laguna 3 button card

**baken** · 25th April, 2016, 08:06 AM

Originally Posted by Senex

Hello. I want to return to this question. Is it possible to prepare to work remote on second hand three button Laguna card with PCF7936? Or only to precode new PCF7936 to start engine (remote and hands free not works), nothing more?
Thanks in advance.

Not possible to re-use remote because transponder 7936 engaged to remote same as k-line psa remotes , also never tested programing blank 7936 for laguna but possible to program 46 renault precoded chip via obd

**GT-INFO** · 24th January, 2018, 11:36 AM

Hi can You help me with virgin file for renault espace for reuse used card? pm sended too
thank You

**GT-INFO** · 26th February, 2018, 05:18 PM

Hi ninja can You send me file virgin for espace 3 button card?

thank You

Originally Posted by ninja123

Im after a file read from a virgin unprogrammed laguna 3 button card.

They are very different than a 2 button one, this one has normal carbon pcf7936 chip inside.

I have laguna, megane, clio & traffic virgin files if anyone needs, just need this one to re use a card

ninja

**yahia1908** · 20th May, 2018, 01:14 AM

PCF7946AT PRICODAGE

**kostelectronics** · 25th November, 2018, 06:34 PM

Originally Posted by shadow12

is this what you need, read from new virgin card from 3dgroup

I hope, you can remember this thread

Was this file pulled from the 25AA040 EEPROM inside the Card?

i'm trying to re-use a 3-button Card from a Espace IV Phase2. PCF7936 is already new.

BR Matthias

**RFRemotes** · 29th November, 2018, 11:04 AM

Originally Posted by kostelectronics

I hope, you can remember this thread

Was this file pulled from the 25AA040 EEPROM inside the Card?

i'm trying to re-use a 3-button Card from a Espace IV Phase2. PCF7936 is already new.

BR Matthias

An old thread but still existing problem.
I think the best way to reuse is to know ISK of the car that card comes from and then unlock the original transponder.
Problem is that ISK is not known in most cases with second hand used cards.

The point we can begin investigate is to read your used card eeprom 25AA040. Can you do this? And are you sure it is eeprom at all? I can see connections of this chip on my card to see also.

**kostelectronics** · 29th November, 2018, 08:45 PM

Hello and thank you for this useful reply!

Ok, let's go trough my Situation:

1. I have a used Remote electronics without Transponder from the scrapyard.
2. I have 10x new Transponders PCF7936 to Play with it.
3. I have a friend with a semi-dead key that is able to start the car. This key is the only one he haves for this car.

Now:
- I have read the EEPROM from the remote-electronics from the scrapyard -->See attatchment. Problem is: i have no additional informations about this car. Also no Transponder from this key.
- I programmed this eeprom with a file that i've found here and should be a virgin file -->See attatchment.
- I try now to pre-program a Transponder (PCF7936) and try to learn the key from the srapyard to the car and see what happens. Problem is: i don't know how to pre-program the Transponder.

Before i can try to learn this key to the car, i must have the Login to the UCH. All my Tools failed to get the Login. I have ordered a FNR 4+1 Cable (clone) and hope this gives me the Login.
My first idea was to remove the UCH from my friend's car and read the EEPROM, but the UCH is under the Dashboard and i Need to remove the Dashboard to remove the UCH. If all Fails, i have no other Chance.

What is the best to do now?

- Remove the UCH and read the EEPROM, then disassemble the key-card and read the 25AA040 EEPROM?
- Try to read the UCH with the FNR Cable, then disassemble the key-card and read the 25AA040 EEPROM?

I will solve this Problem! Maybe we can do it together!

BR Matthias

**RFRemotes** · 30th November, 2018, 12:29 PM

I am not so familiar with these cars but here is what I think about this situation:

- For now no need to remove UCH. This will not be of much help. I'm almost sure that there will be no obvious connection between card's EEPROM and UCH EE data.
- The easiest thing to do is to read your friend's card eeprom and put this data in EE from scrapyard. Then put the working transponder in that card and try what happens.

If all works this will prove that only 3 components are involved - PCF, card eeprom, UCH eeprom.
Keep in mind that developers of this security are good in their job and use many encryptions to avoid sniffing clear data and find out how the system works.
Even in an old megane 1 there are algos hard to reverse plus that they change the keys/algos from model to another.

Sorry to say but I think this mystery will not be revealed until UCH H8S/2626 MCU flash code is disassembled which I'm not able to do for now.
Also I think they put remote ID in NEC mcu inside card but not in eeprom so the test I am suggesting will prove this concept.

**gogu** · 25th February, 2019, 09:59 PM

hello,
can you tell me what tool you used to read 25AA040 EEPROM ?
thank you

**arosta** · 28th April, 2019, 08:48 PM

OK i want to bump this thread.
Today i had customer with broken hands free card for laguna2 (3 buttones with sun/lights)
So i had to open case for repair and there was no pcf7936 inside! (someone was before me coz there was signs of soldering by someone else as well)
ofcourse i did job (repair successful) changed case and... car starts and hands free working fine too.
So i dont think transponder is engaged. I think transponder inside card is some like in new ford keys (only spare for turning ignition on if card is broken).
Someone digging this thread like me?
Someone tried that file 25aa040_orig.bin from that topic?

**ciprishor** · 29th April, 2019, 10:22 AM

I believe hands free model is different from non hands free one. No pcf7936 in first and immo data is sent via antennas inside card!?

**kostelectronics** · 10th July, 2019, 11:48 AM

Ok, i have some News about this.
All datas for the keyless and remote functions are stored inside the 25AA040. that means, all other IC's are not induvidual programmed inside this Keycard. Yeaaahhh

I played a bit around with a working key from my own car. I swapped only the 25AA040 over to a used keycard from the scrapyard and it worked 100% (handsfree and remote).

Now the next question: Must the Datas from the keyless&drive (25AA040) match to the datas from the Transponder? Actually i have only 1 Transponder for both Cards. I want to program a new Transponder and insert it to the cloned keyless-Card and see if the car accept it to learn to the car.
Can somebody help me to pre-code a new Transponder? If this will work, then we can generate a new key with the datas from 1 working key!

BR Matthias

**gogu** · 10th July, 2019, 01:53 PM

hello.to pre-code a new transponder you can use Abrites.i have made one.i have started the car but the remote & keyless don't work.
how did you read 25AA040?

**p1et** · 10th July, 2019, 04:57 PM

That's nothing new here. By swapping IC 25AA040 you can only repair broken card, same procedure like PCF soldering to different remote PCB like Peugeot and others so this is kinda obvious. To make a step forward we must know way to read this 25AA040 chip / make it virgin.

**kostelectronics** · 10th July, 2019, 05:58 PM

I have read the 25AA040 with Orange5. Here's the dump.
I have also a virgin dump, but not tryed yet because i have nothing to prepare a new transponder. I don't have Abrites, only a Zedbull for now.
Can somebody help me to prepare a transponder? then i will try with the dumps.

In the original dump, i can see the key twice and the VIN. It's worth to play with and try (if somebody help me to precode a blank transponder).

BR Matthias