NefMoto

Someone has just uploaded a video of a MK4 cluster performing a needle sweep on startup.  The comments seem to reveal that it's a Passat board with over 200 bits changed in the EEPROM.

Now, does anyone know what's been changed, or have a copy of said EEPROM?

Link to video?  ;D

https://www.youtube.com/watch?v=2bPcrHnFDW4

I now have it stage round, but it doesn't return.

You can do this with VCDS to test the needle sweep. Maybe that could clue us in.

 Posted 27 January 2010 - 04:46 PM

Graeme, I have tracked the guy down his name is Svenni from R32club.de but I cannot register to ask him how complicated the module is to build.

His username is Bisheep on r32club.de.

There was also some talk about a square wave generator tapped into the signal feed to the cluster, triggered with ign on

https://www.youtube.com/watch?v=AK3YjiQZwZE

I've got it to sweep round but it stays at the max position.  I'm going to try a Passat flash. 

People are saying they're "injecting custom code" but that's not a thing in an EEPROM that size.

ALSO: Why are people being so secretive?  It's a MK4 Golf ffs. 

the info was made public today..enjoy
http://www.users.on.net/~graeme86/sweep501/sweep501.html (http://)
http://www.users.on.net/~graeme86/sweep503/sweep503.html (http://)

Very interesting that these clusters allow a "code patch" residing in eeprom area.
Does anyone know if newer types of clusters like VDO NEC (PQ) support such feature also?


Rgs H2Deetoo

I implemented this the other day and it works.

I want to know HOW it works though, but that doesn't seem to be an option.

I read through the datasheet but nothing really stuck out.

Awesome

adam- do you have any datasheet for micronas used in the clusters?

Isn't it just simply some assembler code block?

I don't think so.

The EEPROM just contains settings AFAIK.

seems that there is some call to the code inside eeprom  :-\
post datasheet pls

https://4donline.ihs.com/images/VipMasterIC/IC/MCNS/MCNSS00288/MCNSS00288-1.pdf?hkey=EF798316E3902B6ED9A73243A3159BB0

If you can help explain this, I'd love to hear it!

I did this video, Bodie released patch for public, for both VWK501MH with ROM ID: 00A4, 10A4, 92A3 and VWK503MH ROM ID: 00AE, on Graeme's web site.

I've got it now. :)

I want to know HOW Bodie did it though - that interests me more.  Every time I ask I get shot down though.

Must be an assembler block stored in eeprom.
Just try to disasm this block using IDA and it should be self explanatory :)

it's a 65C816 core in the micronas chip

What address is the eep mapped at though? I don't have access to a cluster to trace the micronas/eep pins

I guess Bodie read the micronas chip(physically or KWP2000) too

Yeah, there's an IDA module for it, but I'll need to install VS to compile it.

That's both a flash read and an EEPROM read.  Not sure how that helps though.

How did you read the flash? I think its incomplete as the datasheet speciefies 256KB ROM

I read that, but it only read 8k.

I'm sure the datasheet goes on to mention only 8kb?  Read it with k-commander.

Hey guys, check this out:

http://www.users.on.net/~graeme86/sweep501/sweep501.html

will check today if my cluster has the right rom number and if yes i will try it and report back.

This has been posted 3 times now haha.

oh sorry for that

Would this be able to be done on the 8L A3 1.8t cluster

Sent from my SM-N900 using Tapatalk

No , diffrent dump

You think it would be possible to activate needle sweep on the 8L with maybe vcds long coding or something?


Sent from my SM-N900 using Tapatalk

Not possible , only extrenal module like vfiz

Very late to the game, I know, but I just figured it out this week (how the ROM patches work in the MKIV VDO clusters, not (yet) how the needle sweep patch works). The EEPROM not only contains settings but also a small patch block. The Micronas chip has a ROM patch module that allows for up to 10 ROM locations to be overwritten with patch data. When the cluster powers up, it loads the patch block into RAM, checks it to make sure it's valid for the cluster ROM version, then sets up the ROM patch module using data in the patch block. This causes a few places in the ROM code to jump into RAM where the patch block was loaded. I'll write up more details soon.

I wrote some open-source software that I use to read/write the EEPROMs in MKIV clusters (VDO, Bosch, Marelli), dump the VDO ROM, read/write the CCM EEPROM (like the ancient VDS-Pro), dump the EDC15 EEPROM and a few other things. Just needs a dumb KKL cable or VCDS with the VCP drivers.

https://github.com/gmenounos/kw1281test

This and the CCM stuff should be interesting!

Here is how cluster patches work:
https://github.com/gmenounos/vwcluster/blob/main/PatchModule.md