Pages: [1]
Author Topic: KWP2000 (CAN) eeprom read  (Read 2977 times)
H2Deetoo
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 94


« on: July 23, 2015, 12:45:44 AM »

Hi guys,


I am trying to write some software to read (and write) the eeprom of a specific module in my VW Passat car.
It is the door/window module, which is reachable using the OBD connector and uses KWP2000/TP20 protocol.

I can communicate with it already (requesting ident) but I am having troubles reading eeprom.
I am doing something like this:

-> 10 84                      (Go to diagnostic mode 84)
<- 50 84                      (Positive response)

-> 27 03                      (Request seed)
<- 67 03 AA BB CC DD   (Seed response)
-> 27 04 11 22 33 44     (Send key)
<- 67 04 34                 (Positive key response)

-> 23 40 00 00 10         (Request 16 bytes of memory from address 400000h)
<- 7F 23 11                 (Negative response: Service not supported in this session)


The problem I am facing is that there are too many possible variables:
- Which diagnostic session to use? -> I made a list of valid values and tried them all
- Which seed/key index to use? -> I haven't tried them all, but only 03/04 seemed valid at first
- Which seed/key algo to use? -> I found a static login value (simple addition) which works. Perhaps not the correct one for reading eeprom
- Which command is used to read eeprom? -> I am trying with KWP2000 command 23, but perhaps this module uses a different or even custom command
- Which address is used to access eeprom? -> I just tried different values like 000000 and 200000 and 400000 ...

Does anyone have a valid log of any eeprom read of any KWP2000/TP20 device?
Any log will be helpfull at this point I suppose.


Thank you,
H2Deetoo
Logged
Deko
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 28


« Reply #1 on: July 23, 2015, 03:19:13 AM »

Hi guys,


I am trying to write some software to read (and write) the eeprom of a specific module in my VW Passat car.
It is the door/window module, which is reachable using the OBD connector and uses KWP2000/TP20 protocol.

I can communicate with it already (requesting ident) but I am having troubles reading eeprom.
I am doing something like this:

-> 10 84                      (Go to diagnostic mode 84)
<- 50 84                      (Positive response)

-> 27 03                      (Request seed)
<- 67 03 AA BB CC DD   (Seed response)
-> 27 04 11 22 33 44     (Send key)
<- 67 04 34                 (Positive key response)

-> 23 40 00 00 10         (Request 16 bytes of memory from address 400000h)
<- 7F 23 11                 (Negative response: Service not supported in this session)


The problem I am facing is that there are too many possible variables:
- Which diagnostic session to use? -> I made a list of valid values and tried them all
- Which seed/key index to use? -> I haven't tried them all, but only 03/04 seemed valid at first
- Which seed/key algo to use? -> I found a static login value (simple addition) which works. Perhaps not the correct one for reading eeprom
- Which command is used to read eeprom? -> I am trying with KWP2000 command 23, but perhaps this module uses a different or even custom command
- Which address is used to access eeprom? -> I just tried different values like 000000 and 200000 and 400000 ...

Does anyone have a valid log of any eeprom read of any KWP2000/TP20 device?
Any log will be helpfull at this point I suppose.


Thank you,
H2Deetoo

sent you a PM
Logged
roth18
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 17


« Reply #2 on: July 23, 2015, 07:32:00 AM »

You might need this.  Grin

BR, Roth
Logged
Basano
Full Member
***

Karma: +56/-1
Offline Offline

Posts: 173


« Reply #3 on: July 23, 2015, 10:37:42 AM »

On my MED9.1 ecu I was able to read the e2p indirectly via the KWP commands.

The e2p is mirrored in RAM and by reading the RAM you can deduce the e2p contents.

Maybe you could try something similar? I'm not sure if they'd use a RAM mirror for a door/window module though (pretty static data)

Logged
H2Deetoo
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 94


« Reply #4 on: July 24, 2015, 12:49:11 AM »

Hi Basano,


Yes I understand what you mean, but still leaves me with exactly the same questions as stated above Sad


Rgs H2Deetoo
Logged
H2Deetoo
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 94


« Reply #5 on: July 26, 2015, 07:14:38 AM »

Solved, cmd 35h was used to read eeprom ;-)
Logged
dream3R
Hero Member
*****

Karma: +13/-6
Offline Offline

Posts: 1202


« Reply #6 on: October 13, 2015, 09:41:44 AM »

Solved, cmd 35h was used to read eeprom ;-)

Nice one, I used the mirror too as as it was easier.

was 35h over UDS/CAN or kline?
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
dream3R
Hero Member
*****

Karma: +13/-6
Offline Offline

Posts: 1202


« Reply #7 on: October 13, 2015, 10:17:27 AM »

seems like 35h is request upload https://en.wikipedia.org/wiki/Unified_Diagnostic_Services
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 17 queries. (Pretty URLs adds 0s, 0q)