Golf mk7 Security Code discovery - Can you help?
I recently constructed a purpose-built test-jig that I intend to use to interrogate the control modules on a mk7 in the comfortable environment of my workshop bench (see below). The device is just a way of interfacing a CAN Gateway (PN-5Q0 907 530 E) between the control module under test and a VCDS cable.
It's really nothing more than a power distribution board and a place to anchor the diagnostic CAN high/low wires. I've also included a T15 (terminal 15) switch on the board to simulate ignition switch-on which is used as a wake-up signal by some control modules. The LEDs are just there to tell me that the power is switched-on and to indicate the state of the T15 switch. All that's needed in addition to the components in the picture is a 12 Volt power supply (less than 1 Amp) and a VCDS cable (oh.. and the module under test- of course).
http://www.vwwatercooled.com.au/foru.../kTTgfAv-1.jpg
Once the device was built, it was an easy matter of stripping all of the original control modules from the installation list on the CAN Gateway (it was second-hand from Germany) and then clearing all of the DTCs to get the very simple, but very unusual auto-scan report below (not many autoscans take only 33 seconds to complete!)
Code:
Tuesday,26,April,2016,00:26:11:03521
VCDS -- Windows Based VAG/VAS Emulator Running on Windows 10 x64
VCDS Version: 16.3.1.1 (x64)
Data version: 20160325
www.Ross-Tech.com
VIN: License Plate: TESTBENCH JIG
Mileage: Repair Order: autoscan
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
19-CAN Gateway -- Status: OK 0000
Chassis Type: 5Q0
Scan: 19
19-CAN Gateway -- Status: OK 0000
-------------------------------------------------------------------------------
Address 19: CAN Gateway (J533) Labels: 5Q0-907-530-V1.clb
Part No SW: 5Q0 907 530 E HW: 5Q0 907 530 E
Component: GW MQB Mid 121 1109
Revision: -------- Serial number: 0000073193
Coding: 010000342B086400EF0006481C0F00000001000000000000000000000000
Shop #: WSC 01357 011 00200
ASAM Dataset: EV_GatewLear 006010
VCID: 3365F3749A38A9A479-FFFE
No fault code found.
End-------------------------(Elapsed Time: 00:33)--------------------------
So why am I telling you this I hear you ask? Well, other than being a real nifty way of finding-out more about how these control modules work (because it's a one-to-one communication's network), the test jig is able (I hope) to discover previously unknown security codes. As many here have found, security codes are essential to do most of the tweaks listed in various forums and in lots of control modules, multiple security codes are used to access specific adaptation channels. At present, VCDS doesn't have a security code discovery facility, but cables like VCP and OBD11 can be used for this function.
As a test exercise, I hooked-up a VCP cable to my jig, set-up the necessary variables and started the polling process to find the security codes in the CAN Gateway. Because of the simplicity of the test-jig (there are no communications crashes on the CAN bus from competing control modules wanting to get access), the speed of the polling process is increased. I let the process run over-night and in the morning I had my answer. It took 9.5 hours to raw poll 100,000 candidate numbers (security codes are a 5 digit number) all without the involvement of a car or me as the cable user!! It confirmed my belief that there is only one security number in the CAN Gateway (20103)- perhaps not a spectacular finding, but as proof-of-concept, I was delighted with the outcome!
So here's the pitch- this is a kind-of "crowd sourcing" request, I guess!! My purpose in writing this post is to hear from anyone who has spare control modules for a mk7 (doesn't matter which, and even if you believe that the module is faulty) - particularly if you are located in Melbourne. I want a loan of the module, so that I can interrogate your module for unknown security codes. Security Code polling is a very "safe" process so the risks of damage are infinitesimal (IMO). Any codes found will be posted on my VCDS reference thread for the use of the forum community (with the control module owner's attribution). After I have finished, the module will be returned.
If you can help, please PM and we can arrange delivery and agree details for returning the module
Don
PS: My only concern about the success of the venture is the Component Protection facility on key control modules on a mk7. I've discussed this question with Sebastian at RT and his advice is that polling shouldn't be a problem on a test-jig environment - I'm keen to confirm Sebastian's hypothesis!!