laguna 3 button card

[ninja123]

Im after a file read from a virgin unprogrammed laguna 3 button card.

They are very different than a 2 button one, this one has normal carbon pcf7936 chip inside.

I have laguna, megane, clio & traffic virgin files if anyone needs, just need this one to re use a card:)

ninja

[Meat-Head]

suggest you hound member pierre theon - if he dosn't have a dump spare - forget it

[ninja123]

CONSIDER HIM HOUNDED!

NINJA

B011OCKS, CAPS LOCK....

[djamelEZS]

THIS IS LAGUNA II OR VELSATIS WITH 3BUTONS NOT LAGUNAIII

[ninja123]

????????????????

Did you see the picture???

[paul_12345]

????????????????

Did you see the picture???

think he misread it as laguna 3 - button card rather than laguna - 3 button card

[gtmech]

Im after a file read from a virgin unprogrammed laguna 3 button card.

They are very different than a 2 button one, this one has normal carbon pcf7936 chip inside.

I have laguna, megane, clio & traffic virgin files if anyone needs, just need this one to re use a card:)

ninja

what are the virgin files you speak of used for mate? cheers

[richard27]

laguna and megane pcf 7947 There are processor 7947 with the program, can I modify and re-zebull

[shadow12]

Im after a file read from a virgin unprogrammed laguna 3 button card.

They are very different than a 2 button one, this one has normal carbon pcf7936 chip inside.

I have laguna, megane, clio & traffic virgin files if anyone needs, just need this one to re use a card:)

ninja is this what you need, read from new virgin card from 3dgroup

[ninja123]

Thanks mate, what did you read this with?

ninja

[albertros]

Hi,
the above dump is for a 3 button as per thumb nail?.
No. 7701 209 123
see my dump
4 pairs of dig = 1 page
only last 2 pages count
http://dl.dropbox.com/u/4682342/pcf7947%20laguna%203%20button%20raw%20prepared.bin

[ninja123]

Hi albertros, Youv lost me a bit here, do you mean the first dump is not from a virgin 3 button card and yours is?

And my problem is, because it has a separate carbon chip, how does the remote part work, surely you must need to add some data to the chip to associate with the remote??

ninja

[gtmech]

what are the virgin files you speak of used for mate? cheers

Any help Ninja?

[albertros]

Hi,
just checked, my card says " Lock + Auto " on the third button and is only for keyless entry.
Tried to borrow a picture off fleabay but it won't let me paste.

[paul_12345]

Hi albertros, Youv lost me a bit here, do you mean the first dump is not from a virgin 3 button card and yours is?

And my problem is, because it has a separate carbon chip, how does the remote part work, surely you must need to add some data to the chip to associate with the remote??

ninja

open the first file in hex editor.. "unknown data"

[ninja123]

The card I refer to is the 3 button one pictued in post #1.

Albertos posted file from a different card, as my 3 button is not hands free, and houses a carbon chip-pcf7936, not an onboard pcf7947.

shadow12 posted what I think I need, as long as it was from a card the same as pictured.

But, what I want to know is, how does the remote work from programming the transponder, I understand the other card with the chip (pcf7947) on board, but how can the remote work from programming a separate chip? There must be some data in the transponder that relates to the remote, RIGHT? (or wrong!?!?!):joyman:

ninja

[ninja123]

Any help Ninja?

Sorry m8, wasn't being ignorant!!

These 'virgin' files are used to pre program virgin transponders so I can re use used keys'cards.

hope this helps, ninja

[ninja123]

open the first file in hex editor.. "unknown data"

Not in hex editor mate, hi tag transponder programmer or similar....

ninja

[paul_12345]

Not in hex editor mate, hi tag transponder programmer or similar....

ninja

I meant the file does not look correct to me.. open it up and it has repeated "unknown data"

so doesn't look much like a file to precode the tranponder, unless thats what its meant to have in it.


Also what chips are on the remote pcb??

[ninja123]

Heres all the info from my used card:-

This is whats on the chips:
1, 78F9116A 0540LM03

2, EM4074 0005
5824700G47
DESIGN REVE

3, 5100 B2

4, 5A4X
1553
08V

this is the transponder read with zedbull:


And a pic from inside the card, the pcf fits in the space just above the battery:

[paul_12345]

I had a quick search and seems theres 2 different 3 button remotes, both stated as hands free.

I would think this is hands free card with the carbon chip in to act as a backup along with the key if the hand free fails.

