Please , GUI for Simos 12.X

Hi again.
When I tried to get ECU info thru Bluetooth, sometimes it doesn't work well,
It doesn't give me the ECU Info, waits forever, seems frozen.

Hello!

Thank you for your work!

I am having issues with OBD unlocking on Simos 18.2 (Jetta GLI, 2016).

While writing the OBD unlocking file into ECU the process randomly gets stuck on random stages. I've tried different Openport cables, different laptops (just in case). It didn't make any difference.

Attached is the log from VW_Flash GUI.

I also noticed the following error in the background:

dashing module not loaded Traceback (most recent call last): File "VW_Flash_GUI.py", line 478, in update_bin_listing AttributeError: 'FlashPanel' object has no attribute 'current_folder_path' 2022-09-16 17:25:51 [CRITICAL] VWFlash: Selected: C:\VW_Flash_GUI_0.2.11\VW_Flasg_GUI\Unlock\FL_8V0906259H__0001.frf

Please let me know if you have any ideas about the possible cause of the issue, and if there is any additional information I may gather.

Thanks in advance!

log.txt

Hello,

do you have a list with tested ecus?
and does it work with scanmatikpro2?
can i write a tune file over obd?

br Sandor

Hello, is there any install info? On my Lapto does it work without any issue but on the Desktop PC it dose not work ... everytime i try to start the window close it as soon as it opens

pip install -r requirements.txt was done ..

if i try to open the tool via command line it is missing the Moduls see below:

dashing module not loaded
Traceback (most recent call last):
File "VW_Flash_GUI.py", line 870, in
File "VW_Flash_GUI.py", line 601, in init
File "VW_Flash_GUI.py", line 156, in init
File "VW_Flash_GUI.py", line 121, in poll_interfaces
File "VW_Flash_GUI.py", line 106, in get_dlls_from_registry
FileNotFoundError: [WinError 2] Das System kann die angegebene Datei nicht finden
[15256] Failed to execute script 'VW_Flash_GUI' due to unhandled exception!

i got Python 3.9

Hello! I am trying to unlock and flash a Simos 18.1 in a Skoda Octavia RS.
When ID:ing the ECU I get:
VW ECU Hardware Number : 06K907425B VW ECU Hardware Version Number : H13 VW Spare Part Number : 5G0906259 VW Application Software Version Number : 0005 Boot Loader Identification : SC8.1 CB.00.00.80 C02.00 SC8 VW System Name Or Engine Type : 2.0l R4 TFSI Engine Code Letters : CHHB

In the windows.md doc, it says "If your Boot Loader Identification said SC8, you need FL_8V0906259H__0001.frf.
If your Boot Loader Identification said SCG, you need FL_5G0906259Q__0005.frf".

However this ECU says it has the SC8 bootloader but different firmware.
Which one should I use for unlocking and flashing then?

Thanks lots for this!

Hi, today first I tried to get bins out of my fl_8v0906259k__0003.frf FRF but i get an error that I also got when I tried to flash the FRF to the car, the line that I ran is sudo python VW_Flash.py --action flash_frf --simos12 --frf frf/FL_8V0906259K__0003.frf when trying without the --simos12 flag it works, maybe is only and issue with the simos 12 part .

flash_details.log
flash.log
udsoncan.log

Maybe a rookie question; are there special requirements for running the vwflashGUI ?

Or is there any document, how to setup windows for running the GUI?

Thanks!

Hello

after successful unlock, on level Full Flash Unlocked (BIN/FRF) - nothing happens and in logs i see some errors
Flash Stock (Re-Lock) also not work and car dont start now (

please help me, thanks!

all files in attac
simos 18_1.zip
h

pip install py2exe
python.exe setup.py py2exe
pip install pyinstaller
pyinstaller.exe vw_flash_gui.spec

but

Traceback (most recent call last):
File "VW_Flash_GUI.py", line 10, in
ModuleNotFoundError: No module named 'serial'
[11792] Failed to execute script 'VW_Flash_GUI' due to unhandled exception!

