005 OBD CAN programmer dealer key Procedure 3 VW Suran SpaceFox SportVan Fox Key Megamos 48 Plus 2006 OBD CAN programmer dealer key Procedure 3 Key Megamos 48 VW Fox 2005 OBD CAN programmer dealer key Procedure 3 1997 VW Polo 3 2004 OBD K not needed TP08 Procedure 1 2004 Key Megamos 48 VW Polo 4 2009 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Polo 5 2009 UDS programmer dealer key Procedure 7 VW Golf 3 1993 OBD K not needed TP08 Procedure 1 VW Golf 4 1997 OBD K not needed TP08 Procedure 1 VW Golf 4 Cabrio 1998 OBD K not needed TP08 Procedure 1 Issued by Abrites Itd Manual Version 3 02 November 10 2014 VW Golf5 08 2006 OBD CAN not needed TP23 Procedure 2 Key Megamos 48 VW Golf5 08 2006 OBD CAN programmer dealer key Procedure 3 VW Crossgolf 08 2006 OBD CAN not needed TP23 Procedure 2 VW Crossgolf 2006 OBD CAN not needed TP23 Procedure 3 Key VW Golf Plus 08 2006 OBD CAN programmer TP23 Procedure 2 Key Megamos 48 VW Golf Plus 2006 OBD CAN programmer dealer key Procedure 3 OBD CAN Key Megamos 48 VW Golf 6 2009 UDS programmer dealer key Procedure 7 VW
160. ween the automatic and manual procedure is that according to the manual procedure you should put the key into the programmer then turn the ignition to ON with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively prompted to put the transponder into the program and then to turn it to the ignition ON position Normally for most models it is required that the key is in the ignition and you only change the position of the transponder You will be prompted to put the transponder into the programmer then to put it near the ignition lock so it is read by the immobilizer An exception is the Passat B6 For it it is required that you put the key with the transponder into the programmer then the key with the transponder into the ignition lock UP TO THE FIRST POSITION ONLY then again into the programmer and again into the ignition lock until the Issued by Abrites ltd Manual Version 3 02 November 10 2014 byte is found NOTE If you get an XXX message you need to stop at the current position and wait for 10 minutes before you continue ATTENTION For the Passat B6 there are some cars for which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of the component security from the engine you can extract the 7 byte from the comfort module
161. xchange Dump Tool 83 Issued by Abrites ltd Manual Version 3 02 November 10 2014 2 5 25Special function Door unlockImR sese eee eee eee 84 2 5 26Special function Coding calculator sss 85 R w TT 88 2 6 1Key learning PrOCe Un OS sigs saccasetssscccdeaconncastenssthaaccndunewaesasanecseimetheuesees onarerensenraneances 89 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via We UN oc cce sigcd etait bee dada cg ecesa sckagaaeesaiia pars esiapdaayesetecaaonunpatecale vee cecenyeeateleuees eee ane 89 Procedure 2 for CAN vehicles till 09 2006 year VW SEAT SKODA via CAN 89 Procedure 3 for VW Seat Skoda CAN vehicles 2006 Passat B6 Audi A3 CAN 90 Procedure 4 for Audi A4 RRR 90 Procedure 5 For vehicles with Hitag2 Key transponder VW Touareg VW Phaeton Bentley Continental Porsche Cayenne Audi AR 90 Procedure 6 for vehicles Audi A6 Q7 Allroad 20U5T 90 Procedure 7 UDS dashboarda sss sese sss seene 90 2 6 2Key learmng les T 91 2 6 2 Standard TON cds ceseurge tice e sec esenee canto enon ees en ee an netue ee nee aesa Ea Eek EEEa 91 PA TPA N CYA ET T T 92 2 0 2 1 2Preparing dealer KEY xicsascns scasasacecresdneccaveanpocashensdcussanceaisasupacaevanscamdantdcoeaxtiers 93 a Preparing dealer key on vehicles with Megamos 48 Yansponder sss sese 93 b Preparing a dealer key with all 7 bytes available 95 c Preparing a dealer

ABRITES COMMANDER FOR VAG USER MANUAL

Contents

Download Pdf Manuals

Related Search

Related Contents