[ninja123]

Its not hands free mate!!

ninja

[gtmech]

Sorry m8, wasn't being ignorant!!

These 'virgin' files are used to pre program virgin transponders so I can re use used keys'cards.

hope this helps, ninja

hmm, thats interesting, thanks for the 411 buddy

[shadow12]

[QUOTE=ninja123;1374554]Thanks mate, what did you read this with?

sorry for the late response, i read this with abrites hitag 2 programmer, sorry i made mistake with this key, you have 05-08 non hands free, reading i gave you was from 3 button handsfree card,i do not have info from one of these but i do have an identical looking key from espace virgin, i have been told these will program to laguna and vise versa but never tried, could read this for you if might help

[PierreTheron]

[QUOTE=ninja123;1374554]Thanks mate, what did you read this with?

sorry for the late response, i read this with abrites hitag 2 programmer, sorry i made mistake with this key, you have 05-08 non hands free, reading i gave you was from 3 button handsfree card,i do not have info from one of these but i do have an identical looking key from espace virgin, i have been told these will program to laguna and vise versa but never tried, could read this for you if might help

Yep .the espace one virgin is the file we are after..

Read it with hitag2 and post
us a screenshot of the page please .


Hijacking this thread .

Ninja 123 mate can you post me a better quality photo of your card pcb please.

Have got card here with missing parts that i want to repair.

But with your shitty photo i can identify nothing .



Pierre

:manuflag:

[PierreTheron]

Ok mates

For those who do not know how to re use a renault megane card .

Remove pcf 7947at and replace with new uncoded one .

Then use the next info to precode so that the remote will also work.

Note :This will be posted only for the ........... and then deleted again..

O k stopped hijacking thread.

Gone it is..

[PierreTheron]

what are the virgin files you speak of used for mate? cheers

Actually these are precode files that you save when you read a new precoded card or key for renault before it gets coded into a vehicle.This info you cannot see anymore once card is locked to vehicle.

Files for uncoded card you can save with Zed clone (Save to TM) .

This file you can then use to Code a new pcf7946at,7947at,etch . Remote will also work (Write to TM)

:congrats::hmmmm2::sleep:

[ninja123]

[QUOTE=ninja123;1374554]Thanks mate, what did you read this with?

sorry for the late response, i read this with abrites hitag 2 programmer, sorry i made mistake with this key, you have 05-08 non hands free, reading i gave you was from 3 button handsfree card,i do not have info from one of these but i do have an identical looking key from espace virgin, i have been told these will program to laguna and vise versa but never tried, could read this for you if might help

Yes please mate, can you read and post please, or ill except a pm if posting is not your cup of tea!!!

ps, you can read with zedbull too.

ninja

[ninja123]

Hijacking this thread .

Ninja 123 mate can you post me a better quality photo of your card pcb please.

Have got card here with missing parts that i want to repair.

But with your shitty photo i can identify nothing .

Thanks for that mate, photo is from my sh!t phone, ill try to get a good one to you...........

[ninja123]

For those who do not know how to re use a renault megane card .
Note :This will be posted only for the ........... and then deleted again...[/QUOTE]


nice tutorial mate, glad you only posted the megane file:manuflag:

[gtmech]

[quote=shadow12;1377780]


Ninja 123 mate can you post me a better quality photo of your card pcb please.


Pierre

:manuflag:

not sure if this pic will help you mate. I have bigger pics at work i can pm you tomorrow if you need them

[PierreTheron]

[quote=PierreTheron;1378109]

not sure if this pic will help you mate. I have bigger pics at work i can pm you tomorrow if you need them


Hi mate . Not correct Photo.

I am posting photo's off the one i need .

Ninja 123.. Is your card working on the buttons when you take frequency reading??


regards.

Am still looking for precode(TM file) or print screen file on this one.

[ninja123]

Hi pierre, not checked this card on rf tester yet, but i will and post results.

Here is the 'other' file you asked for, its a bit awkward to write with zedbull, but its possible.

When you load it, you will need to copy the last 4 pages from the top to the empty ones at the bottom, then write each page individually, job done.

any probs, let me know.

File now removed to protect the innocent................

[shadow12]

I have tried reading this card with hitag2 and will not read eeprom or transponder, i can read older laguna and new type laguna but not this phase2 espace card, dont have phase 2 laguna card at the moment, is there any thing i am doing wrong ? sorry dont have zedbull

[ninja123]

Im not sure what card you are trying to read, BUT:-

If its the same type as mine pictured in post #1, then I couldnt read it either (with zedbull or hi tag).

