Reusing old Peugeot/Citroen remotes type 73373067B,C

[mihotd]

In Citroen and Peugeot the remote is precoded with the transponder. Changing transponder makes the remote stop working. In other words transponder and remote are matched in factory. When you program new transponder it must contain also data for remote. This is needed for BSI module to recognize rf transmissions from the remote.
You can reuse old remotes if you know what kind of data to write into transponder. It is placed in USER 0,1,2,3 pages in PCF7936.
Actual problem is retrieving data from an old, used remote and then put it into blank transponder.

Here is a way to get this data. We need several things to do this: some used (but still working) remotes with fresh battery.
A kind of "reader" based on PIC12F629 and a way to get the data into PC (I use so called USB-to-TTL converter), only RX channel needed and software is the ordinary HyperTerminal for windows (or some of xxxCOM apps if you're using Linux)
Here are the pads used on the remote.
Next part coming soon ...

[workdamnyou]

Good work mate...

Looking forward to seeing how this can be done.

[mihotd]

Part 2: Info, schematics and hex

All needed to build the reader is attached.
To get data open HyperTerminal, make a new connection and in screen "connect to" choose COMx (where USB to UART is).
In COMx properties window press "restore defaults" then OK.
If you made everytthing correctly you'll get a screen like attached one with remote data when you press a button.
This data is different each time (only first two bytes remain the same) and this is expected, data from remotes is scrambled and rolling code.
Calculator to produce transponder data exists (not free service though) and output is 4 bytes, which must be written in PCF7936.

Here is the point where I need your help guys: I need data from some old remote + old transponder (paired ones!) to figure out how these calculated 4 bytes are written into transponder.
Building all this stuff described above is a boring job, I agree. Also needs some effort and knowledge but if there are interested people I think we can resolve this whole problem which stays here for years.

BR

[kerekt]

question : how to read 7936 with Hitag2 if PIN is known ?

[mihotd]

question : how to read 7936 with Hitag2 if PIN is known ?

There is no PIN for transponder. Did you mean SK (secret key 48bits) ? If so, you can read it with tango hitag2 by entering 6 bytes in the key field for crypto mode (not password mode).

Actually all transponders from peugeot I've seen are locked :(
It seems that USER pages can be read only on new, prepared for programming in car key (new couple of 7936 + remote pcb from PSA)

[igorr]

how to open PSA reader

[ninja123]

is there not a way/equipment that can read the data from the IC on the remote board? Surely then after reading a couple of new ones and reading pcf7936 pages from the same remote - before programming, we could work out what data and where etc.

I dont mind butchering a few new ones if we are getting somewhere with this, but only a few as they are so flippin expensive!

Building that stuff above looks a little past me but ill have a go....

ninja

[paul_12345]

is there not a way/equipment that can read the data from the IC on the remote board? Surely then after reading a couple of new ones and reading pcf7936 pages from the same remote - before programming, we could work out what data and where etc.

I dont mind butchering a few new ones if we are getting somewhere with this, but only a few as they are so flippin expensive!

Building that stuff above looks a little past me but ill have a go....

ninja

if you read a new key you will have the data to reprogram that remote to another car, trouble with used remotes you have not got that data and the remote will only broadcast the rolling code.

So you would need to know the algorithm the key is using so you could turn the rolling code back into the orignal data.

This is what the OP want to figure out i.e. get a load of samples of data to try to figure the algorith.. although could be very hard

[mihotd]

I have calculator for [rolling code] -> [original data] :)
But don't know how it is written into transponder.
Only a guess: 4 bytes of original data into USER0 page and inversed values of these written into USER1 page.

Also there can be aadditional coding in body module, that's what i want to figure out

[paul_12345]

so your the one that offering the 4 byte from rolling code for $$$$$ then you want others help to finish your project ??

If you really want to solve why not post calculator!

[ninja123]

ok, i know there is no rolling code algo stored in transponder pages, only solid non rolling data, so, any algo's used here are either in remote or bsi, i presume bsi, as a re sync procedure is available and works all the time.

And how can you get samples when then transponder is locked during programming?

The only way I see is reading new/virgin remotes/transponders and working from there.

I just dont know how to move on from this or I would....

ninja

[mihotd]

so your the one that offering the 4 byte from rolling code for $$$$$ then you want others help to finish your project ??

If you really want to solve why not post calculator!


I can find out the remaining things for this algo alone but I think it's not worth the effort. I already spent a lot of time and money to get there, so i will not post calculator now, maybe later time (it is not a program in fact).
If someone wants to calculate data from rolling code I will calculate it, no problem (and not for $$$$ !)

Nobody is is obliged to help me, i can do it alone, just want to save time and money, that's all.

[kerekt]

how to find this 6bytes in bsi to read transponder in crypto mode?



There is no PIN for transponder. Did you mean SK (secret key 48bits) ? If so, you can read it with tango hitag2 by entering 6 bytes in the key field for crypto mode (not password mode).

Actually all transponders from peugeot I've seen are locked :(
It seems that USER pages can be read only on new, prepared for programming in car key (new couple of 7936 + remote pcb from PSA)

[mihotd]

how to find this 6bytes in bsi to read transponder in crypto mode?

I think these bytes are stored in NEC cpu internal eeprom. One of available tools for reading is NecProg programmer.

[mihotd]

Finally I get it. Here is how it works.

Decoded four bytes from remote are written to its corresponding transponder in USER0,1,2 pages. For example we have a remote with bytes E7D020A5, here A5 is remote TYPE, other 3 bytes are remote ID. For such data you must write to PCF7936 the following:

USER 0: 55E7D020 - remote ID, first byte is always heading 55
USER 1: AA182FDF - inverted USER 0 bytes
USER 2: 0A55FFFF - stands for remote type A5 (Pug 307 in this case)
USER 3: no matter - can be FF's (usually some date is stored here, say 05112003 for 5 NOV 2003)

[kuti]

Could Yo paste a link where to buy USB-to-TTL converter based on PIC12F629 ? thanks

[urcarpc]

This is very interesting, I dont mind givin a shot at making the reader. Have a few spare remote fobs to try on

[ninja123]

I would love to see this happen, you seem to be almost there, keep it up, good work here clever cloggs!! :)

ninja

[ninja123]

can someone explain this to me please - peugeot/citroen remotes, as we all know cant be re used, so how is it, after virginising a bsi from scrap yard, coding to car with planet, and the original keys and remotes work fine??

I have taken NO DATA from ori bsi, so how does this work when the pcf is locked?

Now I am really confused :(

ninja

[paul_12345]

can someone explain this to me please - peugeot/citroen remotes, as we all know cant be re used, so how is it, after virginising a bsi from scrap yard, coding to car with planet, and the original keys and remotes work fine??

I have taken NO DATA from ori bsi, so how does this work when the pcf is locked?

Now I am really confused :(

ninja

logically its either stored else where on car, or possibly unique data from the car is being programmed into the pcf during initial programming

[ninja123]

but the key data is stored in bsi, i have used one from a scrap yard, i did FF FF in eeprom, fitted and coded - so HOW do these remotes still work???????????????????????????????

ninja

[paul_12345]

but the key data is stored in bsi, i have used one from a scrap yard, i did FF FF in eeprom, fitted and coded - so HOW do these remotes still work???????????????????????????????

ninja

lets say the unique data lets say vin number is programmed into the pcf during programming and the remote data is stored in the bsi and then you virginise bsi but the data is already written into the pcf with the data needed i.e. vin number etc

or even the pcf could be locked with the unique number and thus allowing unlocking reusing the key.

[mihotd]

Here we talk about reusing the remote PCB only not along with pcf. Old pcf is useless, we must use new unlocked one and program it to car with lexia (or some other tools).

[JustMeAgain]

Could Yo paste a link where to buy USB-to-TTL converter based on PIC12F629 ? thanks

The guy posted a schematic, but failing that if you are unable to type "usb TTL" into ebay I think this may go way above your head.

[ninja123]

I did not virginise the bsi from this car, it was from a scrap yard, so no way there was any data in bsi relating to the remote key, and the pcf is locked, so does anyone have the explanation of how this works?
If so, then maybe we can get somewhere here, either there is a way to read the locked pcf or I am at a loss as how this procedure works ???????????????????????????????????

And if you are refering to the vin being used to read the locked pcf, then maybe we should be looking down this route, as we can always write down vin from car in scrap yard where we steal the keys from!!

ninja

[mihotd]

Maybe I have not explained the things good enough. I'll give another try...
Well, first you get an old key fob, remove PCF from it and throw it to the trash. Then read data from remote (with all boring stuff with 12f629). From that data I will calculate bytes to be stored in NEW (unlocked) pcf7936. Then put this pcf into keyfob and program it in car. This is tested and working on Pug307 (remote type A5).

BSI takes data from pcf user pages during learning sequence, this way bsi knows about remote.

[avtonega]

I did not virginise the bsi from this car, it was from a scrap yard, so no way there was any data in bsi relating to the remote key, and the pcf is locked, so does anyone have the explanation of how this works?
If so, then maybe we can get somewhere here, either there is a way to read the locked pcf or I am at a loss as how this procedure works ???????????????????????????????????

And if you are refering to the vin being used to read the locked pcf, then maybe we should be looking down this route, as we can always write down vin from car in scrap yard where we steal the keys from!!

ninja

I had the same experience with C2 ( fitting used BSI) , I have successfully program used PCF & remote
I think that the condition for program used PCF & remote is 4 digit PIN code wich you enter in BSI begining of programming?!

[paul_12345]

I did not virginise the bsi from this car, it was from a scrap yard, so no way there was any data in bsi relating to the remote key, and the pcf is locked, so does anyone have the explanation of how this works?
If so, then maybe we can get somewhere here, either there is a way to read the locked pcf or I am at a loss as how this procedure works ???????????????????????????????????

And if you are refering to the vin being used to read the locked pcf, then maybe we should be looking down this route, as we can always write down vin from car in scrap yard where we steal the keys from!!

ninja

Best thing would be to sniff the data from the transponder during first programming, you would then be able to see what data is written to the pcf.

I suppose setting the password for the pcf whether from VIN or other data from ecu etc would be the easiest way to explain how it can reuse them.

[ninja123]

Im still not convinced!! There must be something to do with the pin code, as this is the only data I used from old bsi to new bsi, I did not program the vin number, and key still programmed - so the vin number is out of the question - so I think the pin has a big part to play here, pin must be written to pcf and used to unlock it or match it?? - ill keep digging...........

I think next time I get a car in to prog a new key, If I get enough time with it, remove bsi and read eeprom before and after.

ninja

[ninja123]

Maybe I have not explained the things good enough. I'll give another try...
Well, first you get an old key fob, remove PCF from it and throw it to the trash. Then read data from remote (with all boring stuff with 12f629). From that data I will calculate bytes to be stored in NEW (unlocked) pcf7936. Then put this pcf into keyfob and program it in car. This is tested and working on Pug307 (remote type A5).

