Security Access for USA 2016 MK7 Golf R - 17/Instruments

Glad to hear we are making progress DoN - we appreciate the help.

Uwe said:

It used to be 65535, but I don't think that limit applies to all modules at this point.

-Uwe-

Click to expand...

Uwe: The screen shot came from an MQB database (which I had selected) - so clearly the software manufacturer believed that this upper limit still applies for my mk7. This revelation and your confirmation makes security code discovery a bit easier because I don't need to poll higher numbers (34.5% of the total population of numbers don't need to be polled!)

Don

DV52 said:

clearly the software manufacturer believed that this upper limit still applies for my mk7.

Click to expand...

Just because some software maker believes it doesn't actually make it so, does it?

I think we've been doing this longer than anyone else in the business now and there have definitely been occasions when we've missed expansions like that for a bit.

However, I'm also not saying that the cluster in question doesn't have a limit of 65535. I honestly don't know.

DV52 said:

This revelation and your confirmation makes security code discovery a bit easier because I don't need to poll higher numbers (34.5% of the total population of numbers don't need to be polled!)

Click to expand...

Uhm... I'm fairly confident 6-digit SA codes are coming -- if they're not already here in some modules.

-Uwe-

^^^^^^ Uwe: That's exactly the reason why I frequent this excellent forum - "we've been doing this longer than anyone else in the business now". Why would I learn from an apprentice (i.e. other cable manufacturers) when I can learn from the masters?

OK enough of the hagiography (although it was said with more than a degree of sincerity), for entirely selfish reasons I've decided to assume that the "old" upper limit applies for the control module at address Hex17.

After a long process, the results of my investigations are shown in the picture below (Uwe: please forgive me for posting-up an non VCDS screenshot - this is my 2nd misdemeanour and I promise that there will be no more).



For the benefit of my forum colleagues with NAR model vehicles, the results above relate to the following equipment:


Don
PS: Sorry that I couldn't be the harbinger of better news!

Uwe said:

Uhm... I'm fairly confident 6-digit SA codes are coming -- if they're not already here in some modules.
-Uwe-

Click to expand...

;

Uwe: Surely you have to be joking (yeah, I know, don't call you Shirley)?

What sad, demented mind creates a 6-digit SA code? Do the software developers for these control modules get their jollies by thinking-up ever more perverse ways of annoying simple folk (like me)? If there was clear evidence of control module failure though hacked security codes, I could understand the reason for additional digits. But the fact is that this isn't the case and ironically, even if there was such evidence, the result would be increased sales of control modules! Who do I see about this?

Don

DV52 said:

^^^^^^ Uwe: That's exactly the reason why I frequent this excellent forum - "we've been doing this longer than anyone else in the business now". Why would I learn from an apprentice (i.e. other cable manufacturers) when I can learn from the masters?

OK enough of the hagiography (although it was said with more than a degree of sincerity), for entirely selfish reasons I've decided to assume that the "old" upper limit applies for the control module at address Hex17.

After a long process, the results of my investigations are shown in the picture below (Uwe: please forgive me for posting-up an non VCDS screenshot - this is my 2nd misdemeanour and I promise that there will be no more).

For the benefit of my forum colleagues with NAR model vehicles, the results above relate to the following equipment:

Code:

Address 17: Instruments (J285)       
   Part No SW: 5G0 920 860     HW: 5G0 920 860 
   Component: KOMBI         235 0555  
   Coding: 27A501082380800801087A00040000

Don
PS: Sorry that I couldn't be the harbinger of better news!

Click to expand...

Don! Thanks for going through that! Glad to see you found 2 codes. Unfortunately 20103 didn't work for me. 25327 did work but not for the dimming curve channels . Hopefully though this spurns further research and we can find an answer soon!

DV52 said:

;

What sad, demented mind creates a 6-digit SA code? Do the software developers for these control modules get their jollies by thinking-up ever more perverse ways of annoying simple folk (like me)?

Click to expand...

It was the same ARSEHOLE APPRENTICE who used two wires the SAME colours for two different functions in the right rear light cluster in my Touran.
I fitted the trailer electrics today (took about 4 hours! "Smart" Bypass type, not genuine VW). Luckily (Jack), I HAD RTFB so I knew which was which - seriously though - who does that!?!?!

DV52 said:

Uwe: please forgive me for posting-up an non VCDS screenshot

Click to expand...

Meh, we make a tool, and have no problem with people owning and using other tools as well.

DV52 said:

;What sad, demented mind creates a 6-digit SA code?

Click to expand...

One who wishes to make it more difficult to "guess" or "brute force" the SA codes?

-Uwe-

Dang, there's been some good effort in this thread to crack that security access code. Sounds like we're still locked out, but I appreciate the effort. Just checking in today since I'm plugged in to the car and going through the list of VCDS tweaks I wanted to try.

Cheers!