Hello! Thank you for your amazing work!
I have a problem when I writing calibrations with "Calibration Flash Unlocked" on an Audi A5 Simos 18.1: "[ERROR] Checksum: Could not find ECM3 location for SC800H14". The "Full Flash Unlocked" writing without problems. On the Audi Q5 with the same block, but with a different version of software, the calibrations are writing without any problems.
I am attaching the log files with 2 logs:
2022-07-14 22:40:00 - unsuccessful "Calibration Flash Unlocked";
2022-07-15 00:05:53 - successful "Full Flash Unlocked".

flash.log
flash_details.log
udsoncan.log

Hello, first and foremost big thanks to all of you involved in this project!

I have a question about flashing Simos 18.4, as I have been reading and looking through commits I saw that 18.4 simos was removed from GUI and also from github description, but it is still referenced in readme.md. The methods provided and .frf files for unlock reference SCG and SC8 codes.

My ECU is 8W0906259D so SCB50S00 cboot according to the box_codes.csv provided.

I would like to ask as of today, is flashing of Simos 18.4 possible in any way?

Hello,

This is off-topic for now for sure.
But maybe there are possibilities to OBD flash the Calibration/ASW sector for MG1CS002 SPC5777?

As i am a newbie with Python, i would like to ask, if i am doing right.

I extracted the zip-file for windows (release 0.2.11) to a new folder, and started VW_Flash_GUI. First the command line window opens, stating "Dashing module not loaded", then the GUI starts. I don't know, if this is ok until now, or if have to start it with a command line?
I can select interface, and it seems to find it. No error codes at all.

I read here, that other users start it by command line, but this is not described in the docs. Maybe this is for most users at Github normal to do, but for me it is not clear, if it is needed or not?
Maybe you can clear that up a little bit.
Thank you.

``I facing this issue and whenever i reinstall.same thing happen

Building` wheels for collected packages: wxpython
Running setup.py bdist_wheel for wxpython ... error
Complete output from command /usr/bin/python3 -u -c "import setuptools, tokenize;file='/tmp/pip-install-44632auo/wxpython/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" bdist_wheel -d /tmp/pip-wheel-cpmdrh0i --python-tag cp37:
running bdist_wheel
running build
WARNING: Building this way assumes that all generated files have been
generated already. If that is not the case then use build.py directly
to generate the source and perform the build stage. You can use
--skip-build with the bdist_* or install commands to avoid this
message and the wxWidgets and Phoenix build steps in the future

Hello,

I have installed J2534 openport2.0 driver and run the GUI version(VW_Flash_GUI.py).
But it couldn't find the J2534 interface.
I have tried to modify the code in get_dlls_from_registry.

    try:
        BaseKey = winreg.OpenKeyEx(
            winreg.HKEY_LOCAL_MACHINE, r"Software\\WOW6432Node\\PassThruSupport.04.04\\"
        )
    except:
        logger.error("No J2534 DLLs found in HKLM PassThruSupport. Continuing anyway.")
        return interfaces

Then, script can find J2534 interface, but if I click the button "Get ECU info", this error occurred, OSError: [WinError 193] %1 is not a valid Win32 application.

[t.write(did + " : " + ecu_info[did]) for did in ecu_info]

TypeError: 'NoneType' object is not iterable

would you add code for DQ200 and Dq250/E/F it would be nice :)

Hi!
wow, great work, I am still trying to wrap my head around the code and all the documentation, but it is indeed very interesting.
Thank you very much for sharing all your effort!

I got my hands on matching file for my ECU and I just wonder how should I approach finding out a good address to place the hook in ASW3 with version O30 (111SC8E0O300), since otherwise my CBOOT seems to be matching (NB0 SC841-111SC8E0).

1. Is this enough to dereming if CBOOT is indeed correct/compatible?
2. Are you using some tools to determine a valid address to place the hook in ASW3 or analyze the data? Ghidra does not seem to support TC179x and in my version 0x8088962c seems to contain data (I dont have O20 to compare).
3. After patching CBOOT and removing restrictions, would it be possible to dump the current contents of the flash? I am interested in making a backup first, since my calibration area is different than the one from factory and I would like to keep that.

Best regards, sorry if any questions are dumb, I am very new to reversing firmware.