BSI takes data from pcf user pages during learning sequence, this way bsi knows about remote.

Thanks mate, I completely understand you, but im looking at this from a different view, maybe an easier way ???

ninja

[lidons]

I'm in your theme

I can not help unlock.

it should take into account the first preloads that has the transponder, to know how close it. I think

photos remote original
1 peugeot 206
2 berlingo 2001


196418
196420


http://www.digital-kaos.co.uk/forums/f177/precode-psa-330872/

[keysph]

Im still not convinced!! There must be something to do with the pin code, as this is the only data I used from old bsi to new bsi, I did not program the vin number, and key still programmed - so the vin number is out of the question - so I think the pin has a big part to play here, pin must be written to pcf and used to unlock it or match it?? - ill keep digging...........
ninja
You did not enter any VIN but I'm sure that the BSI automatically took the VIN from the ECU in the learning procedure. When you programed the key the BSI had the VIN and the pincode inside. ;)
Even if you know the VIN and the pin from the car that the key belongs how do you unlock it to mach it on another car?
It is known that PCF and the remote are linked together and you cannot use the remote with other transponder.
Why would you look at the PCF when the problem is the info on the remote?
When you program a NEW transponder isn't that coded with the VIN or the pin or a secret key and locked on that car???? And why doesn't work with the remote?
SO the info that must be cracked and understand is in the remote. By cracking that info you can match a blank PCF to it and only after that you my program it to new car.

You got it now? Or still not convinced?

[reks13]

I dont understand why just not program used PCB with new PCF7936 via OBD and then program buttons like in SBB procedure.
I think used remote PCB will rewrited data from programmed PCF7936

[cammy25]

You guys really dont want to understand what the topic starter is talking about, don't you?

please read his postings again and again carefully to understand.

[paul_12345]

You guys really dont want to understand what the topic starter is talking about, don't you?

please read his postings again and again carefully to understand.

if you mean the people talking about the pcf its you that does not understand what we are on about, we understand that the op is on about retrieving the data from the remote, we are on about something else.


You did not enter any VIN but I'm sure that the BSI automatically took the VIN from the ECU in the learning procedure. When you programed the key the BSI had the VIN and the pincode inside. ;)
Even if you know the VIN and the pin from the car that the key belongs how do you unlock it to mach it on another car?
It is known that PCF and the remote are linked together and you cannot use the remote with other transponder.
Why would you look at the PCF when the problem is the info on the remote?
When you program a NEW transponder isn't that coded with the VIN or the pin or a secret key and locked on that car???? And why doesn't work with the remote?
SO the info that must be cracked and understand is in the remote. By cracking that info you can match a blank PCF to it and only after that you my program it to new car.

You got it now? Or still not convinced?

you dont understand what ninja is saying.. he is saying virgin bsi has not got remote info, yet keys already programmed to that car can be reused.

He knows that a blank pcf wont work, but if you remove the remote info from the car and reuse key then this means during the programming procedure it must be either unlocking the pcf and using the data to write back to the car, or during first programming theres more happening which allows the reusing of the original key.

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

[mihotd]

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

You're right this will be a versatile method for solving the problem. But it will be very hard to find out the connection between PIN(either VIN) and PCF key. To do this we must do reverse engineering of BSI. Maybe we can start with collecting bsi eeprom dumps and (if available) ROM dumps, I mean nec cpu based units.

p.s: The only advantage of my method is that you need nothing but a remote pcb for making working key, even without seeing original pcf/bsi/vin/pin etc.

[paul_12345]

if you had a transponder sniffer you would be able to see what password the transponder gets set to, then it may be easy.

[ninja123]

paul_12345 - im so glad someone is on my level here, this subject has bugged me for a while now, I would love to see the answer to exist in the remote data reading, but i dont think this will happen.

Here is another one for you guys to consider - I but new remotes from same supplier, I always read pcf before programming just in case its not the correct type, then I can use again with new pcf.

Yesterday, I checked the dumps of 7 pcf7936 chips, all from same type remotes, all from same supplier, and all data is the same, every page identical.

I made a key for my moms picasso and one for the guy up the road, today I got both cars together and tried to re sync each others remotes to other cars - not worked - but both remotes started life with same data.

Any one care to explain this one then?

ninja

[paul_12345]

paul_12345 - im so glad someone is on my level here, this subject has bugged me for a while now, I would love to see the answer to exist in the remote data reading, but i dont think this will happen.

Here is another one for you guys to consider - I but new remotes from same supplier, I always read pcf before programming just in case its not the correct type, then I can use again with new pcf.

Yesterday, I checked the dumps of 7 pcf7936 chips, all from same type remotes, all from same supplier, and all data is the same, every page identical.

I made a key for my moms picasso and one for the guy up the road, today I got both cars together and tried to re sync each others remotes to other cars - not worked - but both remotes started life with same data.

Any one care to explain this one then?

ninja

if you use a new pcf with the key from 1 car on the other car then I assume it still programs in?

if so then that fits in with the theory of the password being set to something specific to the car, hence why you can't reuse the 1 key on the other car as once programmed they will have a unique password specific to that car, when reprogramming on the original car it will have the same password allowing the pcf to be unlocked and programed in ok.

[mihotd]

@ninja
Several PCF7936 's with exactly identical ALL pages??? Impossible!
Something with the reading has to be wrong. At least serial number will be different.
Even on chinese spare keys they put different remote data (in pcf7922).

can you post pcf dump to see what is going on there?

[ninja123]

ill post them later, I have looked at all the dumps taken from the same type of remote, and believe me, they are the same.

Paul12345, I think the same but im still at a loss as to how this works after using a second hand bsi, as there is no vehicle specific data in the used bsi as it came from another car, and I have done these without programming the new vin into bsi.

ninja

[paul_12345]

maybe its calculated from pincode, or getting some data from ecu. Something to try.. new ecu edit pincode to the old one, then see if you can reuse key, if it works change pincode and try again to reuse.

[ninja123]

I dont think any ecu data is taken into account, Im not 100% sure, but I may have programmed keys back into a virgin bsi without engine ecu connected, in which case, pin code is only option, so to unlock the transponder, the secret key is an algo of the pin code maybe............

ninja

[cammy25]

if you mean the people talking about the pcf its you that does not understand what we are on about, we understand that the op is on about retrieving the data from the remote, we are on about something else.



you dont understand what ninja is saying.. he is saying virgin bsi has not got remote info, yet keys already programmed to that car can be reused.

He knows that a blank pcf wont work, but if you remove the remote info from the car and reuse key then this means during the programming procedure it must be either unlocking the pcf and using the data to write back to the car, or during first programming theres more happening which allows the reusing of the original key.

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

Yeah Im the crazy one here....





I dont think any ecu data is taken into account, Im not 100% sure, but I may have programmed keys back into a virgin bsi without engine ecu connected, in which case, pin code is only option, so to unlock the transponder, the secret key is an algo of the pin code maybe............

ninja




Thats right Ninja123 ,Password is 100% calculated out of pin.

[ninja123]

If you know this, then do you also know the algo to break this open?

ninja

[mihotd]

If you know this, then do you also know the algo to break this open?

ninja

In old BSI (say peug206/year2000) this can be figured out. They use older transponder there it is PCF7935 and algo is probably different but can lead us to something. I will look at it these days.

It seems that pin affects only 4 out of 7 bytes of pcf password on bsi year 2000 (with pcf7935). There is something like default password which is 413121110F0500. Only first 4 are modified according to pin. That's only for info, will not help here since newer BSI are using different algo.

[kazikk]

Finally I get it. Here is how it works.

Decoded four bytes from remote are written to its corresponding transponder in USER0,1,2 pages. For example we have a remote with bytes E7D020A5, here A5 is remote TYPE, other 3 bytes are remote ID. For such data you must write to PCF7936 the following:

USER 0: 55E7D020 - remote ID, first byte is always heading 55
USER 1: AA182FDF - inverted USER 0 bytes
USER 2: 0A55FFFF - stands for remote type A5 (Pug 307 in this case)
USER 3: no matter - can be FF's (usually some date is stored here, say 05112003 for 5 NOV 2003)

Hi mihotd
I have used Remote for Citroen C3 and i will like to try program this in to car.
I have read remote like you sad :

1CAA950AE353A85A0779
1CAA950AE353A85A0779

1CAA4D483F45ECEA339A
1CAA4D483F45ECEA339A

1CAAE57A809072E6A5DC
1CAAE57A809072E6A5DC

1CAA784825C5ECE93399
1CAA784825C5ECE93399

1CAAB028D3E2A72A37C8
1CAAB028D3E2A72A37C8

1CAAEA8A67040EA95A7A
1CAAEA8A67040EA95A7A

What data i need to write in to PCF7936 now ?

[mihotd]

Actually I never had remote of type 1C in hands. It seems that calculation is different, because each of the 6 packets produces different data when decoded :(
Till now I was dealing with types 69, A5, C7 and C1 and can decode them but yours is different. Can you get data from another type remote? This will ensure that reader with pic is working properly.

EDIT: Calculation has to be the same. PIC reader is not reading all remotes properly, so data received from kazikk is wrong. That was confusing me but now I'm attaching new .HEX file which must operate properly with all remotes even if their sample frequency differs a lot. Enjoy

[kazikk]

Hi. mihotd

i have read another remote :


A5AA6BC714FE0C9D36B3
A5AA82285A72137A4D01
A5AAE845822BFD04D36D
A5AA88346513D2F8232F



A5AAAEC30224BB46A868
A5AA3E8154AC53750CDE
A5AA3F37DB1A29CF8364
A5AA207EC09282B5D7E1


could you help me to pre-code PFR7936

[mihotd]

Yes, data should be
USER0: 552DF01F
USER1: AAD20FE0
USER2: 0A55FFFF
USER3: FFFFFFFF
and will work on Peug 307 for sure

[kazikk]

it will work only for 307 ?
can i use this remote for Citroen C3 ?

[mihotd]

No, it will not work for C3. Important byte is the first one (A5). As I mentioned before this is remote TYPE (in other words - car model).
You should find remote which transmits 1C first, this corresponds to citroen C3 although I didn't test this yet.

[Zmann]

Hi mihotd, Have you tested with this remote type, same successful?

[mihotd]

Yes, same data and coding. Not sure if works with PSA_ReaderV2. I read them by RF receiver, not with cable connection to pic mcu.

[Zmann]

Thanks, I'll try it when some of them come again and would ask your advice then.

