SVDI2 support VVDI2 VAG,BMW and Transponder programmer

SVDI2 - VAG User Manual

1. Document Declaration. 1

2. Overview.. 1

2.1. Noun explanation. 1

2.2. Options. 1

2.3. Diagnostic Function. 2

2.4. Key Learn. 2

2.5. Special Function. 2

3. Options. 3

3.1. Language. 3

3.2. Diagnostic parameters. 3

4.  Diagnostic Function. 4

4.1. Identification. 4

4.2. Read/Clear DTCs. 5

4.3. Coding. 6

4.4. Actuator test. 7

4.5. Security access. 7

4.6. Customer Requests. 8

4.7.  ECU Flasher. 8

4.8. UDS Adaption. 9

4.9. Advance Measure Value. 10

4.10. Basic Settings. 10

4.11. Adaptation. 12

4.12. Measured Values. 13

5. Key Learn. 13

5.1. 4th immobilizer system.. 13

5.1.1. 4th immobilizer system – Instrument cluster. 14

5.1.2. 4th immobilizer system – Passat /CC. 22

5.1.3. 4th immobilizer system – Touareg/Phaeton/A8/Cayenne/Bentley. 27

5.1.4. 4th immobilizer system – Audi A6/Q7/Allroad. 28

5.2. 5th immobilizer system.. 31

5.3. Key Learn. 36

5.4. Remote Key Adaptation. 42

6. Special Function. 43

6.1. Engine control unit. 43

6.2. K-Line Instrument/Immobox. 46

6.3. Change KM.. 49

6.4. Adapt Unit. 51

6.5. Component Protection. 57

6.5.1. Generation 1 component protection. 57

6.5.2. Generation 2 component protection. 60

6.6. EEPROM Dump Tool 63

1. Document Declaration

Please view the following declaration carefully:

u SVDI2 – VAG User Manual can help you maintenance vehicles with SVDI2 device. Please DON’T used for illegal purpose, Please follow the national law

u SVDI2 – VAG User Manual is written by SVDI2, please DON’T used for commercial purposes without authorize

u SVDI2 – VAG User Manual can help you how to use VAG software, please view carefully

u Any illegal use SVDI2 – VAG User Manual, illegal use SVDI2 device, The user should take all risks, the company does not assume any responsibility

2. Overview

2.1. Noun explanation

u VAG: Volkswagen Group, it have many brands, such as: VW, Audi, Skoda, Seat, Porsche, Bentley, Lamborghini etc

u Component security: Sometimes we call it component security bytes. Usually we use CS to express. This data usually use in car immobilizer, ECU and key

u PIN: PIN code, Login, Login code etc. It can use to login module before key learn and adapt device etc

u Component protection: It’s a protection type for unit module. Many modules on Audi A4/A5/A6/A8 use this method to bind module to gateway. If you install a 2nd hand module (has component protection) to new car, you must learn it to new vehicle before it work. Reset to virgin module, learn to new vehicles

u Lost all key: The car lost all working key, there is big different from add key with working key. Note: before OBDII communication, you need open dangerous light, press on the brakes for several times to active OBD communication

2.2. Options

Detail can be found in chapter 3 Options

u Choose Language

u Diagnostic parameters

2.3. Diagnostic Function  

Detail can be found in chapter 4 Diagnostic Function

u Identification

u Coding

u Actuator test

u Read DTCs

u Clear DTCs

u Basic settings

u Security access 

u Adaptation

u Custom requests 

u Measured values

u Advance measure values 

u ECU Flasher

2.4. Key Learn

u 4th immobilizer system: Detail can be found in chapter 5.1 4th immobilizer system

u 5th immobilizer system: Detail can be found in chapter 5.2 5th immobilizer system

u Key Learn: Detail can be found in chapter 5.3 key learn

u Remote Key Adaptation: Detail can be found in chapter 5.4 Remote Key Adaptation

2.5. Special Function

u Engine Control Unit: Detail can be found in chapter 6.1 engine control unit

u K-Line Instrument/Immobox: Detail can be found in chapter 6.2 K-Line instrument/immobox

u Change KM: Detail can be found in chapter 6.3 change KM

u Adapt Unit: Detail can be found in chapter 6.4 adapt unit

u Component protection: Detail can be found in chapter 6.5 component protection

u EEPROM dump Tool: Detail can be found in chapter 6.6 EEPROM dump tool

3. Options

3.1. Language

Support following languages:

u Chinese (Simplified)

u English

 Please manual set user language after first run program                             

3.2. Diagnostic parameters

Set diagnostics connect protocol type (PICTURE 3.1).  This will only be use at diagnostics function. While scan all unit, close unused protocol will enhance scan speed

u CAN resistor: Generally, there is impedance between CAN High PIN and CAN Low PIN. If you connect to car directly, the gateway will finish this job. But if you want connect on a bench or connect to unit directly, SVDI2 will finish this job as your select value

u K-Line parameters:

 K-Line try baud rate sequence: Diagnostic K-Line unit have 2 different baud rates.  You can set which baud rate can be test first. Some old module may need wake up by  initialize 2 times. You can try with change baud rate sequence.   K-Line use OBDII PINs: Set K-Line use PIN. If select 7 PIN, it will be always try first  K-Line connect parameters: Set K-Line timer while initialize and communication          

(PICTURE 3.1)

4.  Diagnostic Function

Support TP2.0, UDS, KWP1281, KWP2000 protocol, It can display item detail information with offline database (PICTURE 4.1)          

(PICTURE 4.1)

u Show all unit: Show all support unit list

u Gateway installation unit list: Get installed unit list from gateway

u Scan all unit show in list: Scan all unit list in (PICTURE 4.1), you can enhance scan speed by set diagnostic parameters

u Clear All DTCs: Clear all trouble codes in list unit, you need scan it first

u Connect input unit: Connect the input unit directly

4.1. Identification

Read the basic information for target unit: VAG number, HW/SW version, coding, system decryption, equipment number, importer number, workshop number etc. Example: diagnostic instrument with UDS protocol

(PICTURE 4.2)           

(PICTURE 4.2)

4.2. Read/Clear DTCs

Read DTCs: The read trouble codes have detail explanation; you can select Read Freeze Frame Data for the DTC environments Clear DTCs: clear trouble codes in module (PICTURE 4.3)         

(PICTURE 4.3)

4.3. Coding

Set target unit coding, we have database for most of the module, you can change coding by select item (PICTURE 4.4)          

(PICTURE 4.4)

4.4. Actuator test

Test every small actuator in target unit, UDS protocol support selective tests, other protocol support sequential tests (PICTURE 4.5)          

(PICTURE 4.5)

4.5. Security access

Login module with PIN code, usually use before adaptation. You can complete many useful function with this, example: learn new key, remote control, change 2nd module (old type) etc (PICTURE 4.6)          

(PICTURE 4.6)

4.6. Customer Requests

You can write your own commands to target unit (PICTURE 4.7)         

(PICTURE 4.7)

4.7.  ECU Flasher

Support flash ECU with original flash file: odx, frf, sgo. Update your module to newest software version. For ECU flash ECU may change the power class, it depends on the flash file you use. (Base on this feature, you can change ECU from 1.8T to 2.0T with suitable flash file). Note: Before flash ECU, you need switch ON ignition with working key or the target module with IMMO OFF status. Of course, if the target unit is none about immobilizer, there’s no limit for flash ECU (PICTURE 4.8)           

(PICTURE 4.8)           

4.8. UDS Adaption

Set new value in channel for model use UDS protocol (PICTURE 4.9)          

(PICTURE 4.9)

4.9. Advance Measure Value

View detail measure value in target model. Mainly use for UDS protocol (PICTURE 4.10)          

(PICTURE 4.10)

4.10. Basic Settings

Complete basic settings for target unit. If you install new module to car, usually require this function to configuration the new module. Usually you need run “Security Access” first. Example: This is K-Line ECU module (PICTURE 4.11), (PICTURE 3.12)          

(PICTURE 4.11)

            (PICTURE 4.12)

4.11. Adaptation

Complete learn key, learn remote, learn new module etc (PICTURE 4.13). Usually you need run “Security Access” first          

(PICTURE 4.13)

4.12. Measured Values

View the detail information from channel. Usually use for CAN and K-Line protocol (PICTURE 4.14)          

(PICTURE 4.14)

5. Key Learn

5.1. 4th immobilizer system

VW/Audi/Skoda/Seat/Porsche/Bentley vehicles all have 4th immobilizer car. (How to verify new key is dealer key?  Key is learned success or not? Transponder is correct or not? Car ignition switch is work fine or not? About this you can find answer for Immo status in “Key Learn ->Key Learn”) Support following types:

1. Instrument - CDC3217/CDC3297/CDC3272 + 24C32

2. Instrument - NEC+24C32

3. Instrument - NEC+24C64

4. Instrument - NEC+24C64 (2013-)

5. Instrument– NEC+24C64 (2012 TFT color display)

6. Instrument– NEC+24C64 (2013 TFT color display)

7. Instrument– NEC35xx

8. Instrument– NEC+95320

9. Instrument– Motorola 9S12XHZ512(Golf6 MM7 – 2011)

10. Instrument– NEC+95320(Johnson Controls)

11. Instrument– NEC+95320(JCI – 2013 Bora/Jetta)

12. Instrument– Visteon 

13. VW Passat B6/B7/CC Key Learn

14. Touareg/Phaeton/A8/Cayenne/Bentley 4th immobilizer

15. Audi A1 – NEC+24C64

16. Audi A3/TT/R8 – CDC3217/3297 + 24C32

17. Audi A4 – instrument Crypto RB4 (2001+)

18. Audi A4 –instrument Crypto RB8 (2004+)

19. Audi A6/Q7/Allroad – EZS-Kessy

20. Audi Q3 

5.1.1. 4th immobilizer system – Instrument cluster

Support function: read/write EEPROM, read/write FALSH (part support), change KM, add key, read START/STOP key data etc SVDI2 – VAG provide auto detect cluster login type. 4th immobilizer cluster use MEGAMOS 48 transponder as key, see the following explanation:

u Diag: We can auto detect cluster login type here, support CAN and UDS protocol. If auto detect error, please send diagnostic results to your dealer by enter unit 17 instrument cluster (PICTURE 5.1)