After I cut it open I took out the pcf and put it in zedbull and it read ok, file posted earlier.

I think this card is a hands free as there are transmitters inside, same as megane hands free type.

ninja

[PierreTheron]

Hi Ninja 123.

Numbers on carbon chip??

Is it pcf 7936as ??

thnx

Pierre

[ghauman]

Hi All,

Little bit off topic maybe but because your all in to keycards...

does anyone now how to program the laguna III 4 buton cards to the car?

Zedbull original doesnt support it yet.

Thanks
Geert

[ninja123]

Hi Ninja 123.

Numbers on carbon chip??

Is it pcf 7936as ??

thnx

Pierre

Yes mate.

ninja

[Meat-Head]

Hijacking this thread .

Have got card here with missing parts that i want to repair.

But with your shitty photo i can identify nothing .



Try doing a search for started thread by member Z786 - do beleive he started a thread about one - chances are it's one he dropped down a toilet or something - being Z he properbly ended up drilling a big hole in it and fitted a flick switch.

Had good photos

Oh isn't there something in the DK rules about NOT hijacking others threads for your own gain? lol lol lol




After I cut it open I took out the pcf and put it in zedbull and it read ok, file posted earlier.


*CONFUSED*

1) Chip type thing with legs?

2) Standard household transponder carbon type thing?

Thanks

Meat

[Meat-Head]

Damm silly me - totally forgot about the edit botton

http://www.digital-kaos.co.uk/forums/f152/renault-megane-keycard-sync-157799/#post751297

[ninja123]

carbon chip meaty.

ninja

[PierreTheron]

suggest you hound member pierre theon - if he dosn't have a dump spare - forget it

Had to get a new one ordered .
Here it is..

Only 150 views and a lot off thanks.

So feel i must remove this file ..

[ninja123]

Hi guys, glad to see this thread aint dead yet.

On the same note, I need to re use a vectra c remote with on board pcf7946 chip, I had a file from gokey but didnt work.

Replaced chip, but need a virgin file read from an new un programmed remote, using zedbull etc.

Maybe we can keep this thread going with more id46 stuff.

Peugeot/citroen coming up...........

Thanks for that file pierre, ill put it on a new chip and see if i can prog the card.

ninja

[workdamnyou]

.................................................. ...........

[workdamnyou]

...............................................

[workdamnyou]

.................................................. ...............

[ninja123]

Could we also list what type of key these reads are from as there are different types, ie 1-2-3 button, can/non can, filp/square/round/rectangle etc.

I can see sales of used keys on fleabay going through the roof:rolleyes:

[coolsoda]

Here is the Hitag2 pages from a New 3 Button remote for the discovery 3 and range rover sport,sorry dont know how to add a bin file so picture works

[coolsoda]

If anyone is brave enough to try the hands free card here are the pages From a new Dealer Card

[PierreTheron]

,sorry dont know how to add a bin file so picture works

Just rar the bin and upload when going advanced.

And Here

Megane2.virgin.pcf7946 as some are still looking for it.

Does someone have virgin Megane2 card with pcf7936at.
(The Hands free one)


Thanks

[coolsoda]

The post just before yours is the Hands free megane card,but this does not use a PCF7936 i think it is PCF7943

[ninja123]

can anyone upload a saab 9-3 box key (new) with pcf7946?

cheers, ninja

[albertros]

Hi,
I have been told by a key supplier that if you replace the pcf7947 with pcf7946 in the megan card they can be re-used. Don't believe it myself as both chips can be locked. I understood it to mean re-program after allocated.

But in the pcf 7947 the customers name address and certain engine details are stored.
When I read the chips I can not find this info only pages P0 to P7
Any ideas how to read this additional info.
I have access to the dealer card reader that only displays this info and not the pages.

This may be usuful to know :-
http://cnautoqi.com/proshow.asp?i=1573

[coolsoda]

$27 each
Wholesale Renault Laguna 433MHZ 2 Button Smart Key free shipping (http://www.aliexpress.com/product-fm/550434837-Renault-Laguna-433MHZ-2-Button-Smart-Key-free-shipping-wholesalers.html)

[albertros]

Hi,
what $135 each is not $27

rub my eyes each lot of 5! must be a mistake?