[912secured]

Working on reading 7946/7 can do 41s. Take dump because you read like eeprom and put into hitag soft to find spots. Tango prepairs remote data can program and read for you, live in us can use saab remote. PM only

[mihotd]

@912secured

Actually here we are talking about calculating data to be put in a new unprogrammed PCF7936. No need to read old one (locked) because it is cheap and not always available (most sellers give only naked pcb without case, no transponder, no battery).
Although it will be useful if someone can read locked pcf7936 but I think this is impossible for now.
Thanks for your response.

[F-1]

Finally I get it. Here is how it works.

Decoded four bytes from remote are written to its corresponding transponder in USER0,1,2 pages. For example we have a remote with bytes E7D020A5, here A5 is remote TYPE, other 3 bytes are remote ID. For such data you must write to PCF7936 the following:

USER 0: 55E7D020 - remote ID, first byte is always heading 55
USER 1: AA182FDF - inverted USER 0 bytes
USER 2: 0A55FFFF - stands for remote type A5 (Pug 307 in this case)
USER 3: no matter - can be FF's (usually some date is stored here, say 05112003 for 5 NOV 2003)


Hi mihotd

Can You help me with this remote id bytes?
Thankyou!!!

A5AAAD7FFD8F64DDE318

A5AA5417553BA7E273D4

A5AA6DA730B7DA54F2BA

A5AA534DAAC855B88C2D

[mihotd]

Hi mihotd

Can You help me with this remote id bytes?
Thankyou!!!

A5AAAD7FFD8F64DDE318
A5AA5417553BA7E273D4
A5AA6DA730B7DA54F2BA
A5AA534DAAC855B88C2D


Yes, data is correct (3 sequential presses, second one is long press) and corresponding bytes are:

55067034
AAF98FCB
0A55FFFF
FFFFFFFF

this will work on peu 307

[F-1]

This one should be:

A5AA323FB9A0234F2BB6
A5AAEB9A8567FAB75E2C
A5AA27FF955A44275757
A5AA207F30B44428F2B9


55067037
AAF98FC8
0A55FFFF
FFFFFFFF

Is it?


Thank You !!!

[mihotd]

This one should be:

A5AA323FB9A0234F2BB6
A5AAEB9A8567FAB75E2C
A5AA27FF955A44275757
A5AA207F30B44428F2B9


55067037
AAF98FC8
0A55FFFF
FFFFFFFF

Is it?


Thank You !!!

Yes, that's correct !

[F-1]

Have i to write something in other areas?

229521
to "config"?

Thankyou!

[reks13]

No need write cfg

[stevan]

I have lot of second hand used remotes from citroen and peugeot.
If someone can give me link wich USB to TTL interface to order on eBay i will read these and post to help.
I have look on eBay but there are lot of types,not shure wich one to order.

231277

[mihotd]

It will work with almost all types USB-TTL converters. Most common ones are based on PL2303 and CP2102 chips. I personally prefer second ones. You can use chip names as keyword in ebay. Picture for reference is in post #3.

[meteor80]

Hi mihotd

Can You help me with this remote id bytes?
Thankyou!!!

A5AAAD7FFD8F64DDE318
A5AA5417553BA7E273D4
A5AA6DA730B7DA54F2BA
A5AA534DAAC855B88C2D


Yes, data is correct (3 sequential presses, second one is long press) and corresponding bytes are:

55067034
AAF98FCB
0A55FFFF
FFFFFFFF

this will work on peu 307



Hello
Can You tell me how to calculate remote id from received bytes?

[RMCtech]

Yes, same data and coding. Not sure if works with PSA_ReaderV2. I read them by RF receiver, not with cable connection to pic mcu.

Thanks for all the info, just a question:

What RF receiver do you use ?

[mihotd]

@meteor80
No, algo is the main secret here

@RMCtech
RX 4MM5 module rf receiver

[obdsystems]

PIC12F629 :party: talk about making life tough
Use a Hitag2 / ID46 editor - plenty about - equipment is already there.

I use my miracleclone to generate chip. Unsure tho if can re-use fobs BUT why bother ??? Just buy new

[meteor80]

@meteor80
No, algo is the main secret here

@RMCtech
RX 4MM5 module rf receiver




OK.
I understand you.
But will you generate remote id if I read my remote?

Wysłane z mojego Lenovo A820 przy użyciu Tapatalk now Free ('http://tapatalk.com/m?id=10')

[mihotd]

OK.
I understand you.
But will you generate remote id if I read my remote?

Wysłane z mojego Lenovo A820 przy użyciu Tapatalk now Free (http://tapatalk.com/m?id=10)

No problem, I already generated many of them for DK members here

[mihotd]

PIC12F629 :party: talk about making life tough
Use a Hitag2 / ID46 editor - plenty about - equipment is already there.

I use my miracleclone to generate chip. Unsure tho if can re-use fobs BUT why bother ??? Just buy new

I'm not sure if you get the point of this thread.
If you want buy new ones (chinese, keep in mind) or original for X10 prices.
Equipment for dealing with PCF7936 is not enough except you are talking about reader for LOCKED pcf's, that will be interesting.

[F-1]

Hi mihotd

Can You generate one more remote id bytes?

A5AA45E55F2B13B92B36

A5AA8A103E0119F67F74

A5AAE50F0A671D537E91

A5AAA51387C9E5E516A3


Thankyou!!!

[mihotd]

User pages of pcf7936 will be:
55038836
AAFC77C9
0A55FFFF

[F-1]

Hi mihotd

Please generate one more remote id bytes?

69AA366B58C1E25C9B08

69AA24BEA776DDC3B6E0

69AA1B4DDD6F72E4CCF9

69AA8068F4806EA9AEDF


Thankyou!!!

[mihotd]

Finally I decided to make a device with integrated calculation for these remotes. It gives all data needed for PCF7936 with just one click on a remote (gets RF signal).

I'm digging now C5/C8 old type remotes, they are different from ones discussed here. Soon I will post some info about them too.

[meteor80]

Finally I decided to make a device with integrated calculation for these remotes. It gives all data needed for PCF7936 with just one click on a remote (gets RF signal).

I'm digging now C5/C8 old type remotes, they are different from ones discussed here. Soon I will post some info about them too.

Will it be for free?

Wysłane z mojego Lenovo A820 przy użyciu Tapatalka

[mihotd]

It cost me many months to get this project finalized, so answer is NO.

[stevan]

Here some remote details from me.
2x short press third one long.


307 remote 1

A5AAB9526E7FEC9BA7DF

A5AA19653BB61E7FF216

A5AAE468DA7C1A37D8E9

A5AA927D67A59926D972


unknown

7CAAA5503480136AE05E

7CAA9AF9CA69281E2B7A

7CAA53832052606218C3

7CAA2B6B7255329ADC9F

cross metal blade ,i think citroen picasso.

69AA3E074BCA281D0764

69AA72F1302A4BD67C0A

69AACFF18E2A48D6C20F

69AA1EDFF73BFEACE75C


307 second 2

A5AA9F21DC44F1B30A88

A5AA9CEECFC77A057023

A5AA69F54E64D18BB45D

A5AAAF6DF933A0A02FB2

[stevan]

I also have several new type remotes with some sop20 nxp IC but need where to connect.

[stevan]

Finally I decided to make a device with integrated calculation for these remotes. It gives all data needed for PCF7936 with just one click on a remote (gets RF signal).

I'm digging now C5/C8 old type remotes, they are different from ones discussed here. Soon I will post some info about them too.

Well you can make only soft to calculate bytes from data.
Hardware with USB-TTL work good,no need to make new hardware.

[estebanfree]

Hi everyone,

I have peugeot 407 and it needs new key as a spare. I checked circuit and circuit numbers. Battery is on the circuit and key number is E28CI01B. Dealer wants 150us dollars:( I have pp2000 peugeot diagbox so I can learn the new key.

How can find cheap circuit board as virgin?

Many thanks,
Mehmet


Sent by mobile

[mihotd]

Hi everyone,

I have peugeot 407 and it needs new key as a spare. I checked circuit and circuit numbers. Battery is on the circuit and key number is E28CI01B. Dealer wants 150us dollars:( I have pp2000 peugeot diagbox so I can learn the new key.

How can find cheap circuit board as virgin?

Many thanks,
Mehmet


Sent by mobile


Your remote is completely different from these discussed here so I can not help you. Try some chinese 3rd party remotes, they will be cheaper.

[jacostanzo]

Good job mate, but I don't understand how can I use PSA_Reader.HEX?

[zeljolaki]

Good job mate, but I don't understand how can I use PSA_Reader.HEX?
PSA_Reader.HEX is hex file for PIC12f629

[meteor80]

Hello.
Can You generate code for transponder for this remote:
7CAA43D66D59C7099F8C


7CAA7EE9FD44FA17AC11


7CAA3E790E08CDFC4EB1


7CAAB1E84D9D0E7D8D24


Thanks in advance.

[baigano]

Hi, Mihotd i have peugeot 307 with BSI-reseted.now the car is started,but can't make the remote working.I read remote data like you say,could you help mi?
(short,long,short)
A5AAD4B92E6B6F08E75C

A5AAF9C80EF4E26C2923

A5AAF9C84AF4A66C2923

A5AA6C5E04D847EFCDE6

Thanks!

[mihotd]

Write in PCF7936:

USER0: 55285184
USER1 :AAD7AE7B
USER2: 0A55FFFF
USER3: FFFFFFFF

Then adapt transponder with PeugeotPlanet or something

[ninja123]

Finally I decided to make a device with integrated calculation for these remotes. It gives all data needed for PCF7936 with just one click on a remote (gets RF signal).

I'm digging now C5/C8 old type remotes, they are different from ones discussed here. Soon I will post some info about them too.

ok, so it wont be free, but will you be selling it? PM me some details :)

ninja

[baigano]

thanks work perfect

[mihotd]

There is a certain progress about calculation for C5, C8, Pug807/1007, Lancia phedra, Fiat ulysse.
Early models also use PCF7936. If someone needs pcf data calc PM me with remote log of few keypresses.

[Pawelsonx]

as the difference between 0536 and 0523 remont key for PSA

[912secured]

The 7941 crypto for key side and remote side are connected on some,depends on how its set up. Get a cloaner from asia with logger and log the data and you will be good.The remote is based on same crypto data when its conncted. People say they do not understand why key changes, its to make cloning harder andsome keep same crypto code. Others start with a acceptable crypto code and it changes it. So its not reusable except in the car programmed into good for nothing else then on out. Half of the companies use the same and do not change. You could make a 4d cloner and a simple cloner that only does non changing crypto ie honda nissan etc. Could not do crysler.

[urcarpc]

can this be used to retrieve remote data?

