Need Help 98 ML320 Security

[peter006]

this one is driving me crazy, any help appreciated..... no start because of security, code in aam is "fixed code ok, rolling code invalid". I tested the pcf chip inside key with zedbull and its ok. I made new keys (pcf chips_ from dump of aam mcu using benz key maker tool and still no start, same code. I changed the ring around ignition, same code still no start, i changed aam and wrote to it dump from old one + also tried to write cleaned dump, still no start same code... I dont know what else to do?:stupid: please help, attached is original dump and cleaned dump that should have rolling codes cleaned.

[Room]

Hi mate,

Read you keys and share. I'll calc roling code for AAM.

[peter006]

ok finally i read the original pcf and new ones i made from dump, my zedbull was broken and i could not read it until now... please see:

original (i will want to use this one to start, please use rolling for this one)
10F1ECD3E0641E47


new pcf using dump from mcu
10900417C2D47FFF

THANK YOU!!:beer:

[Room]

original (i will want to use this one to start, please use rolling for this one)
10F1ECD3E0641E47



Rolling : 95 99 E2 ED A1 00

[peter006]

remove oops

[peter006]

remove oops

[peter006]

i wrote these bits (95 99 E2 ED A1 00) to the mcu dump file and wrote back on the chip, but still same problem, maybe i did wrong? please check my dumps...

[Room]

You did wrong!
Read key once more and let me known ALL you have read.

[peter006]

oh... :(
with zedbull i read like this:
10F1ECD3E0641E47
0000000000008002

[Room]

You car have 6 used keys.
Asking you to read key I tried to find which key is you have.
But you show only roling string.
So I write all 6 keys. One of them will be right.
Try this dump and report.

[peter006]

ok i try it asap, but you are sure that string i read out is the rolling from the pcf7930? it is the only one zedbull shows me, how to see the fixed string from the pcf7930 then?

[Room]

Of course I'm sure. Fully key looks like

[peter006]

im still fighting with this one... still no start after upload new dump to aam, i upload now the picture of all the info from the pcf7930 from zedbull, maybe this help? possible that i can write some new bits to the key for start instead of amm? thank you very much....

[Room]

You key is No 4

This is 100% correct dump for you key.
If you can not start car problem NOT in dump.

[peter006]

still it cannot start, possible somehow pcf is bad even though zedbull read it? i made new pcf from dump and read it with zedbull (attach picture), can clean rolling in dump for this new chip please?:stoned:

[Room]

Your new key No1.
Here is dump for 2 keys (No1 & No4) with right rolling codes.
Need to make a diagnosis to find the cause.

[peter006]

!!!!! with key#1 works perfect... thank you so much... i hug u *hug* :party :


question... how this rolling string should look in dump for keys that are "not used" ever before ? (so in future maybe i can identify which is not used then create it...)

[Room]

question... how this rolling string should look in dump for keys that are "not used" ever before ? (so in future maybe i can identify which is not used then create it...)

Rolling string for the unused key looks similar to the used keys.
But Mercedes has a database of keys and when you order a new key, they just write the correct rolling into key, so the key is ordered from a dealer working at once.

[peter006]

i don't understand why the string in the aam sometimes changes itself then the key is locked-out. also, why i cannot generate the new working pcf chip using benz key maker when this occurs? it can see the current dump with the new rolling...

[peter006]

How come i cannot simply take the rolling code for the given key id# that is on the chip, and place it in the dump as it is in the correct position, without added calculation?

please, if possible calculate new rolling for:
10 5B 87 DD A8 04 9B DA

[peter006]

@ROOM
:party :
plz help generate new string :)

[Room]

please, if possible calculate new rolling for:
10 5B 87 DD A8 04 9B DA

5C FB 22 C8 C8 00

[znoki]

I have same problem. 1 car, 3 keys, ZERO start :mad:
I can read the original keys by clone AD900pro.
I want to use the old 3 keys, if it's possible.
I don't know which key is "in use" and which is "not used" in AAM?

data:
rolling: 10 E4 D2 AE 1B FE 87 36
const: 20 DE 40 E0

rolling: 10 CF 8B 39 D6 B2 DA 3C
const: 20 E4 CF 1E

rolling: 10 CA 1D 81 3C 93 02 92
const: 20 D1 96 80

HOW CAN I GENERATE ROLLING CODE FROM KEY DATA INTO THE AAM?
Can somebody do it for me?
p.s: I want to post 3 dancing party man! :party :(or minimum 2)

[Room]

Read AAM dump and post.