(PICTURE 5.1)

u Read EEPROM/FLASH: Read EEPROM or FLASH via OBDII. Read FLASH is only part support, not support by all type (PICTURE 5.2)

(PICTURE 5.2)

u Save File…/Load File…：Save data read by OBDII (EEPROM, FALSH, Immo data etc) / Load file to buffer

u Read Immo Data/Write Immo Data: Read immo data from cluster/ Write immo data to cluster. Immo data is very important, you can prepare a dealer key with “Key Learn－> Immo data prepare key”, learn key with immo data etc. There are different values for each login type. You must backup original immo data before write immo data, and we don’t recommend generally user do this operation. If you know the immo data very well, you can complete some advance function with write immo data, example: fix car stop working suddenly

u START/STOP key data: It can save useful data to a encrypt file. Write this file to

another SVDI2 product (Keyless/Remote Start device), the car will have keyless function, remote start function etc. (There’s no immo transponder inside car. It’s safe as original)

u Reset Instrument: Make instrument exit from service mode. And if you change KM,  the new KM will show on cluster after reset instrument

u Make Dealer Key: Prepare a new dealer key, see detail in Make key steps for 4th immobilizer cluster

u Add Key: Add new dealer key to immobilizer cluster, see detail in Make key steps for 4th immobilizer cluster

u Service mode: (PICTURE 5.3), All login type have similar operation for lost all key, backup ABS coding->read EEPROM with BDM programmer->Prepare a service EEPROM data->write service EEPROM data to cluster->Put instrument in car->select correct login type->Load original EEPROM file->activate car OBDII communication->write EEPROM via OBDII->read immo data->save immo data->make dealer key->add key->reset instrument. Detail can be find in Special note for lost all key

(PICTURE 5.3)

u Read KM/Write KM：Change KM for car, after write new km you need reset instrument to apply it

u ABS Coding：ABS coding will not lost in add key with working key. But for lost all key, the ABS coding usually lost, so you need backup ABS coding first. If cannot back with button “Backup”, you can write down coding with enter 03 ABS diagnostic.  

Backup: Read ABS coding and backup automatically Restore: Restore the backup ABS coding for target car Set to EEPROM: Read ABS coding from car, and set this coding to ABS EEPROM dump which is read by BDM programmer 

u VIN: Vehicle identification number, usually 17 characters

u Immo No： Vehicle immobilizer identification number, usually have 14 characters. For 4th immobilizer cluster, this value usually have 14 bytes blank  

u CS: Component security bytes. It has 12 bytes for UDS 4th immobilizer cluster. Move your mouse to this area, you will get balloon show 7 bytes CS in ECU ((PICTURE 5.4) show original 6 byes CS is: C2 D3 45 7E 68 0E). You can’t find 7th byte CS from UDS 4th immobilizer cluster, it don’t have 7th byte, it have another 6 bytes CS part 2 

CAN 4th immobilizer cluster (CDC32xx, A3/TT/R8) will have 7 bytes at this value. That is the original 7 bytes CS     ECU must have same 6 bytes CS with balloon show CS bytes. If they are not same, you car can’t start

          (PICTURE 5.4)

u PIN: login code, it can use login to ECU or other module which support login immobilizer PIN. You can learn dealer key with CAN protocol cluster

ECU has same PIN with this value. If not same, car will not start. So, for CAN protocol cluster, you can learn key with PIN read from ECU

u MAC: Synchronization codes between ECU and immobilizer system, usually have 4 bytes. The first 2 bytes is immobilizer synchronization code, the last 2 bytes is ECU synchronization code. MAC value in (PICTURE 5.4) is “B188708F”, “B188” is immobilizer synchronization code, “798F” is ECU synchronization code. Generally, the synchronization code for ECU or immobilizer system is a fixed value. If you install new ECU, MAC value in immobilizer will change last 2 bytes to new ECU synchronization code; if you install new immobilizer, MAC value in ECU will change first 2 bytes to new immobilizer synchronization code. Normally, MAC value must be same between ECU and immobilizer. If there are not same, ECU and immobilizer system will have same DTC error like this: Engine control unit is not authorized. You can fix this error by “Adapt Unit->select ECU->Read->Write”, it will

synchronize MAC automatically between ECU and immobilizer system 

u Status: There will be different value accord each login type. Usually it have a power class byte, you can find the power class byte in status. In (PICTURE 5.4), power class 80 is the 3rd byte in status. If you want change this value in cluster, just write new byte in status and write immo data. ECU also has same power class value. Power class is a fixed value for same ECU with same software version. Change power class in ECU is difficult, one method is change power class in ECU FLASH file(this method is difficult, almost all the ECU have different FLASH file),  another method is ECU – Flasher(Diagnostics->ECU Flasher), so you must have a know power class flash file. If ECU and immobilizer system have different also will get DTC error like this: Engine control unit is not authorized. You can fix this by search ECU power class and write it to immobilizer system.

u Config: This value contain car manufacture, key number, immobilizer status (new, learned, closed), keyless or not etc. Please don’t change this value if you are not sure

u Type: This value is car manufacture, it shown type accord data in Config area.  For NEC24C64 login type, the 5th byte in config area is car manufacture: 01 VW, 06 Skoda, 03 Audi, 05 Seat. (In  (PICTURE 5.4), the 5th byte is 01, means this cluster is config to VW)

u Key 1 – Key 8: VAG cars can have at most 8 keys in one immobilizer. If key ID show FFFFFFFF means there’s no key. Another way to get Key ID is enter “diagnostic->25 immobilizer system->advance measure value-> select transponder id item”.（(PICTURE 5.5) is get ID window for UDS 4th immobilizer cluster, other immobilizer system can find in measured values. That means you can get KEY ID via diagnostic function even lost all key）

(PICTURE 5.5)

Attention: For 4th immobilizer cluster

u Some instrument will become dark after login, this is normal because instrument is enter service mode. You can active it by reset instrument after finish all operation, Pay attention to the login success window (PICTURE 5.6)

u If you get message like “cannot connect to car”, make sure switch ON ignition, OBD line connect to car, lost all key need active OBD connection by open dangerous light, press on the brakes for several times

u After change KM, if the cluster still show old value, just need reset instrument

u Make key steps for 4th immobilizer cluster:

1)   Diag to detect login type for cluster, if can’t auto detect login type, just choose logint type  manually 

2)   Read EEPROM and Save (IMPORTANT!!!)

3)   Read Immo Data and Save (IMPORTANT!!!)

4)   Make Dealer Key. There are 2 type, normal dealer key and OEM dealer key. OEM dealer key: The OEM dealer key support enter workshop for online adaptation (ODIS, VAS5054). Make OEM dealer key need special MEGAMOS 48 transponder that support change ID (PICTURE 5.7). OEM dealer key must select one original key position. If you don’t know which one is lost, you can insert having working key and run “Check working key position”, the having working key will become gray once detected. The not grayed position is the lost key. You can select one to make OEM key. After OEM key make success, it can start engine directly, don’t need step 5)

5)   Add Key (PICTURE 5.8). Support 3 methods:

a. Add dealer key to immobilizer directly:  Input dealer key to SVDI2 programmer before continue. Keyless key don’t use this method, require learn

b. Learn key with read CS bytes: Input learn key number, read immo data via OBD, learn key with the read immo data 

c. Learn key with immo data: Input learn key number, load immo data, learn key with immo data support

(PICTURE 5.6)

(PICTURE 5.7)

                              (PICTURE 5.8)

Special note for lost all key：

u Lost all key is same with add key type: NEC+95320, Motorola 9S12XHZ512(Golf6 MM7 – 2011), NEC+95320(Johnson Controls), NEC+95320(JCI – 2013 Bora/Jetta),  Visteon, Audi A4 – Crypto RB4,  Audi A4 – Crypto RB8 etc. Lost all key is same with add key with working key, no extra operation. Other login type have special procedure

u OBD lost all key: All 4th immobilizer system can make a dealer key via OBDII directly. Don’t need BDM read cluster EEPROM, only require know PIN and 6 bytes CS. PIN and CS can read from Engine Control Unit function via OBDII. Detail can be found in Key Learn->Key Learn->OBD Lost All Key method

u Service mode lost all key:

Some login type cannot read immo data while lost all working key. Login type include (CDCxx+24C32, A3/TT/R8 (CDC32xx), NEC24C32, NEC24C64, NEC24C64(2012 TFT color display), NEC24C64(2013-), NEC24C64(2013 TFT color display),  Audi A1, Audi Q3). This type can make dealer key with following steps: (PICTURE 5.3):

1) Activate OBD communication by open dangerous light, press on the brakes for several times. Backup ABS coding, you can run backup function on bottom right corner, or enter diagnostics 03 ABS, backup abs coding

2) Find EEPROM chip from instrument, usually use 24C32 or 24C64 chip, read EEPROM dump with BDM programmer and save as original EEPROM dump 

3) Enter “Service Mode”, load original EEPROM dump and prepare service EEPROM dump. Attention: DON’T overwrite the original EEPROM dump

4) Write service EEPROM dump to EEPROM chip (24C32 or 24C64)

5) Restore dashboard to car

6) Back to main window and select right login type

7) Load original EEPROM dump (IMPORTANT!!!)

