VAG-COM/VCDS EVERYTHING

[kaalis]

Buy genuine cable and send map to them and wait 10 years before they include "new" lbl/clb files.

Paste your ecu numbers or noone will be able to help you. Search german vcds for your ecu labels.

Sent from my VOG-L29 using Tapatalk

[TheSky]

I have already seen in the German version (v.21.9).
For example last V C D S:

Address 17: Instruments (J285) Labels: * Redir Fail! -SRI2
    Part No SW: 4M0 920 790 HW: 4M0 920 790

or

Address 09: Cent. Elect. (J519) Labels: * None
Part No SW: 8W0 907 063 G HW: 8W0 907 063 G

Is there some way or similar ECU that I can change the name?

[kaalis]

4M0-920-FPK-V1.CLB and 8W0-907-063-V1.CLB doesn't exist yet in DRV, PCI and English.

[badrax]

Found out that this little thing is NOT a transistor
I was fooled for almost a week thinking this was a transistor and that serial data was sent to it for so to be read back on the same pin. The STM transmit data to this over a half duplex serial (single wire serial) and somehow magically receives data back containing a 32 bytes (256 bits) number.






Its a small unit placed on the PCB and has a Q marking and got only tree legs. It must be a transistor right? Wrong.
Its a ATSHA204A Microchip CryptoAuthentication Chip and supports a lot of commands / opcodes.
Here are the datasheet for it: https://ww1.microchip.com/downloads/...-40002025A.pdf

Supported Opcodes:


Looking at the decoded data that I picked up on this pin we can see what they are doing.
8804113343
7727 16 03 00 00 <Nonce>
7707 15 02 0E 00 3628888804000340
7707 15 02 01 00 3988888804000340
7727 08 76 01 00 <Challenge> 88 88 -> <SHA256 Result> 2F49 BB
(I have removed all these 256 bits numbers coz they are related to my chip only)

So we have three different Opcodes used.
They are: Nonce(0x16), GenDig(0x15) and MAC(0x08)
Nonce (Mode Enc 0x03): Load TemKey with this following data <nonce> in pass-through mode
GenDig: (Zone 0x02, Key 0x0E): This will do SHA256(Data Zone Key14 + Internal OTP and Serial data + TempKey) and set the result to TempKey
GenDig: (Zone 0x02, Key 0x01): This will do SHA256(Data Zone Key1 + Internal OTP and Serial data + TempKey) and set the result to TempKey
MAC: (Mode 0x76, Slot 0x01): Apply SHA256(TempKey + Challenge + Internal Serial and OTP data)

The final result of the MAC command is now sent back to the STM

So to my big surprise the genuine cable is also using an external crypto chip most like what the 405 clone are using.
To continue my work I need some one with access to a genuine cable and a bit of skills to log more data on this pin.

If you find this interesting and want to help the pleas PM me and I will let you know what you can do to help.

[szpectronik]

maybe someone will need a photo pcb org vcds hex v2, badrax maybe it will help you, I managed to take a photo once

[badrax]

Does anyone know of a Virtual CAN bus simulator I can use with the VCDS cable?

Like what this dud have done but I would like to have one unit without all the wires hanging around if that is possible.

https://www.youtube.com/watch?v=F_hVRl29qjA

[nextor]

Does anyone know of a Virtual CAN bus simulator I can use with the VCDS cable?

Like what this dud have done but I would like to have one unit without all the wires hanging around if that is possible.

https://www.youtube.com/watch?v=F_hVRl29qjA

I'm using this kind of cable to connect to ECUs on the bench:
https://s.click.aliexpress.com/e/_AO2mgu

Apart from this cable you only need a 12v source and the ECU itself.

[ZIPPO4594]

Hi
@badrax : the more simple, use a gateway ecu.

[badrax]

Hi
@badrax : the more simple, use a gateway ecu.

Can you connect the VCDS cable directly to the GW or do you need some extra interface for the VCDS cable to connect to?
That is. Is there a OBD2 port on the GW?

[badrax]

I'm using this kind of cable to connect to ECUs on the bench:
https://s.click.aliexpress.com/e/_AO2mgu

Apart from this cable you only need a 12v source and the ECU itself.

So this is more or like the same as the dude on the YT video except for that you use a more sophisticated cable?
Can you do both CAN and K-Line or only K-Line with this setup?

[nextor]

So this is more or like the same as the dude on the YT video except for that you use a more sophisticated cable?
Can you do both CAN and K-Line or only K-Line with this setup?

Yes, you can use both CAN and K-Line.

I don't know if any ECU other than the engine has both CAN and K-Line, but as another user suggested, using a CAN Gateway results in a pretty clean setup.

[ZIPPO4594]

Can you connect the VCDS cable directly to the GW or do you need some extra interface for the VCDS cable to connect to?
That is. Is there a OBD2 port on the GW?

yes, you can connect directly VCDS câble on the can diag port on the GW

[badrax]

Yes, you can use both CAN and K-Line.

I don't know if any ECU other than the engine has both CAN and K-Line, but as another user suggested, using a CAN Gateway results in a pretty clean setup.

What about a device like this?

https://www.youtube.com/watch?v=9-e5MVpJYyA

You know if this can be used with the VCDS cable or does this simulate CAN in general and not related to VW?

[nextor]

What about a device like this?

https://www.youtube.com/watch?v=9-e5MVpJYyA

You know if this can be used with the VCDS cable or does this simulate CAN in general and not related to VW?

I think you can use it with VCDS only in the generic OBDII mode.

The product page (https://www.ozenelektronik.com/canbu...mulator-p.html) says this:

The CAN BUS multiple ECU simulator provides a professional OBD development platform which allow the user to test the OBD functionality on the table. Simulates 4 differnt ECUs. reading VIN and suspended DTC is possible . Using 5 potensiometer , 5 live data can be changed and some fixed PID values are provided. Pressing DTC bouton the trouble codes are generated and the MIL LED is ON. Service 4 commands clear the DTCs and the MIL LED. Connection to the tester is provided via a J1962 female OBD port . it needs an external 12 V power supply . More information you can get from the corresponding chipset datasheet.

[badrax]

yes, you can connect directly VCDS câble on the can diag port on the GW

That sounds easy. Do you have a link to such a GW?
Do I need an additional ECU connected to the GW or can the VCDS cable/SW talk to the GW directly?
I have an old Audi A3 ECU from 2005 that I was suppose to use on a different project but perhaps I can connect it to this GW?