jpadie

Dear all I've just fitted a new motor to the passenger side window on a 2006 skoda fabia 1. No motor noise. I've not managed to find a wiring diagram but on the assumption that the wiring goes from the passenger side switch to the drivers side controls and then onwards, I have replaced the drivers side controls too (they were quite ropey). No joy. before declaring this new motor as dead, I'd like to check the obvious culprits which means doing some checks for voltage and signals. Does anyone have the wiring diagram for the windows on a Fabia 1 and the pinout of the plug going into the motor? thanks in advance Justin

sure Keith to get an eeprom dump I used vag k+can 1.4. it refused to work reliably for a long time, giving only snippets of the rom. but just once it connected, maintained the connection and was able to get a full enough dump to decode the SKC. the issue i think is that the ftdi cable running through a usb c converter into a mac running parallels added too much software latency and the app was disconnecting. i suspect that if you were using an older windows PC there would not be the same issues. i then recompiled kw1281test with long timeouts of 10 seconds and issued this command with a key in the lock and the ignition on. dotnet run com4 10400 17 adaptationsave 21 3 01777 this tells the application to open com4 at a baud rate of 10.4k and talk to module 17 to adapt channel 21 to a new value of 3 (3 keys), logging in with the code 01777. this was the output Version 0.80-beta (https://github.com/gmenounos/kw1281test/releases) Args: com4 10400 17 adaptationsave 21 3 01777 OSVersion: Microsoft Windows NT 10.0.22621.0 .NET Version: 7.0.3 Culture: en-US Opening serial port com4 Sending wakeup message Wakeup duration: 2 seconds Reading sync byte Keyword Lsb $01 Keyword Msb $8A Protocol is KW 1281 (8N1) ECU: 6Y0920981M KOMBI+WEGFAHRSP VDO V02 Software Coding 00401, Workshop Code: 13765 Sending Login block Sending AdaptationRead block Received "Adaptation Response" block: 15 00 02 E7 25 00 6C 25 00 6D 1C 00 02 25 00 6B Adaptation value: 2 Sending AdaptationTest block Received "Adaptation Response" block: 15 00 03 E7 25 00 6E 25 00 6D 1C 00 03 25 00 6B Adaptation value: 3 Sending AdaptationSave block Received "Adaptation Response" block: 15 00 03 Adaptation value: 3 Sending EndCommunication block which shows that the code read channel21, tested writing 3 to it successfully and then committed that write permanently. changing channel21 allows 60 seconds for new transponder IDs to be mated to the immobiliser. put each key in to the ignition in sequence and turn ignition (not engine) on. wait a couple of seconds until the immo light stops flashing. the remote open for each fob was done in the normal way (window down, ignition on, put new key in to drivers door, lock the door, remove key, press lock once, press and hold unlock for a couple of seconds. turn ignition off. the keyblades I got from keys in the post. the blank fobs I got off amazon. I used a hammer and panel nail to drive out the cotter(ish) pin, hammer to bash the new key blade in and to drive the pin back into the blade. oddly this took a long time (I didn't have my magnifying glass and my eyes don't work that well any more). hope that helps.

yes. that's why I mentioned that the immobiliser was not accepting them. the adaptation was not sticking. however I have now found this was to do with too high a latency on my serial lines and rewritten some open source code to force the adaptation. this worked and the chips are now programmed.

Hi all i've got some new keyfobs adapted to a 2006 mk1 Fabia but the immobiliser will not accept the transponder chips. they are supposedly ID48 which I thought covered all Fabia mk1s. Did the chips change? or have I happened to buy two duff ID48 chips in a row? thanks justin

long time ago, but did you ever advance this project? I think the EM4093 is the transponder manager, not the EEPROM. EEPROMs are usually a lower pin count

There is still a noticeable absence of this cog sprocket. Charitably I'm assuming that royal mail's dog has eaten the package rather than the seller decided not to deliver on his promise. Anyway... @Breezy_Pete if you're still willing to sell me one and pop it in the post, I'd be much obliged.

