VAG-COM/VCDS EVERYTHING

[Laique]

Hi guys!
Glad that i found this topic

I'm looking for an upgrade to 18.2 or maybe 18.9. (This cable works now with 17.1.3.)

There are few things i dont know and hope you can help me.

Here is my cable that came to me last week.

Attachment 583250

VAGCOM_HWTYPE tells me its:
FW Version: 1.96
HW Version: 0x46

Files that i've found in this thread seem to have the same FW version.

Attachment 583251

What should i do now?
Do i still have follow the FirmWare upgrade procedure or do i just have to install the newer VCDS, then crack it with VCDS_Loader, and then update the cable using VCDS?

thx

Seriously NOBODY ?!

[eliteland786]

Not pin 1 of FTDI but rather pin 25, I believe. Check the chip orientation!

The EEWrite tool reflashes it to the same HW as it was flashed before. It's impossible to flash it to different one because of different bootloader size/different fuse bits.
In order to reflash from 0x46 to 0x44 you will need to do that using AVR programmer (e.g. USBASP)

No it's definitely pin 1 next to the dot...looked at schematic and that's pin 1.

Not going to bother with re flashing with AVR programmer if it's working let it be.

[eliteland786]

No it's definitely pin 1 next to the dot...looked at schematic and that's pin 1.

Not going to bother with re flashing with AVR programmer if it's working let it be.

Pin 1 is TXD and pin 25 is ground...AGND.

[Elektrik1]

Some progress, made - developed Arduino Mega based bruteforce interface with GAL slot and tested with GAL from working 0x44 cable, chip works fine after such manipulations
20181230_032105.jpg

Wrote simple program to toggle each pin and check remaining pins state:

void setup() {
  Serial.begin(115200);
  //Main loop 
  for(int i = 22; i<=39; i++){
    //Pin configuration loop
    for(int j = 22; j<=39; j++){
      if(i == j){
        //Set togg'able pin as output
        pinMode(j, OUTPUT);
      }else{
        //All other pins as input (high impedance)
        pinMode(j, INPUT);
      }
    }

    //Toggle output high
    digitalWrite(i, HIGH);
    for(int j = 22; j<=39; j++){
      //Skip checking togg'able pin from reading
      if(j == i) continue;
      //Check if input is high
      if(digitalRead(j) == HIGH){
        //Print values to UART
        Serial.print(i);
        Serial.print(" ");
        Serial.println(j);
      }
    }
    //Toggle pin back
    digitalWrite(i, LOW);
  }
 
}

TODO: implement code for each combination toggle; Karnaugh map minimizer for logic generation.

Results:

OUTPUT PIN 1-(10 skipped, GND)-19																			INPUT PIN 1-(10 skipped, GND)-19
1	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0		-	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
0	1	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0		1	-	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
0	0	1	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0		1	1	-	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
0	0	0	1	0	0	0	0	0	0	0	0	0	0	0	0	0	0		1	1	1	-	1	1	1	1	1	1	1	1	1	1	1	1	1	1
0	0	0	0	1	0	0	0	0	0	0	0	0	0	0	0	0	0		1	1	1	1	-	1	1	1	1	1	1	1	1	1	1	1	1	1
0	0	0	0	0	1	0	0	0	0	0	0	0	0	0	0	0	0		1	1	1	1	1	-	1	1	1	1	1	1	1	1	1	1	1	1
0	0	0	0	0	0	1	0	0	0	0	0	0	0	0	0	0	0		1	1	1	1	1	1	-	1	1	1	1	1	1	1	1	1	1	1
0	0	0	0	0	0	0	1	0	0	0	0	0	0	0	0	0	0		1	1	1	1	1	1	1	-	1	1	1	1	1	1	1	1	1	1
0	0	0	0	0	0	0	0	1	0	0	0	0	0	0	0	0	0		1	1	1	1	1	1	1	1	-	1	1	1	1	1	1	1	1	1
0	0	0	0	0	0	0	0	0	1	0	0	0	0	0	0	0	0		1	1	1	1	1	1	1	1	1	-	1	1	1	1	1	1	1	1
0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	0	0	0		1	1	1	1	1	1	1	1	1	1	-	1	1	1	1	1	1	1
0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	0	0		1	1	1	1	1	1	1	1	1	1	1	-	1	1	1	1	1	1
0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	0		1	1	1	1	1	1	1	1	1	1	1	1	-	1	1	1	1	1
0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0		1	1	1	1	1	1	1	1	1	1	1	1	1	-	1	1	1	1
0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0		1	1	1	1	1	1	1	1	1	1	1	1	1	1	-	1	1	1
0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0		1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	-	1	1
0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0		1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	-	1
0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1		1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	-