KD900 Remote Maker the Best Tool for Remote Control World (http://www.obdtool.co.uk/wholesale/kd900-remote-maker.html)

[mihotd]

If you already have this KD900 tool you can try if it gives you pure remote data (I doubt so) or can clone/read remotes without giving you any details.
Anyways it is too expensive for just getting remote data. RF reader for these remotes can be made for less than 30eur

[Gita]

Can You generate code for transponder for this remote:


A5AA941127AD1622EFE1


A5AA53468A9B2BC48E55


A5AAE9FAE7F86BC908E1


A5AA1F904341BB29E858

[mihotd]

3 sequential presses, last one is long
data for pcf:

55262736
AAD9D8C9
0A55FFFF
FFFFFFFF

[jolor]

Is possible add data in pcf7936 with zedBull?

[mihotd]

Yes, I think zedbull can write USER pages (last 4 rows) of PCF7936 transponder.

[autoTkey]

Hello mihotd,

Can you help me identify what cars are these remotes meant for:
- C1
- DB

The information is read with Effi - I'm looking at "User 2" middle of first two bytes.

[mihotd]

Type C1 is Citroen C3
Type DB is Peugeot 206+ (2009-2012MY)

[paul_12345]

@mihotd why not work with keydiy you could produce Peugeot/Citroen remotes for keydiy for the remotes with pcf7936 and earn from this that way

[mihotd]

keydiy remote must support Peugeot/Citroen rolling code algo to work. Sure it is not implemented in there

[totalkey]

keydiy remote must support Peugeot/Citroen rolling code algo to work. Sure it is not implemented in there

Most of the remotes there are rolling code, they defiantly not fix code


iPhone Tapatalk

[paul_12345]

keydiy remote must support Peugeot/Citroen rolling code algo to work. Sure it is not implemented in there

if you know the algo then surely it wouldn't be hard to implement into keydiy

[mihotd]

As I see these keydiy remotes are simple copies of some brands of fixed code remotes, not rolling code ones.
Even if they have ability to implement some additional logic/algorithm, no one will give them a proprietary cipher algorithms.
So in one word - these remotes can NOT be used as replacements for PSA remotes.

[paul_12345]

As I see these keydiy remotes are simple copies of some brands of fixed code remotes, not rolling code ones.
Even if they have ability to implement some additional logic/algorithm, no one will give them a proprietary cipher algorithms.
So in one word - these remotes can NOT be used as replacements for PSA remotes.

what are you on about, these remotes are not just fixed type and can be programmed, so if you know the rolling code algo you could program a keydiy remote to the algo

[ninja123]

@ mihotd: I needed to make a key for citroen c2, 2004, but remote not worked, so i buy from 3d group, and i read key data and it was type 96, and is listed as citroen c2 2003 up till CAN (flip type key) and citroen c3 pluriel 2003 till CAN.

I have screen shots of data and pcf7936 before programming if you need.

Hope this helps

ninja

[mihotd]

what are you on about, these remotes are not just fixed type and can be programmed, so if you know the rolling code algo you could program a keydiy remote to the algo

Ok, but I will not use them. I will support only original remotes and no third party remotes with suspicious security. Hope it is clear now.

[nelson76]

Mihotd friend, I have seen many people who really want to figure out how things work, but like you is the first time. CONGRATULATIONS by study and work has been performing. You could do a step by step how do I read mcu or frequency of RF that u 'decrypts' because I see people posting sequential and numerical You put the bits to be placed in pcf and have a question, you're already selling some software or method for calculation of these bits? if the answer is yes what value?

[mihotd]

Ok, here are all variants that I can perform:
- if some people made their own receivers as per instructions here I can calculate PCF data for them @price of 10 eur
- if someone wants a receiver for further reading and calculating it is available for 50eur with 3 free calcs included in this price
- device which reads remote by RF and calculates PCF data is also available (PM me if interested)

No software solutions for calculating data will be available.

[snecii]

Ok, here are all variants that I can perform:
- if some people made their own receivers as per instructions here I can calculate PCF data for them @price of 10 eur
- if someone wants a receiver for further reading and calculating it is available for 50eur with 3 free calcs included in this price
- device which reads remote by RF and calculates PCF data is also available (PM me if interested)

No software solutions for calculating data will be available.

I was trying to send private message but faild. Please send me your email in private thanks!

I need 4 remote codes:

1-es:

C7AA3B6A07680583047C
C7AA3B6A07680583047C

C7AA79A0335E89CC3943
C7AA79A0335E89CC3943

C7AA12BB6664F29B36D6
C7AA12BB6664F29B36D6

2-es:
C7AA98E8C0F863BAD25E
C7AA98E8C0F863BAD25E

C7AA2569E3804B7419B0
C7AA2569E3804B7419B0

C7AA5D5389EC0F95C9E0
C7AA5D5389EC0F95C9E0


3-as

A5AABE49CF4D698FF03C
A5AABE49CF4D698FF03C

A5AAF1AD0BED01A05113
A5AAF1AD0BED01A05113

A5AA2C1B05C10BCC6A94
A5AA2C1B05C10BCC6A94

4-es

A5AAFA359382AF3EFEC6
A5AAFA359382AF3EFEC6

A5AAAE989C5BFA38F11F
A5AAAE989C5BFA38F11F

A5AA451809202AADE151
A5AA451809202AADE151


Please generate for me!

Thanks

[autoTkey]

Unfortunately mihotd got banned because of breaking the rules of DK. So he won't be able to reply to you, nor you will be able to get in touch with him through this forum.

[obdsystems]

Ok, but I will not use them. I will support only original remotes and no third party remotes with suspicious security. Hope it is clear now.

I'm sure he's full of ** anyway - 3d sell original citroen / peugeot remotes.

why on earth this thread exists ??? what is the cost of a fob in the grand scheme of things ??? nothing :)

throw em away

[RFRemotes]

why on earth this thread exists ???


Maybe for you this thread is not useful but for some people is (mainly from poor countries like mine :) )
And according to number of "likes" and views it seems that information here is not so useless ...

[eepromRipper]

Thumbs up mate but Instead of all the stress, just virgin d bsi and it will accept used remotes. I do that daily.

[oknid]

Does anybody knows private email of mihotd? I need to get in touch with him. Please PM me.

[RFRemotes]

Thumbs up mate but Instead of all the stress, just virgin d bsi and it will accept used remotes. I do that daily.

Anyone to confirm this?
Can this be done without removing BSI/desoldering? If not - for me this is not a solution at all.

[eepromRipper]

Confirm what exactly? BSI must be open and eeprom read to put it in virgin state. And if you're referring to the remote, I've done over 500 peugeot vehicles and yes used works as long as it's a virgin bsi

[RFRemotes]

I mean virginising. Can it be made by obd without disassembling the half of vehicle and waste xxx hours.

[kemaster]

Mihotds' method is the easiest way to use old remotes. No doubt. Works fine.

[RFRemotes]

Mihotds' method is the easiest way to use old remotes. No doubt. Works fine.

+1
I'm also using his method. Costs a few bucks but no worries. I mean possible complications with these car's "beautiful" electrical wirings/systems during dismounting.
Just one thing: If someone is going to make key for xsara picasso observe carefully year of production and be sure what original remote looks like. Sometimes I was not able to join a remote for this model (= losing PCF's when they lock).

This reminds me something: there MUST be algorithm for making PCF secret key 48bit from vehicle PIN and I'm going to work it out next months.
If I'm right and key depends only on pin then a table (about 20 megabytes text) can be made with ALL possible passwords.
So no locking and losing transponders anymore :)

If some of you fellows consider this useful I will make this effort although this is a lot of boring job to sniff communications then countless tries and fails .......

[RFRemotes]

Done! For getting PCF7936 secret key are needed both PIN of vehicle and first 32bit of pcf data which contain ID and SN. Also must work for eurovan remotes like pug 807, citr C8.

[autoTkey]

Done! For getting PCF7936 secret key are needed both PIN of vehicle and first 32bit of pcf data which contain ID and SN. Also must work for eurovan remotes like pug 807, citr C8.

You mean the first 4 pages, which you get after you crack it with copying?

[kemaster]

You mean the first 4 pages, which you get after you crack it with copying?
Page0 = ID. Using it and PIN he calculates SKC(6 bytes)

[meteor80]

Hello.
Does someone have e-mail for mihotd?

[oknid]

Hello.
Does someone have e-mail for mihotd?

Please check PM.

[jimmykey]

hi
, i want mihotd mail also. pls help.
thanks

[stevan]

anyone know is it gonna be some HW or SW for sale from mihotd or someone else for calculate data?

[autoTkey]

There already are such tools available. But you should contact him for details.

[jimmykey]

kd900 can make this remotes soon.

[lidons]

@mihotd @RFRemotes
As this subject, I am interested in it.

@jimmykey
KD900, I do not think I can handle these remote bearing PCF. can only with older, WITHOUT PCF

[paul_12345]

@jimmykey
KD900, I do not think I can handle these remote bearing PCF. can only with older, WITHOUT PCF

did you not see the word 'soon' read the kd900 thread!

[ninja123]

I think will be posssible for KD900 for old psa remotes, as they are working on pcf7941, I got some remotes from china for old peugeot 307, they have pcf7941 inside and work good :)

ninja

[lpf01]

If somebody can give me mihotd's email, please pm me :)

[didi_du_93000]

I think will be posssible for KD900 for old psa remotes, as they are working on pcf7941, I got some remotes from china for old peugeot 307, they have pcf7941 inside and work good :)

ninja
The old version of 307 have 7941???

Post picture please.

[ninja123]

here are the pictures mate, peugeot 206 remote with pcf7941 and no seperate transponder :)

ninja

[reks13]

Send me pls his email too.
thanks

[dunnnia]

Hi mates. Does someone have e-mail for mihotd?Thanks

[jimmykey]

USE KD900 TO MAKE A 206 MUCH MORE EASY JOB . JAJA

[autofan1965]

Recycled are ecologic and economic:)

[Fallen]

Has anybody got a calculator for this or can offer the service?

[autofan1965]

I know someone who is able to do. PM me.

[best178]

Hi,
can you please sell me a complete reader?

Regards

[best178]

Hi,

i would like to buy the circuit boards usb to ttl and the microchip pic12f629 ready to use, can you sell me the kit and how much?



regards.

[djolemag]

Hello guys,

I'm new to forum, I've seen this thread and according to my knowledge I think you can give me some clues.
I have a problem with my Peugeot 406 2.0 HDI 2001 yr DW10ATED .
What happened: my keyfob remote housing was very old and it was opening itself from time to time, but with no accidents. Few days ago I went to car wash and guys there lost my remote electronics PCB. Fortunately the transponder was there so I could start and drive the car.
Now, I bought some old remote keyfob from Peugeot 307 2001 year.
I compared transponder chips and both had PCF7936AS chip inside. My problem is that I don't know what type of remote PCB was in my original key remote. In this one I bought, I see it is 73373067b circuit board. There are also 73373067a, 73373067c and 73373067d boards.
My problem is that remote is not working. I tested simply if it works (electronics itself) : on multimeter, battery is in good condition, 2.98 V. When I press some button, there is small voltage drop, meaning it is sending something on 433 MHz.
Now, I tried all standard procedures for Plip resync but no luck.
Finally, my question is: how can I make this remote work? Will Planet 2000 key reprogramming help? Is there a way to find out what model of board was in my original key? Maybe difference in a,b,c,d suffixes is source of problem so I can not resync remote?
Any advice is appreciated, thanx in advance.