Thanks for the vids. The American chappie is using kw1281test which is open source. This is the codebase I've been modifying as it wasn't working with the computers I am travelling with. I've fixed that but the seed algorithms don't cover the Skoda and polo models it seems. If I can find the right algorithm then I can rewrite the code very quickly to use it. The seed key alg allows the eeprom to be read which in turn exposes the skc The eeprom can also be directly read by attaching a reader to the chip. This would then allow the pin to be extracted manually. This would definitely be the approach I would take at home as taking the instrument cluster out and to bits is quick and easy and I have an electronics lab in my basement. Identifying the eeprom and desoldering it would be a couple of minutes work. Unfortunately I'm 1000 miles away from home!

You could be right on the coding of the transponders. I will crack one of the keys open and have a look at the chip and read its specs. It's not impossible at all for these chips to be written to as well as read (e.g. the more advanced RFID chips) and a rolling code would be more secure. If so then they cannot be easily cloned. Which also makes sense. Last gasp at tools is to k-com plus an ftdi cable as my attempts at finding the right seed algorithm haven't borne fruit. If that doesn't work I may take the cluster to bits and dump the eeprom directly. At least that method is guaranteed and won't take more than an hour of dismantling and assembly.

only a credit card bill in the post today. At least it wasn't the leccy.

thanks Keith VCDS can change the adaptation which puts the ECU into learning mode. the ECU then (as I understand it) learn the ident sent by the transponder chip (which is a globally unique code encoded at build time). This is different to the remote opening functionality which is a rolling code algorithm. If i recall, VCDS can also trigger the adaptation to learn new remotes; which can also be done via the ignition on + door unlock method. the VAG key looks interesting but as you mention, I can't seem to find it for sale. I don't mind investing in tools that may be useful in the future; not so keen on paying a garage for something I should be able to myself. Also takes the fun out of it! I've got a legit copy of K Com and have an FTDI cable on its way (annoying as I could have built one in my lab were I at home at the moment). I also had a spare hour this morning and have started unpicking the kw1281test code to work out how to implement the correct algorithm for the polos and skodas. a hack should be possible if the seed/key algorithm is one of those that is known.

got man-flu so postponed for a day. going up to the smoke from Horsham neck of the woods (west sussex/surrey border).

last summer i bought an old Fabia mk1 for my younger daughter to learn to drive and build up an NCB. It was a few hundred quid and was missing a chunk of stuff, but still a solid motor. The brakes failed on the M1 but that's another story the car came with one key and my daughter is not the most careful of individuals. If the key were lost without a replacement then, at the cost of the car, I would scrap it. so I'm looking for solutions to avoid this disaster. I've got two replacement keys cut and mated to the door lock/unlock. They've both got the right transponders in. I've experimented with 1. kw1281test. It didn't work at first so I rewrote some segments, recompiled and it now works well but it doesn't support the ECU that is in my skoda. I can work on this more but it will take a while to crack the encoding 2. vag tacho - i can't find any legitimate version that is not full of viruses. 3. k commander - doesn't seem to recognise my cables and so crashes on load. 4. vcds-lite: doesn't recover the SKC code I've taken the instrument binnacle to bits to check the codes written on the back of the cluster are there other routes to success for recovering the SKC code please? If not I will set aside the weekend to write some more algorithms to unlock the cluster but I'd hate to reinvent the wheel.

ta. i've got a wooden block in place for the drive to London tomorrow. reminds me of my time at the beeb in the 80s. we used to "survey" the speed of general office by putting something in the post for an office on the next floor and sending it by GO and by courier. the courier _always_ arrived earlier; sometimes by as much as a day. P.S. this was at BBC Worldwide; we weren't spending licence payer's cash ... really...

it's not arrived yet ... I'm in Blighty but I've not lived here for 25 years; isn't 4 days a bit of a liberty even for second class post? When I was young 2nd class meant you'd get post in the afternoon rather than in the morning.

Thanks for the info and the offer. The chap who sold me the motor apologised and has sent the sprocket coggy thing by post. Fingers crossed.

Hello everyone. I've recently bought a Fabia mk 1 from 2003 and found that the left hand door card has no regulator or motor (or speaker...). I bought a replacement regulator and motor but think there's a bit missing as I don't see how the spindle engaged with the toothed turner. Am I missing a bit? And if so what would it be called so I can have a butchers on eBay? Thanks Justin