Ordered some blue megane ones will let you know ( ?14.01 each )! They don't take paypal

[coolsoda]

No they are $27 each minimum order of 5 so $135

[albertros]

Buy Renault Megane Smart key (blue color) 433MHZ free shipping , diagnostic tools, auto repair tools, Renault Megane Smart key (blue color) 433MHZ free shipping at Aliexpress.com (http://www.aliexpress.com/fm-store/505342/211274852-552757417/Renault-Megane-Smart-key-blue-color-433MHZ-free-shipping.html)

The prices vary on the same item, took a risk on my visa card.

[coolsoda]

I rekon they will just cancel your order,it does look like a mistake

[albertros]

I rekon they will just cancel your order,it does look like a mistake


So do I but had an automatic email saying order accepted.

If they do arrive the first thing I'll do isorder some more.

[coolsoda]

I used to purchase of these guys
Buy Renault MEGANE REMOTE key card with 433MHZ, remote key shell, remote key, Free shipping Renault MEGANE REMOTE key card with 433MHZ(blue) at Aliexpress.com (http://www.aliexpress.com/store/701535/211159730-515157237/Free-shipping-Renault-MEGANE-REMOTE-key-card-with-433MHZ-blue-.html)

When they used to take paypal,but now i use DHgate,not so much choice and more expensive

[albertros]

Yep it was a mistake.
Now I'll have to get a refund!

Dear Sir***65292;
Thanks for your order.I am very pleased that this is first order from you,as I am newer.
But I am very sorry, I made a mistake.I regard the minimum order as in lot .
This price USD113 is for 1pc,not for 5pcs a lot.
The correct link as following:
Buy Renault Megane Smart key (blue color) 433MHZ free shipping, diagnostic tools, auto repair tools, Renault Megane Smart key (blue color) 433MHZ free shipping at Aliexpress.com (http://www.aliexpress.com/fm-store/505342/211274852-549566302/Renault-Megane-Smart-key-blue-color-433MHZ-free-shipping.html)
I get much blames from my manager as for my mistake. Also I am sorry to bring you so much troubles. Hope to get your understanding.
And there is procedure that your payment will audit within 24hours by aliexpress, we will send package at once after get confirmation from aliexpress.This is Aliexpress***8217;s rule.your order number:1008366079
To express my sincerely apology, I will give you small gift by myself. Hope you will accept it.
Sorry again.

Sincerely yours,
Moon

[ninja123]

bloody typical!
I just got stung by yet another ting tong ic supplier, ordred 100 pcf7947, came yesterday, tested all 100 and everyone is a dud:(

catherine
Company: ICK Internation (HK) Co., Limited
http://www.ickint.com (http://www.ickint.com)

Rip off merchants - please avoid.

ninja

[albertros]

bloody typical!
I just got stung by yet another ting tong ic supplier, ordred 100 pcf7946, came yesterday, tested all 100 and everyone is a dud:(

catherine
Company: ICK Internation (HK) Co., Limited
http://www.ickint.com (http://www.ickint.com)

Rip off merchants - please avoid.

ninja
Try P and D keys mersyside not the cheapest but I ordered 3pm fri got am Sat. You can use 7947 in place if you get stuck.

[3abas27]

Try P and D keys mersyside not the cheapest but I ordered 3pm fri got am Sat. You can use 7947 in place if you get stuck.

who used hitag 2 for keytool abritus original?

[albertros]

Hi,

sorry don't understand the question.
I use zedbull original.

thanks

[isaky]

anyone can help me to follow some tutorial to make virgin megane card
I have zed bull clone 5.00 pro I am very interested not find the answer.
advanced by a hand and ask you please one help please

[ninja123]

And a few more...


traffic pcf7936??? is this correct, or should it have been pcf7946???

Can you use a 7936 for a traffic??

ninja

[ninja123]

Anyone re newed a megane handsfree card successfully??
what tool is used to read/write pcf7943??

ninja

[workdamnyou]

Can you use a 7936 for a traffic??

ninja

Yes, you can. See the files I posted earlier in this thread :beer:

[ninja123]

is this for a non remote key then?

ninja

[coolsoda]

Anyone re newed a megane handsfree card successfully??
what tool is used to read/write pcf7943??

ninja

Read Write with Zed Bull.Does not Recognise Chip type but still reads

[isaky]

i dont know how to use hitah 2 program of zed bull,i know how to charge the file but i dont know what to do to programer pzf7947 of car key of Megane.Can you help me,please? thanks.