[RFRemotes]

Hello guys,

Finally, my question is: how can I make this remote work? Will Planet 2000 key reprogramming help? Is there a way to find out what model of board was in my original key? Maybe difference in a,b,c,d suffixes is source of problem so I can not resync remote?
Any advice is appreciated, thanx in advance.

No way to make remote from 307 to run on 406 phase 2. PP2000 will not help. Don't worry about b,c,d suffixes, they are meaningless. Important is MCU firmware.
You need new virgin key for 406(only) and pair it with PP2000. Everything else is loss of time, money and headache.

[djolemag]

Hi, thank you for quick answer.
I see there are some virgin remotes on ebay and similar, I will obtain one for sure. I have access to PP2000 so I can do it. Now I have a doubt:
Do I really need to reprogram new remote keyfob with new virgin ID46 transponder in order to get remote plip working? I have two keys, both with genuine transponders I got with my car. One is in remote plip and the other, spare one, which has no remote option at all. Isn't transponder chip the one who seeds the code for remote?
I thought maybe I can get new virgin remote and just put in my existing transponder from old remote key?
If not, do I have to reprogram keys with PP2000?
In that case, how will I get old spare key working? Does it has to go through programming or learning procedure with PP2000, if it is feasible?
Finally, do I have to get two new virgin ID46 chips and reprogram keys to get new pair of keys, remote and spare? I'm little confused about that...
Sorry for lot of questions, but it is little tricky...

[RFRemotes]

You need to obtain virgin transponder PAIRED to remote PCB intended for 406ph2. Then learn it to car with PP2000.
ANY other attempts will finish with car starting but remote not working. For more info read this thread carefully from the begining to understand how this system works.

[djolemag]

Hello,

Thank you for quick answer. Sorry for my delay, I've been absent for a while.
SO, if I understood correctly, I have to buy new Virgin transponder with electronics and learn it with PP2000. No help if I use only virgin transponder and used electronics, right?
I have googled a lot, original parts are expensive :
Peugeot Genuine Part Number: 6554RAAdvanced Keys: AKRM111
Hickleys: HVRM79
NW Keys: PUG-NWKS37

There are some chinese remote fobs on ebay, but all of them have pictures of older PCBs with copper coil instead of ID46 transponder and they cost around 20$. I presume they don't fit...
Does anyone knows or can send me a link to PM so I can buy new electronics and virgin transponder?

Thnax in advance.

[simaservis1108]

The consequences of DK making itself available to the public google search has shown itself.
The guy above me called me asking for 406 Pug remote board with virgin transponder.

Too bad it will happen to many members to loose jobs and money,because everything is explained here.
We will have to find new closed specialist forum for us.

[ninja123]

its already available, you are a member - but there wont be the type of people that you find on dk, sad i know but thats the way things are developing now :(

BUT, better for you being a member :)

[ninja123]

Hello,

Thank you for quick answer. Sorry for my delay, I've been absent for a while.
SO, if I understood correctly, I have to buy new Virgin transponder with electronics and learn it with PP2000. No help if I use only virgin transponder and used electronics, right?
I have googled a lot, original parts are expensive :
Peugeot Genuine Part Number: 6554RAAdvanced Keys: AKRM111
Hickleys: HVRM79
NW Keys: PUG-NWKS37

There are some chinese remote fobs on ebay, but all of them have pictures of older PCBs with copper coil instead of ID46 transponder and they cost around 20$. I presume they don't fit...
Does anyone knows or can send me a link to PM so I can buy new electronics and virgin transponder?

Thnax in advance.

WHY DO YOU WANT A PM WITH WHERE TO BUY? You have just listed some of the main suppliers, so buy from there, there is no cheap way, just call your local auto locksmith, or are you intending to have a career change?

ninja

[obdsystems]

Hello guys,

I'm new to forum, I've seen this thread and according to my knowledge I think you can give me some clues.
I have a problem with my Peugeot 406 2.0 HDI 2001 yr DW10ATED .
What happened: my keyfob remote housing was very old and it was opening itself from time to time, but with no accidents. Few days ago I went to car wash and guys there lost my remote electronics PCB. Fortunately the transponder was there so I could start and drive the car.
Now, I bought some old remote keyfob from Peugeot 307 2001 year.
I compared transponder chips and both had PCF7936AS chip inside. My problem is that I don't know what type of remote PCB was in my original key remote. In this one I bought, I see it is 73373067b circuit board. There are also 73373067a, 73373067c and 73373067d boards.
My problem is that remote is not working. I tested simply if it works (electronics itself) : on multimeter, battery is in good condition, 2.98 V. When I press some button, there is small voltage drop, meaning it is sending something on 433 MHz.
Now, I tried all standard procedures for Plip resync but no luck.
Finally, my question is: how can I make this remote work? Will Planet 2000 key reprogramming help? Is there a way to find out what model of board was in my original key? Maybe difference in a,b,c,d suffixes is source of problem so I can not resync remote?
Any advice is appreciated, thanx in advance.

My advice is go pay a locksmith. It'll cost you the same amount as filling your petrol tank, twice say

so not much -

[autofan1965]

its already available, you are a member - but there wont be the type of people that you find on dk, sad i know but thats the way things are developing now :(

BUT, better for you being a member :)

How is possible to become a member?

[djolemag]

WHY DO YOU WANT A PM WITH WHERE TO BUY? You have just listed some of the main suppliers, so buy from there, there is no cheap way, just call your local auto locksmith, or are you intending to have a career change?

ninja
Hi, sorry for delay, been absent. First of all, my respect to all members of DK.

As you said, I don't have intention for career change.
It's just matter of someone's nature. I'm undergraduated engineer and also HB in Economics, with scope on IT. Have 20+ years of computer programming experience in may fields. Been done electronics for many years, today it's just a hobby. Last few years I'm doing consulting and technical support for few companies with main focus on NFC (Near Field Communication) and RFID technologies etc.
Enough introducing, I just wanted to make it clear why I came here.
It is a matter of human's nature. I always wanted to know how stuff works, no matter what is about. Same thing happened here, in this situation.

The easiest way is go to locksmith and do a new remote. It costs a lot in Serbia, some people here can confirm. It is relative to average salary in Serbia,let's say like this: Avg salary = 360 Euro , new plip+key+labour = 120 Euro , so it is 1/3 of average monthly wages, for car which is old more than 10 yrs.
Now, it is not a matter of money only. I can afford it, if needed, not a big deal. But everyone would try to solve problem as cheap as possible, so common. I have last resort to go to locksmith and do that. For the very same money I can install aftermarket alarm which will do the same stuff or even more... Nevermind that, I will decide what to do...
Problem is in the following subject: I saw this thread with title "Reusing old Peugeot/Citroen remotes type 73373067B,C (http://www.digital-kaos.co.uk/forums/showthread.php/325914-Reusing-old-Peugeot-Citroen-remotes-type-73373067B-C)" so I started to read it. Basically, we speak here about NXP's (or Philips) PCF7936 chip, which is 125 kHz Hitag2 chip. Datasheets are available on web in NXP's public area.
So, since I'm not doing locksmithing or car programming etc but I have friends who does some of that stuff, I have access to diagnostic equipment etc, I wanted to see if it is possible to overcome problem other way, like for example old remote and new transponder or similar. It was just sort of "project challenge".

Other reason is a trust. Here in Serbia, many people claim themselves as "master" and they usually say they can solve any problem. Truth is very different. I asked few people and only one had answer. So, my apologies to simaservis1108 member, I think I can remember we spoke over the phone, he had straight answer btu the price was little over my expectations.
My assumptions was based on common practice here: if something is not working, change everything until you fix it. So I thought maybe it is not needed to change everything, maybe just transponder and code it via PP2000. It is the one who gives a seed for rolling code to remote, I thought. Well, that is what I thought. Now I see that remote has to be "blank" too, so BSI can learn it and they can sync their rolling codes sequence. Remote PCB has few components: one MCU, one crystal, few passive components, battery and buttons. That maeks me think that rolling seed is inside MCU's EEPROM (or some part of memory), so if you can't get into MCU (usually you can't, there is bootloader, maybe custom protocol etc) then you're stuck with it as a brick electronics.
Third and last, I was wondering about second-hand remotes on Ebay. Why someone sell it if it is not reusable? And what about Chinese clones? They are pretty cheap (20$ compared to 80$ for genuine) , but definitely they are not the same or even close to genuine part's design. They have coil which impersonates as transponder, which is in fact only physical transport layer of 125 kHz, while "chip" (PCF7936) state machine is in some small MCU. That makes me no confidence of using such solution.

I use this occasion to explain my reasons for posting her and following this thread. Also, once again, my apologies if someone had bad impression about my first post/answer.

FInally:

The consequences of DK making itself available to the public google search has shown itself.
The guy above me called me asking for 406 Pug remote board with virgin transponder.

Too bad it will happen to many members to loose jobs and money,because everything is explained here.
We will have to find new closed specialist forum for us.

I doubt about that. You will always be few steps ahead if you improve your knowledge and skills. Of course, experience is something most valuable and none can get it from few DIY tutorials on YT or some forum. Finally, you are selling mostly your knowledge and experience to your customers. Only few percents of price is the fact that you have dedicated tools and machines. People come to you because you know how to solve a problem and you offer them some warranty. Common users does not come here or any other forum with similar topic.

Thanks everyone for patience, excuse me for long post.
Everyone input is appreciated about this matter.

Best regards.:)

[kemaster]

Let's say this: there are 3 ways of doing this job
1. You use second hand remote assuming the fact you know how to make it re-usable( I doubt because it's not public info) and you program it by yourself or friends of yours having proper equipment in your words(also not forget the fact you need the PIN , but lets say it's not so difficult to get it).
2. You buy brand new remote key and you program it the same way as described above
3. You go to auto locksmith who knows how to do it.
People say time is money. If you have enough of other kind( I mean the time) that doesn't cost money you can try the first or the second method.
But don't expect people that have invested a lot( and I mean not only money) and do this for living to tell you how you can do it by yourself to get it cheaper because you think the price is high.
Don't understand me wrong. Nothing personal to you. :). Just my understanding for life is that you should make all the best to improve your skills in profession you are involved, so to gain more money and be able to pay others people professionalism.
Once again I'm not trying to offend you just to put my point of view(of course you have the right to disagree) :) :) :)

[autofan1965]

Hi, sorry for delay, been absent. First of all, my respect to all members of DK.

