last summer i bought an old Fabia mk1 for my younger daughter to learn to drive and build up an NCB.  It was a few hundred quid and was missing a chunk of stuff, but still a solid motor.  The brakes failed on the M1 but that's another story 

the car came with one key and my daughter is not the most careful of individuals.  If the key were lost without a replacement then, at the cost of the car, I would scrap it.  

so I'm looking for solutions to avoid this disaster.  I've got two replacement keys cut and mated to the door lock/unlock.  They've both got the right transponders in.  

I've experimented with 

 

1. kw1281test.  It didn't work at first so I rewrote some segments, recompiled and it now works well but it doesn't support the ECU that is in my skoda.  I can work on this more but it will take a while to crack the encoding

2. vag tacho - i can't find any legitimate version that is not full of viruses.

3. k commander - doesn't seem to recognise my cables and so crashes on load.

4. vcds-lite: doesn't recover the SKC code
 

I've taken the instrument binnacle to bits to check the codes written on the back of the cluster

 

are there other routes to success for recovering the SKC code please?   If not I will set aside the weekend to write some more algorithms to unlock the cluster but I'd hate to reinvent the wheel.  

 The tool that I used on a Mk2 Fabia for code retrieval, but Mk1 reportedly covered, was VAG Key Login which I am having trouble locating adverts for now.

How To Use V-A-G VAG KEY LOGIN To Read Pin Code & Key Programming | OBD2eShop official blog

I do not expect VCDS Lite to have the facility for key matching, the instructions for VCDS which Lite may not support are as below. I think that this would need the chip in the key having been already written too.

Ross-Tech: VAG-COM: Immobilizer 3 Key Matching

Where are you based, there may be someone local - general location in profile may assist -  that may be able to assist.

Just for clarification - my own experience with the Mk2 was swapping the instrument cluster which contains the immobiliser (immobiliser 4 in Mk2) so I was matching existing used keys to a replacement 2nd hand cluster and not actually coding new keys.

Edited 3 March, 20233 yr by KeithCheetham
Chip to be written to

7 hours ago, KeithCheetham said:

 The tool that I used on a Mk2 Fabia for code retrieval, but Mk1 reportedly covered, was VAG Key Login which I am having trouble locating adverts for now.

How To Use V-A-G VAG KEY LOGIN To Read Pin Code & Key Programming | OBD2eShop official blog

I do not expect VCDS Lite to have the facility for key matching, the instructions for VCDS which Lite may not support are as below. I think that this would need the chip in the key having been already written too.

Ross-Tech: VAG-COM: Immobilizer 3 Key Matching

Where are you based, there may be someone local - general location in profile may assist -  that may be able to assist.

Just for clarification - my own experience with the Mk2 was swapping the instrument cluster which contains the immobiliser (immobiliser 4 in Mk2) so I was matching existing used keys to a replacement 2nd hand cluster and not actually coding new keys.

thanks Keith

 

VCDS can change the adaptation which puts the ECU into learning mode.  the ECU then (as I understand it)  learn the ident sent by the transponder chip (which is a globally unique code encoded at build time).  This is different to the remote opening functionality which is a rolling code algorithm.  If i recall, VCDS can also trigger the adaptation to learn new remotes; which can also be done via the ignition on + door unlock method.  

the VAG key looks interesting but as you mention, I can't seem to find it for sale. I don't mind investing in tools that may be useful in the future; not so keen on paying a garage for something I should be able to myself.  Also takes the fun out of it!   

 

I've got a legit copy of K Com and have an FTDI cable on its way (annoying as I could have built one in my lab were I at home at the moment).  I also had a spare hour this morning and have started unpicking the kw1281test code to work out how to implement the correct algorithm for the polos and skodas.  a hack should be possible if the seed/key algorithm is one of those that is known. 

17 hours ago, jpadie said:

thanks Keith

 

VCDS can change the adaptation which puts the ECU into learning mode.  the ECU then (as I understand it)  learn the ident sent by the transponder chip (which is a globally unique code encoded at build time).  This is different to the remote opening functionality which is a rolling code algorithm.  If i recall, VCDS can also trigger the adaptation to learn new remotes; which can also be done via the ignition on + door unlock method.  
 

 I had always thought that the transponder chips were uncoded, not having a understanding of them, and having seen keys being put into coils after cutting. I now assume that this was to retrieve the code from the new chip for writing to the ECU.

 Strangely with the VAG Key Login adverts they were listed as programming keys but all the write ups and videos I have found detail/show SKU code retrieval, but do not show or are very vague on the programming which may be why they do not appear to be available.

48 minutes ago, KeithCheetham said:

 I had always thought that the transponder chips were uncoded, not having a understanding of them, and having seen keys being put into coils after cutting. I now assume that this was to retrieve the code from the new chip for writing to the ECU.

 Strangely with the VAG Key Login adverts they were listed as programming keys but all the write ups and videos I have found detail/show SKU code retrieval, but do not show or are very vague on the programming which may be why they do not appear to be available

 

You could be right on the coding of the transponders.   I will crack one of the keys open and have a look at the chip and read its specs.  It's not impossible at all for these chips to be written to as well as read (e.g. the more advanced RFID chips) and a rolling code would be more secure. 

 

If so then they cannot be easily cloned.  Which also makes sense.

 

Last gasp at tools is to k-com plus an ftdi cable as my attempts at finding the right seed algorithm haven't borne fruit.  If that doesn't work I may take the cluster to bits and dump the eeprom directly.  At least that method is guaranteed and won't take more than an hour of dismantling and assembly.

 

 

The 'chip' is a teeny glass tube, no markings on it that I've seen.

5 hours ago, jpadie said:

 Last gasp at tools is to k-com plus an ftdi cable as my attempts at finding the right seed algorithm haven't borne fruit.  If that doesn't work I may take the cluster to bits and dump the eeprom directly.  At least that method is guaranteed and won't take more than an hour of dismantling and assembly.

 

 

 Have you seen this below video - not great but at about 8.12 minutes you will see the next bottom line shows an SKC code. Unsure which version of the immobiliser this refers to 3 or 4 so would want to use with caution to ensure you do not wipe any info.

Found a video with key learning but unsure of language, and this still does not answer if chips need writing when new. Searching ID48 T6 which I believe is the chip, appear they do need coding so the VAG Key Login must only match existing keys if the sync is lost.

Edited 4 March, 20233 yr by KeithCheetham
Chips appear uncoded so VAG Key Login would only be usefull for retrieving SKC code in this instance.

Thanks for the vids.  The American chappie is using kw1281test which is open source.   This is the codebase I've been modifying as it wasn't working with the computers I am travelling with.  I've fixed that but the seed algorithms don't cover the Skoda and polo models it seems.  

 

If I can find the right algorithm then I can rewrite the code very quickly to use it.  

 

The seed key alg allows the eeprom to be read which in turn exposes the skc 

 

The eeprom can also be directly read by attaching a reader to the chip.  This would then allow the pin to be extracted manually.  

 

This would definitely be the approach I would take at home as taking the instrument cluster out and to bits is quick and easy and I have an electronics lab in my basement.  Identifying the eeprom and desoldering it would be a couple of minutes work.  

 

Unfortunately I'm 1000 miles away from home!