ViGuide Flasher

Standalone Go application for flashing parameterization data to Viessmann Vitodens boilers via DoIP (ISO 13400).

Overview

This tool replicates the protocol stack used by the Viessmann ViGuide APK to flash parameterization data (POTA files) to HBMU/BCU boards. It implements:

• DoIP (Diagnostic over IP, ISO 13400) - the底层 transport protocol
• OTX (Open Technical Interface) - the diagnostic protocol for executing sequences
• ODX/POTA - the diagnostic data format for parameterization

Project Structure

viguide-flasher/
├── cmd/main.go          # CLI entry point
├── doip/client.go       # DoIP (ISO 13400) client
├── otx/otx.go           # OTX protocol client
├── odx/odx.go           # ODX/POTA file parser
├── go.mod               # Go module
└── go.sum               # Dependency checksums

Prerequisites

• Go 1.26+
• Boiler connected to the same network as the host machine
• 16-digit VIN of the boiler (from type plate)
• ODX data extracted from diagnosticstack_odx_assets.apk

Usage

# Basic usage
./viguide-flasher -ip <boiler-ip> -vin <16-digit-vin>

# With ODX data directory
./viguide-flasher -ip <boiler-ip> -vin <16-digit-vin> -odx ./odx-data

# Dry run (no flashing)
./viguide-flasher -ip <boiler-ip> -vin <16-digit-vin> -dry-run

# With custom timeout
./viguide-flasher -ip <boiler-ip> -vin <16-digit-vin> -timeout 60s

Options

Option	Description	Default
-ip	Boiler IP address	192.168.1.100
-vin	16-digit VIN (required)	-
-odx	Path to ODX data directory	.
-pota	Output directory for POTA files	auto-generated
-timeout	Timeout for OTX operations	30s
-dry-run	Dry run mode (no flashing)	false

Protocol Flow

1. Connect to boiler via DoIP (TCP port 13400)
2. Entity search - identify the boiler on the network
3. Vehicle ID request - send VIN to identify the vehicle
4. Routing activation - activate the diagnostic routing rule
5. Logical link - open a logical link to the ECU
6. Keep-alive - maintain the connection with periodic alive checks
7. OTX sequence - execute AutoParameterFlashing_HBMU with VIN and POTA data
8. Release - close the logical link and disconnect

Current Limitations

1. ODX data extraction: The ODX data is stored in the RAES-encrypted diagnosticstack_odx_assets.apk (~762 MB). The parser currently handles basic XML ODX files but needs the actual decrypted ODX data to map VINs to POTA files.

2. OTX protocol: The OTX protocol implementation is a simplified version. The actual KPIT OTX runtime uses binary message formats and complex VDD (Vehicle Diagnostic Data) structures that need further reverse-engineering.

3. LIMAS licensing: The application does not handle LIMAS license acquisition or security access. The official app obtains encrypted license keys from the LIMAS server before flashing.

4. ODX decryption: The RAES encryption used for ODX assets requires the decryption key from LIMAS.

5. ECU security access: The flash operation requires security access to the ECU, which is obtained through the LIMAS-encrypted license.

Build

cd viguide-flasher
go build -o viguide-flasher ./cmd/

Safety Notes

• Do not use 7898424 as the VIN (it's a spare-part identifier, not the VIN)
• Do not fabricate a VIN based on the validator
• Do not use another appliance's VIN
• Do not interrupt power during parameterization
• After successful parameterization, follow the official service procedure and commissioning checks

Related

• findings.md - Full reverse-engineering findings
• jadx-output/ - Decompiled ViGuide APK sources