As you said, I don't have intention for career change.
It's just matter of someone's nature. I'm undergraduated engineer and also HB in Economics, with scope on IT. Have 20+ years of computer programming experience in may fields. Been done electronics for many years, today it's just a hobby. Last few years I'm doing consulting and technical support for few companies with main focus on NFC (Near Field Communication) and RFID technologies etc.
Enough introducing, I just wanted to make it clear why I came here.
It is a matter of human's nature. I always wanted to know how stuff works, no matter what is about. Same thing happened here, in this situation.

The easiest way is go to locksmith and do a new remote. It costs a lot in Serbia, some people here can confirm. It is relative to average salary in Serbia,let's say like this: Avg salary = 360 Euro , new plip+key+labour = 120 Euro , so it is 1/3 of average monthly wages, for car which is old more than 10 yrs.
Now, it is not a matter of money only. I can afford it, if needed, not a big deal. But everyone would try to solve problem as cheap as possible, so common. I have last resort to go to locksmith and do that. For the very same money I can install aftermarket alarm which will do the same stuff or even more... Nevermind that, I will decide what to do...
Problem is in the following subject: I saw this thread with title "Reusing old Peugeot/Citroen remotes type 73373067B,C (http://www.digital-kaos.co.uk/forums/showthread.php/325914-Reusing-old-Peugeot-Citroen-remotes-type-73373067B-C)" so I started to read it. Basically, we speak here about NXP's (or Philips) PCF7936 chip, which is 125 kHz Hitag2 chip. Datasheets are available on web in NXP's public area.
So, since I'm not doing locksmithing or car programming etc but I have friends who does some of that stuff, I have access to diagnostic equipment etc, I wanted to see if it is possible to overcome problem other way, like for example old remote and new transponder or similar. It was just sort of "project challenge".

Other reason is a trust. Here in Serbia, many people claim themselves as "master" and they usually say they can solve any problem. Truth is very different. I asked few people and only one had answer. So, my apologies to simaservis1108 member, I think I can remember we spoke over the phone, he had straight answer btu the price was little over my expectations.
My assumptions was based on common practice here: if something is not working, change everything until you fix it. So I thought maybe it is not needed to change everything, maybe just transponder and code it via PP2000. It is the one who gives a seed for rolling code to remote, I thought. Well, that is what I thought. Now I see that remote has to be "blank" too, so BSI can learn it and they can sync their rolling codes sequence. Remote PCB has few components: one MCU, one crystal, few passive components, battery and buttons. That maeks me think that rolling seed is inside MCU's EEPROM (or some part of memory), so if you can't get into MCU (usually you can't, there is bootloader, maybe custom protocol etc) then you're stuck with it as a brick electronics.
Third and last, I was wondering about second-hand remotes on Ebay. Why someone sell it if it is not reusable? And what about Chinese clones? They are pretty cheap (20$ compared to 80$ for genuine) , but definitely they are not the same or even close to genuine part's design. They have coil which impersonates as transponder, which is in fact only physical transport layer of 125 kHz, while "chip" (PCF7936) state machine is in some small MCU. That makes me no confidence of using such solution.

I use this occasion to explain my reasons for posting her and following this thread. Also, once again, my apologies if someone had bad impression about my first post/answer.

FInally:


I doubt about that. You will always be few steps ahead if you improve your knowledge and skills. Of course, experience is something most valuable and none can get it from few DIY tutorials on YT or some forum. Finally, you are selling mostly your knowledge and experience to your customers. Only few percents of price is the fact that you have dedicated tools and machines. People come to you because you know how to solve a problem and you offer them some warranty. Common users does not come here or any other forum with similar topic.

Thanks everyone for patience, excuse me for long post.
Everyone input is appreciated about this matter.

Best regards.:)


You choose wrong first challenge. This info is known already only by few peopel besides developer and is worth much much less as your time and energy wich will be necessery to discover it as you use it at the end only few times. When price from sima was too big for you i can assure you that alone equipment to discover this secret will cost you few times more as "too big" sima price. It is just not worth.

[simaservis1108]

Chinese remotes don't work.
Chinese remotes emulate OEM remote inside PCF7941.
BSI just reads info what remote should be stored in BSI,and allowed to be synced when PCF7936 is programmed.
So PCF7936 just tells BSI store "THAT" remote and let it sync with you.

My price for remote was 9600 dinars or around 80 euros - to be honest here.

[djolemag]

Hi again,


Don't understand me wrong. Nothing personal to you. :). Just my understanding for life is that you should make all the best to improve your skills in profession you are involved, so to gain more money and be able to pay others people professionalism.
Once again I'm not trying to offend you just to put my point of view(of course you have the right to disagree)

I agree with you in this part about professionalism and I don't take you wrong, really. Thank you. However, paying for such service will only solve my annoying problem of manual door locking/unlocking. I shall still be curious about way how it works and what is the best way... Maybe even more curious than before... :) So it is not just about money.



You choose wrong first challenge. This info is known already only by few peopel besides developer and is worth much much less as your time and energy which will be necessary to discover it as you use it at the end only few times. When price from sima was too big for you i can assure you that alone equipment to discover this secret will cost you few times more as "too big" sima price. It is just not worth.

Agree once again. I am pretty sure that equipment cost much more than service. But it is always like that, I'm aware of that. Let me explain in short: If someone tells me "It won't work?", I will always ask "Why?". I just want to understand, that is my nature, that is how I do everyday job. I must know how some device/protocol/whatever works in order to debug/solve problem. Also, if I don't know that, I can not give advice to my customer (I speak about my job). Also, I'm payed to give truth and proper answers and good and ethical advisory. So, it's just my attitude and my nature, my being. Most of you recognize that. I'm sure that positive curiosity is major engine fuel for many inventions, improvements, hacks...:)

Sima answered my question and cleared my doubts in following post.



Chinese remotes don't work.
Chinese remotes emulate OEM remote inside PCF7941.
BSI just reads info what remote should be stored in BSI,and allowed to be synced when PCF7936 is programmed.
So PCF7936 just tells BSI store "THAT" remote and let it sync with you.

My price for remote was 9600 dinars or around 80 euros - to be honest here.

First, THANX to Sima for this answer, that is what I needed to know. I thought it works sort of this way, it is Chinese "modus operandi", they do many things like that. They have very big budgets for explorations and research. Last few years they are especially careful about intellectual property rights infringement, so I presume this is their "workaround" : impersonate PCF with coil and MCU. I'm sure they can do it in proper way but then they will probably break some IP rights. Hence, now I'm sure about Chinese remote - will not buy.
So two options left for me:
A) use it without genuine key, install aftermarket alarm (another challenge )
or
B) go to locksmith and pay genuine remote+service


This is important part for me:

@Simaservis
Now I'm pretty sure that guy who contacted you about virgin transponder wasn't me. I asked many people who advertise their locksmithing job on local web portal. Most of them answered negative, only one guy told me it will be around 110 Euros. I have contacted also one well known locksmith store over phone and he told me 120 Euros, as I mentioned above. I had no offers of 80 Euros and I'm 100% sure about that, because I would accept it.

Sima, now I can promise officially here that I will accept that price if you stay at that offer and I must say I see it as fair price. You must admit that ratio of 80/120 Euros is 1:1,50 ratio.
But I will still be very curious about how it works :)

Sima, if you agree, please send me contact details on PM so we can agree about details and time which is most convenient for you. I will explain once again my problem, just as reminder:
Vehicle : Peugeot 406 2.0 HDI 110 , 2001 yr D9, full mux (it has BSI and COM2000, so it should be).
I have two keys as numbered in Peugeot service box according to VIN number, I have "blue" code card with four letters (never had a need to try it with PP2000, I just got it from first owner ).
One key was plip remote, the other is spare key without remote function. I have working ID46 transponders in both keys.
I don't have PCB electronic from remote plip, guys at car washing service lost it due to bad key case who opened occasionally by itself (fortunately transponder was tightly fit into key case).
So I need to have once again fully working remote keyfob.

Looking forward to your answer.

I wish to thank once again to all participants in this thread. Cheers!

[simaservis1108]

Well if your e-mail is same as your username and you live in a town that is about 80kms from Belgrade,then it is you.
If not I am very sorry,it must be other person.
Two of the best locksmiths in the Serbia,are just that,locksmiths.
Locksmiths that have bought very expensive tools,and still can't many jobs,or they kill cars - BMW CAS3+ with AVDI(colleagues will know).
On the other hand,locksmiths here are very educated people,and can handle electronics very well.

I sell "virgin" remotes to other locksmiths in Serbia - nothing on DK though :D

I am not a locksmith myself,I just do keys because they are integral part of car electronic systems.
I don't do locks or cylinders,that kind of stuff either.

On DK every kind of selling is forbidden,so lets drop the subject.

[Johnner]

Guys,to keep this thread open,please drop all discussion about prices for products and services...

Also,please take all business dealings away from DK...nobody is interested in what takes place between you guys...


Thank you...

[djolemag]

I apologize, you're both right. Let's drop this subject about pricing and trading, this is technical forum. I feel sort of guilty for asking such inconvenient questions.

[snecii]

Confirm what exactly? BSI must be open and eeprom read to put it in virgin state. And if you're referring to the remote, I've done over 500 peugeot vehicles and yes used works as long as it's a virgin bsi

I'm interest about this....

These remotes are paired with ID46(7936) so If you make virgin BSI how can you add a lock 7936 chip to the BSI?
Becouse you can not learn lock key to car so you need to write chip into the bsi. Just the ID enought to write? or how?

[albdiag]

Very interesting.
Trying to play with arduino and rf module. http://arduinobasics.blogspot.al/2014/06/433-mhz-rf-module-with-arduino-tutorial.html
But the algo to convert the rf info to pages for pfc7936 is a problem. without it nothing can be done

[nikolanik]

Does someone have e-mail for mihotd?

[szkeptmen]

If somebody can give me mihotd's email, please pm me :)

[stevan]

you can add used key if know original pin code of key transponder.

Sent from my Tesla TTL7 using Tapatalk

[stevan]

Very interesting.
Trying to play with arduino and rf module. http://arduinobasics.blogspot.al/2014/06/433-mhz-rf-module-with-arduino-tutorial.html
But the algo to convert the rf info to pages for pfc7936 is a problem. without it nothing can be done

What exactly type MOtorola MCU is inside,any programmer can read/write?
If yes than with known data can be copied XXX times.

[stevan]

you can add used key if know original pin code of key transponder.

