PCF7941B FOBIK Key unlocked by Orange5

[mezmerized02]

The Orange5 from www.scorpio-lk.com now unlocking PCF7941B on Fobik Keys. Debut at ALOA 2013 as far as I know

New Adapter has 4 Spots for Transponders but can only unlock one at a time.(You know you will destroy a pad eventually)

Total unlock time is about 30 seconds once soldered to the adapter.

The Button Configuration is 100% correct and functions perfectly. (Tested on 2011 Caravan with two PSD and RS)

pcf7941_small.jpgUnlockableFobiks2.JPG7941onAdapter.JPG

The small panic button style RHK should be ready soon according to my source transponder is unlocked but button configuration is still wonky.
Most of us already know that the TANGO will unlock the Large Panic button style RHK already via the built in unlocker function

Scorpio is going to have to make a completely different adapter to unlock the Smooth Back(no battery door) newer model fobik as it uses a different style transponder altogether.

Just thought this was good news for locksmiths out there that have the willingness to do a bit of hot air work.

I may be able to get adapters and software for a good price but you would have to be able to provide the O5 Serial for their forum download


~ME

[lidons]

That seems good news. for me,

I have no orange5, I could upgrade I have omega is for this version?

the PCB, SMD component does not have any, just until you can do in-circuit.

[mezmerized02]

I am almost certain that the PCF software is only useable in the Orange5 software interface.

I will try to verify for you. If you already have an Omega and its adapters they are cross compatible with the Orange5. And you may be able to get a better deal on just the O5 and soft without the 35 adapters that come with it.

[pandora6]

MasterKey3
- Programing ROM-memory ***1084;***1089; PCF7941, PCF7945 ( Writing firmware PCF7941/PCF7945 ).

MKIII Chrysler M3N5WY783X key upload firmware - YouTube

[mezmerized02]

MasterKey3
- Programing ROM-memory ***1084;***1089; PCF7941, PCF7945 ( Writing firmware PCF7941/PCF7945 ).

MKIII Chrysler M3N5WY783X key upload firmware - YouTube

Where can this device be purchased?

[pandora6]

PAM website

[aassfour]

this MKIII can unlock PCF7941 , 7945 ?

[hauwkee]

i try to find info on mkIII come out with some stuff from 2006 i russian website
this device supposed to be able to clone key as well and work from dump to generate keys

[mezmerized02]

I did much searching myself to see if I could purchase the device in question. I see no way to purchase.

[reks13]

This device can unlock only one key which you see on youtube. It dont unlock bmw or any other 7941 not fobik.

[912secured]

Its a start. Brute force is 4.5 gig. Sentry used alot of passwords that they changed to where the same. Might be using clock or voltage glitch. You can get the 7941 in bulk 1.80 for 100. Just need to get all the key numbers(FCC) and the transponders key data,ducks inline.

[mezmerized02]

Using the orange5 you actually open a .bin file provided by Scorpio to write to the 7941

They encrypted the dump FYI and I can't blame them.

They did however make the first 4 bytes changeable. But if they are edited at all it swaps the order of the buttons on the remote around for example;

Lock becomes Panic
Remote start button becomes unlock.

Very comical to me but not to the customer.



Sent from my iPhone using Tapatalk 2

[912secured]

Yea if you use the wrong key even if numbers match up but last is a instead of a x, remote data is different and they are wrong or do not work. I had a list of all on one of the laptop's stolen including the key data. Used a ad90 and used 6 button shells so I could make them what ever I wanted was going to write a program to generate them ad90's com was easy to figure out I got a basic stamp kit as a gift used it to run through and turn passworded transponders back to the original. Can get them again have 2 of each in stock right now gotta go through a dump of a skim and it will jump out at me. Had the fobics remote data also. The new 7941's are not bad they can only use crypto not password mode. There was a guy on tango's forum that said he could reset info on any of the chips 71-75 there must be a backdoor or other way of writting to it he found. Need to data log and see what hes doing. The asians will have it popped soon. Its done in 30 seconds removing the coil you can hook up direct to the ir port and run the brute force quicker 4.5 gigs takes awhile not 30 seconds average 7 days. I said already sentry used alot of the same in the skims so they only made 100 or so different firmwares per remote type.

[912secured]

It has 5 pins connected One is power ground. The guy homer says user program memory and can write any data. Must have a way to read and edit the eeprom. Who ever has the hard ware needs to figure whats the clock/data lines and log them. I guess he can read the eeprom now and have full editing means we can repair any of them. From what I understand he can even change the locked areas/serial number??? So all the used keys that where useless are now going to be able to be good

The mk3 is reading the crypto code from skim or cas and is unlocking that way. nothing new noting special there(superkeytool is already doing it and creating keys just need hitag info and your good to go). Pin 15 is (xclk)(Clock input to serve as external data rate reference)10 is I/O 11 is I/O 4,10,11,15,and 19 are used in that device to read believed eeprom) Need to log 10/11 with the clock. Get default written back quickly then edit via hitag(if there is a area for locked unlocked status unlock everything. If it has to be unsoldered you can use a test clip to program so you only have to solder on and off.

I/O
P13 (B3) P12 (B2) P11 (B1) P10 (B0) pin 14 led

19 is ground 15 is clock 11 is I/O 10 is I/O 4 is power

[mezmerized02]

912 are you saying that you need the skim/wcm off of the vehicle to use the MKIII?




Sent from my iPhone using Tapatalk 2