Home

ABRITES Commander for VAG User Manual

1. 00 00 00 OO 00 DO DD 00000000 00 00 OO 00 00 DO DD 000000 0 00 00 OD 00 00 00 00 00 OO 00 00 DO DD 000000 0 oO DO OO 00 DO 00 Load trom file 00000100 00 OO OO 00 DO DD 00000110 00 OO 00 00 00 00 OO 00 00 00 DD 00000120 00 00 OD 00 00 00 00 00 DO DD 00000130 00 00 00 00 00 00 00 00 Clear crash data 00000140 00 00 00 00 00 00 00 00 DD 00000150 00 00 00 00 00 00 00 00 OD 00 00 00 00 DO DD 00000160 00 00 00 00 00 00 00 00 00 00 00 00 DD 00000170 00 00 00 00 00 00 00 DD 00000180 00 00 00 00 00 00 00 00 DD 4 For some airbag models it is not enough to clear the trouble codes using Clear DTCs diagnostic request but the crash data stored into device s EEPROM should also be cleared For some models see Covered units below crash data can be automatically cleared using Clear crash data
2. PP SD BP Ob BP cee cede wees VOUS Au NE BE DEP ED EB BE DD SES DO EE Pe ED HBHHSBSH BE JE GUIDE OPE DEB ODD PE BRE DD BE p BP a Pur UH DU 000035650 100 FF FF FF FF FF FF FF 00 01 EU SM gg 3BelU 35 30 41 58 58 58 58 58 59 3H JB 5 79 00003820 196 OO FF FF 42 20 83 90 43 FF 30 42 DE B5 siiis s HUUD SEU S 42 Bo 21 PP FP 1 205 544 6 FF FF FF 04 OD 2B 41 55 5 35 SA SO 41 58 58 58 58 58 50 58 11 1E 3B 79 96 FF XEXXXEX Z2y 42 40 93 Sb 43 FF 30 42 DE B5 5 42 20 EG C UB WB 1 HUHHJDEH DP PP OP PP EP DP ID Po BB Pe PE PI 0000380 104 OD 256 41 55 35 30 41 56 58 58 58 58 56 11 1E 79 Yo Bo OO FF FF 42 ZU 93 D d3 X Zwv B x65 E g on the picture above the immobilizer number is AUZ5ZOAXXXXXXX and the login is OD2B in hexadecimal or 3371 in decimal 2 1 the immobilizer number
3. dit v aee EH UNTERE Nat 120 2 2 5 Special Junction Cruse a 120 2 29419 S peciat functon Brake PAGS CHANCE v spes 120 2 9 20 special Jnclton CU Exchange PUMP POO been tin ota eats aeta eoe pe Raton OR 120 2 9 24 Decal J nchom Door UNLOCKING esed estere ed eet tide Con abest tret duces daten a tu ia 121 2 5 22 Special function Coding calculator 123 TROUBLE ER SHOO TING E 125 127 4 1 PROGRAMMING INSTRUMENT CLUSTERS FROM MAGNETI MARELLI K LINE DIAGNOSTIC 127 4 1 1 Instrument cluster from Audi Audi Audi TT VW New 127 2 12 cluster LT AI nt ette e a ect ete 126 4 1 3 VW Passat usually these Instruments are before year 1998222200 1 10000000 00000000000000000000 0 0 130 DT TATIUS 130 4 2 PORSCHE CAYENNE VW TOUAREG GASOLINE ENGINES ECU WAKEUP 5 5 11 1 131 4 3 AUDI A8 FUSEBOX PASSENGER SIDE WAKEUP
4. 02 00 00 0 16000000000 0 se s 132 NNUS pM NR d TM E T TEN EP 133 AD AUDIO RO OAEX CEPT 3 22 136 APO NOTA G2 E Side 136 4 7 VAG K CAN COMMANDER KEY LEARNING 5 137 DUMP TOOL SPECIAL EUNGTION 5 142 Version 2 31 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 Version 2 31 1 INTRODUCTION Abrites Commander for VAG is a Windows PC based diagnostic software for the vehicles from VAG With the help of this tool you can perform operations with vehicles from the VAG group which are in most cases unsupported from the producer diagnostic testers The Abrites VAG Commander provides you also a full diagnostic capabilities for VAG vehicles 1 1 Installing ABRITES Commander for VAG The ABRITES Commander for VAG is contained into the installation package so please run the setup program Now you are ready to start the ABRITES Commander for VAG When starting the software there is a solash screen appeared where the connection with the hardware is examined If no problem appear then a message Connection OK should appear The main screen looks like this ABRITES Commander for VAG 17 0 ww
5. de M 24 Zo CREME 24 MEUM esata CT 24 2d 3C Aa aU 22 Ou PC 25 Z4 JT CUSLOm downlogd eee testas ves ot laetare eta data att 29 2 JO COMPONCIU 2 2 4 I5 civedidgliosiic SeSSIONRAG Is ound te tau up 26 Zo SPBCIAE FUNCTIONS dua eua ERU pe Seat oii 21 22 1 Special functions WUR Immstr meut CANS Lu 28 2 5 1 1 Special functions with Instrument Cluster CAN over 2 0 28 2 991 2 AD pectat VDO NEG PEEL Den P 31 2 5 1 3 Special functions with Magneti Marelli UDS 95 70 33 25 4 Special functions JC T with NEC 95320 EEPROM 35 2 5 1 5 Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM
6. VW Tiguan 2008 2009 OBD CAN Key programmer dealer ke Procedure 3 wan sername Et _ VW Tiguan 2009 UDS Key programmer dealer ke Procedure 11 VW Passat B4 Mo tometer 1996 OBD K not needed 8 Procedure 1 _ tometer 2001 OBD K not needed 8 1 wmm _ VW Passat 6 2005 OBD CAN Key programmer dealer ke Procedure 3 Sy _ VW Passat CC 2008 OBD CAN Key programmer dealer ke Procedure 10 SBE _ VW Passat 7 2011 OBD CAN Key programmer dealer ke Procedure 10 om gamme Key procedure VW Phaeton 2007 OBD grammer ke Procedure 7 Vw Phaeton __ 2008 grammer Procedures _ VW Phaeton 2008 OBD grammer ke Procedure 8 VW Touareg grammer Procedure VW Touareg 08 2007 OBD K grammer ke Procedure 7 HITAG 2 Key pro PCF 7936 VW een 08 2007 OBD CAN grammer EN 8 VW 08 2006 EE C 2 VW Touaran 08 2006 2009 OBD CAN Key programmer dealer ke Procedure 3 ass ARE VW Touaran 2009 UDS Key programmer dealer ke Procedure 11 Porsche game key Procedure Porsche Cayenne 2007 OBD K grammer ke Procedure 7 Porsche Cayenne
7. For EDC16 MED9 ME7 EDC17 MED17 and Simos PPD engine control units the customer can press directly Read and the old CS PIN are displayed If engine control unit is virgin this is also automatically detected So after the successful read of the existing data they are filled automatically in the field below Please pay attention that the 7 byte of the CS is not required here Pressing the Read button will read the power class existing PIN CS also VIN and immobilizer number New immobilizer data Immo number ZZ AFSSNTIT222 92 14 Also after successful reading the fields for the CS PIN VIN and Immo number become active and customer may specify the values he want Please pay attention that the power class for the engine control unit is displayed This is very important value which is stored inside the engine control flash and cannot be changed This value should be the same for the engine control unit and the immobilizer this means if the old broken engine control unit is from one power class and the new one is from other the car will not start even if the adaptation procedure was completed The meaning of the power class value is to prevent putting one engine control unit from e g 3 0TDI to car with 2 0TDI 2 5 7 2 Adapting Audi 8 VW Touareg immobilizer Kessy This special function is dedicated to adapt second hand immobilizers from one veh
8. 88 00000100 13 73 3C CC 42 00 10 73 53 45 5 37 5 lt Audi 2002 Security access code Program transponder 24c17 Required license 006 to view security access code and 9 to write transponder s data to dump The function visualize the security access code and also the immobilizer and VIN numbers It also gives the opportunity to change the immobilizer and VIN numbers Dump Tool Audi AG 2002 Security access code Program transponder 24c1 7 50 au l8 10 11 B3 aD EQ 01 1 14 l8 BE 01 05 05 03 gu a lt uu 14 jl uu uu EF l8 00 at au 10 34 aD 03 uu 3l 50 OF uu 05 4 all 53 uu Bl al uu uu uu Ag 46 20 57 l8 uu 07 03 18 05 OF ol 04 OF 01 uu 00 03 lt uu 05 05 uu 4 a4 20 57 C3 03 34 07 40 uu 78 01 01 01 03 14 50 53 uu 48 Bd uu 5D 50
9. uncrppted login 23413 Component security protection Old uncyptesses 12 9 fos joo New ES 12 09 34 DA jo LIncrypted data can be read from the instrument er from the MED ECU through the ECU MED 9x Immo bypass Required license 12 This function allows you to make a immobilizer bypass for the MED9 engine control units It works on the unencrypted engine control units but also on the encrypted too but on some encrypted engine control units it might not work ATTENTION For the encrypted MED9 x ECUs it is necessary to make changes in the flash too So after you will need to give also the ECU flash and EEPROM as input and after the modifications to write back the modified flash and EEPROM to the ECU Unencrypted MED9x require only EEPROM changes It is automatically recognized whether the ECU is encrypted or not Dump Tool MED 9 x Immo Bypass 5 8 07 02 08 3l all 3l all 03 33 05 3l un un JH all 04 JU all aL 04 03 03 20 74 3l all 3l aU aU 111 aU ol 20 20 33 un 31 57 ju 10 31 Sy 30 uu 35 31 48 uu uu uu uu 20 41 11 af 20 41 11 uu
10. uu TC uu al uu al uu u 48 34 a0 Imma is now OMIN aU 55 uu 41 aU 55 uu uu uu dz al 20 uu 01 uu uu uu al 5 uu 55 aU 54 uu 00 uu 50 35 36 00 uu 00 00 aU 5 uu ER al 54 uu 00 uu 47 43 30 uu FF uu 05 00 05 uu al 5 5 al 5 00 36 33 00 00 00 00 al 3d 00 5 al 3d 00 00 00 3l 00 00 00 00 00 00 00 al 00 3d all 00 00 00 30 00 47 00 00 00 00 00 all 4C all all 11 at at all 31 all 31 3l AQ F4 F4 x EP 07 02 08 1037384968 Load 4 2 1037383785 Save dump 091210 WAUZZZ4L37D0 ISP 9g1210 h WAUZZZ4AL37D 091210 WAUZZZ4L37D0 91210 h Toggle Imma On Off M c T H 5 BPG810 1 32401815C 000 ECU ME 7 x Set component protection data 9P08 95080 Required license 009 This function allows viewing and or changing the component protection data found into the ME7x ECUs Into the ME7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero
11. Type ECU Set component protection data SP08 95080 20 54 FF le 30 35 30 32 33 fee 0502037 00000010 05 01 43 De 71 1C OO OO OO 5 81 c g b ul 00000020 05 01 01 00 43 DS 71 lC 08 00 69 Cl 00 5 80 FC C q i 00000030 04 01 AC De OC 20 Al BO 18 SB OO 00 OO Al 00000040 01 be AC OC 2 Al BO 16 OO OO EE 00000050 OF 80 02 01 06 00 28 04 58 OD OF OO Fl FD LN 00000060 OO 67 b 09 00 OO 19 03 00 OO 00 54 FF 00000070 05 04 zz 09 09 00 06 05 00 FD zD OO 46 000080 05 zz 09 09 00 06 05 OO FD 00 46 41 00000090 m m E vac nnnn AD Component security data f xi p Fao ee m Old 00000 0 ES Bo life E 1a B 0 irme mm EE ME Roe Mew 000 0 0 n NM A 3 ECU ME 7 x Security Code Checksum calculator 9P08 95080 Required license None This function displays the security access code which is contained into the unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area only for the first 0 120 bytes because after that area the EEPROM sections are different for each different software version of
12. to the immo PIN 3328 data Headlmmo Done For Micronas dashboards it is also possible to extract the mileage value by available EEPROM and flush dumps using button Mileage by flash EEPROM dumps Micronas Write Immo cL tu Make dealer key and add it Reading Writing the Immobilizer data is made from the buttons Read Immo data and Write Immo data For Micronas dashboards it is also possible to extract the immo data by available EEPROM and flush dumps using button Immo data by flash EEPROM dumps If you want to make a key you need to read the immobilizer data first or to load it from flash and EEPROM dumps Then you should have a programmer connected and to put the transponder inside After that 1 key is added to the existing keys This means that existing keys continue to work NOTE It is possible to have 8 keys per car If all position are full the key is not added but replace the 8 position NOTE Pressing the Make dealer key and add it to the immo data button programs the transponder as a dealer key and puts the transponder ID into the immobilizer data But the data are not written in the microcontroller yet you ve to press the Write immo data button to write the data Or if you want since you ve a dealer key at this moment you can exit without writing data and later learn the transponder by diagnostic This application can be used with the following
13. 75 30 Se 38 3l 30 31 u 0281012 00000050 31 31 39 20 OO OO 00 16 SC 07 DS 19 Bl 119 05 l2 38 FF FF 31 36 20 3l 20 30 34 FF 8 16 1z 04 00 000000 0 0 000000 0 44 C5 49 CD D 00 56 57 45 rl WAC 5 30 30 30 30 30 30 30 30 380 00 F6 FS 55 2000000000 T 00000100 z4 Fa 49 CD OO OO 56 57 SA 45 rl VEC XJ 00000070 42 00000080 20 pu y rg eum 00000080 00 5 2 8 n 000000 0 Oo az New 1 w o o lo fo ECU EDC16 Immo bypass 95320 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Dump Tool ECU EDETB Immo bypass 95520 50 16 12 04 00000010 FF FF 31 37 31 32 30 34 18 89 OO l7 lz 04 a 00000020 l7 04 00 43 54 31 30 33 37 52 37 34 31 30 36 1037374105 00000030 03 ZF 31 30 33 37 33 37 36 36 37 B lU3737Z657 00000040 OO 06 OO 75 SO Se 38 31 30 31 Ge u lzel lz 00000050 31
14. OBDCAN grammar Procedures 5 Porsche Cayenne 2007 OBD CAN grammer ke Procedure 8 Bentley Continental 2007 opp grammer Procedure Bentley Continental 2007 OBD K grammer Procedure 7 Bentley Continental zo ombcAN gamme Procedures _ Bentley Continental 2007 OBD CAN grammer ke Procedure 8 4 8 tool special function The dump tool receives as input a dump file from the corresponding unit input dump 15 loaded with the Load dump button The dump file may have been read either via OBDII or with a programmer especially for units where reading via OBDII is not possible As output the dump tool displays some data extracted from the input file and or makes some modifications to the input data If any modifications were made for some sub functions there are no modifications made only data are visualized the user has to write the modified dump to a desired file with the Save dump button and then this modified dump should be saved back to the device OBDII or with a programmer If data are read write with a programmer the user must take care to ensure that the proper byte order is used Because most of the programmers are reading the data on 16bit words the byte order in the dump depends on the used programmer some programmers are producing dumps starting with the least significant byte and some are producing dumps starting the most significant byte This means tha
15. Read Read Flash Write EEPROM Immo Data VIN Head Imma data Serial number Transponder identificatars Serial key C5 Status Key count 04 0 For these dashboards it is not needed that working key from car is present You can directly read write EEPROM and read flash and also read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the Key count field If you want to erase all keys put 0 for the key count Key Learning Wizard mode After this type is selected auto detected pressing Next will show this window Immobilizer data Current key count 4 Transponder type Dealer
16. WWZC DOODOOFO 5 30 30 30 30 30 30 30 30 30 AC 02 55 2000000000 00000100 4 Fa 49 CD 56 57 43 s rl VEC Checksume in the file updated Press the Save button ta save the changes ECU MED 9 x Reset component protection data 95160 Required license 009 This function allows viewing and or changing the component protection data found into the MED9x with ST95160 serial EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer ECU MED 9 Reset component protection data 95160 27 ES 35 30 37 2D 39 85 05 07 z9 4 Load dump 00000010 FF FF 30 35 30 37 32 39 18 49 05 47 05 07 29 00000080 29 OF 05 37 46 31 30 33 37 33 37 37 34 33 39 7H1037377439 save dump 00000030 31 30 33 37 33 37 34 39 36 FO l1037372496 000000240 03 5 54 69 96 OO SF IB 05 31 gt 00000050
17. VDO with NEC uC 2009 CAN UDS JCI with NEC and 95320 EEPROM UDS Here you can manually select the desired instrument cluster s type NOTE If you would like to manually to select instrument cluster s type disconnect AVDI from OBDII and open Instrument Cluster CAN special function If one of the above types is automatically detected commander opens corresponding function window 2 5 1 1 Special functions with Instrument Cluster CAN over TP2 0 Available functions are eReading current mileage value eRead Program EEPROM of instrument cluster immobilizer eReading security access code of the IMMOBILIZER eRead Write immobilizer related data Please take into account that provided security access code from this application is IMMOBILIZER related and it will not be accepted from the instrument cluster Instrument cluster Immobilizer special functions Read write EEPROM Immo data Mileage Read Mileage by flash EEPROM dumps Micronas Immo Data VIN 3333 Read Imma Imma data by data flash EEPRUM dumps Micronas Serial number VWZTZ0E1712776 Serial 5 991 7ed3de528d5 239 Transponder identiticators 1 12302146 KeylD5 02 2921 KeulD 5 Status 2000fe5eft Power Clase fe 03 2be 0 Configuration if 0106330111 In 04
18. and orange brown wires and connect the AVDI as shown on the diagram One easy way to connect is to disconnect one plug from the device under the drivers seet and there to put the wires as shown on the picture NOTE After the component protection data are read you should reconnect the AVDI to the OBDII before you continue Connecting to vehicle Reading ABRITES Commander for VAG Component protection generation 1 Connecting to EZS Kessy Entry And Start Autorization OK Reading EZS Kessy with Algo 1 please wait may 1 2 OK Connecting to Central Electic OK Programming component protection OK Component protection is reset with SUCCESS 2 5 5 2 Component protection generation 2 This special function currently works on Audi A6 Q7 Allroad 2004 2008 In these cars the customer is able to adapt completely by OBDII without any restrictions the component protection for the airbag instrument cluster comfort module and EZS Kessy For the remaining modules having a component protection e g DSP Climate Control the customer can adapt the component protection only if he have the Gateway EEPROM dump from the car from which the replacement module is taked Audi A4 A5 Q7 2007 In these vehicles the customer is able to adapt the instrument cluster When the special function Component protection generation 2 is started the system is examined and all modules
19. 36 2 31 60 L6atnine key wA EZ tatu 38 Readimp ehatiptmp V aane 39 Mite EEPROM roc OR o 39 2 9 1 9 Program a blank key soit acdealer Key neo t ica dabat Ped vere Ev ds 30 2 2 PCCial JUNCHONS wuh AGA DIOS Tiriti ERE Ped ous o 40 203 L1 BCM2 bY E Cete ula ee turf 41 Version 2 31 4 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 25 22 Read BCM with AB PR OG aoc titt dia cious o E d d 43 2 32 9 I eysleatnine PE OC CONG E 44 PSP NE eset eet 45 252 228 SUOMI ON ases sale dd ema fuas tiled bote yun sec ek ab 45 2 9 9 Special funetious WIN INSETUIICNE KAINE ee tan tenu 45 2 5 3 1 Transferring keys from one RB8 instrument to 47 25959225 aks 49 3 REMOV
20. ABRITES Commander for VAG m x Find the 7th Byte of the Component Security Bytes Find From Working Key Find the 7th Byte of the Component Security Bytes Automatic Trying r3 Load Comfort Module EEPROM Dump lt Back Exit Here you ve to choose and option from the above two after that to load the comfort module EEPROM dump and the Next button will become active If Find the 7 Byte of the Component Security Bytes Automatic Trying is selected after pressing the Next button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 9 2 5 13 13 Procedure 11 for vehicles with VDO dashboard with the NEC microcontroller These are typically the models produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally when you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the VDO NEC 2009 special function because the key functionality for that vehic
21. Make key for the car NOTE Sometimes writing of the data may fail In order not to lose the information all written data are backed up in the Dumps subfolder NOTE For the dashboards with the colored TFT display if there is no working key then the service mode is entered and all changes should be done before the service mode is leaved Otherwise if the customer wants to enter once again into service mode he will need to modify the EEPROM once again with a programmer NOTE For the dashboards with the colored TFT display it is specific that the dashboard remains dark until the service mode is active 2 5 1 3 Special functions with Magneti Marelli UDS 9512 The Magneti Marelli UDS 9512 special function is dedicated for the Magneti Marelli instrument clusters with 9512 microcontroller and UDS diagnostic protocol Typically these are produced after 2009 year After starting the function a following dialog will be brought to the user in the example below immo data is read Magneti Marelli UDS with 9512 Microcontroller X Magneti Dashboard with Motorola 3512 microcontroller and UDS diagnostic protocal make key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder into the programmer and press Add key After several seconds the key willbe ready The learned key will be added to position count 1 If you want to erase all existing keys and program one new key
22. nc nn Slide door lef Manual Selection if Special functions m3 re CAN 1 Instrument Ez5 Kessy Instrument Engine Control Micranas YEO MEC Magnetidash Component Engine Control Unit Master Previous Next K Line Unit CD C322 2009 UDS 9512 protection adaptation b gt i T f b us ES A E Steering lock activation Key learning Dump tool Airbag Ww Crater OSG Mileage Custom PIN Converter adaptation ED ED2 Read Write NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not possible to distinguish between VW vehicle 2007 and VW vehicle 2007 CAN If vehicle type is correctly recognized then press If you like to select from a list of vehicle immobilizer types then press Manual Selection If for some reason vehicle immobilizer type is not successfully recognized the following message will appear x Engine Control Unit Master 02 Iransmisson 03 ABS 04 Steering Angle 05 25 And Sta Seat memory passenger 07 Control head 3 x E Cannot autodetect immobilizer type Please selectit manually Air heating Slide door le tft 4 Next
23. 37 OB 37 13 00 01 00 00 BC 7 7 lt 00000060 01 05 5 54 69 96 Cl 00 SF 61 IB 05 481 gt 00000070 37 OB 37 13 00 01 OO F7 Be 7 7 lt 00000080 Component security data X 00000090 ddd Gld ra sm nnnnnen 104 Swap bytes n Cancel 0 jo 2 NE ES 0000 000000 0 00 Seen orar go ere rer rre oe 00000100 03 04 8B C8 al 7B 00 00 00 00 00 00 00 OO 00 00 F ECU MED 9 x Security Code Checksum calculator 95160 Required license AN003 This function displays the security access code which is contained into the MED9x unit with ST95160 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the 9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put
24. Special functions P re E Line gt nec sete Instrument 5 Eessy Instrument Engine Control Mieronas 0 NEC Magnetidash Component EDCTE MEDS K Line Ll nit 2009 UDS 9512 protection adaptation b REY 1 HOT 1 cd f 5 186911 x TPE 11 A 9s Qu E epe d pony y e Steennglock activation Key leaming Dump tool Airbag VAM Crater DSG Mileage Custom PIN Converter adaptation ED1 ED2 Reads rite After vehicle investigation has finished and the user has made it s choice to proceed by pressing OK or Manual Selection the following dialog will appear Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN Learn Keys VAG vehicle MM Motorola 9512 2009 CAN Add Key Audi AG Allroard 2005 CAN Program Key Audi A3 S3 2004 CAN Audi A8 VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 11 2007 CAN Skoda Octavia 2007 Seat Altea Toledo 2007 CAN Function Learn keys ss The auto detected vehicle immobilizer is selected into the left list with supported vehicle types If not auto detected the user has to select the desired model into the left list with supported
25. eese 72 2 SVCCIGL JUNCTIONS WIL CALLOUS ota 73 232 TANCHION oo N MU EM 75 2 9 19 76 2 Te 1 Meare cocoa nM DE 79 IKe y learnino PEO CC CULES Fate entre Saa dde difta 80 2 5 13 3 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN 86 2 5 13 4 Procedure 2 for CAN vehicles after 09 2006 year VW 5 5 89 2 5 13 5 Procedure 3 for CAN vehicles 2008 Passat Audi 91 2 5 19 5 DL Prosramimine a dealer key with all 7 bytes avallable dede 94 2 5 13 5 2 Finding the 7th byte INCASE Ol Olan ard Mode ce ated A 94 2 5 13 6 Procedure 4 No more applicable Use procedure 3 2 7 96 2 5 13 7 Procedure 5 No more applicable Use procedure 3 22 9 96 2 5 13 8 Procedure 6 for Audi A4 RBB8 c ccccccsccsssscccessccnsvsccnscsccnscscsnecscsuevscsuecscsnevscsuecscenucsseeseecnecsesueseeseeseesuecsecs 96 2 5 13 9 Procedure 7 F
26. lt a4 gu 04 14 OF 48 gl 03 gu Ol og 01 14 lt uu F4 OF OF gu B 50 lt 4 au 04 aD lE 48 uu 01 0l 01 15 54 54 0l 03 46 10 DD 60 Bl FO al FF OD OC 46 15 aU uu 05 01 01 an 01 03 OD OL uu 04 ED uu EU 78 Bl 05 00 It HE 2x BE LX iun 00 ERES tinier 05 au 1 Oa 24 P 45 P 0 4 uc Seek Pas Save dump Swap bytes L H Login 5126 Other Data Immo number 070699 Set VIN WALZZZADZYN 002822 Pressing the other data button displays the learned keys and if a programmer has been recognized allows to read current transponder s data and add it to the dump With pressing a Program transponder button and if a programmer is recognized the current transponder is read and it s data 15 written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write tr
27. then you can put the component security bytes manually and press Next Learn keys 1 Turn ignition ON dealer key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next put down count of keys to leaern then follow strictly the recommendations 2 5 13 11 Procedure 9 for vehicles Audi A6 Q7 Allroad 2005 It is possible to program a key for the Audi A6 Q7 Allroad but this function is not located in the key learning Standard mode It is available in the key learning Wizard mode The function is also available in the EZS Kessy A6 Q7 function from the Special functions list This is so because it requires separate license If not using key learning Wizard mode please refer to section Special functions with EZS Kessy CAN Key learning Wizard mode L3 ABRITES Commander for VAG 4 select vehicle immobilizer type select function VAG vehicle VDO NEC 2009 CAN Learn Keys VAG vehicle MM Motorola 9512 2009 CAN Program Key Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 S3 2004 Audi 8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 11 2007 skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN 2 Function Learn keys For EZS Kessy mo