8) Activate OBD communication by open dangerous light, press on the brakes for several times

9) Press “Write EEPROM” write original dump to dashboard via OBDII (IMPORTANT!!!)

10) After write success, read immo data and save (IMPORTANT!!!)

11) Make a new dealer key and add to immobilizer system

12) If car use keyless key, learn the dealer key with learn method (with immo data support)

13) Start engine with new dealer key, complete

5.1.2. 4th immobilizer system – Passat /CC

Passat/CC has 2 transponder types: one is MEGAMOS 48, another one is HITAG2 (46 Transponder). Before make key you must select transponder type 48 or 46.  This type support OBD lost all key, Detail can be found in Key Learn->Key Learn->OBD Lost All Key method. How to find correct transponder type while lost all key? You can find answer for Transponder type OK in “Key Learn ->Key Learn” Here we list several method for add new key (operation steps use number in picture):

1) You can read PIN and 6 bytes CS from ECU via OBD, no comfort module dump

46 Transponder: Lost all key is same as add key with working key. Place 7th byte CS to “FF”, you can follow steps: 1->3->4 (PICTURE 5.9) 48 Transponder:  Add key: you need find 7th byte CS from working key, you can follow steps: 1->2->3->4 (PICTURE 5.9)  Lost all key: this type need use try start method to find working key. Try times belong to 0-255. First try need start from 0, if failed in the procedure, record the failed times. Next time, try start with last failed times. You can follow steps: 1-2-3(PICTURE 5.10)            

(PICTURE 5.9)

            (PICTURE 5.10)                         

2) Cannot read 6 bytes CS from ECU. Here you need comfort module dump (95320) support. After load comfort module dump you will get window (PICTURE 5.11)

It has 3 methods to decrypt comfort module dump:

u Decrypt 7 bytes CS from dump file (usually we select this method)

u Get CS from ECU EEPROM dump

u Have 6 bytes CS 

(PICTURE 5.11)

Ø Decrypt success (PICTURE 5.12): You will get the 7 bytes CS and PIN after decrypt success. So make dealer key is very easy. No matter 48 or 46, no matter lost all key or add key, they are all same. You can follow steps: 1->2->3(PICTURE 5.13)

(PICTURE 5.12)

(PICTURE 5.13)

Ø Decrypt failure：This type rarely happen

 Add Key：You can follow steps: 1->2->3->5(PICTURE 5.14) Lost All key: this type need use try start method to find working key. Try times belong to 0-255. First try need start from 0, if failed in the procedure, record the failed times. Next time, try start with last failed times. You can follow steps: 1->4->5 (PICTURE 5.14). Number 6 (Unlock 46 key) in (PICTURE 5.14) only unlock the temp key under try start method under decrypt failure method            

(PICTURE 5.14)

5.1.3. 4th immobilizer system – Touareg/Phaeton/A8/Cayenne/Bentley

This type use HITAG2 (46 Transponder). Operation steps following: (operation steps use number in picture)

u Known 7 bytes CS, input 7 bytes CS and PIN, you can follow steps: 3->5        (PICTURE 5.15)

u Have 6 byes CS and PIN: you can read 6 bytes CS and PIN from ECU via OBD. If OBD read failed, you need read ECU EEPROM dump (95160 or 95128) with BDM programmer, Load ECU EEPROM get 6 bytes CS and PIN 

Add Key：You can follow steps: 1->2->5 (PICTURE 5.15)   Lost All Key: You can follow steps: 1->4->5 (PICTURE 5.15). this type need use try start method to find working key. Try times belong to 0-255. First try need start from 0, if failed in the procedure, record the failed times. Next time, try start with last failed times. You can follow steps: 1->4->5 (PICTURE 5.15).  Number 6 (Unlock Touareg key) in (PICTURE 5.15) only unlock the temp key under try start method

u Some earlier cars (-2009) can get 7 bytes CS and PIN from Kessy 93C86 EEPROM (see chapter 6.6 EEPROM Dump Tool)

u Sometimes the engine cannot start after learn key. Switch ON ignition with learned key, wait a few minutes then can start. (See detail for Engine start permitted in “Key Learn ->Key Learn”)

(PICTURE 5.15)

5.1.4. 4th immobilizer system – Audi A6/Q7/Allroad

This type use MEGAMOS 8E transponder. This type support OBD lost all key, Detail can be found in Key Learn->Key Learn->OBD Lost All Key method           

(PICTURE 5.16)

 Method to prepare new dealer key: If you want prepare a new dealer key, you must know the total 12 bytes CS. But there’s only 6 bytes CS in ECU, so we need read the whole J518 EEPROM dump

1) Autodetect from engine(ECU) ((PICTURE 5.16) Number 1): Read CS from ECU, only read 6 bytes CS and PIN, With 6 bytes CS and PIN help, you can use standard method to read/write EZS-Kessy EEPROM(J518), Read/Write VIN etc. You can follow steps: 1->7->2->4->6 (PICTURE 5.16)

Attention: OBD stand method only support 9S12DT128 type. In (PICTURE 5.16), number 7, 8, 9, 10 only support J518 use 9S12DT128 chip (Most cars before 2009 use this type). J518 with 9S12DT(G)256 chip (Most cars after 2009 use this type) don’t support these 4 items. That means 9S12DT(G)256 type doesn’t support prepare a dealer key with this method. Fortunately, we can prepare a dealer key by OBD Lost All Key

2) Load J518 EEPROM dump file ((PICTURE 5.16) Number 2): Once you get EEPROM dump, you can load it here to make a new dealer key. You can follow steps: 2->4->6 (PICTURE 5.16)

3) Read J518 EEPROM dump with working key ((PICTURE 5.16) Number 3): If you have working key, allow read J518 EEPROM dump with service mode. Note: The cluster may become dark under this operation. If cluster still dark after operation finished, please disconnect car battery and connect again 

Select which type to enter service mode: Most cars before 2009 use 9S12DT128 type, most cars after 2009 use 9S12DT(G)256 type. But there’s some car in 2009, you need try yourself. After read J518 EEPROM dump, you can follow steps: 2->4->6 (PICTURE 5.16)  A few car with 9S12DT(G)256 can’t read with 9S12DT(G)256 type, only support read through 9S12DT128 type. Here the J518 EEPROM dump is not the whole dump file (Pay attention to programs’ message). Attention: DON’T write this false dump to J518. This false dump don’t support make OEM key. It can only use for prepare normal dealer key and learn key 

4) Make Dealer Key ((PICTURE 5.16) Number 4): Run this operation will try read J518 EEPROM with standard OBD method first. If read success, make dealer key with read data. If failed, it will prepare dealer key with loaded J518 EEPROM dump file. So, just continue when you get something like “Cannot connect to Kessy!”

5) Make OEM key remote ((PICTURE 5.16) Number 5): 

This operation need special OEM remote key  First you need make a start key for 8E transponder which is in OEM remote key, make sure this 8E transponder can start engine, then read J1518 EEPROM dump once more (PICTURE 5.17). Load the newest J518 EEPROM and place your OEM remote key to SVDI2 programmer accord (PICTURE 5.18), after operation complete, remote is work now          

(PICTURE 5.17)

           (PICTURE 5.18)

5.2. 5th immobilizer system

This type use VAG immo5 transponder or OEM key  Support following cars: A4 (2009-), A5, Q5, A6 (2012-), A7, A8(2011-), Touareg (2011-)            

(PICTURE 5.19)

 Method to prepare new dealer key: If you want prepare a new dealer key, you must know the total 16 bytes CS. So we need read BCM2 data from BCM2 module (J393)

1) Choose method to read BCM2: Until now most cars support read BCM2 data via OBDII (Add key and lost all key all support). ((PICTURE 5.19) Number 1), read BCM2 need enter service mode, the cluster may become dark under reading. 

u Note: Once you get error like “read data length error” in OBD read method, you need read BCM2 data with 5th BDM Programmer ((PICTURE 5.19) Number 2)

u Note: OBD Read BCM2 for lost all key need disconnect BCM2 power (2 interfaces) for a few seconds. Just follow program message

u Note: Under OBD Read BCM2 for lost all key process, if cannot read BCM2 data after disconnect power or you get disconnect power for next time read, this type may not support OBD read without working key, you need read BCM2 data with 5th BDM Programmer 

u Note: Before you read BCM2 via OBDII, you’d better switch OFF/ON ignition again, Keyless cars press START/STOP button again to switch ON. Else may enter lost all key mode, of course, if read success, it is also right BCM2 data

u Note: BCM2 data is always for the same car. So you only need read one time. As long as you have the BCM2 data, you don’t need to read again, no matter key learn, no matter when 

Some pictures for 5th BDM Programmer read method:

Ø (PICTURE 5.20) is BCM2 (J393) module position

Ø (PICTURE 5.21) is BCM2 (J393) module remove plug

Ø (PICTURE 5.22) is introduction for 5th BDM Programmer

Ø (PICTURE 5.23) is BCM2 (J393) front connect line

Ø (PICTURE 5.24) is BCM2 (J393) back connect line

(PICTURE 5.20)

(PICTURE 5.21)

                         (PICTURE 5.22)

             (PICTURE 5.23)                         (PICTURE 5.24)

2) Check Key Status ((PICTURE 5.19) Number 3): Check key is locked or not, is keyless key or not. For there are many OEM keys on the market, keyless key result may not accurate