Sent from my Tesla TTL7 using Tapatalk

Of course only on Virgin BSI

[Zmann]

What exactly type MOtorola MCU is inside,any programmer can read/write?
If yes than with known data can be copied XXX times.

Motorola hw remote, a member of MC68HC08 with 3v supply and of course with the popular HC08 Security Sequence.

[cancunia]

My first post on here, looks like a lot of work has gone on, I've read through the thread a few times and wanted to summarize to see if I've understood. Please go easy on me if I get it wrong!

But firstly, I'm not interested in having mihotd's email address. :)


A couple of definitions:

Remote = a 2 button lock / unlock device such as 73373067c that fits inside the keyfob
Transponder = The small rf chip (PCF7936AS) that fits inside the keyfob



1, Remotes and Transponders are paired using some of the remote data being encoded into the Transponder
2, It's possible to pair a new transponder into an old remote by encoding the correct data into the Transponder
3, Without the pairing, it's not possible to register the keyfob with the car via Lexia key initialisation
4, The 4 digit Pin code that comes with the car is somehow encoded onto the Transponder as part of the Lexia registration process

[mikajna]

My first post on here, looks like a lot of work has gone on, I've read through the thread a few times and wanted to summarize to see if I've understood. Please go easy on me if I get it wrong!

But firstly, I'm not interested in having mihotd's email address. :)


A couple of definitions:

Remote = a 2 button lock / unlock device such as 73373067c that fits inside the keyfob
Transponder = The small rf chip (PCF7936AS) that fits inside the keyfob



1, Remotes and Transponders are paired using some of the remote data being encoded into the Transponder
2, It's possible to pair a new transponder into an old remote by encoding the correct data into the Transponder
3, Without the pairing, it's not possible to register the keyfob with the car via Lexia key initialisation
4, The 4 digit Pin code that comes with the car is somehow encoded onto the Transponder as part of the Lexia registration process

Everything you understood good, but 4th thing seems not very clear, maybe Im wrong...

4. The 4 digit Pin code that comes with the car, locking transponder while programming process, with proper pin code of that car you can roll back process and retrieve secret ISK code and unlock that transponder (there is one member here which calculate it very good), than you can read encoded remote bytes, from those bytes you can know for which car is that remote and you can register that remote to other car with those bytes, with that transponder...or you can get proper bytes from encoding RF data, on mihotd's method.

[cancunia]

I started looking at this thread to try & understand if / how it's possible to re-use old fobs on different cars, there are so many for sale on various sites that I thought it must either be possible or an enormous scam! I'm thinking that to use an old fob, you must virginize the Transponder so that it just has the original pairing data, probably the easiest way to do that would be by writing data to a new transponder rather than trying to unlock an old one.
But I also read that you can register a fob to a car using a different method than the official Citroen method:

1. Turn the Ignition switch to accessory position using a key, without the remote attached.
2. Hold the remote towards the receiver at the front of the vehicle.
3. Press the large button, then the small button on the remote.
4. Repeat for second remote key if required.
5. Turn ignition OFF.
6. After 5 seconds, remote should now operate.

The above seems to be saying that the car has an active Transponder via the ignition but the Remote is not in the lock. In this case, the Remote cannot possibly be transmitting an id that is matched in the Transponder, but the Transponder would have been originally registered to the car without a Remote. So, perhaps there is a difference in the data between Transponders that are registered with, or without a Remote?

[mikajna]

I started looking at this thread to try & understand if / how it's possible to re-use old fobs on different cars, there are so many for sale on various sites that I thought it must either be possible or an enormous scam! I'm thinking that to use an old fob, you must virginize the Transponder so that it just has the original pairing data, probably the easiest way to do that would be by writing data to a new transponder rather than trying to unlock an old one.
But I also read that you can register a fob to a car using a different method than the official Citroen method:

1. Turn the Ignition switch to accessory position using a key, without the remote attached.
2. Hold the remote towards the receiver at the front of the vehicle.
3. Press the large button, then the small button on the remote.
4. Repeat for second remote key if required.
5. Turn ignition OFF.
6. After 5 seconds, remote should now operate.

The above seems to be saying that the car has an active Transponder via the ignition but the Remote is not in the lock. In this case, the Remote cannot possibly be transmitting an id that is matched in the Transponder, but the Transponder would have been originally registered to the car without a Remote. So, perhaps there is a difference in the data between Transponders that are registered with, or without a Remote?
Did you try that method?

[cancunia]

Did you try that method?

No, I don't have any spare Remotes to try. Hopefully someone who needs to add a Remote key will see this thread & let us know if it works.

[cosmiko]

Can anyone send me PM mihotd?s email??? Thanks in advance

[RFRemotes]

"1. Turn the Ignition switch to accessory position using a key, without the remote attached."

It is interesting what info are containing user pages of these keys with only transponder but no remote.
Maybe it is all FFFF and car can add new remote using this transponder with above procedure? I doubt so but if someone have such key and knows its PIN then we can see what is inside user pages and give a light what's going on.

[paul_12345]

I started looking at this thread to try & understand if / how it's possible to re-use old fobs on different cars, there are so many for sale on various sites that I thought it must either be possible or an enormous scam! I'm thinking that to use an old fob, you must virginize the Transponder so that it just has the original pairing data, probably the easiest way to do that would be by writing data to a new transponder rather than trying to unlock an old one.
But I also read that you can register a fob to a car using a different method than the official Citroen method:

1. Turn the Ignition switch to accessory position using a key, without the remote attached.
2. Hold the remote towards the receiver at the front of the vehicle.
3. Press the large button, then the small button on the remote.
4. Repeat for second remote key if required.
5. Turn ignition OFF.
6. After 5 seconds, remote should now operate.

The above seems to be saying that the car has an active Transponder via the ignition but the Remote is not in the lock. In this case, the Remote cannot possibly be transmitting an id that is matched in the Transponder, but the Transponder would have been originally registered to the car without a Remote. So, perhaps there is a difference in the data between Transponders that are registered with, or without a Remote?

This is on about the older remotes with one big button one small button.

[mikajna]

This is on about the older remotes with one big button one small button.
Which older mate, like for 307? 6554RC and similar?

[paul_12345]

Which older mate, like for 307? 6554RC and similar?

no the older shape remotes with a big round button

[lmsvvavr]

Hi guys...
Looking for some guidance...

Car: 2001 307 2.0HDI
This 307 came to me with a faulty BSI, the guy brought an used BSI at the same time, same part numbers including same variant.
I have read the EPROM on the MCU HC912DG128, virginized the dump and loaded it back into the BSI.
Put it in the car and with PP2000 configured the whole thing, then programmed two new PCF7936.
Then I tried to sync the remote but does not work.
The BSI says there is 1 remote programmed...

Correct me if I am wrong...
As the BSI was Virginized all transponders, remotes etc... were erased.
If so, why is the BSI saying it does have a remote programmed?

Unless I did the procedure wrong... should I have had to program the remote setting into the PCF7936 prior to program it to the car?

I though because the BSI was virginized it would sync with the remote regardless...

Any help will be much appreciated...

[paul_12345]

Hi guys...
Looking for some guidance...

Car: 2001 307 2.0HDI
This 307 came to me with a faulty BSI, the guy brought an used BSI at the same time, same part numbers including same variant.
I have read the EPROM on the MCU HC912DG128, virginized the dump and loaded it back into the BSI.
Put it in the car and with PP2000 configured the whole thing, then programmed two new PCF7936.
Then I tried to sync the remote but does not work.
The BSI says there is 1 remote programmed...

Correct me if I am wrong...
As the BSI was Virginized all transponders, remotes etc... were erased.
If so, why is the BSI saying it does have a remote programmed?

Unless I did the procedure wrong... should I have had to program the remote setting into the PCF7936 prior to program it to the car?

I though because the BSI was virginized it would sync with the remote regardless...

Any help will be much appreciated...

you can not use blank pcf7936.

If you have entered the correct details - pincode etc use the existing pcf chips

[szengen]

Put it in the car and with PP2000 configured the whole thing, then programmed two new PCF7936.
pre code ?,remote control??

[szengen]

difficult subject couple, if it is not a couple,a new pair encodes for now

[mixtheo]

is there way to use chinese key fobs?

[jodge]

Does someone have e-mail for mihotd?
thx

[pepin1]

Put it in the car and with PP2000 configured the whole thing, then programmed two new PCF7936.
pre code ?,remote control??


Good evening, I want to build a key with command for my 406 peugeot, I will read to see if it is possible, and then I will ask my doubts

[misamix]

why I always got this?

[Nikola1309]

does somebody have some contact, on old email he does not respond. thanks

[kyawkyaw]

Part 2: Info, schematics and hex

All needed to build the reader is attached.
To get data open HyperTerminal, make a new connection and in screen "connect to" choose COMx (where USB to UART is).
In COMx properties window press "restore defaults" then OK.
If you made everytthing correctly you'll get a screen like attached one with remote data when you press a button.
This data is different each time (only first two bytes remain the same) and this is expected, data from remotes is scrambled and rolling code.
Calculator to produce transponder data exists (not free service though) and output is 4 bytes, which must be written in PCF7936.

Here is the point where I need your help guys: I need data from some old remote + old transponder (paired ones!) to figure out how these calculated 4 bytes are written into transponder.
Building all this stuff described above is a boring job, I agree. Also needs some effort and knowledge but if there are interested people I think we can resolve this whole problem which stays here for years.

BR

thanks for your post, can you help me where can i buy and how to do ? help me please.

[Zmann]

He is banned on this forum !

[jodge]

does somebody have some contact, on old email he does not respond. thanks

me too :( any new contact?
thx

[didi_du_93000]

Where can buy original at low price please?
Not the shit from China.

With Tapatalk

[ZIKO2000]

thankas for that

[shooting]

Does anyone know how to fix this?
Every time I press the button a line and a half of rubbish...
Is it to do with ANSI?

wbr

Picture:

[jodge]

try it with putty

[jodge]

if you connect a ttl converter directly to the remote data port the received data is just raw stuff
this psa reader stuff is the interpreter

[shooting]

try it with putty

Is the same, but thanks

wbr

Picture:

[shooting]

if you connect a ttl converter directly to the remote data port the received data is just raw stuff
this psa reader stuff is the interpreter

How do I fix it?

wbr

EDIT: I get it... I need to make an interface between the TTL and the pcb :)

[jodge]

not necessary if you familiar with the PIC assembly :) in this case take the PSAreaderv2.asm (i already sent you) use the instructions and buid your own program. But it's just the data logger part. If you want to figuring out the calculating method you have to crack the 68hc908 and disaasembly the algo

[shooting]

not necessary if you familiar with the PIC assembly :) in this case take the PSAreaderv2.asm (i already sent you) use the instructions and buid your own program. But it's just the data logger part. If you want to figuring out the calculating method you have to crack the 68hc908 and disaasembly the algo

Thank you my friend, tho the Algo is a rolling code Algo so it going to take time for me to crack

wbr

[jodge]

if you need samlples i have a few (20-50 pcs) used remote (different type)

[shooting]

if you need samlples i have a few (20-50 pcs) used remote (different type)

Thank you my friend, I have some but the more we have the better :D

wbvr

[jodge]

okk i have to make some time, but i will send you as soon as possible

[shooting]

Does anyone have a better picture of diagram in Post #3 or component list?

wbr

This pic:

[Brat]

Wath is not clear in this picture? This diagram is very simple.

