Security Access for USA 2016 MK7 Golf R - 17/Instruments

   #21  

Sebastian

Ross-Tech Employee
Staff member
Ross-Tech Employee
Joined
Feb 13, 2014
Messages
1,978
Reaction score
1,952
Location
Magdeburg, Germany
VCDS Serial number
HN0-nnnnnn
Don, pretty much all modules are like that. There's rarely only one code, also codes don't just apply to adaptation channels... They can be used to restrict pretty much any diagnostic function as well as do special things which aren't even on the menu (similar to codes enabling regeneration in some ECMs).
 
   #22  

olaf

Verified VCDS User
Verified
Joined
Feb 22, 2016
Messages
2
Reaction score
0
Location
USA
VCDS Serial number
C?ID=128907
25327 does not seem to work on my 2016 GTI SE. I am trying to change the fuel gauge settings. It initially accepts code 25327, but when I try to input a new value it says that a 'security code' is required. Damn.
 
   #23  

LoneMeme

Verified VCDS User
Verified
Joined
Feb 22, 2016
Messages
2
Reaction score
1
Location
USA
VCDS Serial number
C?ID=270456
So, we're just kind of hosed on this until someone that works for VW or a vendor chimes in with the security access? Dang. Really hoping to change this black-ice warning temp (more easily than the re-coding "workaround" that was suggested over the Vortex).

Just tell me who I have to buy some beer for and what they like, and I'm there. :thumbs:
 
   #24  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
Yep - we are totally stuck.
There are 10,000 possible combinations. I used excel to extrapolate them all and then eliminate all the ones with the same number more than 3 times in a row just working logically (like 24443)

There is still loads!!!!
I tried the first 50 in the 2xxxx range and then gave up.
Excel calculated it would take just over 6 days constant to try them all in the module :-P
 
   #25  

Uwe

Benevolent Dictator
Staff member
Joined
Jan 29, 2014
Messages
30,360
Reaction score
21,655
Location
USA
VCDS Serial number
HC100001
Yep - we are totally stuck.
There are 10,000 possible combinations. I used excel to extrapolate them all and then eliminate all the ones with the same number more than 3 times in a row just working logically (like 24443)

There is still loads!!!!
I tried the first 50 in the 2xxxx range and then gave up.
Excel calculated it would take just over 6 days constant to try them all in the module :-P
What you're contemplating is a "Brute Force Attack", which is probably futile. Most modules only allow a set number of incorrect attempts at security access (most typically 3), after which they go into a "lock" mode, where they will reject ALL security access codes, even correct ones, until "lock time" expires, and lock time only counts down with the ignition on...

-Uwe-
 
   #26  

Dana

Administrator
Staff member
Ross-Tech Employee
Joined
Jan 29, 2014
Messages
4,300
Reaction score
6,290
Location
United States
Right, we deal with this frequently in UDS Airbag modules but Advanced Measuring Group Security Access: Number of invalid keys needs to be 0 before another Login is accepted.
 
  • Like
Reactions: Uwe
   #27  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
You get a "time out seed" message after 3 attempts. Haven't yet tried a code, if rejected using the known good code and it being accepted. Then trying the next code.

Not that I'm going to do this - it is almost pointless with 9000+ possibilities
Hopefully someone will be able to help in time
 
   #28  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
You get a "time out seed" message after 3 attempts. Haven't yet tried a code, if rejected using the known good code and it being accepted. Then trying the next code.

Not that I'm going to do this - it is almost pointless with 9000+ possibilities
Hopefully someone will be able to help in time

Xpower: Don't get me wrong, but your attempts to find the illusive security code appears to be ..well......... quite an obsession (no offense intended). You must really, really want to fix the "Ice warning" message on the instrument cluster!!

Given that the most important part of any problem solving conundrum is the outcome (not the process), may I invite you to don your (deBono) "white-hat" and explore another approach? On a forum such as this, it's probably verging on heresy, but have you considered implementing a physical fix, instead of a VCDS solution?


It really depends on how much of a hassle the ice warning message is (down here, our temperatures don't get that low for the warning to be a nuisance). But it is possible (at least in theory) to insert a variable resistor (with a switch -if you want) into the ambient temperature sensor circuit so as to "trick" the instrument panel into thinking that the temperature is higher. Of course doing this will also alter the temperature reading on the MDF, but if this isn't a problem for you, then it just might provide an alternative fix- I think

Here's what I had in mind



The picture shows the wiring arrangement for the ambient temperature sensor. I've included in the picture, the new variable resistor and (if you want) a switch that either engages, or by-passes the fix - for the summer period when the ice warning is not a problem.