[znoki]

I forgot the attachment :banghead:

72456

[Room]

Try this dump

[znoki]

:party ::party ::party : Both 3 keys working! As I said, you are the BEST! Thanks Room!
BUT please tell me, how can you calculate the rolling code for AAM? What kind of program do you use?

[Room]

BUT please tell me, how can you calculate the rolling code for AAM? What kind of program do you use?

You can disassemble the program in AAM and find algoritm for rolling. You may also find how to read/write AAM via OBD.
I am use a simple program "Windows calculator".

[peter006]

Room, if ALL keys are used already..... can gambit create working pcf chip from dump with proper rolling calculation?

because when i try to do this with 'mb key programmer' tool it will simply copy the rolling from the dump without any extra calculation to the new pcf chips, and then it obviously.. still cant start car with new pcf made by mb key maker

[znoki]

Hi all,

I would like to know the algorithm between key rolling and AAM rolling! (Of course, not for free... )
Do somebody have any solution to code used remote control to the car?

Thx!

[3abas27]

Hi all,

I would like to know the algorithm between key rolling and AAM rolling! (Of course, not for free... )
Do somebody have any solution to code used remote control to the car?

Thx!

PLZ AAM CHANGED FROM ML YEAR 2001 270CDI

PROCEDURE FOR ADAPTING REMOTE CONTROLE ?

LOOKIG FOR SOONEST REPLY

[znoki]

You can disassemble the program in AAM and find algoritm for rolling. You may also find how to read/write AAM via OBD.
I am use a simple program "Windows calculator".

I've got an ML to repair again, which forgot the key because of shit battery.

I don't really like to think on an already solved problem, because it is more efficient to give something in return for a good solution.

If somebody tell me the algorithm between key rolling and AAM rolling, or can help me to find the algorithm, I can give a program, which can read / write the AAM eeprom by OBD, or something else.

106803

Key data:
rolling: 10 19 96 A4 E1 9E 71 3A
const: 20 8C 2F 53

Questions:
-Which disassembler should I use? Is this one good?
-Is this disassembled ROM good? I guess no!
-Where can I found the algorithm?

[znoki]

I guess Room is the only one person in this forum, who know the answers, but he doesn't really like me at the moment... :(
But I don't know why?! "Did I hurt you?"

[powered by]

hello vw model is and what kind of motor is? I can help?

regards

[powered by]

sorry falsch!!!!!!!

[znoki]

If somebody has any idea, what is the connection between the following hexa numbers, that will be also helpful!

5CFB22C8C8 <=> 5B87DDA8049BDA

71C4D51EFF <=> E4D2AE1BFE7836

2AF626B7D3 <=> CF8B39D6B2DA3C

2AA71E6A09 <=> CA1D813C930292

Thanks in advance!

[peter006]

What will be new rolling code calculation for aam based on string from key`s pcf chip: 6D 63 49 B3 A9 2F

[peter006]

^^bmp^^bmp

[peter006]

Room, is it possible for you to make this calc?

[znoki]

I don't believe, that Room is the only one in the world, who can calculate this rolling code!
Hare is the AAM dump, key data and a little description for AAM.
163999
163998
163997

[znoki]

Fault codes:
-ECM: P1570
-AAM: B1703
I don't want to replace the original PCF7935! I want to fix it!

[Mizter]

Try to insert the value of FF in place Rolling in AAM and the key

[znoki]

Try to insert the value of FF in place Rolling in AAM and the key

Of course I already tried to write FF into AAM rolling, but it didn't help, the car still didn't start.
Unfortunately I think I can't write the key by AD900, only the ID area.

[QBAelectric]

MB W163 320 - not start

Fault codes:
-ECM: P1570
-AAM: B1703

Very please repair dump.

Key reading Gambit.

209779209780

[michpm]

Hi. Could anybody helps me with repairing rolling code in dump of AAM W163 for Key3 (if counting from key0,1,2...7)
Dumps of the key3 and AAM attached. Thanks.
239390

[czester1]

Please help :burnout:

ML 163 320, AAM B1307

[czester1]

PLZ HELP.........................

[hass42]

I have a ML320 2003 with "start error" on dash. I get B1703 code, I tried new key to program,and tried new DAS and EAM module.
vehicle can not see either new or old key in ignition.

Does anyone know if pick-up coil at column can be issue?

Thanks for any help

[dragoshu]

Hello,
After I made new transponder for AAM W163 window and locking and AC fan not working,any posibility to repair this dump MCU 0G47V.
I have read with orange and make key ,car start but I have above mentioned issue.
I attach orig dump.
Thanks