[shooting]

Wath is not clear in this picture? This diagram is very simple.

Values of components, 100? etc Ohm? my eyes aren't so clear these days lol

wbr

[Brat]

100nf ,ohm not have any in this picture,i thing you must buy glass for eyes

[shooting]

100nf ,ohm not have any in this picture,i thing you must buy glass for eyes

Thanks my friend, wasn't sure what value that capacitor was :)
What is the value of the caps on the left, they look like "2.22p" or something.. ?

wbr

[Brat]

i make this w/o 100nf and 4,7uf, no need this twoo element, need only 2x22pf and quarz 4mhz for oscilator and work perfect

[jodge]

ceramic capacitors!
El-co not working in this case

[Buddy41]

Hi,
Toyota Aygo 2013
Original circuit board reads 73373067D & there is a separate 4D chip in the case.
Im looking for a used circuit board but can only find them ending with B or C & not D

Do you know if these can be used ?
Original circuit board shown.

Must the numbers on the black match ?
Many thanks
535620

[szkeptmen]

Thank you my friend, tho the Algo is a rolling code Algo so it going to take time for me to crack

wbr


If someone likes to count, here is an example: (Picasso, 7C)
After reset, push 3 times the button:

7CAA3E95C4EDC2DB6E1F
7CAAE62DAD6851535215
7CAACF56E6F733E81C05

User 0, 1, 2, 3: (calculated and works fine)

55 81 FE 79
AA 7E 01 86
07 CA FF FF
FF FF FF FF

[Zmann]

Another count, 406 phase2, work fine too ! :)

4DAA455399282F1E22EC
4DAA7A9B19E52D767ACC
4DAA220AA9BA9B54C39A

55 CD BC 48
AA 32 43 B7
04 DA FF FF
FF FF FF FF

[quarrx]

Zmann you solve THE mystery??

[szkeptmen]

Of course... yes...

[RFRemotes]

Of course... yes...

Of course NO is the right answer. Sure you don't have it.

[kelekele]

Hello.
Where i can to buy that device for psa remote data reading and calculation?
Does someone have e-mail for mihotd?

[zztopalma]

Hi friend, why you need 3 reads of the remote?
EXAMPLE: how to decode this?
HOW TAKE THE FIRST 4 BITES of this secuence?

7CAA3E95C4EDC2DB6E1F
7CAAE62DAD6851535215
7CAACF56E6F733E81C05

55 81 FE 79
(55) always (81 FE 79)????

and AA 7E 01 86 is the 55 81 FE 79 inverted, Right?

i have a usb remote reader. Thanks

[didi_du_93000]

Hello, any one selling Peugeot 206 remote WORKING!!!!


With Tapatalk

[RFRemotes]

Hello, any one selling Peugeot 206 remote WORKING!!!!


With Tapatalk

Give the exact model year, fog lights present or not? There are 5 types of remotes on these.

[didi_du_93000]

Give the exact model year, fog lights present or not? There are 5 types of remotes on these.


5 types of remotes???


It's Peugeot 206 year 2004.
Remote with 2 buttons (not the plip key). inside pcf7936 and pcb with remote mcu.
MUX car.

[newone]

5 types of remotes???


It's Peugeot 206 year 2004.
Remote with 2 buttons (not the plip key). inside pcf7936 and pcb with remote mcu.
MUX car.
http://www.digital-kaos.co.uk/forums/showthread.php/508574-peugeot-206-2004-add-remte-key?p=2691231&viewfull=1#post2691231

[Ginocar]

Hello,

Does anyboby know mihotd's email address?

Thank you

[jodge]

no reply since febr.

[koolstuff]

i have seen one of my friend that can renew some PSA remotes from china without desoldering the NXP and even without opening the key shell, he presses the lock and the unlock buttons of the remote (i dont know how many times and the exact timing) this was taught to him buy a chinese that works in a factory where they clone car remotes. If it's a PSA remote for Peugeot 308 407 508 ... it can renew it after it has been programmed to a car. I asked him how to do it but he kept refusing, and i have many second hand remotes. With OEM i can renew them using some tools but with chinese remotes i can not.

[RFRemotes]

Here we talk about older non-flip 2 button remotes with external transponder and this thread has nothing to do with these you mentioned.

[mahmoud10th]

Hello i am asking about reprograming old remote(s) of Citroen xsara || ?
also how to read E16-02A or which programmer can read it ?
Or how to modify the remote data or to virginz the remote to add it back to the Carhttps://uploads.tapatalk-cdn.com/20181031/4799449746c0d7bf3ba8baf15e7f4aba.jpghttps://uploads.tapatalk-cdn.com/20181031/8d1ad54661d9f6d3259486fd21b541bb.jpghttps://uploads.tapatalk-cdn.com/20181031/331d3abce62e0e668457df888350bc47.jpg

Sent from my Moto E (4) Plus using Tapatalk

[ottife]

Thumbs up mate but Instead of all the stress, just virgin d bsi and it will accept used remotes. I do that daily.

With your "virgin d bsi" can I let a xsara picasso BSI work with 206 remote key? Thanks.

[ottife]

Is there somebody still alive in this thread?

I have a confuse about the theory: Some people around me replaced their chipset of the remote board(motorola 70576228), and the key keep working. my confuse is , where the remote ID is stored? Or another probability is the remote ID is only unique for each remote model ?

[Ginocar]

Is there somebody still alive in this thread?

I have a confuse about the theory: Some people around me replaced their chipset of the remote board(motorola 70576228), and the key keep working. my confuse is , where the remote ID is stored? Or another probability is the remote ID is only unique for each remote model ?

The remote's ID is in the MCU of remote (motorola 70576228) and the eeprom of BSI also.

[ottife]

The remote's ID is in the MCU of remote (motorola 70576228) and the eeprom of BSI also.
Thanks for reply.
I mean I know people around me their remote become broken then they replaced the motorola chipset then can work continue.


If the remote ID is stored inside the motorola chip , why they can continue use the remote after replace the chip?

[Ginocar]

Thanks for reply.
I mean I know people around me their remote become broken then they replaced the motorola chipset then can work continue.


If the remote ID is stored inside the motorola chip , why they can continue use the remote after replace the chip?I think that they replaced the transponder chip only. Motorola mcu has a sw (flash dump). Are they have this dump? Can they read/write this mcu? The ID is different for all remote.

[ottife]

I think that they replaced the transponder chip only. Motorola mcu has a sw (flash dump). Are they have this dump? Can they read/write this mcu? The ID is different for all remote.

I sure they replaced the motorola chipset 75076228. Because I also purchased one 75078226 for backup but I didn't use it, for the key of my Picasso never broken, and I found my chipset is different , my one is 75078020 , at last I re-sold the chipset to other guy and he told me the fix is successful.

[Ginocar]

I sure they replaced the motorola chipset 75076228. Because I also purchased one 75078226 for backup but I didn't use it, for the key of my Picasso never broken, and I found my chipset is different , my one is 75078020 , at last I re-sold the chipset to other guy and he told me the fix is successful.How could they to learn the remote to car?

[ottife]

How could they to learn the remote to car?

Seems need to follow a sync process. Like something Push a button for ten more seconds.

[Ginocar]

Seems need to follow a sync process. Like something Push a button for ten more seconds.It is impossible. The PCF7936 include the remote ID. If the PCF7936 and Motorola MCU include different ID then can not to sync the remote to car.

[ottife]

O, disclose the mystery. I just checked with the guy, he told me if the car was manufactured after 2005 include 206/207/307/C2/Picasso／........ by PSA for China market, then replace chipset , or swap remote boards, just need a simple resync or re-pair by scan tool.

[Ginocar]

O, disclose the mystery. I just checked with the guy, he told me if the car was manufactured after 2005 include 206/207/307/C2/Picasso／........ by PSA for China market, then replace chipset , or swap remote boards, just need a simple resync or re-pair by scan tool.Wait. Do I understand you well?
1. He bought a new Motorola mcu.
2. He soldered the new mcu into the used remote what included an old (used/locked) PCF7936 transponder.
3. He resyncronized the remote to an other car with a universal scan tool.

[ottife]

Wait. Do I understand you well?
1. He bought a new Motorola mcu.
2. He soldered the new mcu into the used remote what included an old (used/locked) PCF7936 transponder.
3. He resyncronized the remote to an other car with a universal scan tool.

3. He resync the remote to his car , the kob there is remote board with new motorola chipset , and old transponder chipset which was paired with the car before.

[Ginocar]

3. He resync the remote to his car , the kob there is remote board with new motorola chipset , and old transponder chipset which was paired with the car before.So the used PCF7936 belongs to the car.
How can he to program the blank Motorola mcu?
This is not clear for me.
Does car write the dump into the mcu under remote resync process?

I made a Peugeot 307 remote with mihotd's help 1 month ago.
First I had to read the data from the Motorola mcu.
Then mihotd collegue calculated a dump for PCF7936. His dump included the remote ID.
So the remote ID there is in the mcu.
It is 100%.

[qeso705]

Ottife your friend lied you or you understood something wrong.

[ottife]

So the used PCF7936 belongs to the car.
How can he to program the blank Motorola mcu?
This is not clear for me.
Does car write the dump into the mcu under remote resync process?

I made a Peugeot 307 remote with mihotd's help 1 month ago.
First I had to read the data from the Motorola mcu.
Then mihotd collegue calculated a dump for PCF7936. His dump included the remote ID.
So the remote ID there is in the mcu.
It is 100%.

I don't know whether that one motorola chipset is a MCU inside or it is just a non-intelligence logic circuit to do rolling code algorithm without a MCU.

Did you try this way, just write the 3rd line into transponder then pair and sync the knob with car?i.e. the car only need to know the remote type then know how to decode it, the car don't need to verify something of remoteID.

[ottife]

Ottife your friend lied you or you understood something wrong.

Maybe , because we are just vehicle owner but not industry people, we heard info from different channel but no chance to verify it.

[RFRemotes]

Ottife your friend lied you or you understood something wrong.

____+1____

[bankat]

------45+----

[jset]

Hi to all
wich software you use to open psa reader , i have a usb to uart

thanks

[jodge]

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

[jset]

Hello
which tipe to Rf receiver you use
Thanks