3) Make Dealer Key ((PICTURE 5.19) Number 4): Load BCM2 data and wait complete 

u Note: After make key successfully. The key is not locked before you learn it. So you can make key for other car before learn. Once learn the key, it locked 

u You need select car type under make dealer key process. Is vehicle belongs to A4/Q5/A5 or A6/A7/A8/Touareg. Make key for A4/Q5/A5 don’t need working key support. Make key for A6/A7/A8/Touareg need working key support, if you don’t have working key, the keyless function will not work 

u For OEM keys: You can unlock the locked OEM key in “Transponder Programmer->Other Key Tool”. (Most OEM keys is not support unlock, it can be prepared again with lock status, then learn it as normal). If the OEM keys support change ID, you can make an OEM key, make method is same as 4th immobilizer cluster OEM key, select one original key position and continue 

4) Key Learning ((PICTURE 5.19) Number 5): Load BCM2 data and follow programs’ message. At the last, you will get a message insert every key to learn, don’t press “OK” until you get message “Learn key success” at the bottom. If you press “OK” before that message will cause key learn failure. When you get that message, the cluster will show “x-y”, “x” is the learned key number and “y” is the total learning number. If you learn 2 keys, first will show 0-2, after learn 1 key, it show 1-2, after learn 2 keys, it show 2-2. After success learn key, it will show KM

5) Alarm ON: Open immobilizer alarm, we suggest you open it after key learn

6) Alarm OFF: Close immobilizer alarm

5.3. Key Learn

Support learn key for most of the cars via OBDII. Some need only PIN, and some need 6 bytes CS support. 5th transponder enter 5th immobilizer system for key learn Support following types:

1) Audi A4/A6 (immobilizer box) -1997 - KWP1281

2) Audi A8 (immobilizer box) -1999 - KWP1281

3) Audi A2/A3/A6/TT/Allroad 1997+ - KWP1281

4) Audi A4 1997-2002 - KWP1281

5) Audi A4 2002+ - KWP2000

6) Audi A8 1999-2002 - KWP1281

7) Audi A3 - CAN

8) Audi A6/Q7/Allroard 2005+ - CAN (Support OBD lost all key)

9) Seat Altea -2007 - CAN

10) Seat Cordoba

11) Seat Ibiza (immobilizer box) -1999 - KWP1281

12) Seat Ibiza 1999+

13) Seat Leon - KWP1281

14) Seat Leon -2007 - CAN

15) Seat Toledo - KWP1281

16) Seat Toledo -2007 - CAN

17) Skoda Octavia - KWP1281

18) Skoda Octavia II -2007 - CAN

19) Skoda Octavia II 2007+ - CAN

20) Skoda Superb - KWP1281

21) Skoda Roomster - KWP1281

22) Skoda Scout -2007 - CAN

23) Skoda Fabia (immobilizer box) -1999 - KWP1281

24) Skoda Fabia 1999+ - KWP1281

25) VAG (immobilizer box) - KWP1281

26) VAG KWP1281 Immobilizer - KWP1281

27) VAG KWP2000 Immobilizer - KWP2000

28) VW Polo (PCF7935 transponder) - KWP1281

29) VW Touareg/Phaeton/Bentley/Cyenne KLine - KWP2000

30) Audi A8 - CAN

31) VW,Seat, Skoda -2007 - CAN

32) Porsche Cayenne CAN - CAN

33) VW Passat B6/CC – CAN (Support OBD lost all key)

34) VW Passat B6/CC with EDC17/MED17 – CAN (Support OBD lost all key)

35) VW Golf V with Visteon dash

36) Audi A4 (RB8 Instrument Cluster) 2004+ - KWP2000

37) VW, Seat, Skoda 2007+ - CAN (Support OBD lost all key)

38) VW, Seat, Skoda, Audi with VDO NEC 2009+ - UDS (Support OBD lost all key)

39) Lamborghini Gallardo -2005

40) Lamborghini Gallardo 2005+

41) VW with NEC+95320 or Magneti Marelli with Motorola 9S12 2009+ - UDS (Support OBD lost all key)

42) Immobilizer box use Megamos - KWP1281

43) New Beetle - KWP2000

44) Johnson Controls with 95320 - UDS (Support OBD lost all key)

45) VW Dashboard with VDO NEC35xx 2013+ - UDS (Support OBD lost all key)

46) 

(PICTURE 5.25)

Key Learn window (PICTURE 5.25), after you enter this window, SVDI2 – VAG will auto detect vehicle type. If you find the detected vehicle is error, please select correct Vehicle manually before learn key 

u Immo status value: “YES” mean this item is correct, “NO” mean this item is not correct, “N/A” mean the immobilizer system not support this detect or car immobilizer is incorrectly configured 

Ø Engine start permitted:  “YES” mean can start engine, “NO” mean cannot start 

Ø ECU responding: “YES” mean immobilizer can communicate with ECU, “NO” mean can’t

Ø Transponder type OK: “YES” mean transponder type correct, “NO” mean incorrect

Ø Dealer Key: “YES” mean ignition key is dealer key, “NO” mean not dealer key

Ø Locked key: “YES” mean ignition key is locked, “NO” mean not locked

Ø Learned key: “YES” mean ignition key is already learned, “NO” mean not learned

Ø Key count: The value is total key number in immobilizer system 

Ø Lock time-Accept login (PIN): 0 mean accept PIN, key learn can be performed, other value mean not accept PIN, key learn can’t be performed. If the value is X (Decimal value, not zero), mean the immobilizer system will accept PIN after X minutes. The value will minus 1 automatically after every minute, wait change to 0 and start key learn. Usually the maximum value of X is 10. If you get value bigger than 10, mean immobilizer is incorrectly configured and key learn can’t be performed

Ø Lock time-Accept transponder: 0 mean accept transponder, key learn can be performed, other value mean not accept transponder, key learn can’t be performed. If the value is X (Decimal value, not zero), mean the immobilizer system will accept transponder after X minutes. The value will minus 1 automatically after every minute, wait change to 0 and start key learn. Usually the maximum value of X is 10. If you get value bigger than 10, mean immobilizer is incorrectly configured and key learn can’t be performed. When you get a none 0 value here, the Dealer key, Locked key, Learned key usually show “N/A”, mean not support at this time 

u For UDS 4th immobilizer cluster, don’t support engine start permitted, ECU responding, transponder type OK, lock time-accept login, lock time-accept transponder is not support. These items always show “N/A”

u For CAN protocol and K-Line protocol immobilizer system, all the value should be display correct value after you insert a working key to ignition switch 

u Some simple determination though immo status:

Ø Learn key failed: Insert the key to ignition switch, verify “Dealer Key”. If you get “NO” mean ignition key is not dealer key. You need prepare dealer key first

Ø Check ignition coil status: 

For UDS 4th immobilizer cluster, insert a locked MEGAMOS 48 to ignition switch, verify “Locked Key”. If you get “YES” mean ignition coil can detect the transponder, while “NO” mean ignition coil have problems, another possibility is that the immobilizer system cannot detect transponder signals.  For CAN protocol and K-Line protocol immobilizer system, insert a correct transponder to ignition switch, verify “Transponder type OK”. If you get “YES” mean ignition coil can detect the transponder, while “NO” mean ignition coil have problems. If get “N/A” mean wait lock time-accept transponder turn 0

Ø Passat/CC 46 Transponder learned key failure, verify “Dealer Key”. If you get “NO” mean ignition key is not dealer key. You need prepare dealer key first. Don’t worry about “Locked Key” value, dealer key can be learned without test this item. Please check other failure reason

Ø Passat/CC lost all key, don’t know transponder type, Prepare a 48 transponder and a 46 transponder, insert to ignition switch one by one, verify “Transponder type OK”. If you get “YES” mean the immobilizer system use this type transponder

Ø Touareg/Phaeton/A8/Cayenne/Bentley (4th immobilizer): Car cannot start after learn key. Verify “Dealer key”, “Locked key”, “Learned key” status, if they all show “YES”, verify “Engine start permitted”. If you get “NO” here, please leave ignition

switch ON for several minutes and try start again 

u Learn (PICTURE 5.25)：

Ø Before you learn key, you must prepare all dealer keys. The key will not start if it is not learned

Ø There will be simple procedure for make key and learn key after you select a vehicle. Please read it before learn key 

Ø Most cars only need PIN while learn key, you just need follow programs’ message

Ø For vehicles can learn key only with PIN, you can learn the key with adaption function in diagnostic 25 immobilizer system. This need login with PIN first. (Usually use channel 1 or 21)

Ø For CAN protocol immobilizer system, if the immobilizer have 0 key before enter key learn, usually need wait 5 minutes after success login 

Ø CAN immobilizer cluster support learn one key without delete original key

Ø The following 5 types need PIN and 6 bytes CS to learn key. Input learn key number press button Learn, get window (PICTURE 5.26). You can execute “Autodetect PIN/CS” before key learn; type in known PIN and CS to continue; load immo data (A6/Q7 load J518 EEPROM) to get PIN and CS:

1) Audi A6/Q7/Allroard 2005+ - CAN

2) VW, Seat, Skoda, Audi with VDO NEC 2009+ - UDS 

3) VW with NEC+95320 or Magneti Marelli with Motorola 9S12 2009+ - UDS 

4) Johnson Controls with 95320 - UDS 

5) VW Dashboard with VDO NEC35xx 2013+ - UDS

     In addition, these 5 types support load immo data (A6/Q7 load J518 EEPROM) prepare dealer key (PICTURE 5.25)  

(PICTURE 5.26)  

u Autodetect PIN/CS (PICTURE 5.25)：Read PIN and CS from engine control unit or immobilizer system automatically. After success read PIN and CS, you just need input key count to learn key

u OBD Lost All Key method

Following vehicles support OBD lost all key:

1) Audi A6/Q7/Allroard 2005+ - CAN

2) VW Passat B6/CC – CAN 

3) VW Passat B6/CC with EDC17/MED17 – CAN 

4) VW, Seat, Skoda 2007+ - CAN 

5) VW, Seat, Skoda, Audi with VDO NEC 2009+ - UDS 

6) VW with NEC+95320 or Magneti Marelli with Motorola 9S12 2009+ - UDS 

7) Johnson Controls with 95320 - UDS 

8) W Dashboard with VDO NEC35xx 2013+ - UDS

 Item 1) with OBD lost all key will get window (PICTURE 5.27)  Item 2) 3) with OBD lost all key will get window (PICTURE 5.28) Item 4) with OBD lost all key will get window (PICTURE 5.29) Item 5) 6) 7) 8) with OBD lost all key will get window (PICTURE 5.30). Note：We don’t recommend use OBD lost all key method for item 6) and item 7). These 2 types can read immo data from cluster even lost all key 

Ø  The common point for OBD lost all key is it will change one or several component security bytes in immobilizer system. So, all the original key will stop work after perform this function, and will not support key ordered from car dealer 

Ø  If you want accept the key ordered from car dealer again, you need enter dealer workshop to do online change immobilizer system operation, don’t need new module for immobilizer, it can performed with the original immobilizer system. After finish the above operation, the ordered key can learn successfully. But all the key configured with lost all key method will stop working

Ø  Expect item 1), all other lost all key type support make OEM key, you can enter dealer workshop do online operation with OEM key. Attention: DON’T do online change immobilizer system operation, if you do this operation in dealer workshop, all the key made by lost all key method will stop working

(PICTURE 5.27)

(PICTURE 5.28)

            (PICTURE 5.29)            (PICTURE 5.30)

5.4. Remote Key Adaptation

This function can adapt remote control for 09 “Central Electric” (BCM system and BFM system) (UDS 4th immobilizer cluster)  

u BCM Remote Key Adaptation (PICTURE 5.31)

Ø Clear all remote data: After function performed, all the remote key lost its remote function

Ø Learn remote control: Input remote key numbers, press “Start”, follow the programs’ message to complete adapt remote key

Ø You can enter diagnostics 09 “Central Electric”, select adaptation function, manually complete remote control operation

(PICTURE 5.31)

u BFM Remote Key Adaptation (PICTURE 5.32)

Ø Learn remote control: Input remote key numbers, press “Start”, follow the programs’ message to complete adapt remote key. BFM system support at most 5 remote keys

(PICTURE 5.32)

6. Special Function 

6.1. Engine control unit

OBD read PIN, CS, MAC, change KM, immo OFF/immo ON, read FLASH. Most engine control unit support auto detected login type. You need select ECU type for error detected ECU manually Support following types (Some car has 2 ECUs, one is master, one is slaver):

1) ME7.1.1/7.5/7.8 master

2) ME7.1.1/7.5/7.8 slaver

3) MED17

4) MED 9.1 single

5) MED 9.1 master

6) MED 9.1 slaver

7) MED 9.5.10

8) EDC15x

9) EDC16U1

10) EDC16U1 master

11) EDC16U1 slaver

12) EDC16U31

13) EDC16U31 master

14) EDC16U31 slaver

15) EDC16U34

16) EDC16CP/EDC16CP34

17) EDC16CP34 master

18) EDC16CP34 slaver

19) EDC16C4 master

20) EDC16C4 slaver

21) EDC17

22) SIMOS PPD 1.1/1.5(Siemens)

23) SIMOS benzin(Siemens

24) Porsche 5.2/7.8

            (PICTURE 6.1) 

u Read memory data ((PICTURE 6.1) Number 1): OBD read memory data (EEPROM), decrypt it and show PIN/CS/MAC. The PIN read from ECU can use for key learn, change 2nd hand module etc

u Write memory data ((PICTURE 6.1) Number 2): Write EEPROM dump to ECU via OBD, support EDC15x, ME7.1.1/7.5/7.8 master, ME7.1.1/7.5/7.8 slaver, Porsche 5.2/7.8 etc

u Save File…/Load File…: Save the read data/Load file to buffer

u Write KM ((PICTURE 6.1) Number 3): Set new KM in ECU via OBD, support EDC15x and all type of EDC16x

u IMMO OFF ((PICTURE 6.1) Number 4): Switch OFF immo verify via OBDII. Note: If you set immo OFF, car can start without verify ECU immo status. You can flash ECU with “Diagnostics -> ECU Flasher” after close immo. Support EDC15x,  ME7.1.1/7.5/7.8 master, ME7.1.1/7.5/7.8 slaver, all type of EDC16x

u IMMO ON ((PICTURE 6.1) Number 5): Switch ON immo verify via OBDII. Note: If you set immo ON, when you try start car, it will verify ECU immo status first. Support EDC15x,  ME7.1.1/7.5/7.8 master, ME7.1.1/7.5/7.8 slaver, all type of EDC16x

u Flash counter-Read ((PICTURE 6.1) Number 6): Read flash counter via OBD, include attempt flash number, success flash number, flash tool

u Flash counter-Write ((PICTURE 6.1) Number 7): Write flash counter to ECU, include attempt flash number, success flash number, flash tool

u Write FLASH ((PICTURE 6.1) Number 8): Write the load BIN file to ECU. Attention: You must backup original FLASH+EEPROM before perform this function. Write error flash data will cause ECU damage. Support EDC15x, all type of EDC16x, MED9.X

u Read FLASH ((PICTURE 6.1) Number 9): Read ECU FLASH via OBDII

u Calculate OBD data online ((PICTURE 6.2) Number 2): Use for MED17/EDC17 type ECU, sometimes there’s no internet when you read memory data, so it will failed. But you can save the read memory data, and run this function after you connect to internet, steps: 1->2(PICTURE 6.2)

u Calculate EEPROM/FALSH for PIN/MAC/CS ((PICTURE 6.2) Number 3): Use for MED17/EDC17 type ECU. Some MED17/EDC17 (example: UDS protocol) don’t support to read memory data, you can read MED17/EDC17 FLASH+EEPROM with other BDM programmer. Decrypt PIN and CS by perform this function

(PICTURE 6.2)

u Attention: The following function need internet support and require authorize for CONDOR Automatic Key Cutting Machine: OBD read MED17/EDC17 PIN/CS/MAC, Calculate OBD data online, Calculate EEPROM/FLASH for PIN/MAC/CS 

6.2. K-Line Instrument/Immobox

OBD read PIN from K-Line instrument and immobox, read/write EEPROM, change KM etc Support following types:

1) Instrument Cluster(VDO66,VDO86, Motometer)

2) VW LT immobilizer box

3) VW Gol immobilizer box

4) White immobilizer box - Audi A4/A6/A8

5) Black immobilizer box Siemens 6 PINs HC05 (Immo1)

6) Black immobilizer box Siemens 6 PINs HC05 - 2400 (Immo1)

7) Black immobilizer box Siemens 6 PINs TMS (Immo1)

8) Instrument Cluster - Audi A4 B5 with Board Computer (-1997)

9) Instrument Cluster - Audi A4 B5 without Board Computer (-1997)

10) Instrument Cluster - Audi A8 (-10.1996)

11) Instrument Cluster - Audi A8 (11.1996-)

12) Instrument Cluster - Audi A6 B45 (-1997)

13) Instrument Cluster - Magneti Mareli - Shadow 1

14) Instrument Cluster - Magneti Mareli - Shadow 2 (Passat)

15) Instrument Cluster - Magneti Mareli - Shadow 3 (TT)

16) Instrument Cluster - Magneti Mareli - Direct 1996-2000

17) Instrument Cluster - Magneti Mareli - Direct 2000-

18) Instrument Cluster - Sharan/Galaxy (-2000)

19) Instrument Cluster - Audi A4 BOSCH RB4 Crypto 2001+

20) Instrument Cluster - VW Golf 4 BOSCH RBx

21) Instrument Cluster - Audi A4 BOSCH RBx

22) VW Phaeton/Touareg, Bentley Continental, Porsche Cayenne

23) Instrument Cluster - Audi A4 BOSCH RB8 Crypto 2004+

24) Instrument Cluster - Lamborghini Gallardo -2005

25) Instrument Cluster - Lamborghini Gallardo 2005+

            (PICTURE 6.3)  

u Read EEPROM ((PICTURE 6.3) Number 1): Read EEPROM for instrument or immobox via OBDII, show PIN value. The PIN value can use in key learn and change 2nd hand module etc

u Write EEPROM ((PICTURE 6.3) Number 2): Write EEPROM to instrument or immobox via OBDII. Note: you’d better backup original EEPROM before write new data

u Save File…/Load File…: Save the read data/Load file to buffer

u Read FLASH ((PICTURE 6.3) Number 3): Read instrument FLASH via OBDII

u Reset ECU ((PICTURE 6.3) Number 4): Reset instrument or immobox via OBDII

u Virgin (Factory new) ((PICTURE 6.3) Number 5): Set cluster to virgin status. Virgin device can perform learn 2nd hand module via OBDII 

u Write KM ((PICTURE 6.3) Number 6): Set new KM in K-Line instrument

u Ignore negative response ((PICTURE 6.3) Number 7): Some instrument and immobox can’t read all the EEPROM area. If you don’t select this option, the read/write operation will return once it meet protected area. If you select this option, it will continue operation with follow address. If you select this option, and you find there are sequence 55 55 55 55 … in EEPROM data, means that position don’t support read

u Reset component security ((PICTURE 6.4) Number 1): If you select A4 Crypto RB4 or A4 Crypto RB8 type, you can see this function. It support set new component security bytes, PIN, MAC value to cluster

u Repair RB4 NOT start ((PICTURE 6.4) Number 2): If you select A4 Crypto RB4 or A4 Crypto RB8 type, you can see this function. You can fix car stop working suddenly by perform this operation. Of course, before run this function, you’d better backup