28. 4 Key 3 d2da21be Key 7 d4c12be Key 4 mm Key 8 m Configuration 210103780600 Add Key To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder is added into the key data and write back the data to the immobilizer 1 after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work 2 5 13 14 Procedure 12 for vehicles with Visteon dashboards Normally the Visteon dashboards are build in VW Golf models So if the car is with Visteon dashboard the software recognize the type automatically The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VN4 For this dashboard type normally the Megamos 48 Crypto transponder should be prepared as a dealer key and then learned to the car Fortunately it is possible to read the PIN and all 7 bytes of CS from the Visteon dashboard Key Learning Standard mode If you press Autodetect Login Security code will read the PIN code And pressing the program dealer key will read the 7 bytes of CS and program the transponder without opening any other dialogs After the dealer key is ready you need to learn it to the car b
29. Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9512 microcontroller These are typically some models produced after 2009 year The immobilizer is integrated into the dashboard and the required transponder for that cars is Megamos 48 Crypto Key Learning Standard mode Normally when you open the Key Learning special function the software automatically recognize this type of vehicles and instructs the customer to open the Magneti dash UDS 9512 special function because the key functionality for that vehicles is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand MM7 or MM5 So such cars open the Magneti Dash UDS 9512 special function and following dialog is brought to you Magneti Marelli UDS with 9512 Microcontroller Magnet Marelli Dashboard with Motorola 3812 microcontroller and UDS diagnostic protocol make a key you need to read the immobilizer data first Then put Megamos 48 Crypto tranponder inta the programmer and press After several seconds the key will be ready The learned key will be added to position count 1 if vou want to erase all existing keys and program one new key first put TT for the key count and then make the key ABS coding Mileage Mileage f ileage Head write EEPROM Flash
30. Terminal 58 status Display dimming terminal 58d Terminal 58 status Switch dimming terminal 58s Terminal 58 status Dimmer duty cycle terminal 58st Terminal 58 status Sensor for detecting light in the instrument panel insert Total fuel level differences 5S diff WIM Cum total of fuel level differences Wh Theoretical service interval Year s amount of driving Short term average of fuel level differences Cum total of fuel level values Outside air temperature displayed value Serice Key Master Counter Service Master Counter Service Key Master Counter Service Master Counter 5srice Key Master Counter Service Master Counter Service Key Master Counter Serice Key Master Counter Service Master Counter Serice Key Master Counter Service Master Counter Service Key Master Counter Service Master Counter Service Key Master Counter 4 2 4 7 Security Access Counter Keu ID 1 Counter Counter 3 Counter Key D 4 Counter Kep ID5 Counter Key I D Counter Key ID Counter Counter 1D Geber Last Kep Counter Trigger Error Counter State Imma Fey 382 8 Liter 1107 15720 E350 0 Milli Liter 0 50 0 Degree Celsius Security Access gives you the possibility to perform security
31. by loading the module EEPROM dump available for airbag and EZS Kessy by loading the gateway EEPROM dump from the car from which the module is taked where it was originally build in Customer has to select from the following dialog in which way he want to proceed step 1 1 Reset to virgin state Please select how to reset to virgin state available for EZS Kessy KOMBI AIRBAG and Comfort module C By module EEPROM dump available only for AIRBAG By gateway EEPROM dump available for all devices requires the GATEWAY EEPROM dump from the car where module was originally equipped After selecting the operation way another dialog with the status of the operation is displayed Step 1 2 Reset to virgin state Connecting to Airbag OK Disabling security OK Trying to reset component protection Component protection is reset with SUCCESS After the operation is completed the module is in virgin state and can be adapted to any car 2 5 5 4 Learn module to the vehicle To learn the module to the vehicle it is necessary to have the Gateway EEPROM dump from the car where you install this module ABRITES Commander for VAG step 2 1 Learn module to the vehicle To learn the specified module to the vehicle you need the EEPROM dump of the GATEWAY module from the car where you want to build the module You can r
32. first put LI Far the key count and then make the key Readwrite EEPROMFlash Head Head Flash 10 5 FF FF Write Read mileage ee OST 19 3 38 36 SKO97086 Mileage 0 1000003 2 48 31 30 FF OF 10 1000038 from Save to file Imma Data VIN 90001 data Transponder identificators 4 Keys fii KeylD2 ba3 c0E2 KeylDE Status 03 214133 count 4 73ccd92b 08 LM Add key Seral number 00000000000000 Serial 5 51114 502239 522 2028 Write Immo data Done For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate license while making keys requires the dealer key license 2 5 1 4 Special functions JCI with NEC 95320 EEPROM The JCI with NEC uC and 95320 EEPROM special function is dedicated for the Johnson Controls instrument clusters with NEC microcontroller 95320 EEPROM and UDS diagnostic protocol After starting the function a following dialog will be brought to the user in the example below immo data is read JCI with NEC microcontroller and 95320 EEPROM Head write EEPROM da
33. function from device s EEPROM but for some models the user has to do this by hand read EEPROM memory using Read EEPROM function find where crash data is stored change data write EEPROM memory back using Write EEPROM function Covered units Read Write EEPROM 1 All Siemens CAN Airbags 2003 2008 like 4F0959655B Audi A6 Q7 Allroad 2003 2008 1K0909605AB 1 0909605 1KO909605AD etc 2 K Line Airbags Siemens and Bosch 1 909 605 810 959 655 1J0 909 609 600 909 605 C 6Q0 909 605 600 909 605 959 655 B 1 0 909 605 1 0 909 605 140 909 607 140 909 603 480 959 655 C 4 959 655 J 400 959 655 810 959 655 F 8A0 959 655 C 959 655 959 655 400 959 655 800 959 655 800 959 655 L Clear crash data K Line Airbags Siemens and Bosch 1 909 605 8LO 959 655 1J0 909 609 600 909 605 C 6Q0 909 605 600 909 605 959 655 1 909 605 1 0 909 605 1 909 607 190 909 603 4 959 655 4 959 655 J 400 959 655 810 959 655 F 8A0 959 655 8A0 959 655 8A0 959 655 400 959 655 800 959 655 800 959 655 L 2 5 12 Special function VW Crafter This special function gives the possibility read the engine control unit EEPROM together with the PIN code and component security read mileage into engine control unit make immobilizer ON OFF learn keys with prepared transponders per
34. ll1SN I DF710 H a Save dump Swap bytes LAH HN EET 1117 Login 13252 00000080 43 30 30 30 30 30 30 30 30 30 56 57 43 ZCzZOO0000000NVNZC 00000090 5 30 30 30 30 30 30 30 30 30 57 56 57 SA ZDDDDDDODDITVUZZZ 000000 0 33 43 36 50 31 31 31 31 31 31 57 56 57 SA SA 3CZ6PllllllWVWZz 00000080 5 33 43 36 50 31 31 31 31 31 57 56 57 Z3CZ6PllllllWWWZz 000000 0 54 33 43 36 50 31 31 31 31 31 31 00 00 00 zz3czePlli1111B 7010036906018 ECU Marelli Security Access Code 95320 Required license This function displays the security access code contained into the engine control unit from Magneti Marelli Type ECU Magneti Marelli Security Access Code 35320 00000090 30 33 43 39 30 36 30 34 46 20 20 30 31 31 38 OSC906024H 0118 00000 0 OO 00 OO 00 00 00 00 00 00 00 00 00 00 00 00 00000080 OO 00 OO 00 55 50 90 09 0000 0 00 06 04 07 De GF 27 70 FF OO FF 8 ERER EF ERER EF FE 000000 0 01 00 03 OO 55 36 15 73 8C CC 42 00 00 SS Bia 73 38 13 73 Cl OO 73 38
35. this model is autodetected selected the system will also autodetect whether it is possible to add the key without erasing the remaining keys Please pay attention that during the autodetection whether adding 15 possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that If possible the Add Key function will be available into the list with key learning functions If you choose Learn Keys the key s will be learned normally other keys will be erased If you choose Add Key the key will be added to the remaining other keys will NOT be erased For the case where the key will be added you should give ignition with the key which you want to learn this should be a TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 ABRITES Commander for n x select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN Learn Keys VAG vehicle MM Motorola 9512 2009 CAN Add Key Audi A6 Allroard 2005 Program Key Audi Q7 2005 Audi A3 S3 2004 Audi CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 Skoda Octavia 11 2007 Seat Altea Toledo 2007 CAN Function Learn keys Learn keys 1 Turn ignition ON new or existing key 2
36. 2009 Media Player 1 MP3 CD Changer 2004 2009 Auxilary Heater 2004 2009 ILM Front passenger ILM Beifahrer i1 2004 2009 Instrument Cluster 2003 2006 Seat Memory Passenger 2003 2010 Memory module driver s seat 2003 2010 Currently for the most of the modules is needed first to read with a programmer the internal EEPROM for the MP3 CD Changer the internal flash If it is not necessary to read the flash the Load dump will be not active and the user can proceed with the next step A8 2003 2010 only If a module for A8 2003 2010 vehicles is selected there is one additional step The customer has to connect 3 wires from the AVDI DB25 connector to the vehicles CAN H CAN L and Ground There is wiring diagram how to connect exactly The user has to connect to the organge green and orange brown CAN L wires Additionally also the GND and 12V should be connected The most easiest way is to disconnect some connector e g the connector of the module under the driver s seat and to put there the two wires from the AVDI The ground of the AVDI can be connected to any metal part There is also a picture with example how to connect to these wires After the wires are connected the customer has to press Read component protection data ABRITES Commander for VAG c EB Read A8 component protection data For A8 itis necessary to connect the AVDI to the internal CAN Bus not to the OBDII Find orange green
37. 31 39 z 20 00 00 00 16 07 DS B 16 FA Bl 119 00000060 OO 04 2 75 30 33 47 39 30 36 30 52 31 u 0369060z14 00000070 20 5 34 20 30 4 20 45 44 45 20 20 B R4 amp 01 EDC 20 20 20 37 37 31 03 00 OO 46 00 00 1 00000090 OO OO OO OO OO 00 OO OO OO 00 09 F7 000 0 0 OO z 75 30 33 47 39 30 36 30 52 31 u 3659060z14 0000000 42 20 52 34 20 32 30 20 45 44 43 20 20 20 B R4 2 01 EDC 00 0 20 20 80 20 37 37 31 03 00 OO 46 00 00 00000000 OO OO OO 00 OO OO 00 OO 09 000000 0 44 F3 C5 49 CD 00 56 57 45 rIl WAC 5 30 30 30 30 30 30 30 30 30 02 55 2000000000 00000100 4 Fa CS 49 CD OO OO 56 57 45 s rl Wal Immo is now The Toggle Immo On Off button allows to switch on off alternatively the bypass function ECU EDC16 Security access code Checksum calculator 95320 Required license None This function displays the security access code which 15 contained into the EDC16 unit It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are
38. 35 32 20 20 20 30 32 32 30 DD 02 02 00 10852 0220 Engin e 00000080 07 ED 2 10 77 SF 30 38 2E 30 33 2E 30 37 FF FF 9 08 03 07 00000090 34 46 30 39 30 35 38 35 32 42 20 20 20 33 31 FF 4FD905852B 31 Save dump Swap bytes LAH 33 30 Se 34 34 37 53 J0 30 31 36 30 3052447320012060 0330101035330 Comfort module component protection data Passat B6 Required license AN009 This function is used to extract the 7bytes of the component protection data for Passat B6 This function requires a dump file from the comfort module and the six bytes of the component protection bytes which are always found in the engine control unit So you need to load the dump of the comfort module and then a dialog is displayed where you can put the six bytes of the component protection manually or you can directly load the ECU dump too The tool accepts ECU dump from EDC16 PPD1x MED9x and ME7x ECUs 00 GER EEG ABER aii ata aves 1 00000010 83 zb 2D 20 zb zE zb 2D 33 30 39 35 38 b 3C0959 00000080 34 33 33 46 20 20 30 34 35 33 43 30 39 35 39 433H 0453360959 00000030 34 33 33 46 20 20 20 FF FF FF 05 80 FF FF FF 00000040 FF FF FF FF FF FF FF FF FF FF FF HEROES FF FF FF FF FF FF FF FF FO FF 00000060 54 54 FE
39. 39 21151 1 4 00000070 31 30 38 35 Se 20 20 20 Se Se 30 00 01 01 OO 10852 Bas saa 00000020 51 l 5B 31 Se 36 30 30 37 FF FF l1z56 0z 07 00000090 34 46 30 39 30 35 35 38 42 20 20 31 FF 4 09059528 Sla 000 0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 33 30 35 34 3130 30 39 33 31 38 31 Se 31 35 30 3054100931512150 This special function is dedicated for Q7 A6 Allroad models and the user has the following possibilities a key Learning a key requires in most cases a preprogrammed using VIN key which normally should be purchased from the VW Audi dealer Only models with EZS Kessy with SW version till V2 0 2 it is possible to learn an empty clear key For models with EZS Kessy over this SW version it is required to have a dealer key purchased from the dealer or create with our programmer Read the EZS Kessy EEPROM 2 Write the EZS Kessy EEPROM 2KB but without an area of 96 bytes with the PIN component security and ECU synchronization Change the VIN inside the EZS Kessy EEPROM Program a blank key so it becomes like a dealer key IMPORTANT To make any activity with the EZS Kessy you need one of the following to know the login PIN of the car and the first 6 bytes of the component security bytes The component security is normally 7 bytes but the 7 byte is not required The login and the compone
40. B5 47 FE 03 03 64 00 03 56 ZZ 5 C d V 00000070 00 3 57 03 62 5 FF FC Be 56 43 66 00 W bz V C 00000080 45 UU component protection data E a E 00000090 FF OO 02 00 0 5 FF ECU component protection data from dump FF FF FF Load ECU dump 00000 30 So 3n C Enter component protection data manually 00000100 FF FF FF 00000110 FF FF 00000120 FF 5 000001350 FF FF FF Load dump from EDCTE ME lt uncripted Simas Simos FS Load dump number ERCEFOEROPEOERORPOEROERK 2 2 c ze4mete mn BHUBHHIOU EECEROERSCERECERORESCRESETF ipw a pogr ER IEFERSOEREFE EDOEBRSORROBEOERO BangBgBleos EF ak REO ila alae Wa 00000190 iit OOOO TaD FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF The function also visualize change the immobilizer and VIN numbers Dump Tool Comfort module component protection data Passat Bh ww 00000010 0000080 34 000
41. For SKODA you must use Virgin key or Transponder TP24 Key Learning Standard Mode You need to choose from Special functions Key learning VW Seat Skoda 2007 Key learning Detected car type Vehicle model VW Seat Skoda 2007 TOUS n Produce DS Leam 5 Login Security code 24 1 22 code 0 Lock ti Engine start permitted Dealer key transponder Pena Login acknowledge ECU Responding Key transpander lacked min Transponder type Key transponder leaned Transponder acknowledge Key count mir Tou can reach login code using special functions of nstrument mmobilizer main panel Another way to reach login code is to extract it from the ECU special function Engine Control Unit ATTENTION You produce Seat w Skada Audi TP2x transponders using your Key programmer and pressing the button Produce TP22 TP23 TP24 TP25 transponder Procedure 2 Seat Skoda after 09 2006 For SEAT vau must use Virgin key Transponder 22 For VW pou must use Virgin key or Transponder TP 23 NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer This is done by using the Produce TP22 TP23 TP24 TP25 transponder button This requires only a connection with the Key programmer no connection to the car is needed The key learning procedu
42. RB8 instrument a button Reset Comp Security After pressing this button the following dialog will appear Just put here the component security and MAC of the ECU x OCS ap e 82 fez fad Old E a New MAC 28 rm NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 3 Removing RB8 RB4 DEF error When you select ICP type Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004 or Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 a button Repair RB8 DEF Repair HB4 DEF respectively will appear Pressing this button will initiate the procedure for removing the DEF string from the dashboards display NOTE It is recommended that you read and save the dashboards EERPOM and to make a note of the dashboards Login code before the procedure is started 1 Instrument Cluster Immobilizer Head a rite Head R M Flash PesetELU Repair RBS Security Login n Mileage EE Skip neg responses Exit During the procedure
43. Write of flash memory Read Write the flash counters Read Write EEPROM Extracting security code PIN Immobilizer Enable Disable EDC 15 EDC16 ME7x Functions become available after pressing the button ECU from special functions of main dialog ECU type help Head EEPROM D SSUES ES UNE Load fram file m F CE ow Engine Control Unit Special Functions Fis a Ecu Autodetect ECU Autodetect YAG EDC1 5x VAG ME 7 1 1 7 577 8 wakeup pattern 01 VAG ME 7 1 1 7 5 7 8 wakeup pattern 11 Porsche 5 2 7 6 020002010 00000020 GE CE t e 00000040 Wits EEPRO 00000050 EDC no ni M be 1 ese Phebe eae Seve 00000070 1 00 11210220 JEDCTBCPIEDCTBCP34 m 000000a0 Master DO Slave DU Master i 00000000 1 Slave 00 10000050 jEDCTBUT Master 1 poer WULF Zu ziu maemd amma 0000100 EDCTBUT Slave 00 mime Imma 00000110 1 Master 00000120 Slave 00000130 dEDCI7 i MEDI EE aeu P om 00000150 4 p 4p
44. Writing EEPROM To read write the EZS Kessy EEPROM it is required to put the login and component security bytes as described above Then using the Read EEPROM button you can read the whole EEPROM This EEPROM is required to prepare a dealer key Pressing the Write EEPROM button respectively will write the EEPROM ATTENTION Now is possible also the area 100 to 15F to be written To write this area it is necessary to have a working key This is the area containing the immobilizer data Do any modifications here very carefully because if you modify some of the immobilizer data especially the component security in the range 100 123 the car might stop starting because key will be not recognized if you change the component security and it will be not possible to write this area again because there will be no more working key If this happened you might need to learn new key to the car in order to be able to write this area again e g learn brand new transponder or you can unlock the original key make it dealer key and learn it again then it will be possible to write this area 2 5 1 9 Program a blank key so it becomes like a dealer key You need to put the login and the component security bytes as described above and then to press the Make dealer key button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key sh
45. adaptation Instructions Remote Control Matching Enter the total number of keys including existing Press button Learn and wait for the procedure to finish Press and hold the UNLOCK button on every remote that should be learned for at least 1 sec ATTENTION All the keys must be adapted in one procedure Adaptation of all keys must not exceed 15 seconds Remote Control Erasing Press button Erase Additional settings ee Chn 03 Auto Lock The doors will lock automatically when the vehicle reaches a speed _ of 15 kmfh 10 mph off 1 v Chn 04 Auto Unlock The doors will unlock automatically when the key is removed from the ignition switch 0 off 1 Status x Number of keys In the Instructions window within the Remote adaptation section will be available directions what should be done to learn remote controls Additionally there might be a Additional settings table where there will be listed all the applicable adaptation channels with their current values and description which are related to the remote controls function You can select the desired settings and press button Change to save them This function is available for Audi A3 S3 1997 Audi A4 S4 RS4 1995 2008 Audi A6 1997 2006 Audi TT 1999 Seat Exeo 2009 Seat Leon 2006 Seat Altea 2004 Seat Toledo 2005 Skoda Octavia 199
46. all units there is a possibility to scan all devices and if connection to the device is possible then its DTCs are cleared This is made by pressing the Clear all DTCs button from the Auto scan devices panel Once again the protocols used to connect to the devices are specified in the configuration options 2 3 Broadcast requests Broadcast requests are these requests which are sent to all or a group of devices simultaneously The ABRITES Commander for VAG is able to send broadcast requests to all devices with request to enter into a desired transport mode to clear all DTCs in all devices to disable enable the communication of all devices This is done by pressing the corresponding button from the CAN Broadcast panel Available functions are Transport Mode Entering into or leaving the vehicle from Transport Mode that is used by the factory to put the cars into a sleep to conserve battery charge during long periods of inactivity Disable Normal Communication This function will disable all communication between units in the car This can help you to hold current state of the car and to prevent disturbing of communication while re flashing Enable Normal Communication Restore normal message transmission Clear All DTC s Sending requests to all units in vehicle to erase its DTCs 2 4 Standard diagnostic requests When double clicking on the desired device in the main ABRITES Commander for VAG windo
47. and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 2 5 13 9 Procedure 7 For vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche Cayenne You must use a virgin transponder PCF7936 or a virgin key no need for some special preparation If you use a Transponder you need to switch it in Cipher Crypto mode You can use your Key programmeror HiTag2 programmer for that purpose if you have one This is done by replacing 0x06 with OxOE in the first byte of the configuration page Configuration page is page 3 where page 0 is the transponder ID and pages 1 and 2 are the secret key If this value is already OxOE then the transponder is already in cipher mode After the transponder is switched into cipher mode the key learning procedure goes as follows Key Learning Standard mode From Special functions Key Learning choose vehicle model Write how many keys you need to program enter security access and push the Learn button Then follow strictly the recommendations Key Learning Wizard mode Select vehicle immobilizer type Select function Audi A4 2004 RB8 dashboard KW2000 Lamborghini Gallardo 2005 KW2
48. component protection data Required license 009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos PPD1x generation for diesel engines Into the PPD1x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero 00000000 31 31 31 53 30 49 30 46 37 31 30 00 OO 00 46 1115 010 10 Load dump 00000010 00 OO OO 48 OO OO OO 48 OO OO 38 00 1 OO H H 8 00000080 OO FF 80 60 80 80 80 80 96 80 80 90 00 80 80 Save dump 00000030 FF 19 59 59 ZC 59 94 50 54 50 94 50 Y Y Y P P P sus er 00000020 01 00 01 00 01 00 DO 72 52 79 Be D9 79 EEY CEY 00000050 D9 72 52 79 Ad OO 00 00 OO 00000060 on nn nn 33 33 33 a i eR uu 000000 0 76 F4 65 51 84 9B 80 3B 09 09 93 JE v 0 7 N 00000100 93 62 F4 50 DE 30 30 33 47 39 30 36 30 31 0 ECU Simos 1 Security Access Code Required license 7 This function displays the security access code contained into the engine control unit from Siemens ECUs PPD1x generation for diesel engines Dump Tool _ X ECU Simos PPO1s Security Access Code
49. currently used 10427 and 9600 Using the 10472 9600 and 9600 10247 radio buttons within the options dialog one can set the order in which these two baud rate values will be used If 10472 9600 is selected then first the commander will try to connect to the device over K Line using baud rate 10472 and if it doesn t succeed it will switch to 9600 and try again with it If 9600 10472 is selected then first the commander will try to connect to the device using baud rate 9600 and if it doesn t succeed it will switch to 10472 and try again with it ATTENTION Some device working on baud 9600 cannot be waked up if they are first tried on baud 10472 so if you cannot connect to device through the K Line try to change the options so first to try on 9600 2 1 4 Timing parameters The protocols running under K Line require very precise byte timing Since Windows is not a real time operating system these times are not always respected so it is possible that the communication with some devices is unstable or it is not possible to connect In such cases you can try to change some of the times timing parameters from the Advanced button The timing parameters have the following meaning Wakeup echo delay time after slow init between receiving 55 xx yy and sending the inverted value of yy according the K Line wakeup procedure Communication echo delay time between reception of a byte under KWP12
50. data displays the learned keys and allows several operations if a programmer has been recognized allows to read current transponder s data add it to the dump and if transponder s type is appropriate allows to program it as dealer key allows to change the immobilizer status on some models changing the immobilizer status is used to put the Comfort module e g into deliver condition Comfort module keys im Comfort module keys data Write keys to comfort module durnp can enter manually key in certain position With pressing keys data will be witten comfort module dump Forto delete key fram certain position write OOOU0000 in the key position field fou can press Program transponder ta read current transponder with programmer to certain position With pressing keys data will be written comfort module dump Change immobilizer status By pressing set you can set immobilizer status NOTE Normally immobilizer status should have the value 2 It is recommended ta change it if itis different j r Write keps to Comfort module dump Change immobilizer status Immo status 2 Ct OF CANCEL Keys with data 00000000 represent the empty positions in the dump file position at which no key is learned The rest are already occupied positions and represent the data of the learned at the respective positions keys With pressing a Program