[isaky]

help pls!!!

[ninja123]

there are several tutorials on here mate, use search and all will be well.

ninja

[isaky]

SORRY i have problem with the lenguaje sorry i can not find help in the search

[pianoman58]

Has anyone on here got the virgin hitag2 file for the 2001 clio2 1 button key with pcf7946 ?
Thanks to all

[coolsoda]

Genuine New 1 Button

[ninja123]

Has anyone managed to re use a 3 button laguna card?

I can get the car to start but no remote operation.

It seems there is some data in the transpondr that relates to the remote part, but how to obtain this data from a used remote?

ninja

[igorr]

Has anyone managed to re use a 3 button laguna card?

I can get the car to start but no remote operation.

It seems there is some data in the transpondr that relates to the remote part, but how to obtain this data from a used remote?

ninja
on scorpio lk forum I read that remote can be programed only with reno can clip

[PierreTheron]

Try to synchronise manually .

Do not know procedure but heard it is possible .
Something about pressing central lock button in car and then pressing the buttons on the remote..??????????

[ninja123]

dont think that method works on these mate, that method was just for re sync on remotes already programmed, on old megane & espace etc, before the card system.

ninja

[ninja123]

Has anyone got a citroen c5 virgin remote key id46, early type 3 button remote? 2000-2004?

I need a virgin file to try to re use one of these keys, read with zed bull or hi tag.

Cheers, ninja

[uberbit]

m8s, I've just read the laguna 3 button card thread.
There is something I do not get.
I have a remote with lock+auto ( only keyless entry I presume, no keyless engine start ) that has PCF7949AT.
Now, to precode pcf I use ZedBull, but there I have option only for 2 button remote.
albertros posted a bin file from a virgin 3 button remote. Will that work?

I'm confused because in the beginning of the thread I understood that the bin albertros posted is ok for this type of card, then, in this last page I read that there is no possibility to program this type of card.

Many thanks in advance!

[tas_daz]

who can explain what i see in hitag2?what mean?transporder sn/ide crypto and other else?and in remote?what is all the methode to clone and pcf or make original?i write and the both 2 ares?or only transponder?and remote manual?thanks i have zed bull clone.make a sample to make for clio2 with 7946at chip?one way to make clone and another one to make virgin.i can erase this chip?thanks

[PierreTheron]

who can explain what i see in hitag2?what mean?transporder sn/ide crypto and other else?and in remote?what is all the methode to clone and pcf or make original?i write and the both 2 ares?or only transponder?and remote manual?thanks i have zed bull clone.make a sample to make for clio2 with 7946at chip?one way to make clone and another one to make virgin.i can erase this chip?thanks
Hi Mate

Seems it is going to be a long night when we talk on skype .

contact me and then i will explain the bit i know on these ..

[keygargoil]

the pcf7936 cards are handsfree and the remote is precoded with the chip and only clip can programme the remote part i added one with tango not to long bqack and the car started ok and when i pressed the remote to sync the led on the card reader flashed but would nort work aparently only 1 csrd can be the handsfree card

[PierreTheron]

the pcf7936 cards are handsfree and the remote is precoded with the chip and only clip can programme the remote part i added one with tango not to long bqack and the car started ok and when i pressed the remote to sync the led on the card reader flashed but would nort work aparently only 1 csrd can be the handsfree card


Coded the new card from 3d group i had with no problem .
I used Truecode --Everything worked ..

[bobbik]

And what if I don't have any card, i think car has no HF, (no switches in handle) ? Its Espace IV ph2, i tried to start it with blank shell with blank carbon Pcf7936 inside added with tango, but no success... Tango says "ADD key not tested" and then "it should be remote transponder, continue anyway?" . It really HAS to be remote transponder, or I did something wrong (should i precode chip?) or Tango f**ed something up?

[WildStriker]

And a few more...


Thanks for this, I've been having a hard time finding a virgin image for Saab... been doing a lot of research and I am hoping this file can potentially help me. I do not have a Tango/ZedBull but I am hoping with this file plus a programmer for a IC + a blank PCF7946 I can virginize a key that I could not add to my Saab 93 via TECH2... be an interesting project if I don't get lazy..