EEPROM dump via OBDII 

u Write new immo status ((PICTURE 6.4) Number 3): You can see this function by select A4 Crypto RB8 type. The working immo status is “6”. You can write to fix car stop working suddenly

(PICTURE 6.4)

6.3. Change KM

Support following types (4th immobilizer cluster enter 4th immobilizer system for change KM, K-Line cluster enter K-Line instrument/immobox for change KM):                

1) CAN Instrument - A4(2009-)/A5/Q5

2) CAN Instrument - A6/Q7/Allroad (-2011)

3) CAN Instrument - A8 (2003-2011)

4) CAN Instrument – Touareg/Phaeton (2007-2010)

5) CAN Instrument – VW Touareg(2010-)/Audi A6 (2012-),A7,A8(2011-)

6) CAN Instrument– VW Lavida(China)1.6, 2.0 (NEC+24C08)

7) K-Line Instrument– Touareg/Phaeton (-2007)

(PICTURE 6.5)

u The steps for change KM (expect item 5) (PICTURE 6.5): 

1) Read old KM with button “Read KM”

2) Type in new KM value

3) Run “Write KM”

4) For A4/Q5, A6/Q7/Allroad(-2011) types cluster. It need an unsure time from several minutes to 2 hours for first time change KM. Because SVDI2-VAG need to unlock cluster memory by searching. Every cluster has different lock value, so the time is not fixed. After you unlock the memory, it will be very quickly for second time change KM 

u VW Touareg (2010-)/Audi A6 (2012-),A7,A8(2011-) method (PICTURE 6.6):

1) Connect SVDI2 to car with OBD line, use "Read Dashboard config file" read and save config file A

2) Use BDM programmer read the 95320 EEPROM dump in dashboard, save as file B

3) Press button "Decrypt KM from EEPROM", it will first load config file A, then load 95320 EEPROM file B 

4) After decrypt success, KM value will show in Old KM

5) Input new KM, press button "Prepare EEPROM with new KM" and save new 95320 EEPROM file C

6) Write new 95320 EEPROM file C to 95320 chip, and put the dashboard to car

7) Complete

(PICTURE 6.6)

6.4. Adapt Unit

You can install 2nd hand module with this function, also can synchronize ECU with immobilizer system etc Support following types:

1) ECU (EDC16/EDC17/MED9/MED17/Simos) – 4th immobilizer ECU

2) Kessy Audi A8, VW Touareg/Phaeton

3) Passat B6 /CC Comfort module

4) A6/Q7/Allroad Transmission gearbox

5) Electrical Steering Colum Lock(PQ35)

6) A6/Q7/Allroad EZS-Kessy

(PICTURE 6.6), it looks very easy for change 2nd hand module, write after read is completed. But there’s many important point in the process. Follow will list in detail for each item, please read carefully before you use this function:  

l How to get PIN/CS value stored in 2nd hand module

Ø Usually you can get original PIN/CS from car ECU where the 2nd hand module was original equipped. Of course, you can get original PIN/CS from immobilizer system where the 2nd hand module was original equipped, example: 4th immobilizer cluster, J518, Kessy etc 

Ø For new car, you can get power class from the front system

l Sometimes ask to input power class for 2nd hand module

Ø You need type in power class (stored in 2nd hand module) for some type

Ø When you select load 2nd hand EEPROM dump will get window like (PICTURE 6.8), if you get nothing or “00” here, means the decrypt power class is error, you need type correct power class. If show with other value (such as 63, 26, 07, 80, FE, 84) automatically, mean the power class was decrypted form EEPROM dump correctly. Note: If you get power class “00” for new module, it may correct value.

Ø When you select known PIN/CS, some type get window to input power class (PICTURE 6.8). You can get original power class from car ECU where the 2nd hand module was original equipped. Of course, you can get original power class from immobilizer system where the 2nd hand module was original equipped, example: 4th immobilizer cluster, J518, Kessy etc 

Ø For new car, you can get power class from the front system

l About adapt Gearbox and J518 for A6/Q7/Allroad

Ø CS is the original component security bytes, 6 bytes. 

Ø CS part 2 is another 6 bytes component security bytes. There’s 12 bytes component security bytes in Gearbox and J518. If you read J518 EEPROM with working key support in 9S12DT128 type, it will show 6 bytes CS part 2

Ø There’s component protection for 2nd hand J518. You must learn 2nd hand to car before adapt unit. You can find this in chapter 6.5 component protection

            (PICTURE 6.6)

           (PICTURE 6.7)

u 4th immobilizer system ECU (EDC16/EDC17/MED9/MED17/Simos/ME7)

Ø You can select autodetect engine control unit existing to get PIN/CS or type in known PIN/CS manually

Ø Press button “Read” (PICTURE 6.6), it will complete search power class for several minutes

Ø After success read power class you get window (PICTURE 6.7)

Ø Input new Immo No, VIN, CS, PIN, press button “Write”. It can synchronize immobilizer with ECU automatically after write success. Note: for the synchronization process, you must have a key recognized by immobilizer system

Ø Please don’t change the 7th byte CS, most car ECU only have 6 bytes CS, 7th byte is always “00”

Ø The ECU power class doesn’t support change via adapt unit. You can try with ECU Flash in diagnostics to change power class (You need have a correct flash file)

u Kessy in Audi A8, VW Touareg/Phaeton

Ø You can load EEPROM dump (93C86) for 2nd hand Kessy (support car before 2009), or type in known PIN/CS manually

Ø Press button “Read” (PICTURE 6.6).  It requires input power class for 2nd hand module (PICTURE 6.8).  Attention: the working key in 2nd hand Kessy will stop work after success reading, it can start work after write with correct 7 bytes CS. This usually happen for adapt original Kessy module in car, because the Kessy have working key

Ø Input new Immo No, VIN, power, total 7 bytes CS, PIN, press button “Write” 

Ø Note: Kessy power class can change via adapt unit

         (PICTURE 6.8)

u Passat B6/CC Comfort module

Ø You can load EEPROM dump (95320) for 2nd hand comfort module, or type in known PIN/CS manually

Ø Press button “Read” (PICTURE 6.6).  It requires input power class for 2nd hand module (PICTURE 6.8).  Attention: the working key in 2nd hand comfort module will stop work after success reading, it can start work after write with correct 7 bytes CS. This usually happen for adapt original comfort module in car, because the comfort module have working key 

Ø Input new Immo No, VIN, power, total 7 bytes CS, PIN, press button “Write” 

Ø Note: Comfort module power class can change via adapt unit

u A6/Q7/Allroad Transmission gearbox

Ø You can load EEPROM dump (EZS-Kessy J518) for 2nd hand J518, or type in known PIN/CS manually 

Ø Press button “Read” (PICTURE 6.9).  It requires input power class for 2nd hand module (PICTURE 6.8). Attention: it you start with known PIN/CS, the 2nd hand gearbox will stop work after success reading, it can start work after write with correct CS part 2. This usually happen for adapt original gearbox in car, because the gearbox have CS and CS part 2

Ø Input new VIN, power, CS, CS part2, PIN, press button “Write”. You can get new immo data from the original J518 (which is original equipped on the new car) EEPROM dump (PICTURE 6.9) with function “Load EZS-Kessy dump to which to adapt”

Ø Note: Gearbox power class can change via adapt unit

Ø CS is original component security bytes (6 bytes), CS part 2 is another 6 bytes component security bytes. CS part 2 is use to verify J518 and working key. You’d better fill new immo data with function “Load EZS-Kessy dump to which to adapt”

Ø (PICTURE 6.9) is window for adapt J518, gearbox have the same window, only have different connect unit while adaptation 

u Electrical Steering Colum Lock (PQ35)

u You can select autodetect engine control unit (need connect the ECU from car which the 2nd hand module was original equipped) existing to get PIN/CS or type in known PIN/CS manually

Ø Press button “Read” (PICTURE 6.6) 

Ø Input new VIN, power, 6 bytes CS (7th byte CS must set “00”), PIN, press button “Write”. It can synchronize immobilizer with ELV automatically after write success. Note: for the synchronization process, you must have a key recognized by immobilizer system 

Ø Note: ELV power class can change via adapt unit

u A6/Q7/Allroad EZS-Kessy

Ø You can load EEPROM dump (EZS-Kessy J518) for 2nd hand J518, or type in known PIN/CS manually 

Ø  Press button “Read” (PICTURE 6.9).  It requires input power class for 2nd hand module (PICTURE 6.8). Attention: it you start with known PIN/CS, the working key in 2nd hand J518 will stop work after success reading, it can start work after write with correct CS part 2. This usually happen for adapt original J518 in car, because the J518 have working key 

Ø Input new Immo No, VIN, power, CS, CS part2, PIN, press button “Write”. You can get new immo data from the original J518 (which is original equipped on the new car) EEPROM dump (PICTURE 6.9) with function “Load EZS-Kessy dump to which to adapt”

Ø Note: J518 power class can change via adapt unit

Ø CS is original component security bytes (6 bytes), CS part 2 is another 6 bytes component security bytes. CS part 2 is use to verify gearbox and working key. You’d better fill new immo data with function “Load EZS-Kessy dump to which to adapt”

Ø Attention: EZS-Kessy J518 has component protection, you must learn the 2nd module to car before adapt unit. Detail can be found in chapter 6.5 Component protection

                                (PICTURE 6.9)

6.5. Component Protection

6.5.1. Generation 1 component protection

Generation 1: Audi A8 (2003-2010) control unit, Audi A6/Q7/Allroad (2004-2008) part control unit. Support following types (PICTURE 6.13)：