51. is not present then the login is found somewhere in the region 0x0070 0x009F in the EEPROM Starting from 0x0070 in the EEPROM i e 0x3870 in the memory area there should be a long sequence of OxFF e g about 7 8 bytes of OxFF The first two bytes which are not OxFF should be the login 00003800 00003810 ugga sazu 0 003840 00003850 0 Ga E g on the picture above starting from address 0x0080 of the EEPROM there 17 bytes with OxFF then follows the login which is 0x047F in hexadecimal 1151 in decimal The mileage consists of two blocks usually 0x90 bytes with the inverted mileage followed by 0x90 bytes with the real mileage but this may vary e g blocks with 0x98 bytes instead 0x90 first is the real value and then the inverted 4 1 2 Instrument cluster from Audi TT K First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 3 TT and read EEPROM Currently for the software versions we know the login can be located as described above and the mileage starts from address OxAA to address 0x1C8 marked in the picture below 00000000100 10 OO 17 00 00 OO OB OO UB OO OC OO OD VOCE PP DD BP B
52. key for the immobilizer Kessy after finishing with the reading the Kessy will no more recognize the key start to recognize it again you should put the 7 byte and press Change 2 5 7 3 Adapting comfort module on Passat B6 CC This special function is dedicated to adapt second hand immobilizers from one vehicle to another To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car where you take the replacement Second hand module Starting this special function the following dialog is displayed Exchange ECU OBDII Load comfort dump Specify manually the existing PIN of the engine control unit Mew immobilizer data Immo number VIN Power class CS So you need to load the Comfort module EEPROM dump or to enter manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function Normally the power class of the comfort module is displayed automatically if you load comfort module dump and the customer is able to change it if the ECU has different power class If you enter wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the corr
53. key transponder No ECU responding N A Key transponder locked No Engine start permited N A Key transponder learned No Login acknowledge N A Transponder timeout timeout Press Next to start key learning procedure Press Next to start key learning procedure ABRITES Commander for VAG nl x Immobilizer Keys Key 1 puc re LL ME Key 2 ba37c062 T fh Key 3 mer ics L ME Key 4 ems Kon LL ME Key count Add Key Back gt E xit add a key put any Megamos 48 Crypto transponder into the programmer and press key this will program the transponder modify the immobilizer data so that the new transponder 10 is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required 2 5 14 Special function Dump Tool Using this application you can calculate security access codes calculate mileage and so on This application needs the EEPROM dump from the corresponding unit After the dump is loaded some modification will be made and you need to store the dump as a new file which you can program into the device For more details about the concrete functions please refer to the appendix 2 5 15 Special function Service Interval Using this application you can perform reset of the service reminder reset of the s
54. most cases this chip doesn t require an external power supply but is supplied from the magnetic field which induces electric current The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder With the evolution of the VAG cars the transponder type and the records inside it have changed In general there are five different types of immobilizers transponders used They are called Immo Immo II Immo III Immo IV and Immo V Systems from Immol till Immo III require simply that a transponder from the proper type is found inside the key and they are able to learn these transponders Starting from Immod4 it is required that the transponder is from the proper type but also has some specific records inside it Only transponders with such correct records can be learned According to the data inside there are the following types of transponders Tp22 dedicated for use inside Seat vehicles Tp23 dedicated for use inside Volkswagen vehicles Tp24 dedicated for use inside Skoda vehicles Tp25 dedicated for use inside Audi vehicles especially and A4 ouch transponders can be used in all cars of the specific producer e g Tp24 can be used for all Skoda models The last immobilizer system used in VAG is the Immo V It requires that the transponder is programmed with a specific code and this code depends on the VIN number and is unique for each car Normally only the car producer can de
55. need to program write security access and push Learn button Key Learning Wizard mode ABRITES Commander for VAG mi x Select vehicle immobilizer type Select function vehicle VDO NEC 2009 vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 S3 2004 Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 Skoda Octavia 11 2007 Skoda Octavia 11 2007 CAN Seat Altea Toledo 2007 CAN Function Program dealer key Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options ABRITES Commander for VAG _ 1 x Select an option Component Security Bytes From Kessy ECU Dump e Load Manual Input of the Component Security Bytes Autodetect Component Security Bytes gt Find the 7th Byte of the Component Security Bytes Automatic Trying T Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 s e If you have all 7 bytes of CS available select Manual Input of the Component Security Bytes put down the CS bytes and press Next The key will be programmed If you don t have the CS bytes available select Autodete
56. possible units you can choose a configuration of devices corresponding to specific car model chassis type This is done by selecting the type e g 1T VW Touran from the Chassis type combo box Then pressing the Display button will show all devices which can be installed into this car type Pressing the Scan all button will attempt to connect to each device currently displayed in the list Depending on the configuration options only the selected protocols will be used when scanning for the devices For all devices which the ABRITES Commander for VAG finds a detailed information is displayed in the main screen For each device the following information is shown VAS Number Unit name VAG Number returned by device in the device identification Description returned by device in the device identification Coding returned by device in the device identification Part Imp Supp N Part number Importer number Supplier number information is shown separated with spaces also returned from the device in the device identification DTC number of DTCs stored in the unit Instead of scanning all units which can take a while the user retrieves the list of the installed devices from the gateway by pressing the Gateway config list button Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing DTCs are not accepted from
57. security This special function allows managing of brand new units and immobilizer units where is allowed programming of PIN SKC BGW MAC Functions are under CAN TP2 0 2 4 17 Active diagnostic session Default diagnostic session established after connection to the unit is 89 User can request entering in a different diagnostic session where is allowed performing of diagnostic activities unavailable in standard session 89 Take into account that in most cases different diagnostic sessions require security authorization Diagnostic session 2 5 Special Functions Special functions are some specific for electronic control units application which will allow you reading security access codes read program EEPROM flash content and so on Special functions are available from the main dialog of the application Special functions Vehicle Selection D Broadcast Options a 7 mw i ub 54 p K Line sf Fs Instrument Ez5 Kessy Instrument Engine Control Component EDCTB MEDS Steerng lock ARAB K Line Unit protection adaptation Kessy ada adaptation am D E La TN 66012 QU 0m Open TV activation learning Dump Airbag WAM Crafter DSG Mileage Custom Converter Remote 4 ED1 ED2 Ready rite control a tana Wann ar The appropriate special f
58. some other keys which you don t learn here they will stop working 2 Preparing a dealer key If you have a Key programmer you can prepare a dealer key from a Megamos 48 transponder Put how many dealer keys you want to program and press the Program dealer key It is not required to enter anything the VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can proceed like in the case Learning dealer key purchased by VIN number NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due to flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change the immobilizer status to 6 Key Learning Wizard mode ABRITES Commander for VAG Bl x Select vehicle immobilizer type Select function seat Altea Toledo 2007 CAN Seat Leon 2007 CAN Skoda Scout 2007 CAN Porsche Cayenne CAN Learn Keys Program Key New Beetle KW2000 Lamborghini Gallardo 2005 KW2000 Audi A4 2004 RB8 dashboard KW2000 Lamborghini Gallardo 2005 KW2000 VW Touareg K Line KW2000 VW Phaeton Bentley Cayenne K Line 2000 Audi A2 1997 k line diag 1281 Audi A3 1997 k line diag 1281 Function Learn keys Authomatic read of Login co
59. the Hitag2 key tool 2 2 Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU using the Load component protection from Kessy ECU dump radio button After pressing the Load dump button you ve to select the respective dump file after that the Program button will be active NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer 2 3 Making the key in the case when the Autodetect button is not functioning is possible that by some reason the Autodetect button is not functioning e g missing license you don t make the short with the fuses properly ECU 15 missing or is broken and so If you ve already read the component security bytes previously e g by dissoldering the ECU EEPROM and decoding it by dump tool then you can put the component security bytes manually and proceed as described in step 2 1 3 After the key is programmed like a dealer key write how many keys you
60. the ME7x unit Fortunately the most of the interesting data are found in this section Dump Tool Tupe ECU ME Security Code 7 Checksum calculator T Swap butes LAH 00000010 5 34 45 38 33 30 30 37 35 39 35 41 zdES83N007535A 000000 0 5 34 45 538 30 30 37 35 39 35 41 EC z4dESG3NUD7595A 55 56 33 54 43 31 33 31 30 34 34 33 E4 Ux3Z Lls3104d43 00000100 55 56 33 30 43 31 53 31 30 34 34 33 E4 Ux3Z Ll3104d43 F Checksume in the file updated Press the Save button to save the changes ECU EDC15 Immo bypass 24C04 Required license None This function is used to make the so called Immobilizer bypass Bypassing the immobilizer means that the ECU start the engine even if the immobilizer is not allowing the engine start e g due to a wrong key or wrong synchronization between the immobilizer and the ECU Type ECU EDC15 Imma bypass 24004 Swap bytes LAH 3 Toggle Immo On The Toggle Immo On Off button allows to switch on off alternatively the bypass function Steering lock VW Passat 6 Security code 68HC908 Required license to view security access code and 009 to view component protection data This function displays the security access code contained into the steering column locks of Passat B6 which are with Motorola m
61. the commander will read and write several times the EERPOM memory to the dashboard It is normal if on dashboards display appears string Error during the procedure is In progress Repair RB8 DEF After the fixed EEPROM is written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait for some time The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 and then will allow you to choose whether you like the commander to recover the old learned keys or you will learn all keys again by yourself using the Key learning special function Depending from your choice it will recover the old keys or not and finish the procedure If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards secur
62. the visualized security access code to some detail e g ECU or immobilizer Dump Tool l X ECU MEO Security Code Checksum calculator 35160 ren Pe ore eo 00000010 FF FF 30 35 20 30 37 20 32 39 18 49 05 47 05 07 29 00000020 OF 05 37 46 31 30 33 37 33 37 37 34 33 39 1 03 5377439 00000050 31 30 33 37 33 37 34 39 36 FO 103737z4965 00000040 01 05 5 5 69 96 OO 00 00 61 IB D4 05 21 gt 00000050 357 357 15 00 01 00 00 00 F7 3 7 7 lt ae Load dump Save dump Swap bytes LAH gt Login 20835 00000090 30 30 30 30 30 30 56 57 45 54 30 30 30 30 30 30 30 30 57 56 57 5 52 43 56 45 30 0000 3 00000 0 00 57 56 57 33 36 45 00000010 30 30 30 30 30 30 30 57 5 45 30 30 30 30 30 0000000 2 200000 000000 0 30 30 30 50 57 56 57 53 45 5 56 45 30 0000 3 Checksums claculated up to address 052801 Press the Save button ot save the changes ECU MED 9 x Reset component protection data 95080 Required license 009 This function allows to view and or change the component protection data found into the MED9x with ST95080 serial
63. transponder button and if a programmer is recognized the current transponder is read and it s data is written at the corresponding to the pressed button position position in the dump file for example pressing Program transponder button next to Key 4 data will write transponder s data at position 4 in the dump After current transponder is read if it 5 type is appropriate it is also allowed to program transponder as dealer key You will be asked whether you like to do it In short if you put a TA3 transponder and program it to a specified position the car should start without making any key learning procedure By pressing OK all changes in dump s data will be saved By pressing CANCEL the loaded dump will remain unchanged ECU EDC16 Set component protection data 95320 Required license 09 This function allows viewing and or changing the component protection data found into the EDC16 Into the EDC16 there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero ECU Set component protection data 95320 00000010 FF FF 31 37 zD 31 20 30 34 10 69 OO 39 17 12 04 g nannnnza 17 12 04 00 43 54 31 30 33 37 37 34 31 30 36 CTl0373741 086 00000050 42 03 31 30 33 37 33 37 356 36 37 FO B l03737zb567 00000040 00 06 OO 04
64. with available component protection are displayed ABRITES Commander for VAG This functinality allows the customer to adapt used parts on other cars In general this requires following steps 1 Reset the module to virgin state 2 Adapt the module to the vehicle you want Bevise Checking modules for component protection EZ5 Kessy Entry And St Adapted to ci Connecting ta EZS Kessy Entry Start Autorization OF Airbag Adapted to ci Connecting to Airbag OF Instrunert Ister Adapted to Connecting to Instrument Cluster Central Flectic Com Brat Connecting to Central Electic bi SD 3 Connecting to Comfort module vehicle el System SG Comfort module vehicl Adapted to Connecting ta Memory module driver s seet Failed Climatronic Auto HVAC Adapted to ci Connecting to ClimatrenicZAuta HVAC Connecting to Heater Failed Connecting to Seat memory passenger Failed Connecting ta DSP Failed Scan finished From the displayed list of available modules the customer has to select the module which he want to adapt Then the procedure of adapting the component protection is performed in two steps reset to virgin state learn module to the vehicle 2 5 5 3 to virgin state Reset to virgin state is possible to be made in three ways by reading the module by OBDII available for instrument cluster airbag comfort module and EZS Kessy
65. x Security Code Checksum calculator 95080 Required license 003 This function displays the security access code which is contained into the MED9x unit with 5195080 serial EEPROM It also calculates and fixes if some of them are incorrect the checksums of the EEPROM Please pay attention that the checksums are calculated for the area till address 0x280 because after that area the EEPROM sections are different for each different software version of the MED9 unit Fortunately the most of the interesting data are found in this section Please pay attention that for some MED9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer XJ ECU MEO Security Code 7 Checksum calculator 35080 hl 8 5 7 20 Load dump 205 07 29 L G 7H1037377439 1037372 ROS BITE J 00000090 30 30 30 30 30 30 56 57 43 30 30 30 30 30 0000002 00000 30 30 30 30 57 56 57 33 43 26 45 30 00000080 30 30 30 30 30 11 OO 00 OO 00 00 00 00 Fe 5 n000 000000 0 02 04 57 56 57 33 43 35 45 0000000 30 30 30 30 30 30 56 57 5 43 54 30
66. 000 VW Touareg K Line KW2000 VW Phaeton Bentley Cayenne K Line KVW2000 Audi A2 1997 k line diag KW1281 Audi A3 1997 k line diag KW1281 Audi A6 Allroad 1997 k line diag KW1281 Audi TT 1997 k line diag KW1281 Audi 4 1997 ext immobox KW1281 Audi 4 1997 2002 k line diag KW1281 Audi A6 1997 ext immobox KW1281 Audi A8 1999 ext immobox KW1281 Audi A8 1999 2002 k line diag KW1281 Seat Cordoba k line diaa KW1281 Function Learn keys Learn keys 1 Turn ignition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next then follow strictly the recommendations Program Key 1 Select Program Key 2 Press Next 3 The following window will appear giving you to select from few options ABRITES Commander for VAG E ioj x Select an option Component Security Bytes From Kessy ECU Dump Manual Input of the Component Security Bytes Autodetect Component Security Bytes gt Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 e 4 Press Next then follow strictly the recommendations 2 5 13 10 Procedure 8 for vehicles with a Hitag2 Key transponder 2007 or Audi A8 CAN produced after year 2002 For vehicles aft
67. 000 0 05 00 03 OF 01 01 64 01 05 00 05 OO 00000100 7C 7C 01 64 B7 3b 5 30 33 47 39 30 36 30 31 03690601 ECU Simos 7 CAN Reset component protection data 93C76 93C86 Required license 009 This function allows viewing and or changing the component protection data found into the Siemens ECUs Simos 7x generation which are accessed through K Line or CAN for benzine engines Into the Simos 7x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there are 6 bytes contained then the 7 byte is zero Mme de AC 54 54 54 00 01 00 01 00 Dia eats Load dump 00000010 01 00 OO OO OO OO 00 00 00 00 00000020 7 OF OF 00 00 08 38 00 1 00 00 00 04 00 DD 00000030 OO OO OO zb zb 2E zb zb ZE zb zb 00 OO Ein Component security data mI 00000050 _ OOOO00CO 70 7F EB 02 80 90 80 00 90 80 TF 80 00000000 80 60 80 60 80 80 80 60 90 80 80 80 80 000000 0 80 80 80 a0 90 60 90 90 00 00 90 S0 90 80 80 000000 0 80 80 80 80 80 80 60 90 80 80 00000100 80 80 80 50 90 60 80 90 90 7E 80 00 80 80 k ECU Simos 1 Reset
68. 00030 34 0000000 00000050 00000060 5 00000070 00 00000080 43 00000090 FF 5 0000000 000000 0 FF 00000000 FF 57 000 30 00000100 00000110 00000120 FF 33 33 5 03 oe 34 50 EN 33 FF FF 57 30 FF FF FF 2 48 48 B5 43 69 FF FF FF FF 31 a0 FF FF FF a 47 03 a3 33 FF FF dg DER F 29 C VS 33 43 30 39 35 38 b 3C023529 30 34 35 33 33 43 30 39 35 39 4 3 04533C0959 20 20 FF FF FF FF 3 60 FF FF FF 333H ER lanceam RR FF 7F FF F8 FF FF FF FD FF l FE 03 63 00 03 64 00 03 56 zZ Z D C d WV 5 FF B3 56 FF 43 66 00 W bz V C Save dump 45 43 85 SA FE 79 62 44 C C C C Z yb 2 amp 5 m mr AA 1 moh H component security Load dump Component security bytes are 7252 79 Be E4 4 VIN 223269000082 Set Component security 09 2 79 2 E4 A4 xil m Pressing the other
69. 00130 00000140 00000150 00000160 000001701 00000180 00000130 000001 0 000001 0 4 00 00 00 00 00 00 00 00 0l Instrument Cluster Laborghini Gallardo 2005 Instrument Cluster VDOBb5 VDOSB Motometer m instrument Cluster DO66 D066 Motometer oq VW LT Immobilizer ot immobilizer box Vv GOL White immobilizer box Audi Black immobilizer box Siemens 6 PIN HCO5 1 Black immobilizer box Siemens b PIN 5 2400 1 oj Black immobilizer box Siemens b PIN TMHS Immol 0l Instrument Cluster Audi A4 B5 with Board Computer 199 Ol Instrument Cluster Audi A4 B5 without Board Computer 1997 Instrument Cluster Audi 10 1996 oq Instrument Cluster Audi 8 11 1996 odInstrument Cluster Audi B45 1997 0 Instrument Cluster Mareli Shadow 1 Instrument Cluster Magneti Mareli Shadow 2 Passat sj Instrument Cluster Magneti Shadow 3 TT oq Instrument Cluster Mangeti Mareli Direct 1996 2000 oj Instrument Cluster Mareli Direct 2000 04 Instrument Cluster Sharan Galaxy up to year 2000 9 Instrument Cluster Audi A4 BOSCH RBA CRYPTO 2001 Instrument Cluster VV Golf4 BOSCH REx oq Instrument Cluster Audi 44 BOSCH REx o1 VV Phaeton Touareg Bentley Continental Porsche Cayenne 91 Instrument Cluster Audi 44 BOSCH RBS CRYPTO 2004 r3 Load from file Head Save bo Head RIOIM F
70. 06 OBDCAN 2 tse _ VW Jetta 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 Procedure 11 OBD CAN Megamos 48 or VW Jetta 2009 rw ea programmer ru ke D 13 aU K not 2 1 Megamos 48 VW Bora 2009 UDS Key programmer ade 11 VW EOS 8 2006 OBD CAN 00 5 48 VW EOS 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 VW EOS 2009 UDS Key programmer MN ke Procedure 11 VW CaddyVDO 2004 09 2006 OBD CAN VW 2008 Key programmer VW 2007 Procedure 2 VW 4 1998 Procedure 1 ee VW T5 2009 UDS Key programmer dealer ke Procedure 11 VW Sharan 1997 2009 OBD K not needed TN Procedure 1 wee me _ VW Sharan 20094 UDS programmer dealer ke Procedure 11 usas mam goce VW Scirocco 2008 2009 OBD CAN programmer dealer ke Procedure 3 UE seen VW Scirocco 2009 UDS Key programmer dealer ke Procedure 11 VW Touran 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 cnet VW Touran 2009 UDS Key programmer dealer ke Procedure 11 woman
71. 1 4E 20 00 00 E4 BO 07 DO 00 00 FA 82 21AN 00000060 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 03G906021K Save ta file 00000070 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 H R4 1 9L EDC 00000080 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 9245 H 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 11 F8 A9 000000A0 00 00 00 00 00 01 30 33 47 39 30 36 30 32 31 4B 0369060216 00000080 48 20 52 34 20 31 2C 39 4C 20 45 44 43 20 20 20 1 91 EDC 000000 0 20 20 20 20 20 20 39 32 34 35 03 00 00 48 00 00 S385 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 11 9 00000080 99 17 ED 3D C5 28 DS 1 AD 00 00 00 56 57 5A 37 VWZ7 000000 0 SA 30 47 37 30 30 30 30 30 30 00 E5 70 OF F BE Z0G7000000 p 00000100 99 17 ED 3D C5 28 DS 1 AD 00 00 00 56 57 5A 37 VWZ7 Imm 00000110 5A 30 47 37 30 30 30 30 30 30 00 E5 70 OF F BE Z0G7000000 p 00000120 99 17 ED 3D C5 28 DS 1 AD 00 00 00 56 57 5A 37 VWZ7 00000130 5 30 47 37 30 30 30 30 30 30 00 ES 70 OE BE Z0G7000000 p 00000140 01 BY EB 34 45 57 56 57 SA 31 SA 37 50 4EWVWZZZIlKZ7P 00000150 34 34 34 34 34 34 73 00 00 00 BY 00 00 SC F7 83 44444 00000160 01 B7 EB 34 45 57 56 57 SA 31 4B SA 37 50 4EWVWZZZIKZT7P 00000170 34 34 34 34 34 34 73 00 00 00 B7 00 00 83 4444448 00000180 00 02 00 F4 4
72. 12 Reset of unit Reset will request from the unit a SW reset Not all electronic control units support this service Please note that it is not available in all diagnostic sessions 2 4 13 Custom requests Using this function the user can send manually diagnostic requests to the corresponding unit The example below shows a request for identification of an Instrument Cluster ECU Custom requests Request Trace list Tx OO 02 1 SB Ex OOF 30 SB 34 46 30 39 31 30 39 33 30 41 20 20 30 36 33 30 03 20 12 01 BB 38 DE 2B 7 4B 4D 42 49 49 4E 53 54 52 2E 20 4D 37 33 20 45 31 36 2 4 14 Program VIN Program VIN requests the stored in the device VIN and tries to change it Not all electronic control units support this service Please note that it is not available in all diagnostic sessions Urgent point for this diagnostic service is that most of electronic control units updating its internal memory when ignition is turned off and current diagnostic session is closed Example are engine control units BOSCH EDC16 2 4 15 Custom download upload Custom download upload allows direct reading from the address map of the device This option will be available only if you have some updates in your configuration like e g Reading writing the flash counters Take into account that in most cases a security authorization is required before you try to read write into the address map 2 4 16 Component
73. 17241 Electrical Malfunction Status Permanent error lower limit exceeded 2 4 5 Clear Diagnostic Trouble Codes Clear DTCs will clear all stored DTCs inside of the unit M 2 4 6 values Non UDS modules Measured values provide you a possibility to check measured values in different groups You can enter manual number of the group or use to increment or decrement the group number Measured Values Power Supply Scan all Voltage Terminal 20 Voltage status Terminal 15 Status Pras J5 ON S Contact Status activate d The button Scan all will generate a file with all measurement values from all groups Measured values Immobilizer Code authorized YES key Status Transponder Lock Fixed Code authorized yes Immobilizer Status 6 0 Some important measured values The most used measured value is the key recognition in the immobilizer The key recognition 15 made on channel 2 if the Immobilizer is by CAN or on channel 23 if the immobilizer is by K Line The only exception is the Q7 A6 Allroad where the recognition is made also on channel 23 UDS modules Measured values provide you a possibility to check measured values by selection from a list Measurement Values E _ x Security Access number of invalid keys