As it seems things get tricky, as it seems from datasheet, GAL can be configured as clocked, and registered modes:
sshot-2018-12-30-03-53-10-1.jpg

So for further investigation I need someone who can tell about known 0x44 configuration (additionally to C3H8 logic), as well as create .JED file with known logic to check if bruteforcer works fine.

Cheers

[Roma77]

Elektrik1

The algorithm of work and programming CUPL of FPGA is well described in this article. https://justmoose.ru/?p=17

Laique
Please read the info file in the kolimer folder, as well as several pages of the forum and you will find the answers.

Please read the info file in the colimer folder, as well as several pages of the forum and you will find the answers.

[schmiddie1982]

Hello @LL,

can someone reupload the newest loader for \/CDS 18.9.0 (DRV) German and the firmware files please ?

Thank you in advance.

Best regards

schmiddie1982

Gesendet von meinem F8331 mit Tapatalk

[kaalis]

What should i do now?
Do i still have follow the FirmWare upgrade procedure or do i just have to install the newer VCDS, then crack it with VCDS_Loader, and then update the cable using VCDS?

Run VAGCOM_HWType.exe to see if you have locked bootloader, then VAGCOM_EEWriteLang.exe if it's not locked and you don't know how old vcds version was used for it, use loader, and then update firmware after port test.

can someone reupload the newest loader for \/CDS 18.9.0 (DRV) German and the firmware files please ?

Check last post from Kolimer, there are still some loader links active.

[Laique]

Run VAGCOM_HWType.exe to see if you have locked bootloader, then VAGCOM_EEWriteLang.exe if it's not locked and you don't know how old vcds version was used for it, use loader, and then update firmware after port test.

Check last post from Kolimer, there are still some loader links active.

thx. for the answear man!

49029629_2036877646534703_4153387633277403136_n.jpg
This is all what VAGCOM_HWType.exe is telling me. How do i know if the bootloader is locked ? The cable works with 17.1.3 now.

[kaalis]

That exe is not from 7.2 loader.
Anyway you can try eewrite and it will tell if it's not in bootloader mode or flash it succesfully.

Don't forget to plug it in obd2 port while flashing.

[Laique]

That exe is not from 7.2 loader.
Anyway you can try eewrite and it will tell if it's not in bootloader mode or flash it succesfully.

Don't forget to plug it in obd2 port while flashing.

THANKS A LOT!

The VAGCOM_HWType.exe from 7.2 shows the bootloader is enabled! i will start with VCDS 18.2.0 ENG.
Is the 18.9.0 stable 100% ?

[kaalis]

Latest not very, but you can report your findings in this topic.

[GianniNOS]

Hi, is possible to repair this cable?

[alexm1]

Yes, you can. But first you need "kill" STC, see how in info.pdf from Kolimer zip.

L.e.
You may need to use usbasp programmer, I do not think will work by usb, but you can try...

[liviudiaconu]

hid3, they are, you can see it in screenshots and my reverse engineered schematics, I have 3 of such cables

About your schematic i don't see K-line and L-line Rx. K-line and L-line are bidirectional.
If that transistor with emiter "in air" i assimilate as a diode, can be Rx. And go on 17 and 19 pins of GAL. Thet mean that pins are IN, not OUT.
Look as a correct schematic for a 44HW, not transistors but correct and can see the Rx (K/L lines)

[Laique]

Got the 18.2.0!!! It's ALIVE!

@KOLIMER! WHEREVER YOU ARE, GOD BLESS YOU.

Small tribute for you man!
48375864_991209821084315_3612454867626360832_n.jpg