1) Audi A6/Q7 (2004-2009) - 07 - Control Head (MMI)

2) Audi A6/Q7 (2004-2009) - 09 - Central electric (ILM Fahrer)

3) Audi A6/Q7 (2004-2009) - 0E - Media Player 1 (MP3 CD Changer)

4) Audi A6/Q7 (2004-2009) - 18 - Auxilary Heater

5) Audi A6/Q7 (2004-2009) - 46 - ILM Front passenger (ILM Beifahrer)

6) Audi A6/Q7 (2004-2009) - 06 - Seat Memory Passenger

7) Audi A6/Q7 (2004-2009) - 36 - Memory module (Driver's seat)

8) Audi A8       (2003-2006) - 17 - Instrument Cluster

9) Audi A8       (2003-2010) - 06 - Seat Memory Passenger

10) Audi A8       (2003-2010) - 36 - Memory module (Driver's seat)

11) Audi A8       (2003-2010) - 47 - DSP Bang & Olufsen

Steps for generation 1： 

1) Require 2nd hand device EEPROM dump. Item 8) can read by OBDII, other item need read EEPROM dump with BDM programmer

2) After decrypt 2nd hand device EEPROM dump, we need new car component protection data. Accord car type there are 2 methods:

Ø  For A6/Q7/Allorad vehicles: You can load new car J518 EEPROM, of course you can read this EEPROM by OBDII 

Ø For A8 vehicles: We need connect to internal CAN line to obtain component protection data. Following the picture: SVDI2 DB25 line (PICTURE 6.11), internal CAN line (PICTURE 6.12) (under driver’s seat), connect the line one by one. Then press button “Read” in (PICTURE 6.10). After success read, before continue you need connect SVDI2 DB25 interface to car OBDII

3) After read component protection data success from new car. Just follow programs’ message and NEXT to learn the 2nd hand device to new car

           (PICTURE 6.10)                     (PICTURE 6.11)

          (PICTURE 6.12)                      (PICTURE 6.13)

6.5.2. Generation 2 component protection

Generation 2: Audi A6/Q7/Allroad other control unit, Audi A4/A5/Q5 control unit (PICTURE 6.13) Now we support following modules: Entry And Start Authorization, Airbags, Instruments, Central Electric, Central Comfort Module, Seat Memory Driver, Auto HVAC, Auxiliary heater, Seat memory passenger, Sound System, Control head, Information Electric, Radio etc           

           (PICTURE 6.14)

 Steps for generation 2:

1) Connect SVDI2 to car via OBDII, press button “Start”.  (PICTURE 6.14) is one scan result

u Status show Adapt to car means unit is already adapt to car

u Status show No Component protection means unit don’t have component protection function

u Status show Virgin means unit is new module, it is ready to learn

2) Select destination unit and press button NEXT

u For the Adapt to car module we need reset module to virgin, we provide 4 methods (PICTURE 6.15):

Ø By module EEPROM dump read by OBDII (available for EZS-Kessy, KOMBI, AIRBAG, Comfort module and Climatronic) (First time read climatronic via OBDII need reflash module)

Ø By module EEPROM dump (available for EZS-Kessy and AIRBAG)

Ø By GATEWAY EEPROM dump (available for all devices, requires the GATEWAY EEPROM dump from the car where module was originally equipped)

Ø By GATEWAY EEPROM read by OBD (available for all devices, requires the GATEWAY from the car where module was originally equipped, to be connected in the car. It may need reflash GATEWAY for the first time, flash need about 2 minutes)

u After success reset module to virgin, turn to step 3), enter learn module to car (PICTURE 6.16)

3) For virgin module, enter learn module to car (PICTURE 6.16)

u To learn the specified module to the vehicle, you need the EEPROM dump of the GATEWAY module from the car where you want to build the module 

Ø Load GATEWAY EEPROM dump (Load the new vehicle GATEWAY EEPROM dump)

Ø Read by OBDII (Requires connect to new car, and will reflash GATEWAY for first time read (about 2 minutes))

u After you read GATEWAY EEPROM success, press button NEXT to complete learn operation

4) After the 2nd module learn to car, it works now

           (PICTURE 6.15)                     (PICTURE 6.16)

6.6. EEPROM Dump Tool

(PICTURE 6.17) accord to the load EEPROM dump, it mainly has following functions: ECU EEPROM: Decrypt for PIN, CS, MAC, set new PIN, CS, MAC value Immobox EEPROM: Kessy(93C86), J518, Comfort module dump, decrypt for PIN, CS, Immo No. VIN etc  Instrument EEPROM: Decrypt for PIN, KM, and set new KM            

(PICTURE 6.17)

Support following types:

1) IMMO - KESSY - Audi A8, VW Touareg, VW Phaeton, Porsche Cayenne, Bentley Continental [93C86]

2) EZS-Kessy Security access code / component protection data [9S12]

3) Passat B6 Comfort module component protection data [95320]

4) ECU Magneti Marelli(MM7GV, used in part NEC35xx type) PIN and component protection data [95320]

5) ECU EDC16 Set component protection data [95320]

6) ECU EDC16 Immo bypass [95320]

7) ECU EDC16 Mileage calculator [95320]

8) ECU EDC16 Security access code / Checksum calculator [95320]

9) ECU EDC16 Speed Limiter [95320]

10) ECU EDC16 Make virgin [95320]

11) ECU MED 9.x Reset component protection data [95160]

12) ECU MED 9.x Security Code / Checksum calculator [95160]

13) ECU MED 9.x Reset component protection data [95080]

14) ECU MED 9.x Security Code / Checksum calculator [95080]

15) ECU MED 9.x Reset CRYPTED Login/Component protection

16) ECU MED 9.x Reset flash counters

17) ECU MED 9.x Immo Bypass

18) ECU ME 7.x Set component protection data [9P08/95080]

19) ECU ME 7.x Security Code / Checksum calculator [9P08/95080]

20) ECU ME 7.x Immo Bypass [9P08/95080]

21) ECU EDC15 Immo bypass [24C04]

22) Gateway Mileage resetter [95160]

23) Steering lock VW Passat 6 Security code [68HC908]

24) ECU Simos Benzin - Immo bypass

25) ECU Simos 7 - K-line - Login code [93C76] [93C86]

26) ECU Simos 7 - CAN - Security Access Code [93C76] [93C86]

27) ECU Simos 7 - CAN - Reset component protection data [93C76] [93C86]

28) ECU Simos 6.x - Security Access Code

29) ECU Simos 6.x - Reset component protection data 

30) ECU Simos PPD1x - Reset component protection data

31) ECU Simos PPD1x - Mileage calculator

32) ECU Simos PPD1x - Security Access Code

33) ECU Simos 9.1 - Reset component protection data

34) ECU Simos 9.1 - Security Access Code

35) ECU Simos 9.2 - Reset component protection data

36) ECU Simos 9.2 - Security Access Code

37) ECU Simos 6.3 - Reset component protection data

38) ECU Simos 6.3 - Security Access Code

39) ECU Simos 3.3 - Security Access Code and CS bytes

40) ECU Magneti Marelli Security Access Code [95320]

41) ECU Magneti Marelli - Reset component protection data [95320]

42) ECU Magneti Marelli Security Access Code [95080]

43) ECU Simos 9.1 (Polo 2007) - Security Access Code

44) ECU Bosch M3.x - Immo bypass

45) ECU MSA1x - Immo bypass

46) IPC VDO VW/Seat/Skoda (2007+) Micronas

47) IPC - CRYPTO Skoda Fabia, Skoda Roomster, VW Polo, Seat Ibiza [ 93C86 ]

48) Magneti Marelli MM4 Instrument mileage and login code [HC12]

49) Audi A3/A4/A6 UKNSI 1995-1997 mileage and login code [93C56]

50) Audi A3/A4/A6 UKNSI 1997-1998 mileage and login code [93C56]

51) Audi A3/A4/A6 UKNSI Japan mileage and login code [93LC56]

52) Audi 100 VDO 1995 mileage [94C46]

53) Golf 3 VDO 1995 mileage [93C46]

54) Golf 3 VDO V3.9 mileage [93C46]

55) Golf 3 Diesel mileage [93C46]

56) Golf 3 Motometer V5.8 mileage [93C56]

57) Polo Motometer mileage [93C46]

58) Polo Motometer 1996 mileage [93C66]

59) Passat VDO 1991 mileage [93C56]

60) Passat VD202 1993 mileage [93C46]

61) Passat GT mileage [93C46]

62) Passat GT mileage [93C56]

63) Caddy mileage [93C56]

64) Corrado VDO 1993 mileage [93C46]

65) Corrado MotoMeter 1991-1995 mileage [93C56]

66) Corrado VDO 1991-1995 mileage [93C56]

67) Jetta 1994-1996 mileage [93C46]

68) T4 MotoMeter 1996-1997 mileage [93C56]

69) Audi A8 (-2002) - Security access code [24c17]

70) Audi A8 (-2002) - Mileage calculator [24c17]

