Passat B7 mileage correction

[mickyjenny]

Hello everybody,
I wanted to have a 3D color cluster in my B7 Passat so I bought a 3AA920880 SW611 to modify to 3D with tiguan SW 1104 and CC 38C920881A EEPROM content.
The first surprise is that this cluster has a write protection on the EEPROM (Microchip Tecnology 24LC64, according to the datasheet WP on pin 7, checked with the multimeter in circuit this pin is shorted to pin 1-2-3-4, so I'm not able to read or write without desoldering it. I also tried with test points but GND is shorted to pin 7 so the problem is still there), the second is that it has more than 190.000 Km and that I can't transfer a lower mileage (I have 128.000) with VAG dash editor. Before I start desoldering (to save the content of the original EEPROM), soldering again, flashing, desoldering once more (to write the 38C920881A EEPROM) and soldering the last time I wanted to know if there is a way to correct the mileage. The tools I have are CH341A, TL866II PRO, T48, VCP, VCDS and several hammers in the worst case scenario. :roflmao:

[H2Deetoo]

There is no write protection in use for these clusters.
You can read/write the 24C64 in-circuit if you have a proper programmer, or desolder it.

You cannot lower mileage by only eeprom, it has to be done by OBD using a suitable tool.


Rgs H2Deetoo

[mickyjenny]

There is no write protection in use for these clusters.
You can read/write the 24C64 in-circuit if you have a proper programmer, or desolder it.


It's very strange, I've seen a lot of these instrument clusters but I think I found the only one with a protection. :chuncky: Also the pcb around the eeprom is different compared to other clusters. You can see the traces under pin 1-2-3-4 and 7, other clusters look different:
948481




You cannot lower mileage by only eeprom, it has to be done by OBD using a suitable tool.


Rgs H2Deetoo

The creator of a dashboard tool wrote that the problem is that when you put a lower mileage in the bin file the checksum will not be automatically calculated. To do it manually you must know the algorithm and it is different for every processor. :palm2:

[H2Deetoo]

It's not a checksum but simply an encrypted mileage value which must match the non-encrypted mileage value.
So it is possible to ajdust it in eeprom directly but you have to know the unique key from the cluster flash.

And I'm pretty sure you don't have a unique cluster which has a write-protected eeprom; you must be doing something wrong.

[H2Deetoo]

The WP pin works on a high level, so it is normal it is connected to GND to make it UNPROTECTED!

[mickyjenny]

You are right. After desoldering the chip I had the same issues to read it:
948862
But now I understood why... TL866II PRO and T48 don't autorecognise 24 EEPROM, I had to select manually the chip and then read it. It works also in circuit, after resoldering the chip I tried with the clip and works perfectly.
I'm glad about it because since than, I had to read and write the EEPROM more than ten times to clear all the errors that I got. And I'm not done, after solving all the issues changing several addresses in the bin file (thank you internet for all the informations that you provide) I took the car to a shop and they lost almost 3 hours because Obdstar X300 PRO and Diagprog4 asked for the smart key (that my passat doesn't have) to change the mileage. I had to took apart the cluster so that they could feel a section of the EEPROM with FF. Now I have the right mileage but a lot of errors. Tomorrow I will transfer the actual mileage to the last working EEPROM that I had (with an higher mileage but no errors at all and my old VIN number that I took from my original cluster: 0x12E1-0x-12F8, 0x13C0-0x13D7, 0x13D8-0x13E0F). Will be interesting to understand which address was causing the key request, this part is still something from the tiguan EEPROM that is not needed on the passat (for the 2d to 3d mod).

[mickyjenny]

The first part is done, I was able to get rid of all the errors caused after lowering the mileage. Coping just the mileage to my last working bin was not enough, the cluster started in error mode (instead of the km you just see the error message and a lot of funny errors in VCDS, all without mileage indication). The reason is that in the EEPROM the mileage is stored in 3 different addresses:

0x12A0-0x12BF (Mileage)
0x12C7-0x12DE (Base mileage checksum)
0x14D0-0X14E7 (Duplication of the main mileage control)
*Update
0X14E8-0X14FF Must be changed too, is another duplication of the base mileage. I had no errors when I forgot to change it, but to be sure now I changed it too.

Just changing the first part: Error mode
First and second parts: The cluster shows the old mileage 193.000 (moment of fear, I thought I could not come back to 129.000)
First, second and third parts: Everything works, the right mileage is back (129.000) and no key request error after a while (this error first appeared after they messed with my EEPROM, filling it with FF... I don't know exactly which address).

I still would like to understand which address of the immo part is responsable for the key request by trying to lower the mileage with a special tool. I'm pretty sure that it's a mess that I did at the beginning:
I made no backup of the orginal 3AA920880P, thinking that I had to import just the content of my 3AA920780A to 38C920881A. A big mistake because you can not just import the immo part of a cluster to another cluster.
So I had to import the immo of the 3AA920880P backup to 38C920881A after flashing with the tiguan firmware. I made a backup of the EEPROM after the upgrade (has been recognised as 3AA920880P SW1104) and than I imported the immo part to 38C920881A. I think that during the tiguan flash some part of the eeprom (between address 0X12A0 and 0X14FF) has been overwritten with tiguan information (that I still have on my EEPROM), that's why when you try lower the mileage with every tool will ask for the key (normal procedure for a tiguan).

[mickyjenny]

It's not a checksum but simply an encrypted mileage value which must match the non-encrypted mileage value.
So it is possible to ajdust it in eeprom directly but you have to know the unique key from the cluster flash.

I can confirm it now. Knowing the value of 0x12C7-0x12DE / 0x14D0-0X14E7 / 0X14E8-0X14FF of a specific cluster, with a certain mileage, you can always go back to that mileage.
The creator of Vag Dash Editor was able to find out his own encryption key and he can put every mileage (on that cluster).
Maybe a day someone will create a tool that starting from the encrypted value in the bin file can calculate a new base mileage.