74. 30 30 30 30 0000002 200000 30 30 30 30 57 56 57 33 43 36 45 30 nn nglmWzzz3aczeku 000000 0 30 30 30 30 30 1M 00 00 00 00 00 00 00 Fe 00000100 05 SB Al 7B OO 00 OO 00 00 OO 00 00 OO Ie rs Lhecksums claculated up ta address 052901 Press the Save button ot save the changes ECU MED 9 x Reset CRYPTED Login Component protection Required license 009 The function allows changing the security access code and the component protection data into 9 1 ECUS for which the EEPROM is encrypted As mentioned previously for some MEDO 1 ECUS the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer Changing the security access code and the component protection data into the ECU requires that the original uncrypted data are entered These data can be read e g from the Immobilizer Instrument if possible and are entered into the Old fields E g for Audi RS4 the 9 1 ECUs are with encrypted EEPROM but the login and component protection data can be taken from the RB8 instrument cluster ECU MED 4 4 Reset Loain Component protection Login Old login 153234 Cancel
75. 4 20 83 01 03 50 00 00 FF 00 00 o D P PERRIS 01 EF EF EF 0000018 FF 00 00 00 00 00 A7 OD 00000180 DD FF 01 36 Fa 44 6 D 4 Flash counter NN Flash tool ID Head Flash Write Flash Component security 33 17 ed 3d 28 45 FOES BD F HINTS when reading writing EEPROM memory of ECUs 1 The whole EEPROM is possible to be read for EDC15 ME7 EDC16 For 9 EDC17 and oimos engine control units only the PIN CS MAC is displayed 2 To read the EDC17 MED17 PIN CS MAC is required online connection 3 If you experience problems with reading ME7 x EEPROM better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again HINTS when reading writing flash memories of ECUs or changing flash counters 1 In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster At a certain point during reading writing flash memory of the EDC15 ECU you will see Trying gateway options written on the status line at the bottom of the Engine Control Unit window Make a quick Ignition OFF ON at this point 2 In case of ME7 x or ECUs from Porsche you can r
76. 7 Skoda Octavia 1 2005 VW Caddy 2004 VW Eos 2006 VW Jetta 1998 VW Golf Bora IV 1998 VW Golf Golf Plus Bora V 2004 VW Golf Golf Plus Golf Variant 2009 VW Touran 2003 Skoda Fabia 2007 VW New Beetle Cabriolet 1998 2010 VW Fox Spacefox Sportvan Suran 2005 VW Passat 1997 2011 VW Transporter 1997 2009 VW Tiguan 2007 For Audi VW Touareg VW Phaeton Bentley remote controls are learned with the key learning special function 2 5 17 Special function Navigation Using this application you can enable disable the Eject button of the Navigation system eject the navigation CD DVD holder and set tire circumference value applicable for the navigation controller function 2 5 18 Special function Cruise control system Using this application you can activate deactivate a cruise control system and change the related steering wheel electronics SWE configuration if SWE unit is available With the opening of the special function window if SWE unit is available the commander will read and display it s current configuration After Activate Cruise Control or Deactivate Cruise Control button is pressed this will activate deactivate cruise control system function and apply any changes of the SWE configuration to the SWE unit 2 5 19 Special function Brake pads change Using this application you can Open rear parking brake for pad change Close rear parking brake perfor
77. 7 CAN Mew key count Program dealer ALL KEYS Login Securit Login Security code 0 key LOST l Lock timers Engine start permitted Dealer kev transponder Login acknowledge ECU Responding eu transponder locked 000 Transponder type Key transponder leamed Transponder acknowledge count rin rau can reach login code fram the ECU of the vehicle special Functions Engine Control Unit read eeprom Procedure 10 For the moment iz not possible to read the Component security bytes from all EDCT7 MEDT Far Passat with such engine control unit tis possible to decrypt the comfort module using the of the you ve to read the PIN code fram the ECL and to read the Comfort module EEPROM with programmer Pressing the Program dealer key button will bring you wizard with will help vau to prepare the dealer After obtaining the dealer key you learn it normally as on normal Passat BE The customer has to choice the vehicle model for which it wants to learn a key In the background the system tries to determine automatically what vehicle model is If succeeded the recognized model will be selected automatically If the system cannot recognize the model the user has to choice the model manually NOTE It is possible that the system doesn t recognize correctly the model In this case you ve to select the model manually For example it is not poss
78. 8 UDS Key programmer dealer ke Procedure 11 eosam Ey _ Skoda Octavia RS 2009 UDS Key programmer dealer ke Procedure 11 emos am Ps _ Skoda Octavia Scout 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 ae Octavia Scout 2009 UDS Key programmer 5 11 ieee scout 08 2006 OBD CAN 2 Skoda Scout 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 menses Skoda Scout 2009 UDS Key programmer dealer ke Procedure 11 Skoda Fabia II RS 2011 UDS Key programmer dealer ke Procedure 11 Skoda Fabia Scout 5 UDS Key programmer a ke Procedure 11 Skoda Superb 2008 __ rps Procedure lt Skoda Superb 2008 UDS Key programmer dealer ke Procedure 11 OBD CAN Megamos 48 Skoda Yeti 2009 UDS Key programmer dealer ke Procedure 11 Seat Atea 1062006 OBD CAN Seat Altea 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 OBD CAN Megamos 48 Seat Altea 2009 UDS Key programmer NE ke Procedure 11 Seat Cordoba 1996 2004 Seat Ibiza 2008 OBD K not needed 08 Procedure 1 Megamos 48 Seat Ibiza mum UDS Kev programmer mun ke Procedure 11 Seat Leon Procedure 1 Seat Leon 08 2006 OBD CAN not needed TP22 Procedure 2 Seat Leon 08 2006 2008 OBD CAN Key programmer dealer ke Pr
79. 81 and sending it inverted back to the device Inter byte time time between sending two bytes under KWP2000 Time between messages time delay between reception of response from device and sending new request to it 2 1 5 K Line PINs Normally the K Line is output on of the OBDII connector But some models e g Porsche Cayenne 2004 the K Line with some units might be on PIN3 or PIN15 For that reason there is option on which PINs to try to connect to the units ATTENTION If you check all PINs to be examined l e PINS PIN7 PIN15 then when scanning for units the time will will be significantly increased For that reason by default only 7 is selected 2 1 6 CAN resistance According the CAN specification there should be a resistance between CAN Low and CAN High Normally the gateway has this resistance but if you want to connect on some device on the table then you should use that resistance For that reason there is a option what resistance to use None 75 Ohme 100 Ohm 120 Ohm or 10 Kiloohme By default 120 Ohm is used Normally you should don t have any problems but if some problem appear you can try to change the CAN resistance 2 2 Scanning units After startup on the main screen of the ABRITES Commander for VAG a list of all possible units with their VAS Number is displayed The customer is able to connect to the listed devices by double clicking on the desired device Instead of displaying all
80. ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 000 ABRITES Commander for VAG User Manual Version 2 31 issued by Abritus 72 Ltd Version 2 31 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 List of Revisions Date Chapter 27 11 2007 __ Releaseversionofthedocument sid 10 12 02 2008 7 Adaptationregardng SWversion4 1 O Changes regarding setting of the working folder for the shortcuts Update to V6 5 of the ABRITES Commander for VAG Procedures for Q7 A6 Allroad described 19 05 2009 2 3 7 Update to V6 6 of the ABRITES Commander for VAG 2 10 Update to V8 0 of the ABRITES Commander for VAG added section for the CDC32xx programmer for VW Crafter 9 09 2010 Update to V8 4 of the ABRITES Commander for VAG Update to V9 0 of the ABRITES Commander for VAG as Update to V12 0 of the ABRITES Commander for VAG Sen de Update to V13 0 of the ABRITES Commander for VAG Ss 16 01 2012 Component protection chapter added Chapter Remote control adaptation updated NO Chapter Special functions with updated Chapter Coding of the unit updated Chapter Repair RB8 DEF added 26 03 2012 8 05 2012 13 06 2012 Version 2 31 Added ECU adaptation by OBDII chapter No Added Key learning wizard mode Added BCM2 key learning proced
81. Audi 2003 2007 Key programmer dealer ke Procedure 3 Megamos 48 Audi A3 mum OBD CAN orogrammer Mum ke Procedure 3 Audi A4 2003 2008 OBD K BEEN orogrammer EUN 6 Audi A4 2008 Audi A5 S5 05 n auias 204 A6 RS6 m OBD CAN mm orogrammer uum EE 9 Allroad OBD K not wetness 1 Blank key for Audi Allroad 2004 OBD CAN Abrites programmer Q7 A6 Procedure 9 Audi 07 5 ae orogrammer Procedure 9 Audi wa not _ Procedure 1 adn OBDCAN gamme Key Procedure Audi A8 20024 OBD CAN grammer ke Procedure 7 luda 5 sz me Audi A8 20074 grammer ke Procedure 8 uum x dmi Audi S8 20074 grammer ke Procedure 8 se omo _ Audi R8 2006 OBD CAN programmer dealer ke Procedure 3 Audi TT 2005 OBD K NN Procedure 1 Megamos 48 Audi TT 20074 OBD CAN Kev programmer dealer ke Procedure 3 2 OBD CAN Megamos 48 Audi A1 2011 UDS Key programmer dealer ke Procedure 11 Skoda Octavia 1997 2003 Skoda Octavia 2003 08 2006 TM omoi Rope _ Skoda Octavia ll 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 memos SE _ Skoda Octavia ll 200
82. EEPROM Into the MED9x there are at least 6 bytes of the component protection found or sometimes there are 7 bytes If there 6 bytes contained then the 7 byte is zero Please pay attention that for some 9 1 ECUs the data security access code and component protection data are encrypted and in that case they are incorrectly displayed You can recognize whether the EEPROM data are encrypted by trying to put the visualized security access code to some detail e g ECU or immobilizer ES FF FF 35 zb 37 zb 39 OO 8 05 07 29 Load dump 00000010 FF FF 30 35 30 37 20 32 39 18 49 05 47 05 07 238 I t6 ngn ngz 29 OF 05 37 46 31 30 33 37 33 37 37 33 38 7H1037377438 Save dump 00000050 02 02 30 33 37 33 37 32 34 36 1037372496 00000040 01 03 A5 54 69 96 00 00 6l IB D4 05 21 gt 2 00000050 37 A8 OB 37 13 00 01 00 00 00 BC F7 Be 7 7 00000 0 03 54 69 96 Cl OO 00 IB D4 05 41 gt 00000070 37 DB 37 13 00 01 00 F7 2 7 7 lt 10000090 0000 GHODPORT UE HE 5 37 B 00000080 00001020 A j CE6E oooooopo NeW 0 0 _ 0000 Swap bytes i 00000100 03 04 CS Al 7B OO OO OO 00 OO 00 OD OO k E xit ECU MED 9
83. First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 1 and read EEPROM The login is displayed The mileage is displayed as 4 2 Cayenne VW Touareg gasoline engines ECU wakeup fuses Porsche Cayenne fusebox 4 3 8 fusebox passenger side wakeup ECU 4 4 07 To get communication with the ECU you need to short the fuses as shown on the picture below 7 If not succeeded to communicate with the ECU then you should try picture below If you re still not able to get communication with the ECU it is possible to make short of the external fusebox it is found under the front cover where also the engine is You ve to short the first 5A fuse with the 12V connection as shown on the picture Please pay attention that you ve to use a bigger cable because if you use a small cable it can become hot 4 5 Audi A6 RS6 except 3 2L To get communication with the ECU you need to short the fuses as shown on the picture below 4 6 Audi A6 3 2L FSI To get communication with the ECU you need to short the fuses as shown on the picture below 4 7 VAG K CAN Commander key learning procedures Programmer Key Learnig procedure aaia _ OBD K Audi 208
84. IN CASE ALL KEYS ARE LOST After performing this procedure any existing keys will be no more possible to use Also keys purchased from the dealer will also not work The All keys lost button is available for most of the Immo III and all Immo IV systems This means that with this button you can learn keys also for the UDS immobilizers for the Audi Q7 till 2013 Passat B6 CC Passat 7 etc It is necessary first to give somehow ignition ON to be able to communicate with the engine control unit For vehicles with regular key you need simply to give ignition ON but for systems with electronic ignition e g Passat A6 Q7 you need to short PIN1 to PIN16 of the OBDII plug Then press the ALL KEYS LOST button and after 1 2 minutes you should be invited to put the new key transponder into the programmer After the key transponder is written there is a message to remove any shorts made in order to read the engine control unit After any shorts are removed the procedure continues and the keys are learned On the display you will see 0 1 and when you put key should change to 1 1 In that order you can make a key even if all keys are lost Starting from V18 0 is possible to re learn any dealer keys from this main dialog also for the Immo IV systems You should first autodetect PIN CS and then you put how many keys to learn In that way you can learn also keys for the UDS immobilizers but also for the A6 Allroad Q7 vehicles So if a
85. ING DEF Oaks 49 2 254 Special JUNCTIONS wuh ENGINE tta 52 2 9 3 Special functions Component Protectio ise 54 2 Component protecton S CNET ALO Me e 55 2 9 3 2 omporicnt PLOL CUOMO CMe AON 2er 58 2 50 95 JE6SeEb EO VIT OTI SEO Oe 58 2 3 3 4 Loaro mod le to he dp laude E 60 2 5 6 Special functions with 17 17 Engine Control Unit 63 2 5 7 Special functions Immo parts 65 2 92 51 Adapun ent Me CONTO UMTS senie ENEA RE OOE A 66 2 5 7 2 Adapting Audi A8 VW Touareg immobilizer 67 2 1 55 Adap ns comfort module on Passat BOCCO a r A ARERR 68 2 5 7 4 Adapting Transmission gearbox 6 69 2 9 0 opecial JUNCTION Steering lock adaptation 70 243 9 pectat MMI TV OCUVAN ON ATONE EA E 71 2 5 10 Special function Custom memory access Download Upload ReadMemory
86. KeyIDS 191379409 2 191379409 29873 03 453 0973 04 KeylD8 LN Serial number 5 dba6573433d6b1 3863626 0 Status 1400006 Configuration 210106660100 vw PIN 7752 O Write Imma data Add kep Service mode can be entered in two ways by OBDII if the car has working key and you give ignition with it EEPROM dump if the car is not having working key So if you ve working key from the car simply give ignition ON with it and press Enter Service Mode by OBDII If the procedure is completed successful a message Service mode OK will be displayed in the status bar If you don t have a working key from the car to enter service mode you need to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After the EEPROM is written back the service mode should be entered normally not needed to do nothing else Please not that if you press the Leave service mode by in this case if you want to enter the service mode again you will
87. Learn keys Learn Keys Program Key prepare dealer key 1 Select Program Key and press Next The following window will appear loj x Select an option Manual Input of the Component Security Bytes Autodetect Component Security Bytes gt Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 ow 2 Select the desired option and press Next If you have chosen Autodetect Component Security Bytes the commander will read the PIN and all 7 bytes of CS from the Visteon dashboard If by some reason the SW doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7n byte After all 7 bytes of CS are available the key will be programmed as dealer key To learn key 1 Select Learn Keys and press Next 2 Supply Login code and press Next 3 Follow the instructions 2 5 13 15
88. O Byte 05 Bit 4 Trailer installed 05 5 Cruise Control System CCS installed Byte Bit 0 Start Stop System installed Byte 07 Bit 3 Flexible Service Interval LongLife active 25 Byte 01 Bits 0 2 1 Transmission Type Manual Transmission I5 Transmission Type Direct Shift Gearbox Dual Clutch D S 25 Byte 01 Bits 3 7 10 Transmission Gear Ratio 5 5 18 Transmission Gear Ratio b Speed 2l Transmission Gear Ratio Speed 25 Byte 03 Bits 1 2 00 OR Manual Climate Control installed 14 5emi Automatic Climate Control Climatic installed b Automatic Climate Control Climatronic installed 25 Byte 04 Bits 1 2 00 Fan Control not installed 25 Byte 04 Bits 5 6 2 4 10 Basic settings Basic settings will expect from you to enter a number of the group and to press the button or OFF 2 4 11 Actuator test Available are two types of tests Selective and Sequential In the selective test you have the possibility to enter a test code manually or to select it from a list box When a test is selected you just need to press Start x Selective test mode Selective test Enter output code Test code Select output Sequential test END of selective output test Relay for Terminal 58 Bi xenon Shutter Solenoid Fae Bulb far Daytime Running Light Lett 2 4
89. O 05 16 OF 01 01 94 G 01 05 00 16 OF 01 01 84 01 00 03 OO 00000100 7C 01 84 BY 20 3b 30 33 47 39 30 36 30 31 05G90601 F ECU Simos 7 CAN Security Access Code 93C76 93C86 Required license 003 This function displays the security access code contained into the engine control unit from Siemens ECUs Simos 7x generation which are accessed through CAN for benzine engines Interesting for these ECUs 15 that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool M ECU Simos 7 Security Access Code 33C 75 33C85 Swap bytes Login 41138 00000070 56 57 43 30 30 30 33 33 33 33 30 30 56 57 vilzczanaa333 ovr 00000050 54 45 54 30 30 33 33 33 30 30 30 56 57 43 zCz ns33300 0VITZzL 00000090 4 30 30 30 30 33 33 30 30 57 56 57 zn 0003300NVITZzz 33 43 5 38 33 33 33 33 33 33 33 57 56 57 3LZ83333333WwVWzz 000000 0 5 33 38 50 31 33 33 33 33 33 57 56 57 zZ3CLzaPl33333WVWz 000000 0 5 54 33 45 38 33 33 33 33 33 33 33 00 00 zz3Cz83333333 00000000 7C 7C 30 39 30 37 30 33 47 39 30 36 30 31 38 46 110907035905018 000000 0 47 20 00 00 00 01 05 OO 03 07 01 01 64 G 000
90. ORTANT If the car doesn t have a working key communication with the EZS Kessy is possible only if you press the brake pedal So if don t have a working key before learning keys making dealer keys read write VIN read write EEPROM you ve to make Ignition OFF then Ignition ON and press and hold the brake After that you can continue with the function from learning a key making a dealer key reading writing EEPROM or reading writing VIN NOTE To make any activity with the EZS Kessy you need to put the login and the component security bytes or to load the EZS Kessy EEPROM dump or to get the component security and CS by OBDII from EZS Kessy If this information is not made any attempt to make any activity with the EZS Kessy will result an error 2 5 1 6 Learning key with EZS Kessy To learn a key for the EZS Kessy You need to put the login and component security bytes as described above and to specify the number of keys which should be learned Then pressing the Learn button will learn the key IMPORTANT For EZS Kessy modules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer 2 5 1 7 Heading changing VIN To read write the EZS Kessy VIN it is required to put the login and component security bytes as described above Then using the read write buttons you can change the VIN 2 5 1 8 Reading
91. P EP Be PP DD RP 00000020 FF FF FF FF FF FF FF EA 03 70 00 2B FF FF UNOS BD Se ro PP DP EP BP IE SP DD 00000040 1 FF 38 69 96 58 58 58 56 56 50 58 56 FF FF 00000050 06 Ob FF FF FF FF 10 00 58 58 56 58 58 56 50 UHBBHHHBHISE Sg PP PP PP BP PP OOUUOUO OOS Fe EE ED DP RP ED EF PE TE or PP PP PP OPE DT FF 1D EB 04 OF OO FF FF FF FF FF FF FF FF 0 Bn 0 0 nga 00000100 00000110 00000120 00000130 00000140 00000150 00000160 00000170 00000190 00000190 0 1 40 0 01 0 01 40 01 40 FF OD 05 VOODOO RE BP HWEBBEELEN LER KR DE EM BB p HE Ha HL a 4 1 3 VW Passat usually these Instruments are before year 1998 First try to access the instrument as one of the Magnet Marelli direct types especially for year 2000 and if succeeded proceed as described above If not succeeded select type Magneti Marelli Shadow 2 Passat and read EEPROM The login is displayed mileage is displayed as O 4 1 4 VW New Beetle
92. Replace align Steering column lock using PIN The complete system consist of the following Steering column lock control element EZS Kessy control module Engine management control module master slave Up to 8 vehicle keys Only with this the procedure Steering columng lock control element can be aligned Do you want to continue Press NEXT to continue or EXIT to exit to leave the operation 2 5 9 Special function MMI TV activation Using this special function you can change speed limit of MMI compatible vehicles to change speed where TV becomes OFF Covered vehicles are eAudi A3 S3 eAudi A6 S6 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A8 S8 MMI up to July 2006 eAudi Allroad MMI up to July 2006 eAudi A6 S6 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 eAudi A8 S8 MMI starting from August 2006 eAudi Allroad MMI starting from August 2006 Activation xj Speed Limit 0 km h i Edition 1 Edition 2 Use the following rule when enabling TV the car is before 2007 try with edition 1 In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2 If the car is after 2007 it is better to try at first with edition 2 2 5 10 Special function Custom memory access Download Upload ReadMemory The Custom memory access Download Upload ReadMemory functionality is available from
93. Return REY pm l aafeab 2 4 8 Adaptation Adaptation will open for you a separate window where you can check adaptation values Non UDS modules You need to enter the number of the channel where adaptation will be performed and then press the button Test If the specified value is accepted by the unit press the button Save Adaptation __ X Channel 50 Pel TS Adaptation CHANNEL stored value seus JE Testvalye Test New value 2336 The button Scan all will generate a file with all channels and adapted values Some important channels used for adaptation Channel 50 is used for adaptation of new parts Usually to get access to this channel you should make a security access with the Login of the device to which you re connected and which you will adapt to the car After you gain access to the channel 50 you should put the Login PIN of the car to which you adapt the new part Channel 21 If the Immobilizer is by K Line then on channel 21 the adaptation of the keys is made To gain access to it it is necessary that security access with the immobilizer is made Channel 1 If the Immobilizer is by CAN then on channel 1 the adaptation of the keys 15 made To gain access to it it is necessary that security access with the immobilizer is made UDS modules xi Manual Data Identifier Select Language version in inst
94. S 00000070 00 FF 05 02 00 02 FF 01 FF FF FF FF Ol FF FF agin ORCC IE CR Irma number Swap bytes LAH zl Pressing the other data displays the learned keys and also allows changing the immobilizer status some models changing the immobilizer status is used to put the Kessy e g into deliver condition kessy keys Kep 1 DCDDA4426 FFFFFFFF Key 2 344320 Key FFFFFFFF Key 3 FFFFFFFF Key 7 FFFFFFFF 4 FFFFFFFF Key FFFFFFFF Imma status Set EZS Kessy Security access code 9512 Required license 003 This function is used to extract the security access code from the EZS Kessy The EEPROM of the EZS Kessy is found inside the microcontroller Motorola 9512 family and is typically read with a programmer for some older version of the EZS Kessy till V2 0 2 of the EZS Kessy is also possible to be read by OBDII Type E S Kessy Security access code 3512 Load dump 00000010 37 33 30 30 32 36 30 30 31 31 FF FF 30 35 37 37 7300260011 0577 00000020 36 33 30 30 30 34 30 36 30 31 FF FF 35 39 32 35 6300040601 5925 00000030 31 30 30 31 32 30 36 30 30 33 39 30 33 31 30 34 1001206003903104 00000040 34 32 34 37 35 FF FF FF 36 30 2E 32 30 2E 30 32 42475 60 20 02 00000050 36 36 33 30 57 41 55 SA SA 34 30 37 44 30 BB530WAUZZZALO7DO 00000060 30 30 30 30 30 FF FF FF 02 20 66 03 34 46 30 39 00000 f 4F 9 EE EN 00000070 31 30 38
95. Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key Vehicles before 2007 1 Press Next 2 Follow the instructions Vehicles after 2007 1 Press Next 2 The following window will appear giving you to select from few options ABRITES Commander for VAG loj x Select an option Manual Input of the Component Security Bytes Autodetect Component Security Bytes Find the 7th Byte of the Component Security Bytes Automatic Trying the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 ow Select an option and press Next 3 Follow the instructions 2 5 13 4 Procedure 2 for CAN vehicles after 09 2006 year VW SEAT SKODA For this type you will need a virgin key or transponder TP22 TP23 TP24 depending on the type of the car as follows For SEAT you must use Virgin key Transponder TP22 For VW you must use Virgin key or Transponder TP23
96. U uad ee wa POR Flash Reset ECU 32 2 22 222222 Reset Comp Repair RBS Security DEF 00000100 5C 78 1C 2B 02 CF 01 E4 BO 64 01 44 60 46 u gt d DmF Login 00000110 54 9D 43 72 ED 60 FO AB 97 A9 56 28 AG 79 9A T Cr V y 2199 00000120 00 01 B9 82 FC 01 2B 2D 43 68 53 5B DO 61 2 5 ieee 00000130 FB 1C 78 9C 3C 03 A4 36 4E 01 AD 08 70 00 x 6 amp N p 00000140 FD 17 00 00 00 00 00 00 00 00 00 00 00 00 00 OO 5920 00000150 57 41 55 38 45 35 35 41 34 35 37 33 39 WAUZZZBE55555739 00000160 39 00 01 00 00 96 00 74 00 SD 00 DA 02 6D 01 9 t m Imma Status DDODOl7U 01 DD 00 DO 00 DD 00 00 DO BO DD DO Of Dl Change 00000180 00 4 FF FF 14 3B 00 00 00 32 46 50 73 7B 82 J 7 2FPs 00000190 00 16 2D 2D 46 54 00 00 00 00 00 38 FF 00 00 DO EZ 8 000001 0 00 00 00 93 63 OF 1E 00 00 00 00 00 00 9B FF 00000180 45 04 80 9 OF FF 06 FF 04 OF FF 1F FF 30 30 87 E 00 Fiead keys White keys Crypto data read xi In order to transfer the keys you have first to read the EEPROM of the source instrument and when pressing Read keys they are saved into file Then you have to go on the destination instrument read its EEPROM and pressing the Write keys button then you will prompted for the file where the s