Hello
If i have simos18.1 for chhb engine with immo off
When i tried instructions unlocked then flashed it wiped immo data i guess
What steps without touch immo data blocks to upload tune?
because editing fullread write (iflash files) on bench as you know to get back immo and car run.

Thanks for your efforts

Hello,

I made a mistake when unlocking the ecu.

I first did "Unlock ECU (FRF)" with the file "8V0906259H". The flashing was interrupted during the patching process, because of a loose contact. Then I restarted the vw_flash gui and clicked the wrong way and accidentally selected "Full FLash Unlocked (BIN/FRF)" and flashed the file "8V0906259H". I noticed this afterwards and wanted to flash the original frf from my car "5G0906259K" but VW-Flash got stuck at "SETUP - Upgrading to programming session.... - 100". I tried to flash with VCP to original but always get the error "programming preconditions not fulfilled :General reject 653".

What can I do to save the ECU ?

Not an issue or a fault, but a nice-to-have additional tool in the toolbox.

Sometimes it’s quite useful to be able to manually construct a specific sequence of hex bytes, send it across to the ECU and observe what comes back. This is about passing an ad hoc, user-specified byte string to the underlying ISO-TP encoder/decoder already present within VW_Flash, especially since VW_Flash already contains support for multiple hardware options and is handling the stack. The interface could be a simple shell, invoked from within VW_Flash, that would allow you to type in the bytes you want to send. All the ISO-TP segmentation would be taken care of by the stack, you are simply entering some bytes and getting a response in return. In essence, this gives users the ability to create and send their own UDS commands, assembling the commands byte by byte.

Pseudo listing below, of how this could be potentially invoked and used.

python3 VW_Flash.py --action UDS_Shell
Welcome to the raw UDS shell. Type help or ? to list commands, Ctrl+] to quit.
(raw UDS)>

Example #1 – Reset DTC

(raw UDS)> send 0x04
received 0x7F 0x04 0x78
received 0x44

Example #2 – Set Long Coding

(raw UDS)> send 0x2E 0x06 0x00 0x0A 0x19 0x00 0x32 0x24 0x06 0x01 0x0B 0x00 0x02
received 0x6E 0x06 0x00

Example #3 – Tester Present
(raw UDS)> send 0x3E

Can I use vas tool? How?

Hi,

Thanks for your great work, I was looking to flash custom calibration data to a SIMOS18 with the following SW number 5G0906259F__0002 I have decrypted frf, extracted odx and got the 5 blocks.

My ASW version is O30, I found an address to place the hook it was 0x9474 by comparing the file used in the example (FL_8V0906259H__0001.frf).

One thing I'm missing is patch compatibility, in a issue opened on 3 Dec 2020 you wrote that if the CBOOT we have contains the bytes DA 00 3C 02 at offset 0x8D1E this will be compatible. I don't have these bytes but even if I look at the CBOOT from the example you provided (8V0906259H__0001) I don't see these bytes at offset 0x8D1.

Could you please give me some additional information to identify if the patch is compatible with my version.

This is the file I am working on https://www.dropbox.com/sh/fruy7cak0tkf4p4/AACuqfKUZyRObhKiwafDQ1qva?dl=0

Thanks again for this work, I am new to Tricore reverse engineering.

See attachment. BLE scan breaks the "device select" functionality. With BT disabled on the machine, the device select functionality works as intended (with no BLE scan of course). See pic/attachment:

https://user-images.githubusercontent.com/94764002/167018616-0c19b805-dbed-4665-ad1f-d903f7bf18c4.png

For obvious reasons, we should archive boot passwords as often as possible (not just on full flash).
Mainly because you may be using a different machine or your original backup from you full flash is unavailable.

if you try adjust STMIN_TX it goes to 1000 (max value)

you can't go back to 35000 (default value) because max value you can select is 1000.

Have a 18.1 ECU on the Bench, Can ID etc etc but when trying to enter a programming session getting the following..

Server refused our request for service DiagnosticSessionControl with code "ConditionsNotCorrect" (0x22)

Would this be due to missing Gateway etc???

Hi ,
First of all, many thanks for this great software. You've done a great job.

