Security Access for USA 2016 MK7 Golf R - 17/Instruments

   #41  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
Glad to hear we are making progress DoN - we appreciate the help.
 
   #42  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
It used to be 65535, but I don't think that limit applies to all modules at this point.

-Uwe-
Uwe: The screen shot came from an MQB database (which I had selected) - so clearly the software manufacturer believed that this upper limit still applies for my mk7. This revelation and your confirmation makes security code discovery a bit easier because I don't need to poll higher numbers (34.5% of the total population of numbers don't need to be polled!)

Don
 
   #43  

Uwe

Benevolent Dictator
Staff member
Joined
Jan 29, 2014
Messages
30,370
Reaction score
21,669
Location
USA
VCDS Serial number
HC100001
clearly the software manufacturer believed that this upper limit still applies for my mk7.
Just because some software maker believes it doesn't actually make it so, does it? ;)

I think we've been doing this longer than anyone else in the business now and there have definitely been occasions when we've missed expansions like that for a bit.

However, I'm also not saying that the cluster in question doesn't have a limit of 65535. I honestly don't know.

This revelation and your confirmation makes security code discovery a bit easier because I don't need to poll higher numbers (34.5% of the total population of numbers don't need to be polled!)
Uhm... I'm fairly confident 6-digit SA codes are coming -- if they're not already here in some modules.

-Uwe-
 
   #44  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
^^^^^^ Uwe: That's exactly the reason why I frequent this excellent forum - "we've been doing this longer than anyone else in the business now". Why would I learn from an apprentice (i.e. other cable manufacturers) when I can learn from the masters?

OK enough of the hagiography (although it was said with more than a degree of sincerity), for entirely selfish reasons I've decided to assume that the "old" upper limit applies for the control module at address Hex17.

After a long process, the results of my investigations are shown in the picture below (Uwe: please forgive me for posting-up an non VCDS screenshot - this is my 2nd misdemeanour and I promise that there will be no more).



For the benefit of my forum colleagues with NAR model vehicles, the results above relate to the following equipment:

Code:
Address 17: Instruments (J285)       
   Part No SW: 5G0 920 860     HW: 5G0 920 860 
   Component: KOMBI         235 0555  
   Coding: 27A501082380800801087A00040000
Don
PS: Sorry that I couldn't be the harbinger of better news!
 
Last edited:
  • Like
Reactions: Uwe
   #45  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
Uhm... I'm fairly confident 6-digit SA codes are coming -- if they're not already here in some modules.
-Uwe-
;

Uwe: Surely you have to be joking (yeah, I know, don't call you Shirley)?

What sad, demented mind creates a 6-digit SA code? Do the software developers for these control modules get their jollies by thinking-up ever more perverse ways of annoying simple folk (like me)? If there was clear evidence of control module failure though hacked security codes, I could understand the reason for additional digits. But the fact is that this isn't the case and ironically, even if there was such evidence, the result would be increased sales of control modules! Who do I see about this?

Don
 
   #46  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
^^^^^^ Uwe: That's exactly the reason why I frequent this excellent forum - "we've been doing this longer than anyone else in the business now". Why would I learn from an apprentice (i.e. other cable manufacturers) when I can learn from the masters?

OK enough of the hagiography (although it was said with more than a degree of sincerity), for entirely selfish reasons I've decided to assume that the "old" upper limit applies for the control module at address Hex17.

After a long process, the results of my investigations are shown in the picture below (Uwe: please forgive me for posting-up an non VCDS screenshot - this is my 2nd misdemeanour and I promise that there will be no more).



For the benefit of my forum colleagues with NAR model vehicles, the results above relate to the following equipment:

Code:
Address 17: Instruments (J285)       
   Part No SW: 5G0 920 860     HW: 5G0 920 860 
   Component: KOMBI         235 0555  
   Coding: 27A501082380800801087A00040000
Don
PS: Sorry that I couldn't be the harbinger of better news!
Don! Thanks for going through that! Glad to see you found 2 codes. Unfortunately 20103 didn't work for me. 25327 did work but not for the dimming curve channels :(. Hopefully though this spurns further research and we can find an answer soon!
 