Edit: After downloading the file it doesn't to appear to be a dump from what I can tell but I assume a profile for a program of some sort? In my sleep deprived state/following a link here I may have jumped the gun a bit and thought this was a dump of a precoded PCF7946.. I'm sure I'll figure things out in the morning

[Senex]

Hello. I want to return to this question. Is it possible to prepare to work remote on second hand three button Laguna card with PCF7936? Or only to precode new PCF7936 to start engine (remote and hands free not works), nothing more?
Thanks in advance.

[baken]

Hello. I want to return to this question. Is it possible to prepare to work remote on second hand three button Laguna card with PCF7936? Or only to precode new PCF7936 to start engine (remote and hands free not works), nothing more?
Thanks in advance.

Not possible to re-use remote because transponder 7936 engaged to remote same as k-line psa remotes , also never tested programing blank 7936 for laguna but possible to program 46 renault precoded chip via obd

[GT-INFO]

Hi can You help me with virgin file for renault espace for reuse used card? pm sended too
thank You

[GT-INFO]

Hi ninja can You send me file virgin for espace 3 button card?

thank You


Im after a file read from a virgin unprogrammed laguna 3 button card.

They are very different than a 2 button one, this one has normal carbon pcf7936 chip inside.

I have laguna, megane, clio & traffic virgin files if anyone needs, just need this one to re use a card:)

ninja

[yahia1908]

PCF7946AT PRICODAGE

[kostelectronics]

is this what you need, read from new virgin card from 3dgroup

I hope, you can remember this thread :D

Was this file pulled from the 25AA040 EEPROM inside the Card?

i'm trying to re-use a 3-button Card from a Espace IV Phase2. PCF7936 is already new.

BR Matthias

[RFRemotes]

I hope, you can remember this thread :D

Was this file pulled from the 25AA040 EEPROM inside the Card?

i'm trying to re-use a 3-button Card from a Espace IV Phase2. PCF7936 is already new.

BR Matthias

An old thread but still existing problem.
I think the best way to reuse is to know ISK of the car that card comes from and then unlock the original transponder.
Problem is that ISK is not known in most cases with second hand used cards.

The point we can begin investigate is to read your used card eeprom 25AA040. Can you do this? And are you sure it is eeprom at all? I can see connections of this chip on my card to see also.

[kostelectronics]

Hello and thank you for this useful reply!

Ok, let's go trough my Situation:

1. I have a used Remote electronics without Transponder from the scrapyard.
2. I have 10x new Transponders PCF7936 to Play with it.
3. I have a friend with a semi-dead key that is able to start the car. This key is the only one he haves for this car.

Now:
- I have read the EEPROM from the remote-electronics from the scrapyard -->See attatchment. Problem is: i have no additional informations about this car. Also no Transponder from this key.
- I programmed this eeprom with a file that i've found here and should be a virgin file -->See attatchment.
- I try now to pre-program a Transponder (PCF7936) and try to learn the key from the srapyard to the car and see what happens. Problem is: i don't know how to pre-program the Transponder.

Before i can try to learn this key to the car, i must have the Login to the UCH. All my Tools failed to get the Login. I have ordered a FNR 4+1 Cable (clone) and hope this gives me the Login.
My first idea was to remove the UCH from my friend's car and read the EEPROM, but the UCH is under the Dashboard and i Need to remove the Dashboard to remove the UCH. If all Fails, i have no other Chance.

What is the best to do now?

- Remove the UCH and read the EEPROM, then disassemble the key-card and read the 25AA040 EEPROM?
- Try to read the UCH with the FNR Cable, then disassemble the key-card and read the 25AA040 EEPROM?

I will solve this Problem! Maybe we can do it together!

BR Matthias

[RFRemotes]

I am not so familiar with these cars but here is what I think about this situation:

- For now no need to remove UCH. This will not be of much help. I'm almost sure that there will be no obvious connection between card's EEPROM and UCH EE data.
- The easiest thing to do is to read your friend's card eeprom and put this data in EE from scrapyard. Then put the working transponder in that card and try what happens.

If all works this will prove that only 3 components are involved - PCF, card eeprom, UCH eeprom.
Keep in mind that developers of this security are good in their job and use many encryptions to avoid sniffing clear data and find out how the system works.
Even in an old megane 1 there are algos hard to reverse plus that they change the keys/algos from model to another.

Sorry to say but I think this mystery will not be revealed until UCH H8S/2626 MCU flash code is disassembled which I'm not able to do for now.
Also I think they put remote ID in NEC mcu inside card but not in eeprom so the test I am suggesting will prove this concept.

