New Beetle 2000 PIN

[pojd]

Hello there!

Anyone kind around to help me with decoding PIN from immo dump for my wife's New Bettle? The immo code is 1C0 920 800 C. It is a 2000 New Beetle, 2.0 gas.

I tried using VAG K Commander with a KKL cable with the FTDI chip inside, the communication works, but it gives me few different PIN readings. It only reads the PIN when choosing Instrument Cluster Magneti Mareli - Shadow 2 Passat there as an option, for other Magneti Mareli options I get no reading at all (stays at 0). None of the options gives me any odometer reading either.

I tried all those numbers (1792, 1796, 1540), but none of them work in VCDS when using login (I may have hit the secure timeout in immo though). Yes, I did enter them with a 0 in the beginning (5 digits). Ideally I would know the PIN for sure, tried looking up the actual algorithm, but did not find any for this immo2 so far.

Tried doing dumps with all Magneti Mareli options, but only the "Cluster Magneti Mareli - Shadow 3 (TT)" gave consistent bin dumps. Comparing to some other Beetle dumps, mine seems quite small though in size (only 488 bytes as opposed to 1024 bytes I have seen around). Perhaps I should try using some other program to dump the immo instead?

If it is complete though, would anyone be able to help decoding the PIN from there?

Thanks a lot!

[nikz]

dump bad
too small

[pojd]

You're right. I was playing around a bit more with VAG Commander, noticed some magic checkbox (something like skip negative response) and that seem to have helped to get the full 1024 bytes out. At times it would also read a PIN, at times not, this time 3072 most of the times, but VCDS rejected that.

Can you please kindly check this dump instead?

[narkeleptk]

still seems like bad dump. I was looking at it with orange5 and its wont calculate the pin.<br>this is pretty easy cluster to read on bench if you have anything that can read mcu 912d60

[pojd]

Thanks for checking! I am using VAG K CAN Commander via OBD2 to read the contents of the chip (directly connected to the car OBD2). I thought perhaps due to some failed attempts earlier to enter PIN, it may just be somehow protecting against reads, so pulled out fuse and tried again. It seems it is still giving different readings - after some time they are consistent and they always differ in just 1 byte at offset 432.

The dump from yesterday had value ed in there, today after removing fuses the first fresh read gave value ec. But then some follow up reads eb and ea (the last one now consistently reads). Any clue why that would be the case? Or any recommendation on using some other soft? I am using KKL cable with FTDI chip running on WinXP (in virtual).

I have attached all the variants just in case some of them would be good (rom1 in the zip is the file from yesterday and there are also these 3 more variants).

Thanks for your help!

[cqae]

remove the cluster & read it with a programmer

[pojd]

Thanks. I have removed the cluster, but still no joy. I also removed the back from it to see the actual PCB, but I do not see the chip 95040 inside, perhaps that's why I am having issues. Reading in OBD mode with eeprom tool or any other tool still gives the same results as before.

I wanted to try a bootmode, but am actually confused as to which chip on the board actually holds the immobilizer. I assume it is the one marked as Magneti Marelli L9143? I can also see chip PCF8566T, 991MQG (MEGAMOS RES). I assume the last one is the actual chip controlling the whole dash, whereas the Magneti Marelli is the one I am trying to talk to?

Tried looking for a datasheet to know which pins to ground to get to bootmode, but with no luck. Anyone has any clue to help me with my bench setup? Perhaps I need some special tools to read this chip data instead? I have tried all the ones I could (vag tacho, vag k commander, me7_95040, vag eeprom programmer, but still no joy. Just VAG K Commaner was able to read, but the dumps still look the same as above - i.e. bytes at offset 0x32 and 0x33 are still FF, which I believe should hold the pin instead, correct?

Any clue much appreciated! We bought this car from a local shop, it is likely this dash has been played with before (since I also found earlier the CEL led was covered with a dark black glue to hide CEL).

[vasa]

Old new beetle have motorola MCU and cant read eerpom obd you need programmer xprog upa usb etc 4 wire conect and read maybe is easy read pin from ecu

[pojd]

I have a custom bench setup (simply using some breadboard and wires going out of the cluster and OBD connector and an extra 12V car battery to power it all up.
I followed http://nefariousmotorsports.com/forum/index.php?topic=5068.0title= to set all up, used http://dehon.org/antoine/newbeetle/NewBeetlePDF%27s/Instrument%20cluster%20pin%20assignments.pdf to find out pin assignments on the connectors at the back of the cluster and am able to talk to the cluster again over K-line. From all those links it seems I should try to ground a pin on the ECU, but I don't know whether it applies to my setup too.

I am attaching the pics of the board, anyone has a clue how to be able to read this with a plain KKL cable on a bench?

https://photos.app.goo.gl/wJlE2T3fW6E5lT9s1

[narkeleptk]

I said in my first post you need read the mcu 912d60. I usually use orange5 but 'm sure there are many cheaper programmers that can read this mcu.

[pojd]

Ah, ok, got it now. So no joy without that programmer and I don't want to try going a path of programming something myself, will probably just try recoding the chips inside the new keys then, should be brand new. Thanks for all your help!

Still seems like VAG K CAN Commander was able to read at least the first portion of the EEPROM just fine, but I can see comparing to other dumps that the section full of 55 hex values is probably some sort of protection of the chip against the read, I only get that when checking skip negative response from controller.

Anyway, giving up now, thanks again all.

[pojd]

OK, after putting all back into the car, the immo inside cluster probably reset itself, so even the old key would flash the immo light. So decided to purchase a bit older Vag Tacho interface and was able to pull out the eeprom and the PIN too over OBD inside the car. The tool claims the PIN is 6121, can anyone kindly confirm from the dump? When I tried coding new keys in VCDS, the controller rejected the login (06121), but I suppose that is due to some security wait time. Is that inside the eeprom (i.e. this dump) too? Anyone able to either confirm this PIN is correct or potentially find out the wait time? I suppose there is no way to workaround this with the tools I have other than just drive with the old key for a few weeks and then try again? (Alternatively obviously keep a car charger on the battery and leave the ignition on say overnight).

Btw after I connected vagtacho, the old key was recognized again by immobilizer, so I can at least drive now again using the old key...

[narkeleptk]

I suggest you look at some help files on using vcds at their site. You can check lock times with it to see if that is your problem for starters.

[pojd]

Thanks, will do some more research, found nothing in measuring blocks, but this does not belong here anymore. Thanks for confirming the PIN!

[pojd]

Btw all sorted now. This is immo2, so the wait time is not visible anywhere in the measuring blocks unlike immo3. But still a few hours later I was able to code new keys just fine.

[webzone2019]

I got the same problem and need help to find out the PIN code.

I have a 2000 New beetle tdi 1.9L diesel car. the car should have immo2. I got a cluster dump file by using the vag k+can commander 2.5 and a kkl cable.

Please help me to find the PIN code in the file.

Thanks!