LoneMeme said:

Dang, there's been some good effort in this thread to crack that security access code. Sounds like we're still locked out, but I appreciate the effort. Just checking in today since I'm plugged in to the car and going through the list of VCDS tweaks I wanted to try.

Cheers!

Click to expand...

LoneMeme: I have a once-in-a-lifetime offer for you. Now that I have my test-jig set-up (see How-To's and Tips section), if you send me down a 2016 NAR BCM, I'll brute force 100,000 numbers into the module and I'm sure that the little beastie will tell-all!!
Don

Just want to bump this up to the top. Has anyone had any breakthroughs?

Defitely not anymore.

We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.

Xpower said:

We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.

Click to expand...

It's not at all clear it will work. We manually tried the technique they appear to use for that. That technique works on older ones, but not on newer ones.

-Uwe-

Bruteforce attempts are generally blocked in recent control module generations (not just clusters), there have been other tools (way before VCP) which did this - though they were not available to the broad public. Sadly by VCP officially supporting that feature, the manufacturers figured that they needed to close that long standing security hole. In the end, I feel that the VCP guys did the community a disservice by making that a public feature.

Xpower said:

We are still waiting as far as I know. I was tempted to buy a VCP cable and run the "force find the codes" protocol but it's a lot of money for just that task.

Click to expand...

Xpower: Notwithstanding Uwe/Sebastian's sad news, the irony here IMO is the self defeating fact that in order to find a valid security number with both the VCP and OBDeleven devices that I have used for this purpose, a valid SA must first be entered as a "seed" to open the controller!

I recently tried using VCP on the instrument control module for a MY16 Golf wagon (RoW model) and the process failed to kick-off because the 2 x known security numbers (20103 & 25327) weren't accepted as a valid seed. At least I think that this was the reason for the failure ((VCP's error messages are appalling) because I tried the process on another module in the same car (forget which one, now) and the polling started to work OK. This said, I remember thinking that it was odd that 25327 wasn't a valid seed since I have been told in another forum that MY16 instrument control modules on NAR cars accept this SA for the dash illumination tweak with the rotary light switch on Parker position. So perhaps the problem was related to Uwe/Sebastian's advice - I don't know and I only had access to the car for a short time.

Anyway buying a VCP cable might be an expensive failure if this is its only purpose. What would be ideal is if there was a forum colleague near-by with a cable that would be willing to help.

Don

PS: Not sure that I agree with the sentiment that "the VCP guys did the community a disservice by making that a public feature" but I do understand why Uwe/Sebastian might hold this view! Regardless of the reason why VW appears to have altered its SA strategy, the dynamic is fundamentally problematic for ALL 3rd party cable/dongle manufacturers. Without public access to these important numbers, the value proposition for purchasing these devices plummets dramatically - IMO. I'm not sure if there are legal methods that enable the community to get access to SA s but the prospect of always having to go to a dealer for even the most minor of problems (because of SA access) smacks of blatant anti-competitive behavior (which I assume is not legal, in other countries)

I have even tried using ODIS, there are one click functions to enable all sorts including dial illumination permanently.

It was turned off on my car, unfortunately turning it on had no affect which was strange :-(

Also affecting Australia delivered cars by the looks of it, trying to adjust the curve lighting and all current codes did not let me in.

So I can confirm that the following tweak works for making the instrument lights brighter during the day. It just makes them come on whenever the DRLs are on. The only negative is that the center display is always in night mode. So when I'm using android auto, the google maps is a dark theme, which is really hard for me to read. But at least now I can see my instruments when it's dusk!

http://www.vwroc.com/forums/topic/16793-instrument-cluster-illumination/

nathan16mk7R said:

So I can confirm that the following tweak works for making the instrument lights brighter during the day. It just makes them come on whenever the DRLs are on. The only negative is that the center display is always in night mode. So when I'm using android auto, the google maps is a dark theme, which is really hard for me to read. But at least now I can see my instruments when it's dusk!

http://www.vwroc.com/forums/topic/16793-instrument-cluster-illumination/

Click to expand...

Nathan. Hi. Not your fault, but withstanding the authorship of the post on your link - the original creator of this tweak was "dmc_" (who is a forum colleague on VW Vortex). The net is replete with examples of such copies which have no attribution and the original authors can either consider this to be outright plagiarism, or the most sincere form of flattery - the latter view is far less stressful IMO!

Anyhow, the tweak was originally intended (by dmc_) to disable the recent practice on your NAR mk7s, not to illuminate the cluster display when the rotary light switch was on the parking light position (hence the setting that is used : lds - which is what VW call their rotary light switch).

On older model clusters for the mk7, the Illumination_algorithm-Scale_switching_algorithm isn't available-so I can't test my hypothesis. But there are other settings in the earlier adaptation channel which has the simpler descriptor illumination_algorithm. If the channel in the more modern version of the instrument cluster also have other options - you could experiment with these settings (I suspect) which may deliver a more appropriate lighting effect - maybe.

Don