71) Polo TRW [24c08] - Security access code

72) Black immobilizer box VALEO 24C04 - Security access code

SVDI2 - BMW User Manual

1. Document Declaration. 1

2. Overview.. 1

2.1. Noun explanation. 1

2.2. Options. 2

2.3. EEPROM/KM/Synchronization Codes (OBD) 2

2.4. Key Learn. 3

2.5. File Make Key. 3

2.6. Unlock Key. 3

2.7. File Change KM.. 3

2.8. CAS Repair. 3

2.9. CAS PLUG.. 4

3.  Options. 4

3.1. Language. 4

4.  EEPROM/KM/Synchronization Codes (OBD) 4

5.  Key Learn. 7

5.1. Overview.. 7

5.1.1. CAS1/CAS2/CAS3/CAS3+ Function. 7

5.1.2. CAS4 Function. 10

5.2. Special note in OBD operation (Important!!!) 11

5.3. CAS1/CAS2/CAS3 make dealer key by OBDII 15

5.4. CAS3+ not encrypt version make dealer key by OBDII 15

5.5. CAS3+ encrypt version (include ISTAP) make dealer key by OBDII 16

5.5.1. Add new key with working key. 16

5.5.2. Lost All Key. 17

6.  File Make Key. 18

6.1. Special note in File Make Key (Important!!!) 18

6.2. EWS1/EWS2/EWS3/EWS4/CAS1/CAS2/CAS3 (include lost all key) 21

6.3. CAS3+ (include lost all key) 22

6.4. CAS4 (CAS4+) (include lost all key) 23

7. Unlock Key. 24

8.  File Change KM.. 25

9.  CAS Repair. 27

9.1. CAS1 (0K50E) OBDII Repair. 27

9.2. ISTA-P4* OBDII Repair. 27

10. CAS PLUG.. 28

10.1. CAS PLUG Overview.. 28

10.2. Make old CAS PLUG work on SVDI2. 29

10.3. CAS PLUG connect to EWS/CAS. 31

10.4. Manual line to achieve CAS PLUG.. 34

1. Document Declaration

Please view the following declaration carefully:

u SVDI2 – BMW User Manual can help you maintenance vehicles with SVDI2 device. Please DON’T used for illegal purpose, Please follow the national law

u SVDI2 – BMW User Manual is written by SVDI2, please DON’T used for commercial purposes without authorize

u SVDI2 – BMW User Manual can help you how to use BMW software, please view carefully

u Any illegal use SVDI2 – BMW User Manual, illegal use SVDI2 device, The user should take all risks, the company does not assume any responsibility

2. Overview

Mainly function shown in (PICTURE 2.1):         

(PICTURE 2.1)

2.1. Noun explanation

u BMW: Bayerische Motoren Werke

u EWS: Immobox used in earlier BMW cars

u CAS: Car Access System(40 unit), mainly include CAS1(0K50E), CAS2(2K79X), CAS3(0L01Y),    CAS3+(0L15Y, 0M23S), CAS4(1L15Y, 5M48H), this document will only use CAS1, 2, 3, 3+, 4, 4+ to express, don’t write detail mask. If document have detail mask indicates the special explain to this type

u FEM: The latest immobox used in BMW cars. Now SVDI2 don’t support this type

u OBDII method: connect SVDI2 to car with OBDII interface

u CAS PLUG: It is not a standard device, need buy for extra. Communication with CAS through CANBUS 100Kbps.  Detail can be found in chapter 10 CAS PLUG

u CAS3+ encrypt version: Sometimes we call CAS3++. When the car (not encrypt version) start, CAS will verify key, engine will verify CAS. But for CAS3++ type, engine will verify key in addition. So add key for this type need working key or ISN support. For the above reason, the introduction for CAS3+ is also applicable for CAS3+ encrypt version. Expect write no applicable for CAS3+ encrypt version

u ISTAP Version: Strictly, ISTAP belong to CAS3+ encrypt version, the only different is that we cannot read CAS immodata by OBDII for ISTAP version. Fortunately, we can OBDII read ISTAP CAS immodata by update CAS flash. SVDI2-BMW update ISTAP version flash only need 10 minutes. So the introduction for CAS3 encrypt version also applicable for ISTAP version, expect write not applicable for ISTAP

u ISN: Identification Serial Number, this value use to verify engine with key. 16 bytes

u Known CAS3+ encrypt version(not ISTAP) SN: 9226238, 9227053, 9237046, 9237047

u Known ISTAP version SN: 9262360, 9262361, 9278745, 9278746, 9287534, 9287535, 9267608, 9267609

u Lost all key: The car lost all working key, there is big different from add key with working key. Note: before OBDII communication, you need open dangerous light, press on the brakes for several times to active OBD communication

2.2. Options

Detail can be found in chapter 3 Options

u Language

u About…

2.3. EEPROM/KM/Synchronization Codes (OBD)

Detail can be found in chapter 4 EEPROM/KM/Synchronization Codes (OBD)

u Read EEPROM / Write EEPROM

u Read KM / Write KM

u Synchronize DME-CAS, CAS-ELV

2.4. Key Learn

Detail can be found in chapter 5 Key Learn

u Get Key Info

u Write Key Info

u Load Key Info / Save Key Info

u Prepare dealer key with programmer 

u Prepare dealer key with ignition switch

u Add key

u Program Key Info

u Repair Keyless Key

u Enable Key / Disable Key

u Clear DTC / Clear Shadow

2.5. File Make Key 

Detail can be found in chapter 6 File Make Key

u EWS1/EWS2/EWS3/EWS4

u CAS1/CAS2/CAS3/CAS3+/CAS4

2.6. Unlock Key

Detail can be found in chapter 7 Unlock Key

u Unlock with key info file

u Unlock with CAS1/CAS2/CAS3/CAS3+ EEPROM

2.7. File Change KM

Detail can be found in chapter 8 File Change KM

u EWS3/EWS4

u CAS1/CAS2/CAS3/CAS3+ CAS4

u Cluster (E Series): M35080 EEPROM dump

u Cluster (F Series)

2.8. CAS Repair

Detail can be found in chapter 9 CAS Repair

u CAS1(0K50E) OBDII Repair 

u ISTAP4* Version OBDII Repair 

2.9. CAS PLUG

Detail can be found in chapter 10 CAS PLUG 

3.  Options 

3.1. Language

Support following languages:

u Chinese (Simplified)

u English

u Italian

u Spanish

u German

u Hungarian

 Please manual set user language after first run program                     

4.  EEPROM/KM/Synchronization Codes (OBD)

OBD main window (PICTURE 4.1), Support following functions:

u Auto Detect: Auto detection communication protocol, support KWP-E6X…, CAN bus 100Kbps, CAN bus 500Kbps. Other functions need choose manually

u OBDII KWP – E6X, E7X, E9X, E81, E82, E87, E89: Usually used in old cars with CAS1, CAS2 and some CAS3

u KWP – CAN bus 100Kbps: This type will be use when your SVDI2 connect to CAS with CAS PLUG or without gateway

u KWP – CAN bus 500Kbps: This type will be use when connect to car with CAS3, CAS3+  

u BMW EWS KLine: When connect EWS with CAS PLUG, choose this type

u BMW F-Series: This type can connect to CAS4 in BWM F-Series  

(PICTURE 4.1)

u Connect: Connect to CAS system. Attention: EWS don’t support this (see special note 1). After connect to CAS, there will display detail information in CAS identification (PICTURE 4.2). When you choose Auto Detect, only connect support, it will detect the connection type: KWP, CANBUS 100, CANBUS500. You must choose

another type before other operation

u CAS identification:  

Ø CAS ID: CAS identification number

Ø CAS type: CAS type is very important, this type is detected by SVDI2-BMW, If the type detect incorrect，add new key may not work. Usually have the following types: CAS1, CAS2, CAS3/CAS3+, CAS3++, CAS3++ (ISTAP), CAS4 etc.  

CAS3/CAS3+: This means CAS should be CAS3 (0L01Y) or CAS3+(0L15Y)(not encrypt version) CAS3++: This means detected CAS3+ encrypt version CAS3++ (ISTAP): find ISTAP version

Ø VIN: Vehicle identification number

Ø Prod. Date: CAS production date

Ø HW: CAS hardware version

Ø FSV: Function software version in CAS

Ø OSV: Operation software version in CAS

(PICTURE 4.2)

u Read EEPROM: Support Read CAS1/CAS2/CAS3/CAS3+ (ISTAP version not support) EEPROM. For CAS1/CAS2/CAS3 type require CAS PLUG; CAS3+ can use OBDII or CAS PLUG. Attention: the read EEPROM for CAS3+ is not the whole EEPROM, You can’t write it to CAS with BDM programmer, it can use to prepare dealer key with File Make Key

u Write EEPROM: Support write CAS1/CAS2/CAS3 EEPROM dump by OBDII,

requires CAS PLUG

u Save to File… / Load From File…: Save the reading data / load EEPROM dump to buffer

u Read KM: Read KM stored in CAS system, support CAS1/CAS2/CAS3/CAS3+ (ISTAP version not support). CAS1, CAS2, CAS3 require CAS PLUG; CAS3+ can access by OBDII and CAS PLUG

u Write KM: Write new KM to CAS, support CAS1/CAS2/CAS3/CAS3+ (ISTAP version not support). CAS1, CAS2, CAS3 require CAS PLUG; CAS3+ can access by OBDII and CAS PLUG  

Attention: KM shown on instrument stored not only in instrument, but also in CAS system, it can synchronize CAS with cluster for the bigger one. So, when you want change KM, you’d better take instrument away from car, Set CAS KM to 0, read EEPROM dump from instrument, change instrument EEPROM KM to new one with File Change KM function, write the new EEPROM dump to instrument and put your instrument in car 

u Read Code: Read DME and EGS code stored in CAS

u Write Code: Write DME and EGS code to CAS system. Attention: We don’t recommend general user write this code, the car will stop working if write error code

u Synch DME-CAS: Synchronize DME and CAS. Don’t do this operation if you lost all working key. Sometimes add new key for CAS1/CAS2/CAS3 will lost synchronization code, then you can run this operation, see Special Note 2

u Synch CAS-ELV: Synchronize CAS and ELV, This function can be run once ELV has error; Sometimes add new key for CAS1/CAS2/CAS3 will cause ELV error，then you can run this operation, see Special Note 2