97. ains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC Press Next to start the key learning procedure 2 5 13 3 Procedure 1 Normal key learning procedure for vehicles from 1996 to 09 2006 year via K line and CAN You must use Keys or transponders TPO5 TPO08 TP22 TP23 TP24 Note some of the new vehicles need to remain with ignition ON five minutes before starting of the key learning procedure VW Golf5 Skoda Octavia Il VW Touaran Seat Toledo 2004 Other vehicles may need to stay more than 30 minutes with ignition ON until programming becomes allowed Skoda Fabia 2006 Skoda Roomster 2006 Skoda Superb 2007 VW Polo 2006 Seat Ibiza 2006 Key Learning Standard Mode From Special functions Key Learning Standard Mode choose vehicle model Key learning X Vehicle model Audi 4446 1997 external immobilizer box 1 281 gt Seat Toledo Skoda Octavia k line diagnosis 441281 Skoda Il 2007 CAN Skoda ll 2007 Skoda Superb k line diagnosis 201 Skoda Roomster k line diagnosis 2071 Skoda Scout LAM Skoda Fabia 1999 ext
98. ansponder s data at position 4 in the dump You should use transponder 8 By pressing OK changed data will be written into the dump By pressing CANCEL the loaded dump will remain unchanged Keys data 80 can enter manually key in certain position or you press Program transponder to read current transponder with programmer to certain position With pressing keys data will be written ta dump Cancel After you have done all the modifications you wish you have to press Save dump for to save the changes in the dump Audi 4 UKNSI 1995 1997 mileage and login code 93C56 displays the login and calculates mileage No license required Audi 4 UKNSI 1997 1998 mileage and login code 93C56 displays the login and calculates mileage No license required Audi A3 A4 A6 UKNSI Japan mileage and login code 93L C56 displays the login and calculates mileage No license required Audi 100 VDO 1995 mileage 94C46 calculates mileage No license required Golf VDO 1995 mileage 93C46 calculates mileage No license required Golf 3 VDO V3 9 mileage 93C46 calculates mileage No license required Golf 3 Diesel mileage 93C46 calculates mileage No license required Golf 3 Motometer V5 8 mileage 93C56 calculates mileage No license required Polo Motometer mileage 93C46 calculate
99. anually some PINs of the VAG Interface connector with cables to the wiring of the CAR o0 you ve to find somewhere in the car the desired wires orange with green CAN H and orange with brown CAN L and you ve to connect them to OBDII connector PIN6 CAN H and OBDI Connector PIN14 CAN L Also you ve to connect OBDII Connector PIN4 Ground to any metal part of the car After you re ready you can call the Unlock doors special function Following dialog will be displayed Door unlocking Unlock s Unlock Touareg PFhaeton 1 46 Allroad AB Unlock Porsche Cayenne Pin lt gt Pin 14 lt gt CAM H oranger browr OBDII 4 lt gt metal part of the car Unlock Vw Passat Unlock sw EOS Unlock Audi Unlock Audi So for any of the desired model you ve to press the appropriate button ATTENTION In the most cases this only opens the doors It doesn t disable the alarm 2 5 22 Special function Coding calculator Using this function you can calculate long code coding value of different modules When you open the special function the following window appears 75 ABRITES Commander for VAG 1 x Select device select coding Engine Control Unit Instrument Cluster Gateway Central Electric Comfort System Parking Assystant Door Control Audio System Hadio Mavigation steering Control Trailer R
100. ased by YIN number have dealer key purchased by VIN number you ve to put the number of keys to be programmed and to press the Lear button Before the procedure finished on the display of the instrument itis displayed LY where x is number of successtully leamed keys and v is the total number which has to be learned When 1 is displayed pou will asked ta put each next key and to press UK After pressing the OR the instrument will be reset and x value should be incremented until iE reaches the y value NOTE This 1 not adding of the but programming of all keys which will be accepted from IF you have Key learning procedure goes in the following steps 1 Learning a dealer key purchased by VIN number If you have dealer key purchased by VIN number you have to put the number of keys to be programmed and to press the Learn button Before the procedure is finished on the display of the instrument is displayed L7 x y where X is the number of successfully learned keys and y is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press After pressing the the instrument will be reset and x value should be incremented until it reaches the value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have
101. authorization on different levels Security Access Secuthy access parameters Standard User defined security amp ccessiLogin Security Access 2332 BE Value DEC Value HE security Access eystem 2 4 7 1 Standard Security Access This type of security access can be e Security Access Login usually used in immobilizer systems e Security Access Component Security usually used during adaptation of different units parts e Security Access System Specific security access different from the previous two and different from authorization for programming session Hints When device to which you connect is using KWP1281 diagnostic protocol then only Security Access Login If you want to put the security access to the ECU you should use Security access CS This will allow you access to adaptation channel 50 If you want to put the security access on the Immobilizer you should use Security access CS If you ve a error message that it is not supported you should use then Security access Login 2 4 7 2 User defined Security Access You need to clarify the type of the security access and then by using the buttons Request SEED Send KEY authorization can be performed Security Access Secuthy access parameters Standard User defined i Request SEED 1 Value DEC aluet HEX
102. calculated for the area till address 0x180 because after that area the EEPROM sections are different for each different software version of the EDC16 unit Fortunately the most of the interesting data are found in this section ECU Security access code 7 Checksum calculator 35321 FF 7 8 1 1 4 00000010 FF FF 31 37 2D 31 32 2D 30 34 08 10 18 89 00 39 17 12 04 5 00000020 17 12 04 00 43 54 31 30 33 37 33 37 34 31 30 36 CT1037374106 00000030 42 03 2F 2F 31 30 33 37 33 37 32 36 36 37 FO B 1037372667 00000040 00 06 05 00 04 2 10 75 30 32 38 31 30 31 32 u 0281012 00000050 31 31 39 20 20 00 00 00 16 9C 07 DS D 18 FA Bl 119 00000060 00 04 2 10 75 30 33 47 39 30 36 30 32 31 41 u 036906021A m Ey 00000070 42 20 52 34 20 32 2C 30 4C 20 45 44 43 20 20 20 B R4 2 01 EDC EMIL 00000080 20 20 20 20 20 20 37 38 37 31 03 00 00 48 00 00 00000090 OO OD OO OO OO 09 F7 GE n 000 0 0 OO z 75 30 33 47 39 30 36 30 52 3l u 3659060z14 42 20 34 20 30 20 45 44 45 20 20 20 B 2 01 EDC 00 0 20 20 20 20 37 37 31 03 00 OO 46 00 00 dpe 00000000 OO OO 00 OO OO 00 OO 09 F7 000000 0 44 F3 C5 49 CD 00 56 57 5A rIl
103. cense while making keys requires the dealer key license To make any operation on these dashboards it is required first to enter into service mode Without entering into service mode nothing is possible Entering into service mode is possible in two ways read the EEPROM 24C32 with a programmer then load it with the Load EEPROM dump button modify it then with Enter service mode by EEPROM dump and finally write back the resulting file with a programmer to the EEPROM If the car has a working key from the car give ignition with it and then press enter service mode by OBDII ATTENTION If you use Enter service mode by EEPROM dump in the case of 24C64 it is possible that after the modified EEPROM dump is written with the programmer to the instrument cluster the ABS module loses it s coding That is why it is strongly recommended that you detach the dash and work with it on a desk not in the car Or you can switch off ABS module during your work with the dashboard If you prefer to work with the dash in the car then it is strongly recommended that you save the ABS coding before writing the EERPOM dump and restore it after that For this case there are buttons Backup and Restore in section ABS coding Press Backup for the Abrites commander for VAG to read and save the ABS module coding before writing the modified dump to the instrument cluster Press Restore for the Abrites commander for VAG
104. contained There are several ways to extract the component security In case of Wizard mode Select Autodetect component security and press Next The system will try to read the CS bytes from ECU or if possible from Instrument Cluster It will also automatically decide whether you ve the 7 byte or you ve to search for it In case of Standard mode Simply press the Autodetect component security select Autodetect component security and press Next in case of Wizard mode and the component security bytes will be read from the ECU This will also automatically decide whether you ve the 7 byte or you ve to search for it Also the login will be displayed in the status bar The autodetection is not always possible it works basically for EDC16 and MED9x engines which are using CAN diagnostic connection The component protection bytes are displayed e g using the special function Engine Control Unit when reading the EEPROM of the engine control unit then VAG Commander will show you the component security bytes 0000010 0001 0 0000011 Head Flash Mur Flash Data read Component security 1b 05 4 37 Ob For CAN immobilizers till end of 2006 it is possible to read all 7 bytes from the instrument immobilizer This is possible from the Immo panel you ve to go to Special function then Instrument CAN and Read write immo data After you read the immobilizer data i
105. ct Component Security Bytes and press Next After the component security is read if you have all the 7 bytes then the key will be programmed directly If you have only the 6 bytes you have to choose a if you have working key from this car you can put it into the programmer and select the Find 7 byte of Component Security Bytes Find from working key and press Next the 7 byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then select the Find 7n byte of Component Security Bytes Automatic Trying and press Next you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7in byte at least when you prepare such keys for the firs
106. d Write 307037 EEPROM EEPROM Eg Int E Int Eg E 00000090 31 i D 0 6 7 z nanonAO 5 15 WVWZZZIKZAWIII 00000080 31 20 20 20 20 2 i 41 51 3 E from Te 4 Operation in progress please wait Operation finished with SUCCESS If the user press Read PIN CS the PIN component security and MAC will be displayed to the customer EDC17 MED17 read write TC1796 Lm Lm lE Int Int lE Operation in progress please wait CS 36 67 4F 60 6 00 50990 64 Immo status Normal learned Operation finished with SUCCESS The Immo status can be Normal this is the normal operation mode of the engine control unit i e adapted to vehicle This engine control unit has Immo bypass and can start no matter whether the immobilizer recognizes the engine Virgin This is brand new engine control unit which was not build into a vehicle The information about the PIN CS MAC can also be obtained if you have the EEPROM and Flash dumps from the engine control unit 2 5 7 Special functions Immo III IV parts adaptation This special function is dedicated to adapt virgin or to reuse second hand immobilizer parts e g engine control units immobilizer Kessy transmission gear box from one vehicle to another In ge
107. de lt Back gt Exit VW Crafter Audi A4 2002 KW2000 To learn key you must either have dealer key purchased by VIN number prepare it prepare a dealer key If you have a Key programmer you can prepare a dealer key from Megamos 48 transponder Select Program Key function and press Next Enter key count gt X Key count 0 Put how many dealer keys you want to program and press The VAG Commander connects to the RB8 instrument and reads all required information After the dealer key is prepared you can learned it using Learn Keys To learn a key Select Learn Keys function and press Next Put how many dealer keys you want to program and press Follow the instructions Before the procedure is finished on the display of the instrument is displayed L7 x y where is the number of successfully learned keys and is the total number which has to be learned When L7 x y is displayed you will be asked to put each next key and to press After pressing the instrument will be reset and x value should be incremented until it reaches the value NOTE This is not adding of the key but programming of all keys which will be accepted by the car If you have some other keys which you don t learn here they will stop working NOTE When reading the RB8 EEPROM the device is put into service mode
108. dialog Set transponder ype Megamas 48 VW id Autodetect component security All bytes of the component protection data component security are know Program transponder 7 bytes n I Find the 7th byte of the component security data Find and program transponder Component e7 da 7d 63 secunty bytes Automatcial tring of the 7 byte O Manual trying of the 7 byte vw Passat Value for the autarizatian read by daignostic Find rth byte from working with transponder in ignition programmer over key if you have chosen key learning wizard mode select function Program Key and press the Next button which will show the following dialog loj x Select an option Manual Input of the Component Security Bytes Autodetect Component Security Bytes gt Find the 7th Byte of the Component Security Bytes Automatic Trying Find the 7th Byte of the Component Security Bytes Find From Working Key Component Security Bytes 0 0 0 0 0 0 0 owe e The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit Inside the engine control unit there are stored always at least 6 of the component protection bytes sometimes also the 7 byte is
109. dules with SW version above 2 0 2 it is required that you ve a dealer key This key can be obtained from the VW Audi dealer or can be made if you have the respective Key programmer Prepare dealer key 1 Select Program Key and press Next The following window will appear ABRITES Commander for VAG q Bl Get component security from Engine Control Unit ECU Get component security from EZS Kessy EEPROM dump Get component security from EZS Kessy by requires to give ignition ON with working key Login 0 Component Security Bytes e et You need to put the login and the component security bytes as described above 2 Press the Next button In this time the blank key should be inside the Key programmer and the ABRITES Commander should be connected to the car After several seconds the dealer key should be ready and can be learned Learn key 1 Select Learn Keys 2 Press Next follow the instructions See Special functions with EZS Kessy CAN for additional information 2 5 13 12 Procedure 10 for vehicles VW Passat B6 CC equipped with EDC17 MED17 such car is equipped with EDC17 MED17 then it is not possible to read the component security from the engine control unit Instead it is only possible to read the PIN code from it Fortunately it is possible to program a key for such car You need to read the PIN from the EDC17 MED17 and als
110. e component security from the engine you can extract the 7 byte from the comfort module EEPROM using the dump tool It is also possible to program directly the key to the car from the dump tool if you ve attached a programmer For more details please refer to the dump tool section ATTENTION As mentioned above for some cars it is not possible to find the 7 byte of the components security You can understand whether for the desired car is possible by performing the following procedure a Connect with 25 Immobilizer and go to Measured Vaues Channel 2 b Put the original key or key with Megamos 48 transponder in this case in the Measured values you should have yes or 1 on the second possition of channel 2 c Eject the key so there is no key in the ignition lock If the second positions changes to No or 0 you CANNOT search for the 7 byte the second positions remains Yes or 1 you can search for the 7 byte After you obtain a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned In case of Wizard mode If the 7 byte is not available you must choose one of the two options Find the 7th Byte of the Component Security Bytes Automatic Trying This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to
111. ead mileage to read current mileage value Press button Read EEPROM Write EEPROM to read write EEPROM data using ABPROG Special functions with EZS CAN When this function is opened the ABRITES Commander for tries to establish a diagnostic session with the EZS Kessy Entry And Start Authorization using KWP2000 over TP2 0 25 for 07 A6 Allroad x Component security Get component security from Engine Control Unit Component protection bytes ad 22 a3 Login code 83242 Get component security from 5 EEPROM dump Load EZ5 Kessy dump O component security from Ez 5 Kessy by Load from by requires to give ignition ON with working key Autadetect from engine ECU Learn keys Number of keus tn 1 Leam keps Make dealer key learn 5 EEPROM 00000000 24 10 02 OO 10 FD BO FF FF 01 FF 36 33 36 37 5 5367 00000010 31 33 30 30 32 36 30 30 31 FF FF 37 33 38 37 l3 002860011 7387 Head EEPROM 00000080 30 33 30 30 30 34 30 36 30 31 FF FF 31 30 30 38 OS00040601 1006 00000050 34 31 32 31 31 35 30 30 39 30 33 31 30 34 4121115000903104 00000040 34 32 34 37 35 FF FF FF 35 30 31 31 aE 38 32 42475 50 11 82 00000050 32 30 31 57 41 55 54 34 46 58 36 34 31 3Z lWAUZZzzJAFxb54dl 00000060 32 31 31 33 31 FF FF FF 11 28 z3 10 34 46 30
112. ead the dump by OBDIl but this will reflash the gateway or you can load the EEPROM dump Please specify how to proceed Read by OBDII ATTENTION this might reflash gateway if itis not already reflashed C Load gateway EEPROM dump You have the option to read the Gateway EEPROM dump manually with a programmer or to read it by OBDII Reading by OBDII takes normally about 3 4min but requires a module reflash If the gateway is once reflashed further operations of the EEPROM reading don t need reflash o0 the customer has the option to select whether he wants to read the EEPROM dump by OBDII or to read it with a programmer If he selects to read by OBDII then the next dialog displays the status of the operation ABRITES Commander for VAG Reading gateway EEPROM by OBDII Connecting to CAN Gateway OK Checking EEPROM access OK Reading EEPROM OK Gateway EEPROM read with SUCCESS Once the EEPROM data are read loaded the adaptation of the component protection is performed Once this step is completed successfully the module should be fully functional step 2 2 Learn module to the vehicle Connecting to CAN Gateway OK Trying to set the component protection OK Connecting to Airbag OK Trying to set the component protection OK Module learned to vehicle with SUCCESS 2 5 6 Special functions with EDC17 MED17 Engine Control Unit This function is dedicated to read write the EEPROM and flash m
113. ead the flash memory like reading of the EEPROM only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length If you experience problems with reading ME7 x memory better remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again 3 When flashing the device please always read and save first the original flash 4 When using EDC16 please notice that the flash which was read is saved automatically in the Flash subfolder and can be used in case of any failure to restore the flash ATTENTION FILE IS CRYPTED Don t use it directly to write it In case of failure during the flashing the device should enter into a boot loader mode which will allow to flash the device but not to read it The flash can be then restored with the Custom Read Write function 5 Please stop all screen savers power saving options and unused application during the flashing Please do not do anything else on your PC while flashing 6 Please take into account that the reading writing of the flash will take a long time especially when CAN connection is used as result the battery may become flat 2 5 5 Special functions Component protection As part of the security strategy some parts of the modules build in the VAG vehicles implement the so called component protection This is a mechanism dedicated to prevent exchange of
114. eck boxes in the above picture modify certain value see the list with the two columns text and value in the above picture or select certain value by combo box selection Check Select all check box to mark as checked all the check boxes from the check boxes list The coding value is represented into the edit field at the bottom of the window next to button Show Coding Value When certain item is changed this is automatically reflected into the coding value If you would like to see certain coding value meaning you should write down the value into the edit field and press button Show Coding Value 3 TROUBLESHOOTING Below you can find a list of typical problems and how to solve them Problem When starting the ABRITES Commander for VAG on the splash screen Interface NOT found is displayed Solution Please be sure that the USB interface drivers are installed properly You can look at the device manager the USB interface should appear as USB Serial Port where xx is the number of the port If the interface is recognized OK then please try to unplug and plug it again into the USB slot and restart the ABRITES Commander for If the interface is not recognized the USB interface appear with yellow exclamation mark the device manager then you can try to solve the problem by uninstalling and reinstalling the USB interface drivers see sections Installing USB interface driver
115. ecognition eo By selecting a device you ll be shown list of possible long code coding to choose TG ABRITES Commander for VAG Select device Select coding Engine Control Unit 3C3 920 lt x b digits code value 920 22 digits code value Gateway 41 0 22 22 digits code value Central Electric 2 b digits cade value Comfort System 9 0 920 22 digits code value Parking Assystant 20 22 digits code value Door Control Audio System Radio Navigation Steering Control Trailer Recognition lt Back Next gt Exil Select the appropriate coding and press Next iG ABRITES Commander for VAG Select all Central Electric Seat Altea 42 digits cade value Coding information O Front Fog Lights installed Xenon Headlights with Shutter installed Q Lighting system 004 Daytime Running Lights Scandinavia active Daytime Running Lights North America Driving lights O Driving lights Coming Home active Rear Seat Recognition installed O Headlight Washer installed PR 8x1 Headlamp washer delay after power on Default 51 ms 22 Headlamp washer time to excite the default 230 ms pe 4000011040000000000005 Show Coding value Back Exil In the opened window you can check un check the desired features see list with ch
116. ect power class in the beginning of the procedure This is so because the Immobilizer Comfort module will take the power class you enter ATTENTION After the reading is finished any working keys will stop to work and should be re learned to make them working again NOTE This special function can be used also for key learning If you have the comfort module dump you can load it here and all 7 bytes of CS will be displayed Then the customer can make dealer key using these 7 bytes 2 5 7 4 Adapting Transmission gearbox on A6 Q7 Allroad This special function is dedicated to adapt second hand transmission from one vehicle to another To adapt the transmission gearbox you need the existing PIN and CS of the second hand gearbox You can extract it by reading the EZS Kessy or engine control unit from the car where you take the replacement Second hand module Starting this special function the following dialog is displayed Exchange ECU by OBDIT f Load existing PINES from Ez5 Kessy dump Specify manually the existing C5 PIN af the engine control unit Old ES 7B 188 C1 02 required Old PIT 15565 Mew immobilizer data STRE Wil 4F99N111114 Power class 51 Load L3 7G gt 5 dump to which ta adapt 23232 5 Part Connected Start transfer recerve of data So you need to load the EZS Kessy EEPROM dump or to enter manually the PIN and CS of the
117. emories of the EDC17 MED17 engine control units Here not only VAG engine control units can be read but also engine control units from other producers like BMW Opel etc You need to connect the boot pin of the engine control unit to ground connect the CAN H of the ECU to PIN6 of the AVDI OBDII Connector connect the CAN L of the ECU to PIN14 of the AVDI OBDII Connector connect the ignition of the ECU to PIN7 of the AVDI OBDII Connector connect the power supply 12V and Ground of the ECU to power supply source check which microcontroller in used in the ECU the Infineon TriCore type ReadPinvcs from dump Head EEPROM EEPROM Read Int Vi rite Int FLASH FLASH Load fram file Operation in progress please wait Manufacturer ID 0000182000008A02 OPT Protect 0x10000 0x13fff OPT Protect 0x14000 0x17fff Protection installed YES Internal flash size 2048 KB EEPROM size 128 KB External flash not available Operation finished with SUCCESS Then you should select the proper microcontroller and connect to it Once connected the user has information about the flash EEPROM size and protection and has the ability to read write EEPROM Dflash read write Flash Pflash Get PIN CS MAC for the engine control unit 00000000 2 i i Read FIN CS zm dec 00000010 0 36 2D 9 00 D D 7 06 08 17 0 3 rom dump 120 i 31 30 09 4 8 37501956 10 Hea