I want to ask few questions about unlock:

1. If ECU was previously tuned with other equipment like MMS FLEX and it is unlocked for tuning with this tool , can I write only calibration with Your software , without unlocking at the beginning ? Every tool does unlock Simos18.1 same way ?

2)Is there a way to check if ECU was unlocked before ? Flex for example is showing LOCKED or UNLOCKED when id is done.

3)My ecu is FL_5G0906259H_0001 info from Your box_codes file:
5G0906259H 1 2.0l R4 TFSI SC8I0S00 SC8I0S50 SC800S50 55724 66096 ['06K907425B', '5G0906259H']
So if i understand correctly i have to :

1. Unlock it with FL_8V0906259H__0001.frf (unlock is always with this file regardless what is inside ecu?)
   2)Flash it with full .bin unpacked from : FL_5G0906259H_0001.frf

2. I have also a spare ecu that i want to immo off and use for development. If i understand correctly i have to :

3. read it in boot mode
   2)use vehical or other software to do immo off
   3)unlock it with FL_8V0906259H__0001.frf
   4)Flash it with full .bin unpacked from : FL_5G0906259H_0001.frf
   Immo will stay off , or i would need to read ecu in boot mode and use immo off software again ?
   Or is there other way to o it ?

There's a send_obd call at the end of the flash process... but send_obd doesn't work with tactrix since it tries to make a new connection to the DLL when there's already an existing one opened....
One fix would be to call a close on conn BEFORE calling send_obd (so that the dll gets closed, and conn2 can re-open it with a new rxid/txid.
Not sure how that would play with the other interfaces though. The clear dtc is the last step in the process, is there any reason not to close them?

Hello, VW_FLASH team

I am owning USDM GOLF 1.8 TSI (AT) with Part number 8V0906264D 0002.
As I know FL_8V0906264K__0003.frf never was a direct factory/recall update of 8V0906264D.

Revisions chronology was like this: 
8V0906264D 0001 --> 0004
and after that changed the part number to  5GM906264 0001.

I truly believe that it is safe to flash 8V0906264K 0003 but maybe some features are not fully compatible?

Sorry for the dummy question.

Hello,
I was trying to follow the instructions
My original ID showed Bootloader Identification as SCG
So I flashed the FL_5G0906259Q__0005.frf
And followed instructions and then flashed the correspondent bin file
Now the car does not start, I tried to flash back my stock file with HP tuners, this also did not work.

After investigating my issue and checking my original ID my original SW number was 8V0906259Q 0002
and now it is 5G0906259Q 0005

No device is being able to flash back the my original Bin

even trying to flash the new stock file is not working

attached are a few files and logs that I have

ECU ID.txt
Successful unlock log.txt
Trying to recover log.txt

flash.log
flash_details.log
udsoncan.log

we are following the steps https://github.com/bri3d/VW_Flash/blob/master/docs/windows.md

we find ourselves stuck at not seeing"H13" to "X13"

We can no longer start the car or revert back to stock.

you have to create a hook to it so that when code executes, it redirects to your loader code

Hello

manual for DQ250, like this https://github.com/bri3d/VW_Flash/blob/master/docs/windows.md is exist?

thanks

Is it possible to flash a DSG DQ381 in Golf7R with the DQ250 function? Identification of DQ381 was successful!

Hi,

I'm trying to learn more about the ODX format and conventions for VW variants of the files. I don't have access to the ASAM specifications but I do have a set of three ODX files from VW.

When I try to run the "extractodxsimos18.py' script, I initially got failures & inserted some debugging info as below:

python3 ../VW_Flash/extractodxsimos18.py --file FL_03L906012BM_4824.odx --outdir foo
length of dataBinary is 41469
key is  b'\x98\xd3\x12\x02\xe4\x8e8T\xf2\xcaV\x15E\xbao/'
Failed to decrypt, exception is  Data must be padded to 16 byte boundary in CBC mode
length of dataBinary is 1854128
key is  b'\x98\xd3\x12\x02\xe4\x8e8T\xf2\xcaV\x15E\xbao/'
Failed to decrypt, exception is  bytearray index out of range
length of dataBinary is 495
key is  b'\x98\xd3\x12\x02\xe4\x8e8T\xf2\xcaV\x15E\xbao/'
Failed to decrypt, exception is  Data must be padded to 16 byte boundary in CBC mode
length of dataBinary is 2414
key is  b'\x98\xd3\x12\x02\xe4\x8e8T\xf2\xcaV\x15E\xbao/'
Failed to decrypt, exception is  Data must be padded to 16 byte boundary in CBC mode
length of dataBinary is 510082
key is  b'\x98\xd3\x12\x02\xe4\x8e8T\xf2\xcaV\x15E\xbao/'
Failed to decrypt, exception is  Data must be padded to 16 byte boundary in CBC mode