   #47  

NZDubNurd

Verified VCDS User
Verified
Joined
Nov 10, 2014
Messages
1,130
Reaction score
1,687
Location
New Zealand
VCDS Serial number
C?ID=230482
;

What sad, demented mind creates a 6-digit SA code? Do the software developers for these control modules get their jollies by thinking-up ever more perverse ways of annoying simple folk (like me)?
It was the same ARSEHOLE APPRENTICE who used two wires the SAME colours for two different functions in the right rear light cluster in my Touran.
I fitted the trailer electrics today (took about 4 hours! "Smart" Bypass type, not genuine VW). Luckily (Jack), I HAD RTFB so I knew which was which - seriously though - who does that!?!?!
 
   #48  

Uwe

Benevolent Dictator
Staff member
Joined
Jan 29, 2014
Messages
30,370
Reaction score
21,669
Location
USA
VCDS Serial number
HC100001
Uwe: please forgive me for posting-up an non VCDS screenshot
Meh, we make a tool, and have no problem with people owning and using other tools as well. :)

;What sad, demented mind creates a 6-digit SA code?
One who wishes to make it more difficult to "guess" or "brute force" the SA codes?

-Uwe-
 
   #49  

LoneMeme

Verified VCDS User
Verified
Joined
Feb 22, 2016
Messages
2
Reaction score
1
Location
USA
VCDS Serial number
C?ID=270456
Dang, there's been some good effort in this thread to crack that security access code. Sounds like we're still locked out, but I appreciate the effort. Just checking in today since I'm plugged in to the car and going through the list of VCDS tweaks I wanted to try.

Cheers!
 
   #50  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
Dang, there's been some good effort in this thread to crack that security access code. Sounds like we're still locked out, but I appreciate the effort. Just checking in today since I'm plugged in to the car and going through the list of VCDS tweaks I wanted to try.

Cheers!
LoneMeme: I have a once-in-a-lifetime offer for you. Now that I have my test-jig set-up (see How-To's and Tips section), if you send me down a 2016 NAR BCM, I'll brute force 100,000 numbers into the module and I'm sure that the little beastie will tell-all!!
Don
 
   #51  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
Just want to bump this up to the top. Has anyone had any breakthroughs?
 
   #52  

Sebastian

Ross-Tech Employee
Staff member
Ross-Tech Employee
Joined
Feb 13, 2014
Messages
1,978
Reaction score
1,955
Location
Magdeburg, Germany
VCDS Serial number
HN0-nnnnnn
Defitely not anymore.
 
   #53  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.
 
   #54  

Uwe

Benevolent Dictator
Staff member
Joined
Jan 29, 2014
Messages
30,370
Reaction score
21,669
Location
USA
VCDS Serial number
HC100001
We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.
It's not at all clear it will work. We manually tried the technique they appear to use for that. That technique works on older ones, but not on newer ones.

-Uwe-
 
   #55  

Sebastian

Ross-Tech Employee
Staff member
Ross-Tech Employee
Joined
Feb 13, 2014
Messages
1,978
Reaction score
1,955
Location
Magdeburg, Germany
VCDS Serial number
HN0-nnnnnn
Bruteforce attempts are generally blocked in recent control module generations (not just clusters), there have been other tools (way before VCP) which did this - though they were not available to the broad public. Sadly by VCP officially supporting that feature, the manufacturers figured that they needed to close that long standing security hole. In the end, I feel that the VCP guys did the community a disservice by making that a public feature.
 
  • Like
Reactions: Uwe
   #56  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.
Xpower: Notwithstanding Uwe/Sebastian's sad news, the irony here IMO is the self defeating fact that in order to find a valid security number with both the VCP and OBDeleven devices that I have used for this purpose, a valid SA must first be entered as a "seed" to open the controller!