118. er year 2007 or Audi A8 you need to prepare a Hitag2 key transponder before you use the key learning function You can use a virgin transponder PCF 7936 or a virgin key Key Learning Standard mode 1 From Special functions Key Learning choose vehicle model Push Program dealer key The following dialog will appear 2 There are following possibilities 2 1 Making the key without disassembling the Kessy completely by OBDII The Autodetect from ECU button will try automatically to read the component security bytes from the ECU and will select for you automatically whether you need to search for the 7 byte or not Dealer key with Hitag2 X TR NS Autodetect Program from Program transponder from bytes Component protection bytes rag 3b E bo rag Load component protection data from Kessy ECU dump Program from Kessy ECU dump All bytes of the component protection data component security are know Find the 7th byte of the component protection data Find th byte and program transponder Component protection bytes b b rag Login 132 Find byte from working key Trying bytes 8022 Take key OUT and place inta programmer IMPORTANT If you don t have a working key from the car you will need to short the fuses as described in the appendix to get communication with the ECU After the component security is read if you
119. ernal immobilizer E1281 count Login S ecurity cade 1 1 Enter security access code and the number of keys 1 2 Turn ignition ON new or existing key 1 3 Press button Learn 1 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining key stopping to work You will be asked whether you want to use this feature Please answer with yes no according to your wishes 1 5 Wait until adaptation finished is displayed 1 6 Remove the key and turn ignition off with all remaining keys NOTE The system will autodetect whether it is possible to add the key without erasing the remaing keys If possible and if 1 key is selected then and only then a message will appear Where you ve to confirm that you want to add the key If you press No here the key will be learned normally other keys will be erased If you select other than 1 key to learn or if adding is not possible than the key will be learned normally with erasing other keys which are not present For the case where the key will be added you should give ignition with the key which you want to learn this should be TP2x transponder for older cars and prepared dealer key for newer cars e g after 2007 Please pay attention that during the autodetection whether adding is possible reflashing of the instrument may be needed for newer cars 2007 so you will be asked for that Key Learning Wizard Mode
120. ervice interval parameters or change service interval options With the opening of the special function window the commander will connect to the instrument cluster and read the available information concerning the service interval function Depending on the vehicle model year etc you will have enabled Service reminder reset or and Service interval reset or and Change service options sections Together with these sections in the section Applicable adaptation channels you will see the adaptation channels which values will eventually change if you select one of the listed above three operations with their current values units and short description When the read information is first loaded and also when certain options within the window are changed column New value of the Applicable adaptation channels table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options The applicable and available adaptation channels from column New value are also available for editing so the user may put there any other values 2 5 16 Special function Remote control adaptation Using this application you can learn remote controls With the opening of the special function window the commander will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation Remote control
121. form diagnostic on the engine control unit and the immobilizer NOTE It is possible to connect only to the engine control unit and immobilizer for VW Crafter vehicles To connect to any other device you will need the ABRITES Commander for Mercedes Starting this special function brings a following dialog 01 Engine Control Unit Master 02 ransmiason Previous 03 ABS 04 Steering Angle 05 E45 Kessy Entry And Sta 06 Seat memory passenger 07 Control head 08 Climatronic Auto HVAC Connect x m Engine Control Immobilizer ote Control Diagn Exit Unit Diagnostic Diagnostic it special functions Vehicle Selection Broadcast Options s en CAN the eu y S Instrument Ez5 Kessy Instrument Engine Control Micranas YEO dash Component Steering lack K Line Unit 2009 UDS 9512 protection adaptation 9 mm LL en TY activation Key learning Dump tool Airbag VAM Crater OSG Mileage Custom Converter Service EDT ED2 Read Write interval E eel cs TTE From these buttons is possible when pressing ECU EEPROM the same dialog as in the Engine control unit is brought to the user and is possible to read EEPROM read mileage and make immobilizer bypass from here Not needed to select any engine type it is made automatically pressing Key learning w
122. give ignition ON and place the programmer ring over the key when the key is on the ignition Find the 7th Byte of the Component Security Bytes Find from Working Key You have to put the six bytes which are known and press Next 2 5 13 6 Procedure 4 No more applicable Use procedure 3 instead 2 5 13 7 Procedure 5 No more applicable Use procedure 3 instead 2 5 13 8 Procedure 6 for Audi 4 RB8 Audi vehicles equipped with instrument cluster BOSCH RB8 with integrated immobilizer require a different key learning procedure In most cases the instrument doesn t accept the security code even if it is correct For that reason a different procedure 15 used Key Learning Standard mode You need to choose from Special functions Key learning Audi A4 2004 RB8 Instrument Cluster KW2000 The following buttons will be available Key learning Vehicle model or Program dealer key Login Securty cade 0 Ma login cade i need for the key learning have to put the number of the keys which will be adapted Procedure Audi vehicles equipped with instrument cluster BOSCH RBS with integrated immobilizer require different procedure In mast cases the instrument doesn t accept the security cade even if itis corect For that reason separated procedure is used The Kev learning procedure goes in the following steps 1 dealer key purch
123. ible to distinguish between VW 2007 and VW 2007 for that reason by default VW CAN 2007 15 selected by default After the vehicle model is recognized the system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Yes here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi which uses Hitag2 transponder then here the value will be No If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car Afte
124. icated Yes Key locked Yes Key learned Yes Read BCM2 OBDII Read BCM with programmer with ABPROG C Alarm OFF Alarm ON This special function offers following options Making keys for these vehicles requires to read the BCM2 module In general the procedure is split into three steps otep 1 Check type otep 2 Read either by OBDII or with ABPROG otep 3 Key learning procedure making dealer key and learning keys 2 5 2 1 Read 2 by OBDII This option will read the BCM2 module by OBDII If all keys are lost after the reading is started following message will appear At that moment the user should disconnect the BCM2 module from the power supply for 2 3 seconds and after that reconnect it again After the reconnection the user has to press the OK button If there is a valid key and the ignition is ON it is not necessary to disconnect the BCM2 module ABRITES Commander for VAG 9 2 Read Connecting to immobilizer Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN p E DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN After the reading is finished the existing key count power class and VIN are displayed and the customer can continue with the key learning procedure Read BCM OBDII C
125. icle to another In general the earlier VW Touareg VW Phaeton Porsche Cayenne Bentley continental allow to adapt the immobilizer using only PIN code and adaptation on channel 50 But 8 and later VW models after 2007 require to use this special function To adapt the immobilizer to the car you need the existing PIN and CS of the second hand immobilizer You can extract it by reading the EEPROM dump of the second hand module or if you have the engine control unit from the car where you take the replacement second hand module otarting this special function the following dialog is displayed Load Kessy dump Specify manually the existing C5 PIN of the engine control unit Mew immobilizer data Immo number VIN Power clazz CS So you need to load the EZS Kessy EEPROM dump or to enter manually the PIN and CS of the second hand module ATTENTION You should know the power class of the engine control unit before you execute this function After pressing the read button the customer has to enter the power class manually you enter wrong power class and this is a working vehicle i e ECU and Immobilizer are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the Immobilizer Kessy will take the power class you enter ATTENTION If you put the CS manually i e you put 6 bytes of the CS and there is a working
126. icrocontroller the unit can be either with ELMOS or Motorola microcontroller The function displays also the component protection bytes by pressing the Other data button Dump Tool 2333333333333333 3333000000000000 333311111933 3333333333333333 33333333334 ECU Simos 7 K line Login code 93C76 93CC86 Required license 006 This function displays the security access code contained into the engine control unit from siemens ECUs Simos 7x generation which are accessed through K Line for benzine engines Interesting for these ECUs 15 that the same ECU can be used through K Line and CAN and depending which link is used the security access code which is accepted from ECU is different Dump Tool X ECU Simos 7 K line Login code 33C 75 33085 Login 22153 00000070 56 57 30 30 30 30 30 30 30 30 30 56 57 2 2000000000 00000080 54 43 30 30 30 30 30 30 30 30 30 56 57 5 43 eCe000000000 WzC 00000090 5 30 30 30 30 30 30 30 30 30 57 56 57 5 5 zz 33 45 5 33 53 23 33 53 33 33 52 33 33 53 33 33 3LZ3333333333333 33 33 33 33 33 33 33 33 57 56 57 333333333333WWVWz 33 45 33 33 53 33 33 33 33 UD 00 223333333332 DOOOOODO 7C 7C 30 39 30 37 33 32 33 39 30 36 30 51 38 46 10907323506015 000000 0 47 20 00 OO 00 00 01 05 O
127. ify the current key count E g in the example above they are 22 and this means two keys are present i e the identifiers in fields KeyID1 and KeyID2 will be used If you want to erase the keys you should put there 00 instead 22 if you want only 1 key to be active you ve to put there 11 and so Key Learning Wizard mode After you choose Wizard mode the key learning special function will automatically detect this vehicle type Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 Audi 7 2005 CAN Audi A3 CAN Audi CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Function Adds one key to the existing keys without erasing them lt Back gt Add Learn keys 1 Select Add Key and press Next 2 After the window with immobilizer data appears press Next to start the key learning procedure For to make a key for this vehicle type it is required to enter into so called service mode commander will automatically try to do this after you start the key learning procedure If you have a working key from the car ser
128. ill bring the Key learning dialog the user is not required to select model it is selected automatically Engine control unit diagnostic will perform a standard diagnostic reading identification trouble codes etc to the engine control unit Immobilizer diagnostic will perform a standard diagnostic reading identification trouble codes etc to the immobilizer NOTE If the car doesn t have any working key it is not possible to give ignition ON respectively to get communication with the engine control unit over OBDII because the gateway the EZS in this case is not gating the CAN messages to the engine control unit if no valid key is recognized So if you ve a car without any valid key you will need dismount the ECU and connect it on the table or to connect the CAN wires of the ECU directly to the interface NOTE For the key learning it is needed to give ignition with the valid key before starting the procedure If there is no valid key simply put the key into the ignition lock but the key learning procedure will take about 5 minutes in this case When the procedure is finished you will need to make ignition ON with each key which you want to learn NOTE Sometimes during communication with the immobilizer it is possible to lost communication with it so you will need to repeat the procedure in this case 2 5 13 Special function Key learning Inside every key there is a small chip called a transponder In
129. in the programmer then in the ignition lock than back in the programmer then back in the ignition lock and so on until the dealer key is done When the transponder is ready you will have all the component security bytes displayed in the status bar After having the dealer key you can learn it in absolutely the same way as for the Passat B6 CC with EDC16 9 Key Learning Wizard mode ABRITES Commander for VAG Select vehicle immobilizer type Select function VAG vehicle VDO NEC 2009 VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 Audi Q7 2005 Audi A3 S3 2004 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 11 2007 CAN Skoda Octavia 11 2007 Seat Altea Toledo 2007 CAN Function Program dealer key To learn a key to this car you should make first a dealer key Prepare dealer key 1 Select Program Key and press Next 2 The following window will appear ABRITES Commander for Autodetect Login Code Write Login Code Load Login Code Using Dump Tool Dump Tool Login Code 0 ni x owe 3 Choose an option to supply Login code and press Next 4 If Login is available the following window will appear
130. ity access code on channel 50 After that you have to learn all keys using the Key learning special function Repair RB4 DEF During the procedure the commander will read modify and write back the EERPOM memory to the dashboard After the fixed EEPROM 15 written into the dashboard the commander will try automatically to adapt the dashboard again to the vehicle i e to perform adaptation on channel 50 For to do this a security access login is needed with login code 13861 In most cases the dashboard will not be ready for the security access right away so it might be needed to wait for some time The commander will ask you whether you like to wait and let it finish the procedure automatically or you can choose to cancel the procedure and finish it manually If you choose the automatic way when the waiting finishes and the dashboard allow us to perform login the commander will automatically adapt the dashboards security access code at channel 50 If you choose to finish the procedure manually you have to wait for some time on Ignition ON then connect to Instrument cluster through standard diagnosis perform security access Login with login code 13861 and then to perform adaptation of the dashboards security access code on channel 50 After the procedure finishes you have to learn all keys using the Key learning special function 2 5 4 Special functions with Engine Control Unit Special functions with ECU can be Read
131. l automatically proceed to the next step Write If Login is already available to the user he she can put it down directly into the field Login Code Autodetect Login Code Write Login Code Load Login Code Using Dump Tool ey Dump Login Code 36750 gt Load using Dump Tool If this option is selected the button Dump Tool will be enabled Pressing this button will open the Dump Tool special function which you can use for the obtain Login code from a dump Load Login Code Using Dump Tool Select an option and press Next The following window will appear ABRITES Commander for VAG Immobilizer data Current key count 2 Transponder type No Dealer key transponder Yes ECU responding No Key transponder locked Yes Engine start permited No Key transponder learned Login acknowledge 10 Transponder acknowledge o timeout timeout Press Next to start key learning procedure wo The system checks the key recognition and engine start conditions They are displayed in the following fields Engine start permitted Having the value No means that the key or engine control unit is not properly identified from the immobilizer Reason for that might be invalid key or engine control unit not adapted to the car or for some model some waiting time is running Ye
132. lash ECU Virgin Factory New Login 0 0 Mileage Instrument Cluster Laborghini Gallardo 2005 Skip neg responses Exit From this dialog you need to choose the type of your instrument cluster immobilizer and then you can read write EEPROM read mileage read PIN code and so on Please note that only connection via K Line will be made KWP1281 or KWP2000 and this doesn t depend on the configuration options ATTENTION All read EEPROM dumps are stored in the Dumps sub folder of the ABRITES Commander for VAG so it is possible to restore the EEPROM in case of unwanted changes For the most of instrument clusters is implemented automatic parsing of data from the EEPROM mileage immobilizer For instrument clusters from Magneti Marelli please refer Appendix A If connection to Momometer instrument is not succeeded please send the file motometers txt to moto abritus72 com and this instrument will be added to the database till three business days Latest database for Motometer instruments is available on www abritus 2 com mmdata bin NOTE Sometimes if you try to access the instrument cluster by selecting the wrong type the cluster may block and reject any future diagnostic requests until it is reset from the power supply by removing the fuse or disconnecting from battery For example this always happens for Bosch clusters which will blocked if accessed as Instrume
133. les is realized there The customer can also recognize this dashboard type when connect with the dashboard or immobilizer and in the identification string should stand VDD or VDO So for such cars open the VDO NEC 2009 special function and the following dialog is brought to you To make keys read mileage for these cars it is necessary to enter first into the so called service mode VDO with NEC Microcontroller 2009 x Service Mode Service mode can be entered in two ways for some dashboards it is possible to enter by OBDII not always possible by modifying the EEPROM content with a programmer dump Service mode can be leaved always by but ance leaved you may need to modify the EEPROM dump in order to enter it again Load EEPROM Enter Service Mode by Leave Service Mode by 24 32 24 dump DOBDII Haead write EEPR UM Flash Head Head Flash 00000010 8l DS SA 21 OB Z 00000018 28 Dl 41 57 21 62 7B 49 AW bII ABS coding Write 00000020 AS CD 79 67 DD 1C y g 00000028 07 DS BF F4 FF 65 1 28 oe Mileage Head mileage Mileage 0 00000030 60 83 4D E4 DD 19 SF 8C _ dics mill E fom Save to file 4 00000008 8B 5B 7B 1 El 6 31 11 11 Imma D ata VIN VWLWZIEEBMTITITI data Transponder identificators 0769709
134. liver such keys and such keys are called dealer keys because only the dealer can supply them For some cars special programmer is needed in order to prepare key to be like an ordered from the authorized VAG dealer Currently following programmers are supported Hitag2 programmer used only to program keys with Hitag2 transponders PCF 7936 PCF794x ouch cars are VW Touareg VW Phaeton Porsche Cayenne Bentley Continental Audi A8 Abrites Key Tag programmer used to program Hitag2 Megamos 48 crypto transponder and Q7 A6 RS6 Allroad keys The Abrites key programmer is referred as key programmer in the following description Normally there are several key learning procedures which are applied depending on the car type and year of production You can check in the appendix section which car to which key learning procedure belongs otarting the key learning special function will bring the following dialog Wizard Mode Press Standard Mode to use key learning special function as till version 15 0 of the Abrites Commander for VAG Press Wizard Mode to use key learning special function in wizard mode which will guide you to the key learning procedure for the specific vehicle type Pressing Standard will bring the following dialog Key leaming Detected car type Cannot autodetect immobilizer type Please select it manually Vehicle model VW Passat with EDC17 MED1
135. ll keys are lost and you want to make 2 keys you can make the procedure for ALL KEYS LOST twice this will prepare 2 dealer keys and then to learn 2 keys 2 5 13 2 Key learning procedures Pressing Wizard Mode the system will try to detect automatically the vehicle model unit name WAG Number Description 076 Coding 00 45 01 Engine Control Unit Master 02 Transmisson menai 03 ABS 04 Steering Angle 05 EZ5 Keasy Entry And Sta see nenory x gt 07 Control head 08 Climatronic Ac Investigating vehicle Connect 09 Central Electi Air heating 0 Special functions if Instrument Ez 5 Kessu Instrument Engine Control Micronas VDO MEC Magnetrdash Component EDCTE MEDS3 K Line 2009 UDS 3512 protection adaptation b EE D Ld i 1 mr 3 1 Steering lock TY activation Key leaming Dump tool Airbag Ww Crafter OSG Mileage Custom FIN Converter adaptation ED1 ED2 If vehicle model is successfully detected it will be suggested to the user with the following message 01 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Keasy Entry And Sta 06 Seat memory A EI x 07 Control head 08 Climatronicya Investiaatina vehicle Connect Vehicle lmmobilizer type recognized as Audi 53 OB Air heating 2004 CAN
136. m Parking brake function test This function is available for the following vehicle models Audi A8 2004 Audi A6 allroad 2005 Audi Q7 2009 VW Passat B6 VW Tiguan 2009 For vehicle model Audi A8 it is also possible to set the pad thickness 2 5 20 Special function ECU Exchange Dump Tool Using this application you can change the EEPROM dump of an engine control unit so that after it is programmed into an ECU the ECU can be adapted to a vehicle You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle called in the application active ECU and the EERPOM dump of the engine control unit with which you wish to replace it called in the application replacement ECU After opening the application load both dumps using buttons Load active ECU dump and Load replacement ECU dump Press Change replacement ECU dump to do the needed modifications in replacement ECU dump Press Save replacement ECU dump to save the modified dump into a new file which you can program into the device after that ECU Exchange Dump Tool Choose ECU type JEDCI6 Load active ECU dump Load replacement ECU dump Change replacement EIL dump Save replacement EEU dump 2 5 21 Special function Door unlocking This function is dedicated to open the doors of the car when the car is in SAFE mode To use this function you will need to connect m
137. mmander for VAG folder Problem Some device cannot be read or unexpected behavior was found Solution Please enable the logging as described in chapter 3 1 5 and send to use the corresponding log file 4 4 1 Programming instrument clusters from Marelli K line diagnostic link 4 1 1 Instrument cluster from Audi A3 Audi A6 Audi TT VW New Beetle Access to these type 15 possible using the types Instrument Cluster Magneti Marelli Direct 1996 2000 and Instrument Cluster Magneti Marelli Direct 2000 depending of the production year of the car So you have to select the one of the both types and then try to read the EEPROM Please note that the threshold of the year 2000 is not absolute some models are continue to be equipped with older instruments even if they are after year 2000 So the best way is to choose first the Instrument Cluster Magneti Marelli Direct 1996 2000 if not succeeded you have to make the ignition OFF and again ON and to try with the Instrument Cluster Magneti Marelli Direct 2000 type If succeeded to read the PIN code and mileage are automatically recognized and displayed for Magneti Marelli direct types but in case of error you can do it by yourself using the description below 1 In the EEPROM search for the Immobilizer number AUZ WAUZ If the immobilizer number is found then the login is the two bytes preceding the immobilizer number
138. models VW Golf5 VW Caddy VW Touaran VW EOS VW Individual Skoda Octavia Skoda Scout Seat Leon Seat Altea Seat Toledo Audi A3 Audi A6 Audi A8 Audi Q7 Audi Allroad With Audi A6 Audi A8 Audi Q7 Audi Allroad the function for reading current mileage value is not available ATTENTION Please take care that some instrument clusters from Audi A3 and Audi A8 are with blocked access to these special functions This can be recognized if after reading of current mileage value is displayed unreal value To restore instrument cluster to normal behavior need to be removed for one minute fuse of instrument cluster for example on Audi A8 can be used fuse number 5 Reason for blocking of security access is usage of bad diagnostic tools in the past ATTENTION ABRITES Commander for VAG is designed to calculate mileage values in KM units Please take this into account especially when using dump tool or when VAG Commander asks you about displayed value of instrument cluster Audi Q7 Audi A6 Audi Allroad 2 5 1 2 Special functions with VDO The special function is dedicated for the instrument clusters with NEC microcontroller Typically these are VW Seat Skoda Audi cars produced after 2009 year After starting the function a following dialog will be brought to the user VDO with NEC Microcontroller 2009 E X Service Made Service made can be entered in two ways some dashboard