So here's the theory - it's usual for VW's temperature sensors to have what's known as a "negative temperature coefficient", which means that as temperature drops, the resistance of the sender increases. For "ice warning" conditions, the resistance of the sensor will be higher than the resistance at summer time temperatures. So what you need to do is to lower this resistance. The way to do this is to add another resistor "in parallel" with the sender (as shown in the picture).

You may already know (my apology if you do) but if two resistors are connected in parallel (R1 and R2, say), the formula for the resulting resistance is Total Resistance = R1*R2/(R1 + R2) . For example if R1 and R2 have the same value, then the total resistance is half the value of R1 (or R2) - This is all the maths that I want to include in this reply, but hopefully this makes sense and hopefully, you can see how adding another resistor in parallel with G17 lowers the overall resistance of the sensor

Using the above as an introduction, here's a possible alternative way for solving the ice warning problem:
1.Locate G17 - I believe that the ambient temperature sensor is physically located behind the front bumper, just to the right of the licence plate
2.Disconnect G17 from the connector (T2ca in the WD) and measure its resistance (using a multi-meter) when the temperature is cold
3.Confirm my negative temperature coefficient assumption by warming-up the sensor (with your hands) - the resistance should drop. (note: if the sensor has a positive temp coefficient, the variable resistor should be connected in series with the sensor)
4.Buy yourself a good quality variable resistor (preferably multi-turn) at about 4 to 10 times the measured resistance and wire it as shown in my circuit above (add the switch if you want - or wire the new resistor via a connector, so that it can be unplugged in summer). Only a low power variable resistor is needed (perhaps 1/2 to 1 Watt)
5.With the new resistor attached, vary the slider and have someone inside the car tell you when the ambient temperature reading on the MFA has risen sufficiently to avoid the ice warning.
6. Place a dob of glue on the slider mechanism, so that it won't move with the car's vibrations. Make sure all the new components are secured
7. Go inside and pour yourself a large glass of single malt scotch (with ice from outside your house) for a job well done!

Of course, if all this seems like more trouble than it's worth, then just ignore my suggestion!!

Don

PS: Question for RT (hopefully asked tactfully): The control module's proclivity to "spit-the-dummy" after the 3rd unsuccessful attempt, appears to have been resolved (in a fashion) in the "other cable" (won't name it, but it needs a correct security code to launch the "login finder" application). Given the importance of security codes to changing programmable parameters in the modules and the proliferation of codes as per Sebastian's reply above, does RT foresee a similar application (to login finder) in their cable in the fullness of time?
 
Last edited:
   #29  

olaf

Verified VCDS User
Verified
Joined
Feb 22, 2016
Messages
2
Reaction score
0
Location
USA
VCDS Serial number
C?ID=128907
How about the smartest guy in the room just come up with a valid code? Pretty please? With sugar on top?
 
   #30  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
DoN I appreciate your detailed reply, for me I am not looking at the ice warning message as 4 deg c is ok for me.
I am looking at setting the instrument cluster to be back lit all the time.

In previous MQB platforms this could be done in 2 ways:
1) change the values in the instrument cluster, either the "dimming characteristic curve day" values
or the "internal phototransistor" values.

2) in the 09 module you could active running lights all the time, this would be interior illuminations
(including instruments), tail lights, number plate lights & DRL's.

On the 2016 MQB platform VAG seems to have made a change, so number 2 no longer works.
On my car if you switch the side lights on (some call them park lights), the instruments are NOT backlit, they only come on when the headlights are on.

Original MQB
Light switch in off position - instruments variable backlight (from maximum brightness to unlit
depending on light conditions)
Light switch in side light position - instruments permanently lit with variable backlight for extremely
bright conditions
Light switch in headlight position - instruments permanently lit with variable backlight for extremely
bright conditions

2016 MQB
Light switch in off position - instruments variable backlight (from maximum brightness to unlit
depending on light conditions)
Light switch in side light position - instruments variable backlight (from maximum brightness to
unlit depending on light conditions)
Light switch in headlight position - instruments permanently lit with variable backlight for extremely
bright conditions
 
  • Like
Reactions: Uwe
   #31  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
DoN I appreciate your detailed reply, for me I am not looking at the ice warning message as 4 deg c is ok for me.
I am looking at setting the instrument cluster to be back lit all the time.