It's throwing an exception at the cipher.decrypt line when invoking the AES CBC cipher. All three fail the same way.

I'm very certain these ODX files are valid but don't know enough about the specific format details to figure out what's wrong. I've looked at e.g. the "preview" at https://www.sis.se/api/document/preview/910417/ but can't find details on the assumptions.

I do note that while the compressed data is not a multiple of 16 bytes, the uncompress block is a multiple of 16.

Is it supposed to be uncompressed and then decrypted?

Is there more publicly available info on the format? Happy to send a PR if/when I get this figured out.

Would it be possible to get a walkthrough together for DQ250-MQB? Like the one that is together for Simos18?

Thanks!

Hello,

there is an issue if you want to write only calibration maps after unlock with vwflasher. This issue is with stock file and modded file. Log File is attached.
flash_details.log
flash.log

I tried to get data logging with mode 0x22, it seems it doesn't support 0x22 mode.
Also 3E mode doesn't work correctly, as I checked the csv file stored in local logging directory.
Please let me know how to solve these issue.

No Issue, but just a clarification.

The unlock files are the original files from Volkswagen or do they need some modification before using it?

For my car (Eu-spec Audi S3 Limousine) there is no FRF from Audi available (8V0906F_002), so i am not sure if i can go back to stock if something goes wrong.
I got a bin-file from an unknown source now, but not sure if i can use it.
Thank you!

Since the project is getting larger and expanding to additional controllers (TCU, haldex), instead of doing --dsg, we should do --controller=dsg (and similarly, --controller=ECU). Defaults are good, but I wouldn't want to flash_bin my ECU with a TCU driver.

It's probably also a good opportunity to work in some additional idiot proofing (like flash_cal does) to at least prompt the user before potential crossflashing.

This Software are compatiple for Python 3.9

In Python 3.10 you need to Change "license-file" to license_file" to install ! Thats a change
in the Lib of wxpython that doese not support "-" anymore :)

othervise the programm will not run :)

Every time I try to start a log, it shows the following errors:

Failed to create 3E list: 7f3e13
Unhandled exception: name 'exit' is not defined

simos_hsl.log

Are you available for paid consulting services? I checked your website but it seems to be down

http://brianledbetter.com/

im looking for some way to crossflash 5NA920790B into 5G1920790B/5G1920791B
will this project be way how to achieve this eventually?

Hey ! Everything works fine.. ID successful, but its stuck at Upgrading to programming session. Any Idea, whats going on ?

flash.log
flash_details.log
udsoncan.log

sorry for noob question, but with the GUI currently 18.1/6 and 18.10 are supported.
Do these cover a range of ECU's or are they specific to only 18.1 18.6 and 18.10??

As I am now in my 60's and not a fan of the command line, looking through the code, it seems possible that the ECU selection could be expanded to support other ECU's

simos18.s18_flash_info,
simos1810.s1810_flash_info,
simos184.s1841_flash_info,
simos16.s16_flash_info,
simos12.s12_flash_info,
simos122.s122_flash_info,
simos10.s10_flash_info,
simos8.s8_flash_info,

and linked above into the self.module_choice = wx.Choice(self, choices=available_modules) and related code maybe?

Thanks

I THINK YOUR WIKI LACKS INFORMATION, CAN YOU UPTATE IT PLEASE...

good day, im having a problem using the vw flash, i cant seem to get the unlock feature to work, i can ID the car perfectly but then cant get to flash functions for some reason , im on windows 11 using the latest GUI.
flash_details.log
udsoncan.log
flash.log