139. modules between different vehicles without central authorization from the VAG online database Such modules build in another vehicles activate the component protection active DTC and are with restricted functionality when build in another vehicle This special function allow to remove this component protection active trouble code and allows to the module to works with its full functionality The component protection start to be implemented first in the A8 2003 and in the 2004 vehicles Component security is not implemented in all VAG vehicles There are actually two types of component protection generation 1 and generation 2 Component protection generation 1 is implemented in the A8 2003 vehicles while the A6 Q7 Allroad 2004 is using component protection generation 2 for most of the modules and only few of the modules are using component protection generation 1 In the beginning the customer has to select which generation want to use select component protection type Generation 1 2003 2010 Audi A6 2004 2008 MMI CD Changer ILM Fahrer amp Beifahrer C Generation 2 All other modules of Audi 2004 and 4 5 05 2 5 5 1 Component protection generation 1 For the Component protection generation 1 the customer has to select the module which want to adapt it ABRITES Commander for VAG select device to adapt Control Head MMI 1 2004 2009 Central electric Fahrer 2004
140. n the field Serial Key the 7 bytes of the component security will appear 2 5 13 5 1Programming a dealer key with all 7 bytes available If the 7 byte is different from 00 then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer In case of Standard mode In this case you must choose All 7 bytes of the component protection data component security are known put the 7 bytes and press the Program button In case of Wizard mode After you have chosen Autodetect Component Security Bytes or Manual Input of Component Security Bytes press button Next If all 7 bytes are available the system will automatically proceed with dealer key preparation 2 5 13 5 2Finding the 7 byte In case of Standard mode If the 7 byte is not available you must choose Find the 7th byte of the component protection data and you have to put the six bytes which are known There are three possible ways to check whether the 7 byte is matched from working key if you ve a key which can start the car put it in the programmer and press Find 7 byte from working key after 70 80 seconds the 7 byte should be found Automatically This mode requires that the immobilizer and the Key can simultaneously read write the transponder For that reason you ve to give ignition ON and place the programmer ring over the key when the key is on the ignition NOTE The au
141. nS ae fo EE 00000160 Flash toc ID onn00170 d 9 1 Master 00 0000120 d MED 9 1 Slave 00 00000190 9 1 Single j JOQ 00000120 5 PPD 1 1 1 5 Siemens googl Uu uu uu cusg un ug uu DU i 2 22 2 e IMPORTANT You need to clarify the type of Engine Control Unit in car before proceeding There is also a Autodetect function implemented and will detect the ECU type in almost all cases but is possible that it is wrong and then is needed to select the type manually You can choose ECU type VAG EDC15x VAG 7 1 1 7 5 7 8 Porsche 5 2 7 8 BOSCH VAG EDC15x VAG ME7 1 1 VAG ME7 1 VAG ME7 5 VAG Cartronic ME7 8 EDC16U1 EDC16U3x CP etc Extracting security code enable disable immobilizer and so on Example is 1 9 TDI EDC16 Engine Control Unit Special Functions Ch ECU EDC16U31 w ECU type help 000000 01 25 38 31 35 20 30 31 2030 37 F 00000010 FF 31 36 20 30 31 2D 30 37 DB 10 14 BD 03 B2 18 01 07 Read EEPROM t 8 15 01 07 Load from file 00000020 18 01 07 08 15 21 31 30 33 37 33 38 32 30 38 33 1037382083 00000030 41 03 2F 2F 31 30 33 37 33 37 37 31 35 30 EF CA A 1037377150 00000040 00 04 02 00 00 00 00 00 01 30 33 47 39 30 36 30 0369060 Write EEPROM 00000050 32 31 4
142. need to write back the modified EEPROM dump again Dashboard is equipped with 24064 EEPROM you need to read the EEPROM with programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Enter service mode by OBDII and the service mode should be entered Once the service mode is entered the customer has the possibility to read write EEPROM and read flash and also to read write the immobilizer data Pressing the read immo data button will read the important immobilizer data such as a VIN immobilizer number component security PIN existing keys etc and also will activate you the buttons for making the keys and writing the immobilizer data To add a key put any Megamos 48 Crypto transponder into the programmer and press Add key this will program the transponder modify the immobilizer data so that the new transponder ID is added into the key data and write back the data to the immobilizer i e after pressing this button the programmed transponder is ready to start the car nothing else is required Please note that this will add the key the existing keys will continue to work If you need to erase the existing keys you need to modify manually the configuration field In the configuration the digits on position 7 and 8 spec
143. neral some Immo III parts e g the earlier EDC16 and and all EDC15 allow to adapt parts using only PIN code and adaptation on channel 50 But for the VW Seat Skoda starting from 2007 and for Audi starting from 2003 2004 this is no more possible This special function is dedicated exactly for these parts which do not support the channel 50 adaptation E g for engine control units this also includes not only the Bosch EDC16 MEDS but also EDC17 MED17 and also Siemens VDO Simos PPD and Simos 9 x 6 x 7 x engine control units When the function is selected the customer has to choice what what to adapt There are following possibilities engine control unit Audi A8 VW Touareg Phaeton Porsche Cayenne or Bentley continental immobilizer Kessy Passat B6 CC immobilizer comfort module Transmission gearbos for Audi A6 Q7 Allroad 2003 2 5 7 1 Adapting engine control units To adapt engine control unit to the car you need the engine control unit is virgin you should only put the new CS 6 or 7 bytes and new PIN code You can read them normally from the immobilizer or from the old ECU if it is present the engine control unit is used you need the existing CS and PIN of this second hand engine control unit plus the new CS and new PIN code When starting this special function the following dialog is displayed Exchange ECU by New immobilizer data Imma number VIN Power class
144. nition ON new or existing key 2 Select Learn Keys press Next 3 Supply Login Code press Next 4 Press Next 5 Wait until adaptation finished is displayed 6 Remove the key and turn ignition off with all remaining keys Add Key 1 Turn ignition ON with the key you want to add it should be TP2x transponder 2 Select Add Key press Next 3 Press Next 6 Wait until the procedure finish Program Key 1 Press Next 2 Follow the instructions 2 5 13 5 Procedure 3 for CAN vehicles 2008 Passat B6 Audi A3 CAN Normally most of the newer cars require a transponder which is precoded with the VIN number from a dealer Fortunately it is also possible to precode the transponder by yourself using the Key programmer if you have available the 7 bytes of the component protection data and you need to use an Megamos 48 transponder as base for this operation NOTE The Set transponder type combo box specifies what kind of dealer key to make for VW Seat Skoda or Audi As base for this operation is used Megamos 48 transponder If you have a dealer key transponder you can proceed with normal key learning like procedure 1 Simply put the number of keys to learn and the security access code and the keys will be learned If do not have a dealer key if you have chosen key learning standard mode press the Program dealer key button which will show the following
145. np PLN Seo P M M ME 11 TOSSO EE M tC 12 UNIT S M au 12 2 3 BROADCAST RBOUBS DS 2 92 a aa 13 PASSO TANDARD DENGNOS TIC RE OWES LL 13 VIENDO TE 14 2 4 2 Software Hardware version of the 14 2 eT ACO UTE IACI ney 15 2 44 Diagnostic Trouble CodeS oina e deca vac tue i 15 LA Car IDA ITONO C abdo ER eto 15 2 4 0 VOTUES 16 PUR MARE OI a VA es RSs ev 17 24 SC NCCCSS 18 a Sor i ad ever 20 2 4 esta 20 2 4 0 COdINS Of eoi MU 22 Zi WO SUR CU
146. nt cluster VDO66 VDO86 Motometer type NOTE Please be very careful when selecting Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 and Instrument Cluster Audi A4 BOSCH RBx instruments You will be able to read the EEPROM of the instrument no matter which of both types is selected but if you ve chosen the wrong type and you try to make some changes you can damage it You can recognize whether the right type is selected by doing the following 1 Choose Instrument Cluster Audi 4 BOSCH 2 Read the EEPROM 3 If the displayed mileage corresponds to the real value and if the displayed login is accepted then the type is Instrument Cluster Audi A4 BOSCH otherwise it is Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001 NOTE When reading the RB8 EEPROM the device is put into service mode and LO x y is displayed If by any reason the instrument leaves in this situation e g if your laptop goes off due flat battery or you disconnect the interface from the car or the car battery is flat you need to read the RB8 instrument EEPROM and change immobilizer status to 6 2 5 3 1 Transferring keys from one RB8 instrument to another otarting from V5 2 of the ABRITES Commander for it is possible to transfer the keys from one instrument to another After reading the RB8 EEPROM there are two additional buttons Read keys and Write keys Instrument Cluster Immobilizer K Head J
147. nt security bytes can be read normally from the ECU This 15 true for all cars with EDC16x MED9x ME7x EDC17 MED17 ECUs The login and the component security bytes can be read manually from the ECU from the customer using the Engine control unit special function or decoded from EEPROM dump which is read with programmer It is also possible that the VAG Commander reads the required information automatically when you press the Autodetect button In this case the VAG Commander connects to the ECU and reads the login and CS automatically and then fill the required fields Sometimes by some reason is not possible to read the ECU and to get the component security from there In this case if the car has working key you can read the CS and PIN from the EZS Kessy using the Get component security from EZS Kessy by OBDII function If the car doesn t have any working key you need to open the EZS Kessy and to read its EEPROM with a programmer Then you ve to select the Get component security from EZS Kessy and to load the EZS Kessy dump After that you can learn make a dealer key also from such cars IMPORTANT If the car doesn t have any existing working key it is not possible to give ignition ON in order to get communication with the ECU So to be able to communicate with the ECU you ve to make short with the fuses as described in the Appendix After the login and the component security bytes are read you can restore the fuses IMP
148. o to read the comfort module EEPROM with a programmer Key Learning Standard mode Then you ve to select VW Passat B6 CC with EDC17 MED17 CAN from the key learning dialog To learn a key to this car you should make first a dealer key This is made by pressing the Program dealer key button which brings the following dialog X amp utadetect component protection Program transponder fram 7 bytes Component protection bytes 2g m on m o o mg Program dealer key Set transponder we Megamos 48 f All bytes of the component protection data component security are know Find the 7th byte of the component protection data Find byte and program transponder Component protection bytes o o on m a o Automatcial tying of the 7 byte possible when you check in measured values when key is recognized Manual tying of the 7 byte after each attempt you can try with the key on the ignition Value for the autarization read by daignastic Passat BE LL with 72 7 Login Secunty code 24264 Load comfort module EEPROM dump Here you ve to put the PIN code after that to load the comfort module EEPROM dump and the Program button will become active After pressing the Program button you should perform exactly the same procedure as the manual procedure for the Passat l e you will need to change the position of the key
149. ocedure 3 OBD CAN Megamos 48 Seat Leon 2009 UDS Key programmer Procedure 11 Seat Toledo 08 2006 OBD CAN not needed TP22 Procedure 2 mee Seat Toledo 08 2006 2008 OBD CAN Key programmer dealer ke Procedure 3 lt Seat Toledo 2009 UDS Key programmer dealer ke Procedure 11 Me me umen ET pes _ VW American Fox 2003 OBD CAN Key programmer dealer ke Procedure 3 west coon regne Sy mean _ VW CrossFox 2005 OBD CAN Key programmer dealer ke Procedure 3 VW Suran Space Fox SportVan Fox Megamos 48 Plus 2006 OBD CAN Key programmer dealer ke Procedure 3 Megamos 48 VW ae 2005 OBD CAN Key programmer 65 VW Polo 4 2004 2009 OBD CAN Key programmer dealer ke Procedure 3 Procedure 11 VW Polo 5 2009 UDS Key programmer dealer ke Procedure 11 1998 OBDK notneeded _ 2 eR RIA VW Golf5 08 2006 OBD CAN not needed TP23 Procedure 12 Megamos 48 or VW Golf5 08 2006 OBD CAN Key programmer dealer ke Procedure 12 Procedure 2 ama mom on VW Crossoolf 08 2006 OBD CAN not needed TP23 Procedure 12 Procedure 3 Or VW Crossogolf 20064 OBD CAN n needed TP23 2 12 a 48 VW Golf Plus 2004 OBD CAN pure orogrammer NEP 12 Procedure 11 OBD CAN Megamos 48 or VW Golf 6 2009 UDS Key programmer dealer ke Procedure 13 220
150. onnecting to immobilizer OK Disabling security OK Entering into service mode OK DISCONNECT BCM MODULE FROM POWER SUPPLY FOR 2 3 SECONDS AND RECONNECT AGAIN Trying to reconnectto BCM OK Disabling security OK Transfer data Decoding data VIN WAUZZZ8T48A123456 Key count 1 Power class 79 2 read with SUCCESS 2 5 2 2 Read 2 with ABPROG If you select to read it with the ABPROG programmer you need to solder 6 wires on the BCM2 PCB and one resistance should be removed temporary after reading is finished restore this resistance There is also wiring diagram The wiring diagram is found in the program folder too for VAG zi ABRITES Commander E 70684 145 0307064AE 00000060 008000070 120000090 120000040 rj 2 GRAM fF 1 1 3 Initializing ABPROG Communicating with BCM2 Reading OF Decoding data OK VIN WAUZZZ8K89A112122 Key count 1 Power class 9C If the BCM2 module is read OK you will see the VIN number the existing key count and the power class 2 5 2 3 Key learning procedure Once the BCM2 module is read you can make as many as you want dealer keys A brand new key is needed for the dealer key One brand new key can be made a
151. or vehicles with Hitag2 Key transponder from 2004 to 2007 year VW Touareg VW Phaeton Bentley Continental Porsche 98 2 5 13 10 Procedure 8 for vehicles with Hitag2 Key transponder 2007 or Audi 8 CAN produced after year 2002 100 2 53 13 11 Procedure 9 for vehicles Audi 7 2005 105 2 53 13 12 Procedure 10 for vehicles VW Passat B6 CC equipped with 17 106 2 5 13 13 Procedure 11 for vehicles with VDO dashboard with NEC 110 2 9 13 Procedure 12 for vehicles with Visteon dashboards Hau etude ho omi rag a 113 2 5 13 15 Procedure 13 for vehicles with Magneti Marelli dashboards with UDS diagnostic and 9512 microcontroller e 115 2914 JSSDOCIUL 1 1 EUN 118 2 2 15 Special Junction Service IhieFval ed te a c d e tus oa o E NEED 116 Version 2 31 5 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 2 5 16 Special function Remote control adaptation 118 2 ld Fa 9pOClaL JURCROH NaON
152. ould be ready and can be learned with the learn button 2 5 2 Special functions with 2 A4 A5 Q5 This special function is dedicated to learn keys to the vehicles equipped with the so called BCM2 Normally these are A4 A5 Q5 after 2007 also A6 A7 A8 2010 Touareg 2010 In the beginning the customer has to select the model ABRITES Commander for VAG Select car type Audi 4 5 05 ATTENTION Strongly recommend to have a working key from the car If you don t have a working key and want to add new key the new hee will be learnt but it is not sure that it will start the car Please first put working key in programmer and press Read working key The models are divided in two groups Audi A4 A5 Q5 not necessary to have a working key Audi A6 A7 A8 VW Touareg request to have a working key or key purchased from dealer If you will learn a blank key it is necessary to put the working key in the programmer and to press Read working key If you will re learn the existing keys or will learn a key purchased from dealer i e without programming blank keys it is not necessary the press Read working key After selecting the model the procedure is identical for both groups ABRITES Commander for VAG step 1 Check BCM type Connecting to EZS Kessy Entry And Start Autorization OK Reading identification VAG 8 0907289 8W0253 Key count 1 Key authent
153. ource instrument keys were read After selecting the key file you will be asked what information to transfer Select key data to transfer Transfer learned key IDs Transfer learned key count w Transfer component protection data Transfer login Transfer learned keys Ids this are the key fixed code identifiers If they are not transferred you have to perform key learning on the new dash Transfer learned key count transfer the key count Transfer component protection data this transfer the key variable code Without this the key 15 not recognized and cannot be learned Please pay attention that in order to start the engine you ve also to adjust these component protection data in the ECU too Transfer login transfers the car login NOTE There are two types of RB8 Instruments such with 7 bytes of component protection inside and such with 12 bytes of component protection This procedure is valid only for instruments which are with 12 bytes component protection Almost all RB8 Instrument clusters are from that type these with 7 bytes of component protection are mainly represented on A4 benzine cars RS4 Benzine is also with 12 bytes 2 5 3 2 Exchanging RB8 Instrument If you want to put used RB8 instrument into a car you ve to synchronize the ECU and the RB8 instrument For that reason you need to read the ECU component protection data and the ECU MAC Then after reading the the
154. ptation measured values etc Special functions like reading login PIN reading EEPROM etc All devices which can be installed into the car are listed in the main screen of the ABRITES Commander for with their VAS Number If you want to connect to some device please double click on it The ABRITES Commander for will try to connect to the device using consecutively the following protocols KWP2000 over TP2 0 with baud 5000KB s CAN KWP2000 over TP1 6 with baud 5000KB s CAN UDS over ISO transport protocol CAN KWP1281 KWP2000 over K Line the protocol is recognized automatically from the wake up pattern You can choose which of these protocols to try when attempting to connect as described in the Configuration section 2 1 Configuration The ABRITES Commander for VAG can be configured by pressing the Options button from the main screen The following dialog is displayed in Special functions Vehicle Selection 17 Broadcast i Options Used protocol for diagnostic K Line baud rates trying sequince m Language 1 7 6 10472 9600 TP 2 0 English TP 1 6 O 3600 10472 r K Line used OBDII PINs p Logging jj 015 K Line RM P2OOO EWP 291 Enable CAN log Antena factor 5 1 _ Resistor UDS 5 Test m Enable K Line log 120 Ohm
155. r making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times remains until new login attempt can be accepted Lock timers transponder acknowledge If you give ignition OFF ON cyclically the immobilizer stops to recognize the transponder and even valid transponder will not start the car This timer shows when the immobilizer will recognize transponders This value is typically set when trying to make keys for Passat B6 CC To perform the key learning you will need the Login and for some models also a dealer key One way to obtain the login is to press the Autodetect Login Security code button This will read the login and also the component security If after that the option for making a dealer key is opened this login component security will be used there automatically 2 5 13 1 All Keys Lost Starting from V18 0 of the VAG Commander there is a special button called ALL KEYS LOST PLEASE USE THIS BUTTON ONLY
156. re when have a Tp2x transponder is the following 2 1 Enter the security access code and the number of keys 2 2 Turn ignition ON new or existing key 2 3 Press button Learn 2 4 For some VW Seat Skoda vehicles it is possible to add a new key without the remaining keys to stop working You will be asked whether you want to use this feature Please answer with yes no according to your wishes if prompted 2 5 Wait until adaptation finished is displayed 2 6 Remove key and turn ignition on with all remaining keys Key Learning Wizard Mode NOTE If you have a Key programmer you can produce the corresponding TP2x transponder which will be then accepted by the immobilizer To do this choose the Program Key function and press Next This requires only a connection with the Key programmer no connection to the car is needed ABRITES Commander for VAG loj x Select vehicle immobilizer type Select function VW Golf V Micronas dash Magenti ECU VW Passat 6 CAN VW Passat 6 with EDC1 7 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 CAN Skoda Octavia 2007 Skoda Octavia 2007 seat Altea Toledo 2007 CAN seat Leon 2007 CAN Skoda Scout 2007 CAN Porsche Cayenne CAN VW Crafter Audi A4 2002 KW2000 New Beetle KVV2000 Function Produce TP22 TP23 TP24 TP25 transponder Back gt E wit Learn Keys Learn keys 1 Turn ig
157. rument panel insert control module Ua 0924 English Value read Exit You have to select from a selection drop down list a certain item After item is selected it is automatically read and its current value can be found into column Current Column Unit shows the measurement unit of the selected item change current value you have to write down select a certain new value into the corresponding cell from column New 2 4 9 Coding of the unit Coding will open for you a separate window where you can change the coding value of the master and all slave units In the example below only the master unit supports coding Slave units 1 and 2 are without coding Coding x 01 O3C S0b6 016 BC Long 01 2sEFoDCBOU56002FF New coding 111 Coding Helper Set coding type manually 9 12 bit coding 20 bit coding QO Long coding Bytes 0 Coding data read Pressing button Coding Helper will open a new window where you can see the corresponding coding information with an opportunity to change the appropriate settings Long coding help 2 3 4 5 9 101 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 Byte 03 4 Airbags installed Byte 05 Bit 0 RightHand Driy e RHD Byte 05 Bit 2 Anti Lock Breaking System ABS installed
158. s Instant Logging NOTE changes regarding interface detection and timing parameters which you made in this dialog will be applied after restarting the application 2 1 1 Used protocols The meaning of the check boxes is as follows CAN TP2 0 when trying to connect to the device the commander will try to connect to it using KWP2000 over TP2 0 with baud 500KB s CAN TP1 6 when trying to connect to the device the commander will try to connect to it using KW P2000 over TP1 6 with baud 500KB s UDS when trying to connect to the device the commander will try to connect to it using UDS over ISO transport protocol with baud 500KB s K Line KW P2000 KWP1281 when trying to connect to the device the commander will try to connect to it using KWP1281 or KWP2000 over K Line NOTE These check boxes are used for configuring only the used protocols when trying to connect to the device in order to perform standard diagnostic requests they are not applied when auto scanning devices 2 1 2 Interface detection Normally the ABRITES Commander for VAG USB Interface is recognized automatically 2 1 3 K Line baud rate settings When trying to connect to the device over K Line the commander will try to connect to it using one baud rate and if it doesn t succeed it will switch to another baud rate and try again There are two baud rate values
159. s and Uninstalling USB interface drivers If there are some bluetooth device try to disable them Problem When starting the ABRITES Commander for VAG Interface not calibrated is displayed Solution Send all logs to a distributor Problem The device connects sometimes to the device under K Line and sometimes not Solution Try to increase decrease the Wakeup echo delay timing parameter Problem The connection with the device under K Line is unstable Solution Try to increase decrease the Inter byte time Time between messages and Communication echo delay parameters Problem How to recognize whether the instrument cluster is 4 RB4 or A4 RB4 Crypto Solution If the instrument is not crypt this means it is RB4 the immobilizer number 14 ASCII symbols is found on addresses 0x00 0x100 and 0x200 If the immobilizer number is placed there then the instrument is not crypt otherwise Problem After reading the A4 RB8 instrument the instrument displays LO instead the mileage Solution Read the RB8 instrument EEPROM and change the immobilizer status to 6 Problem It is not possible to connect to a device through the K Line since it is possible to connect to it with other diagnostic tools Solution Try to change the baud sequence to 9600 10472 from the options dialog Problem Cannot read Motometer instruments Solution Download and replace file www abritus72 com mmdata bin into the ABRITES Co