In previous MQB platforms this could be done in 2 ways:
1) change the values in the instrument cluster, either the "dimming characteristic curve day" values
or the "internal phototransistor" values.

2) in the 09 module you could active running lights all the time, this would be interior illuminations
(including instruments), tail lights, number plate lights & DRL's.

On the 2016 MQB platform VAG seems to have made a change, so number 2 no longer works.
On my car if you switch the side lights on (some call them park lights), the instruments are NOT backlit, they only come on when the headlights are on.

Original MQB
Light switch in off position - instruments variable backlight (from maximum brightness to unlit
depending on light conditions)
Light switch in side light position - instruments permanently lit with variable backlight for extremely
bright conditions
Light switch in headlight position - instruments permanently lit with variable backlight for extremely
bright conditions

2016 MQB
Light switch in off position - instruments variable backlight (from maximum brightness to unlit
depending on light conditions)
Light switch in side light position - instruments variable backlight (from maximum brightness to
unlit depending on light conditions)
Light switch in headlight position - instruments permanently lit with variable backlight for extremely
bright conditions
Xpower: My bad, I got you mixed-up with nsap. Yes, I've written-up both the tweaks for changing the dynamic curve for the photo-transistor and the Clock dials (this latter tweak came from ZEAL8080). But in both, the adaptation channel values have been set so that the cluster dims at twilight levels. This has been done deliberately to provide the driver with a visual prompt to turn-on the headlights. For safety reasons, I suggestion that you retain this effect.

I've been following the search for a way to defeat the curious NAR characteristic for the side-light switch on MY16 models. As you are probably aware, my tweak write-up deals ostensibly with the X channels (which I believe are related to daylight cabin light levels. If you want to deal with night-time conditions, then I you will need to develop a new curve for the "Y" values - if you are tweaking the photo-transistor. When I was experimenting with the "Y" curve, I found that modifications to these channels were much more prone to overriding the dimming control on the MENU, so bear this in mind.

But of course all this depends on finding the security code for the instrument control panel. I think that I might know a way to do this, but it's probably more prudent that I PM my suggestion -
Don
 
  • Like
Reactions: Uwe
   #32  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
Xpower: My bad, I got you mixed-up with nsap. Yes, I've written-up both the tweaks for changing the dynamic curve for the photo-transistor and the Clock dials (this latter tweak came from ZEAL8080). But in both, the adaptation channel values have been set so that the cluster dims at twilight levels. This has been done deliberately to provide the driver with a visual prompt to turn-on the headlights. For safety reasons, I suggestion that you retain this effect.

I've been following the search for a way to defeat the curious NAR characteristic for the side-light switch on MY16 models. As you are probably aware, my tweak write-up deals ostensibly with the X channels (which I believe are related to daylight cabin light levels. If you want to deal with night-time conditions, then I you will need to develop a new curve for the "Y" values - if you are tweaking the photo-transistor. When I was experimenting with the "Y" curve, I found that modifications to these channels were much more prone to overriding the dimming control on the MENU, so bear this in mind.

But of course all this depends on finding the security code for the instrument control panel. I think that I might know a way to do this, but it's probably more prudent that I PM my suggestion -
Don
Hi Don,

I am wanting to do the same as Xpower. I can't stand how the backlighting gets darker as the sun goes down. I have automatic headlights so there is no need to remind me to turn my headlights on. I'm really hoping you and Xpower find a way to fix it! You've done so much for VCDS!
 
   #33  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
I am looking at setting the instrument cluster to be back lit all the time.


Hi Don, I am wanting to do the same as Xpower. I can't stand how the backlighting gets darker as the sun goes down. I have automatic headlights so there is no need to remind me to turn my headlights on. I'm really hoping you and Xpower find a way to fix it! You've done so much for VCDS!
Xpower/Nathan: just out of dumb curiosity and because I always find NAR settings to be especially intriguing - do you have a copy of the admap for the instrument control module that you are willing to share?
Don
 
  • Like
Reactions: Uwe
   #34  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
   #35  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
Absolutely! In fact, here is a link to all the admaps on my '16 NAR Golf R with DAP. https://drive.google.com/folderview?id=0BxAYRwr8uzF6UlJrdG52b3FPVkE&usp=sharing
Nathan: As I said, NAR settings are invariably the most intriguing of all!! Comparison of the curves between your car and mine in the table below. My hypothesis (which is tentative and unproven, and is different to that of ZEAL8080) is that the "Y" values are those that pertain to darkening cabin levels with the most-dark at Y1 and the least-dark (twilight) at Y5



If you ever do find the security code for the Instrument control panel, I will be VERY interested in the values for your new curves

Don
 
  • Like
Reactions: Uwe
   #36  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
Nathan: As I said, NAR settings are invariably the most intriguing of all!! Comparison of the curves between your car and mine in the table below. My hypothesis (which is tentative and unproven, and is different to that of ZEAL8080) is that the "Y" values are those that pertain to darkening cabin levels with the most-dark at Y1 and the least-dark (twilight) at Y5



If you ever do find the security code for the Instrument control panel, I will be VERY interested in the values for your new curves

Don
Hi Don,

I think I read in another forum that you said you are going through all the possible codes to see if you can find the match? Is that right? Were you able to make any progress?

Thanks,
Nathan
 
   #37  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
Hi Don,

I think I read in another forum that you said you are going through all the possible codes to see if you can find the match? Is that right? Were you able to make any progress?

Thanks,
Nathan
Nathan: Hi - I'm a little hesitant to discuss this matter on Uwe's forum, but I hope that a few brief comments wont offend (now that the question has been raised)!
  1. I'm doing this investigation mainly for curiosity sake. I'm not sure how useful any findings will be to those in your situation (my car is a MY13 RoW vehicle). As I said in another forum, I'm more than happy to do these investigations on a MY16 NAR car - all that you need to do is to drive one down here!
  2. The task is a little like the work of your countryman Mr Edison and the invention of the light globe- I can tell more about which codes DON"T work. Thus far, I can confirm that there are no successful numbers in the range 30000 to 50000!
  3. Cold-polling these control modules with candidate security numbers is a slow process! If I try to speed-up the process by shortening the time between the stop and start communication request, or if I attempt to increase how many logins are tried between resetting a failed login - the process becomes unstable and the control module spits-the-dummy! These UDS control modules that VW uses are like belligerent children - very temperamental and not forgiving at all!!
  4. When I get my battery charger back (I've had to loan it to a mate who thus far hasn't returned-it), I will re-start the process again.

Don
 
   #38  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
Nathan: Hi - I'm a little hesitant to discuss this matter on Uwe's forum, but I hope that a few brief comments wont offend (now that the question has been raised)!
  1. I'm doing this investigation mainly for curiosity sake. I'm not sure how useful any findings will be to those in your situation (my car is a MY13 RoW vehicle). As I said in another forum, I'm more than happy to do these investigations on a MY16 NAR car - all that you need to do is to drive one down here!
  2. The task is a little like the work of your countryman Mr Edison and the invention of the light globe- I can tell more about which codes DON"T work. Thus far, I can confirm that there are no successful numbers in the range 30000 to 50000!
  3. Cold-polling these control modules with candidate security numbers is a slow process! If I try to speed-up the process by shortening the time between the stop and start communication request, or if I attempt to increase how many logins are tried between resetting a failed login - the process becomes unstable and the control module spits-the-dummy! These UDS control modules that VW uses are like belligerent children - very temperamental and not forgiving at all!!
  4. When I get my battery charger back (I've had to loan it to a mate who thus far hasn't returned-it), I will re-start the process again.

Don
Hi Don,

Thanks for the quick reply! Glad to hear you are making progress. At least we ruled out 20% of the codes! I just hope it can translate over to the MY16NAR. No rush! I've already gone 4 months with the annoying lighting. I can wait longer. At least the days are starting to get longer on this side of the globe!

Nathan
 
   #39  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,693
Reaction score
4,107
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
Here's a screen shot from a device that I have been playing-with and which I won't name. The thing that I find interesting, is the range of security numbers on the screen that the user is invited to enter . This same range is quoted for the Instrument control module (address Hex17). Can anyone here confirm that the upper limit for security codes on VW control modules is the number quoted - 65535?
Don

 
   #40  

Uwe

Benevolent Dictator
Staff member
Joined
Jan 29, 2014
Messages
30,360
Reaction score
21,655
Location
USA
VCDS Serial number
HC100001
It used to be 65535, but I don't think that limit applies to all modules at this point.

-Uwe-
 
Top