I recently tried using VCP on the instrument control module for a MY16 Golf wagon (RoW model) and the process failed to kick-off because the 2 x known security numbers (20103 & 25327) weren't accepted as a valid seed. At least I think that this was the reason for the failure ((VCP's error messages are appalling) because I tried the process on another module in the same car (forget which one, now) and the polling started to work OK. This said, I remember thinking that it was odd that 25327 wasn't a valid seed since I have been told in another forum that MY16 instrument control modules on NAR cars accept this SA for the dash illumination tweak with the rotary light switch on Parker position. So perhaps the problem was related to Uwe/Sebastian's advice - I don't know and I only had access to the car for a short time.

Anyway buying a VCP cable might be an expensive failure if this is its only purpose. What would be ideal is if there was a forum colleague near-by with a cable that would be willing to help.

Don

PS: Not sure that I agree with the sentiment that "the VCP guys did the community a disservice by making that a public feature" but I do understand why Uwe/Sebastian might hold this view! Regardless of the reason why VW appears to have altered its SA strategy, the dynamic is fundamentally problematic for ALL 3rd party cable/dongle manufacturers. Without public access to these important numbers, the value proposition for purchasing these devices plummets dramatically - IMO. I'm not sure if there are legal methods that enable the community to get access to SA s but the prospect of always having to go to a dealer for even the most minor of problems (because of SA access) smacks of blatant anti-competitive behavior (which I assume is not legal, in other countries)
 
Last edited:
   #57  

Xpower

Verified VCDS User
Verified
Joined
Jun 14, 2014
Messages
61
Reaction score
25
Location
UK
VCDS Serial number
C?ID=163029
I have even tried using ODIS, there are one click functions to enable all sorts including dial illumination permanently.

It was turned off on my car, unfortunately turning it on had no affect which was strange :-(
 
   #58  

dean001

Verified VCDS User
Verified
Joined
May 24, 2016
Messages
19
Reaction score
5
Location
Australia
VCDS Serial number
C?ID=277309
Also affecting Australia delivered cars by the looks of it, trying to adjust the curve lighting and all current codes did not let me in.
 
   #59  

nathan16mk7R

Verified VCDS User
Verified
Joined
Dec 16, 2015
Messages
19
Reaction score
5
Location
USA
VCDS Serial number
C?ID=264933
So I can confirm that the following tweak works for making the instrument lights brighter during the day. It just makes them come on whenever the DRLs are on. The only negative is that the center display is always in night mode. So when I'm using android auto, the google maps is a dark theme, which is really hard for me to read. But at least now I can see my instruments when it's dusk!

http://www.vwroc.com/forums/topic/16793-instrument-cluster-illumination/
 
  • Like
Reactions: Uwe
   #60  

DV52

Verified VCDS User
Verified
Joined
May 16, 2014
Messages
3,694
Reaction score
4,108
Location
Melbourne, Australia
VCDS Serial number
C?ID=194404
So I can confirm that the following tweak works for making the instrument lights brighter during the day. It just makes them come on whenever the DRLs are on. The only negative is that the center display is always in night mode. So when I'm using android auto, the google maps is a dark theme, which is really hard for me to read. But at least now I can see my instruments when it's dusk!

http://www.vwroc.com/forums/topic/16793-instrument-cluster-illumination/
Nathan. Hi. Not your fault, but withstanding the authorship of the post on your link - the original creator of this tweak was "dmc_" (who is a forum colleague on VW Vortex). The net is replete with examples of such copies which have no attribution and the original authors can either consider this to be outright plagiarism, or the most sincere form of flattery - the latter view is far less stressful IMO!

Anyhow, the tweak was originally intended (by dmc_) to disable the recent practice on your NAR mk7s, not to illuminate the cluster display when the rotary light switch was on the parking light position (hence the setting that is used : lds - which is what VW call their rotary light switch).

On older model clusters for the mk7, the Illumination_algorithm-Scale_switching_algorithm isn't available-so I can't test my hypothesis. But there are other settings in the earlier adaptation channel which has the simpler descriptor illumination_algorithm. If the channel in the more modern version of the instrument cluster also have other options - you could experiment with these settings (I suspect) which may deliver a more appropriate lighting effect - maybe.

Don
 
Last edited:
  • Like
Reactions: Uwe
Top