160. s here means that the immobilizer recognize properly the key and the engine is allowed to start i e everything is OK ECU Responding This shows whether the immobilizer is able to communicate with the engine control unit Transponder type OK This is used as indication whether the key on the ignition has the correct transponder type For example for Audi A3 car the immobilizer expect Megamos 48 transponder but if you put dedicated for Audi A8 which uses Hitag2 transponder then here the value will be If there is no key into the ignition you will have No once again Key count shows the currently learned keys After completing the key learning procedure this field should be updated to the new value if all keys were learned correctly Dealer key transponder Shows whether the keys transponder was successfully precoded to the specific car After making a dealer key this position should change to Yes if you put the prepared transponder into the ignition Key transponder locked indicates whether the transponder is writable Key transponder learned Indicates whether the transponder ID is recognized from the immobilizer as valid ID for starting the car After learning the key transponder to the car this should change to yes Lock times login acknowledge if invalid login was put several times to the immobilizer the immobilizer rejects further attempts to put the login This timer indicates how many times rem
161. s a dealer key several times but if you learn this dealer key to the car it is locked during the key learning procedure and cannot be used on other car anymore Once you have the required count of pre coded dealer keys you can learn them Also the original keys should be learned in this step otherwise they stop working step 3 Learn key Number of keys to learn 9 Make dealer key Key count 1 Key authenticated Yes Key locked Yes Key learned Yes 2 5 2 4 Alarm OFF This option is dedicated for the case where there are no keys from the car If there is an alarm installed after unlocking the driver s door the alarm is started after 15sec If in the meantime the customer activate this function the alarm will not start Than the customer can unlock all doors by unlocking the driver s door once again Some vehicles do not have installed alarm and after opening the driver s door all doors are unlocked 2 5 2 5 Alarm ON After the alarm was disabled and new key was learned to the car it is recommended to restore the alarm using this option 2 5 3 Special functions with instrument When this function is opened the following dialog appears Instrument Cluster Immobilizer Choose IPC type 00000000 00000010 00000020 00000030 00000040 00000050 00000070 00000080 00000090 0000004 0 000000 0 000000 0 00000000 000000 0 000000 0 00000100 00000110 00000120 000
162. s it is possible to enter by nat always possible or by modifying the EEPRUM content with a programmer dump Service made can be leaved always by but once leaved you may need to madify the EEPROM dump in order to enter it again Load EEPROM Enter Service Mode by Leave Service by Pesel 24C32 24C64 dump DOBDII ABS coding Head write EEPRUM Flash Head Read Flash 00000010 81 05 Al 5A 21 OB 2 00000018 28 Dl 41 57 21 62 7B 49 1 White 00000020 AS CD 79 DA 67 DD 1C y g 00000028 OF DS 6A F4 FF 65 1 Mileage Head mileage 00000030 60 83 4D E4 DD 19 M 00000038 CE FD 60 92 85 3C F8 F3 E OI a 2 FD q pb 00000008 8B 5B 7B 1 AC E1 6 31 11 Mileage 0 Imma Data VIN VWLWZTBBBMTITITI data Serial number Serial key L5 dbab57 34 X3db5b1 3863626 Status 140006440 Configuration 210106660100 Vw PIN 7752 Transponder identificatarz 0759704 5 KeylD2 4379408 249 73 KeylD3 45 473 LN 04 3 _ 08 LM Write Immo data Add key For these instruments it is possible to read mileage and make keys Also exchanging parts and adapting the identifications configuration is also possible The mileage function requires a separate li
163. s mileage No license required Polo Motometer 1996 mileage 93C66 calculates mileage No license required Passat VDO 1991 mileage 93C56 calculates mileage No license required Passat VD202 1993 mileage 93C46 calculates mileage No license required Passat GT mileage 93C46 calculates mileage No license required Passat GT mileage 93C56 calculates mileage No license required Caddy mileage 93C56 calculates mileage No license required Corrado VDO 1993 mileage 93C46 calculates mileage No license required Corrado MotoMeter 1991 1995 mileage 93C56 calculates mileage No license required Corrado VDO 1991 1995 mileage 93C56 calculates mileage No license required Jetta 1994 1996 mileage 93C46 calculates mileage No license required T4 MotoMeter 1996 1997 mileage 93C56 calculates mileage No license required
164. second hand module ATTENTION You should know the power class of the engine control unit before you execute this function Normally the power class of the comfort module is displayed automatically if you load EZS Kessy dump and the customer is able to change it if the ECU has different power class If you enter wrong power class and this is a working vehicle i e ECU and transmission are adapted the car will stop working It will start working again only if you put the correct power class in the beginning of the procedure This is so because the transmission will take the power class you enter Specific for this module is that the component security is not 7 bytes but is 12 bytes The first 6 bytes are these which you read from the ECU or the EZS but the second 6 bytes are available only in the EZS So you should put here the values which are displayed when you read the EZS it is more easily if you load the EZS dump for the car to which you will adapt the transmission gearbox 2 5 8 Special function Steering lock adaptation The window Steering lock adaptation can be used for adaptation of steering lock control module to the VW Touareg VWPhaeton Porsche Cayenne Bentley Continental Audi A8 This adaptation can be by CAN TP2 0 or K KWP2000 To perform this adaptation you need to know the security access code of the immobilizer and working aligned key from the car HiG ABRITES Commander for YAG E x Procedure
165. sion 0 In this dialog is needed to clarify the diagnostic session which you want to be entered before start of read program memory In the example above it is used session 86 If you want to save currently running diagnostic session simply enter session 0 2 5 11 Special functions with Airbag With this special function one can Read Write EEPROM memory of an airbag module Clear the crash data of an airbag module Connection type Choose ECU type Read EEPROM AUDI BOSCH 1997 2000 Automatic AUDI BOSCH 2001 2003 a 00000010 oo og AUDI BOSCH 2003 NON WG 00000020 00 OO VM SIEMENS ALL DUBIE GG Write EEPROM 00000030 00 00 00000080 00 ee or ee 00000050 00 00 00 OO OO OO BO 00 00 00 OO OO 00000060 00 00 OO OO OO OO OO 00 OO 00 00 00 00 OO 00000070 OD OO 00 DO DD OD 00000080 OD OO DO DO DD OD 00000090 00 00 00 00 OD DD 00 OO OO DD OD 00000040 00 00 00 00 OO OO 00 DO DD OD 00 OO OO 00 DD
166. splays if the service is supported by the corresponding controller the SW and HW version of the unit including all slave units of the master unit BW HW version SW version of module 1 Ez 5 9 SW version of module z Dz 86 39 SW version of module 3 6 3 version of module 4 4 7 SW version of module 5 APOSS V19 nz Hardware number E 2 4 3 Extended Identification Extended identification VIN displays programming data flash status programming attempts flash date VIN number Supplier identification TF 74035 Production date 16 10 03 Changes from supplier s ns Number of validation status 1001 Current supplier s number 3DEF Flash Programming succefull ready for driving Programming attempts 0 Successful programming attempts 0 Status of conditions for programming Flash Tool code 0000 0 Flash date z3 05 n03 2 4 4 Read Diagnostic Trouble Codes Read DTCs will display all present errors in master and slave units Displayed errors can be together with freeze frame data this depends on the checkbox Read Freeze frame Status Permanent error 18038 Accelerator Position Sensor i579 Signal too Low Status Permanent error 19804 Control Circuit for Controller for Turbocharger 1 117241 Electrical Malfunction Status Sporadic error mechanical error 13604 Control Circuit for Controller for Turbocharger 1 14
167. t for the same unit two different programmers can produce different dumps Normally the software tries to autodetect the byte order of the dump but if it doesn t succeed then you may need to use the Swap bytes button This buttons changes alternatively the byte order into the dump So if after loading the dump file into the dump tool data cannot be extracted or modified or the extracted data are not valid e g displayed PIN is not accepted from the car please try to swap bytes to get result For some functions the swapping is made automatically for example the decoding of the Kessy but for some function the user has to made this manually A more detailed description of the most important functions follows below IMMO KESSY Audi A8 VW Touareg VW Phaeton Porsche Cayenne Bentley Continental 93C86 Required license 003 This function is used to extract the security code from the Kessy module this module is used in Audi A8 VW Touareg VW Phaeton Porsche Cayenne and Bentley Continental The function also displays the learned keys and visualize change the immobilizer and VIN numbers IMMO KESSY Aud Vw Touareg Phaeton Porsche Cayenne Bentley Continental S336 Load dump Save dump D7 00000050 35 57 46 34 57 30 32 31 DA 56 42 52 42 78 D SWEAT7 ZI VBRB4x 00000060 56 42 52 42 34 78 DA 56 42 52 42 34 78 05 04 00 VBERBdx VBERB4dx m
168. t time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with the Hitag2 key tool Making the key by disassembling the Kessy or the ECU You can load a dump of the Kessy or ECU by selecting Component Security Bytes Kessy ECU dump After pressing the Load button you ve to select the respective dump file Press Next to proceed with key programing NOTE Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes In this case you will need to search for the 7 byte NOTE Please pay attention that if you have the Kessy dump then you will have all the 7 bytes But there are a lot of Kessy devices with different software versions so it is possible that the EEPROM is incorrect decrypted especially for newer cars respectively the component security bytes will be wrong In this case the key will not work and you will need to restore the key using the Hitag2 programmer Making the key in the case when Autodetect is not functioning It is possible that by some reason the Autodetect is not functioning e g missing license you don t make the short with the fuses properly ECU is missing or is broken and so on If you ve already read the component security bytes previously e g by dis soldering the ECU EEPROM and decoding it by dump tool
169. ta Head mileage Immo Data VIN WWWZZZERZAYI 23456 Head Immo data Serial number dr Transponder identificators Serial key C5 7 1 ccfefet5 KeylDi5 data MAC 50280000 KeyD2 12 13 Status 140000fedd kelba Tab48ef4 Eel Dr Configuration 2 0106 330100 vy n 4 Kel Da Add key FIM 12345 Press button Read mileage to read current mileage value Press button Read EEPROM Write EEPROM to read write EEPROM data Press button Read Immo data for reading the Immobilizer data After Immobilizer s data is read you can make modifications and write it back using Write Immo data button After Immobilizer s data is read you can add a new key Pressing button Add key will prepare dealer key add it to the immo data and write the new immo data to the immobilizer 2 5 1 5 Special functions with A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM The A8 4H A7 4G A6 4G Touareg 7P UDS dashboard with 95320 EEPROM special function is dedicated for the A8 4H A7 4G A6 4G Touareg 7P instrument clusters with 95320 EEPROM and UDS diagnostic protocol After starting the function a following dialog will be brought to the user 4 7 46 6 46 7 UDS dashboard 95320 Head EEPROM Load Dump Modify Dump write EEPROM Save Dump Mileage 0 Press button R
170. the Special functions list but also it is available in the standard diagnostic dialog The functionality is the same on both places with that difference that in the standard diagnostic dialog the user should open the diagnostic connection perform security access enter into diagnostic session prior to starting the custom read write When this functionality is opened from the Special functions list these actions are automated and performed from the ABRITES Commander for Using this application you can read program memory in some electronic control unit Requests sent from this application can be related for the currently running session of for some of electronic control units from the dialog You can use this application for many different purposes investigations read program flash memories for example you can program by this dialog internal flash memory of EDC16 In the example below we read a part of the flash of EDC16CP Custom memory download upload Choose ECU type EDC16U1 1 EDCIBCPJEDCTBCP3A m Master EDCIBCA Slave EDCIBUT Master Save to Slave EDC16U31 Master Slave 9 5 10 MEDS 1 Master 9 1 Slave Connection Sk Address 00000 Len of req 0 Total size 100000 Shep Encryption Download Upload C Read write mem Diag session Ses
171. to write the saved coding back to the ABS module after you have finished your work with the instrument cluster Additionally the commander will automatically try to read and save the ABS module coding when you load an EEPROM dump using button Load EEPROM 24 32 24 64 The interface should be connected to the car and ignition must be ON in this case If the ABS coding is successfully saved the commander will automatically try to restore it after you use Enter Service Mode by OBDII It is possible that the ABS module refuses to accept the coding even though it is the valid coding read before it was lost In this case the commander gives you the option to write the coding directly to the ABS module EEPROM Read the ABS EEPROM with a programmer and then use button Set EEP into ABS coding section which will write the saved coding into the EEPROM dump Save the modified EEPROM and write it back to the ABS Service Mode is leaved when if you entered the service mode using a programmer then Leave service mode will leave it If you want to enter again you need to modify the EEPROM dump again Pressing the Reset button will not leave the service mode if you entered the service mode by OBDII both the buttons Leave service mode and Reset will leave the service Once the service mode is entered you can Read Write the whole EEPROM Read the whole Flash Read the mileage Read Write the immobilizer data
172. tomatical check might be not possible for some models e g VW Passat B6 So it is required that the manual procedure is used in this case Manual The main difference between the automatical and manual procedure is that by the manual procedure you should put the key into the programmer then make a ignition with it and then once again to the programmer and so on until the byte is found If you use the manual procedure you will be consecutively invited to put the transponder into the program and than to give it to the ignition Normally for the most models it is required that the key is in the ignition and you change only the position of the transponder You will be invited to put the transponder into the programmer then to put it near ignition lock so it is read by the immobilizer Exception from this is e g the Passat B6 For it it is required that you put the key with the transponder is put into the programmer then the key with the transponder is put into the ignition lock BUT TILL FIRST POSITION than again into the programmer and again into the ignition lock until the byte is found NOTE If you get XXX is displayed you need to stop on the current position and wait 10minutes before you continue ATTENTION For the Passat B6 there are some cars for which you cannot search for the 7 byte For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM Then after having the 6 bytes of th
173. unction is opened by selecting it in the list box and double clicking it or by pressing the Open button NOTE For the purposes of the some special functions basically for the key learning there are buttons for auto detection of the PIN and component security Basically this will try to read these data from the engine control unit but it will try also first to read them from the instrument cluster if the instrument cluster supplier is VDO Please pay attention that for VDO version after end of 2006 it might be required that the part of the instrument cluster is re flashed This is also required for functions for the reading of the mileage As mentioned in the license agreement use these operations on your own risk 2 5 1 Special functions with Instrument CAN When this function is opened the ABRITES Commander for tries to establish diagnostic session with the Instrument cluster using KWP2000 over TP2 0 or UDS session is successfully established the commander reads module s identification and tries to automatically detect the instrument cluster type The following types can be detected VDO MM Visteon 2007 CAN TP2 0 VDO with NEC uC 2009 UDS JCI with NEC uC and 95320 EEPROM CAN UDS Magneti Marelli with 9512 uC CAN UDS A8 4H A7 4G A6 4G Touareg 7P with 95320 EEPROM CAN UDS If connection to Instrument Cluster cannot be established or Instrument cluster s type cannot be
174. ure 2 26 2 2 1 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 List of Revisions Date Chapter TIT NN INCIDIT TTE a 2 31 Update to 18 0 of the software 22 01 2013 EDC17 MED17 bootmode added EDC17 MED17 readingby OBDII added Adaptation of EDC16 EDC17 MED9 MED17 description changed Adaptation of Passat B6 comfort module added Adaptation of A6 Q7 Allroad transmission gearbox added ALL KEYS LOST section added Version 2 31 3 ABRITES COMMANDER FOR 18 Document number 2 20071127 Date 22 02 2013 disi vad shan cece esas 8 1 1 INSTALLING ABRITES COMMANDER FOR a R 8 2 DIAGNOSTIC WITH ABRITES COMMANDER FOR 7 222 2 9 gt a 10 2 d Used DEOIOUDISS iius ita 10 24525 MITE TCE CLC CL OV igo 11 210 KEME Daud soviet 11 2 4 O PONET OT S 11 Dal
175. ve all 7 bytes then you can program the key directly If you have only the 6 bytes you have to choice a if you have working key from this car you can put it into the programmer and press the Find 7 byte from working key the 7 byte will be found in several seconds b if you don t have a working key you ve to search manually for the 7 byte The procedure takes approximately about 20 25 min but can rise to 45min in the worst case You ve to connect the interface to the OBDII and the programmer should be connected too Then after pressing the Program button you will receive notification when to put the key into the ignition and when to put it into the programmer IMPORTANT You need only to put the key inside for VW Touareg you will hear the unlocking of the steering in this case please DO NOT ROTATE THE KEY IMPORTANT You may hold the programmer near the ignition lock so you can proceed faster when you remove the key But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed NOTE It is always better to use a plastic key or an empty transponder when you search for the 7 byte at least when you prepare such keys for the first time If by some reason the key becomes locked e g battery goes down computer is hang up etc you can find the encryption key with the Find 7 byte from working key button and then you can restore the key with
176. vehicle types After vehicle immobilizer type is selected in the right box appears a list with supported key learning functions At the bottom of the window appears a short description of the selected function Learn Keys To perform key learning choose Learn Keys Add Key For some models it is possible to add a key to the existing already learned keys without erasing them If available select Add Key function for this case Program Key oome models require a dealer key To prepare a dealer key select Program Key After the desired function is selected press button Next to proceed To perform the key learning in most cases you will need the Login If you have selected Learn Keys pressing Next will lead you to the following window ABRITES Commander for n x Autodetect Login Code Write Login Code Load Login Code Using Dump Tool Login Code 9 lt Back Exit You choose from three variants to obtain Login Autodetect If this option is selected by pressing Next the system will try to read login component security automatically ABRITES Commander for VAG _ 0 Autodetect Login Code Write Login Code Investigating cluster Please wait Login Code 0 lt Back gt Exit If login is read successfully it will be put into field Login Code and the system wil
177. vice mode should be automatically entered In other case if you don t have a working key from the car and service mode cannot be entered by OBDII the commander will ask you whether you want to enter service mode by EEPROM dump If you choose to enter service mode by EEPROM dump you have to dismount the dashboard to open it and to read the EEPROM with the programmer There are two possibilities dashboard is equipped with 24032 EEPROM in this case you need to read the EEPROM with the programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered Dashboard is equipped with 24064 EEPROM you need to read the EEPROM with programmer then press Load EEPROM 24C32 24C64 dump and load the EEPROM dump Pressing Enter Service mode bye EEPROM dump 24C32 24C64 will modify the EEPROM dump and you need to write back the modified dump to the dashboard immobilizer After that you need to press Next and the service mode should be entered After service mode is entered 3 The following window will appear FJ ABRITES Commander for VAG loj x Immobilizer Keys Key 1 68e4c4f1 6d768ef4 5 Key 2 b704fdec 5 38
178. w you connect to the device to proceed standard diagnostic requests The following dialog is opened MG Engine Control Unit Master P2000 Rx Establishment diagnostic session with selected unit electronic control unit identification lt lt 2 lt lt lt Imzz 222 z2222 2 23 7090 016 VAG number PROGRAMMABLE Clear log Program status 7 data status 01 Coding 11172 Part number 56525 Importeur zs number 211 Supplier number 137 System description BS z 5L EDC GCOOUSE Write lod X A Diagnostic requests Read Freeze frame Securit See Diagnostic session Identification Read DTCs Basic settings downloaduplo 5 Access ES E Clear DTCs requests Measured i Ext Ident IN EE Reset Program This dialog provides you the possibility to execute the following diagnostic requests Adaptation Actuator test Coding 2 4 1 ldentification Identification will provide you the VAG part number and software coding 1 eB lectronic control unit identification Device l 4FO0910401L lt VAG number PROGRAMMABLE Program status OO data status 0 Coding 11772 Part number Importeur zs number 0 Supplier number 0 System description 3 0L V TPI cGOO004AGC 2 4 2 Software and Hardware version of the unit SW HW version di
179. w abritus72 com Ioj xl unit name VS Number Coding E 1 Engine Control Unit Master Previous 02 Transmisson 03 ABS 04 Steering Angle 05 EZS Heasy Entry And Sta 06 Seat memory passenger 07 Control head Climatronic Auto HVAC Central Electic Air heating oc an Slide door left Special functions e Vehicle Selection i Broadcast ed Options CAN K Line P di EE Instrument Ez 5 Kessu BUM Instrument Engine Control Component EDCTE MEDS A amp B Touareg Steering lock L465 K Line Unit protection adaptation b Kessy ada adaptation Se QU 086 m m activation Key learning Dump tool Airbag Mw Crafter DSG Mileage Custom Converter Remote EDT ED control Wail Tana om ATTENTION Make sure you are running the ABRITES Commander for VAG from its folder If you are using a shortcut to the ABRITES Commander for VAG please be sure that the working folder parameter is set to the folder where the executable is placed If the working folder of the shortcut is not set the K Line may function incorrectly 2 DIAGNOSTIC WITH ABRITES COMMANDER FOR The ABRITES Commander for VAG consists basically of two parts Standard diagnostic functions like reading clearing trouble codes device identification ada
180. y pressing Learn button with the respective PIN code entered If by some reason the SW doesn t succeed to read the PIN CS from the Visteon dashboard the SW proposes to read the from a Magneti Marelli EEPROM dump since these cars are equipped in the most cases with a Magneti Marelli engine control unit If the car is really with Magenti Marelli engine control unit you need to open the EEPROM dump here and this will read for you the PIN code and the CS If only 6 bytes of the CS are contained in the engine you will need to search for the 7 byte NOTE Some cars are equipped with Simos engine control unit instead of Mangeti Marelli If once again the SW doesn t succeed to read the PIN CS you need to read the Simos EEPROM dump with a programmer and from the dump tool to get the PIN CS Then you can prepare a dealer key and to learn in on the absolutely same way as for VW Seat Skoda 20074 Key Learning Wizard mode ABRITES Commander for VAG 4 Select vehicleummobilizer type Select function VAG vehicle VDO NEC 2009 CAN VAG vehicle MM Motorola 9512 2009 CAN Audi A6 Allroard 2005 CAN Audi Q7 2005 CAN Audi A3 CAN Audi A8 CAN VW Golf V Micronas dash Magenti ECU CAN VW Passat 6 CAN VW Passat 6 with EDC17 MED17 CAN VAG vehicle 2007 CAN VAG vehicle 2007 Skoda Octavia 2007 Skoda Octavia 2007 CAN Seat Altea Toledo 2007 CAN Function

ABRITES Commander for VAG User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents