Direct access to ECU using ELM 327 key and ISO 9141

I have a VW Golf 4 which is quite old and says KWP 2000 (ISO 9141) on its CAN bus. I am using an ELM 327 dongle connected to the OBD-2 port of the car.

I am trying to send messages separately to each ECU. I tried to change the title of the messages: AT SH 48 XX F1

(I was hoping that XX

would be the ECU ID; 48

this is a flag for "use physical addressing"). Any command I issue (eg try 3E

for "testester present") returns NO DATA

(I disabled automatic timeouts and set a maximum timeout).

Is there a way to send messages directly to the ECU? I am not interested in the data set provided via OBD-2 and I do not want to restart the ECU. At the moment I'm just trying to figure out what ECUs are available on the bus.

Thank!