[gogu]

hello,
can you tell me what tool you used to read 25AA040 EEPROM ?
thank you

[arosta]

OK i want to bump this thread.
Today i had customer with broken hands free card for laguna2 (3 buttones with sun/lights)
So i had to open case for repair and there was no pcf7936 inside! (someone was before me coz there was signs of soldering by someone else as well)
ofcourse i did job (repair successful) changed case and... car starts and hands free working fine too.
So i dont think transponder is engaged. I think transponder inside card is some like in new ford keys (only spare for turning ignition on if card is broken).
Someone digging this thread like me?
Someone tried that file 25aa040_orig.bin from that topic?

[ciprishor]

I believe hands free model is different from non hands free one. No pcf7936 in first and immo data is sent via antennas inside card!?

[kostelectronics]

Ok, i have some News about this.
All datas for the keyless and remote functions are stored inside the 25AA040. that means, all other IC's are not induvidual programmed inside this Keycard. Yeaaahhh :dancing:

I played a bit around with a working key from my own car. I swapped only the 25AA040 over to a used keycard from the scrapyard and it worked 100% (handsfree and remote).



Now the next question: Must the Datas from the keyless&drive (25AA040) match to the datas from the Transponder? Actually i have only 1 Transponder for both Cards. I want to program a new Transponder and insert it to the cloned keyless-Card and see if the car accept it to learn to the car.
Can somebody help me to pre-code a new Transponder? If this will work, then we can generate a new key with the datas from 1 working key!

BR Matthias

[gogu]

hello.to pre-code a new transponder you can use Abrites.i have made one.i have started the car but the remote & keyless don't work.
how did you read 25AA040?

[p1et]

That's nothing new here. By swapping IC 25AA040 you can only repair broken card, same procedure like PCF soldering to different remote PCB like Peugeot and others so this is kinda obvious. To make a step forward we must know way to read this 25AA040 chip / make it virgin.

[kostelectronics]

I have read the 25AA040 with Orange5. Here's the dump.
I have also a virgin dump, but not tryed yet because i have nothing to prepare a new transponder. I don't have Abrites, only a Zedbull for now.
Can somebody help me to prepare a transponder? then i will try with the dumps.

In the original dump, i can see the key twice and the VIN. It's worth to play with and try (if somebody help me to precode a blank transponder).

BR Matthias

[gogu]

hello.i have one keycard keyless.
I have been able to read 25AA040 and write your dump with UPA-S Programmer. I will pre-code a chip and I have a friend who wants one more keycard keyless. I will try to talk to him if he has time to try to write it.

[kostelectronics]

Thank you!
I will make a dump from the UCH too for this car.
Then we have the Data from the Keyless 25AA040 and from the UCH. The ISK we have too from the dump from UCH. Maybe we come further with this informations

[gogu]

hello,
I tried to write the card written with dump ,,LagunaII_25AA040_virgin.rar,, on the car. the car starts but the remote does not work.see the photo

[Catalizator]

photo of both cards give me

[ziomski]

hello,
I tried to write the card written with dump ,,LagunaII_25AA040_virgin.rar,, on the car. the car starts but the remote does not work.see the photo
You need insert battery for properly hands free programing.

[gogu]

hello.ok. I will try with battery and with dump LagunaII_25AA040_virgin.rar
A+

[Ecuprog31]

hello.ok. I will try with battery and with dump LagunaII_25AA040_virgin.rar
A+
Hello did you try again with battery ?
thanks

[Domi]

wrong thread ....

[gogu]

hello.yes, not working
A+

[tumb1er]

HI! I got a mini z-bull, a Chinese clone, like everyone else probably) is still at the stage of study, but as far as I understood from the topic, no one could bind a three-button card so that it open using hands free?))
laguna 2 ph1 2002 year

[leynad72]

Hello. Did you succeed to write the card? I mean the remote part of it, I am also trying for an Espace IV and I am not sure if the virgin dump file posted here from a Laguna works.

[gogu]

Hello,

Try this solution.Works 100%

Renault ECU Tool | Downloads (immo-tools.lt) (https://www.immo-tools.lt/en/downloads.htm)

[leynad72]

I need to buy the tool from them? Renault Can K line Ecu tool? The software does not recognize my eeprom programmer. Please, if you have a virgin 25AA040 file, can you upload it here? I have the original PCF7936 that works, but no remote function.

[gogu]

Hello,
Yes,you need to buy the tool to work.send the eeprom that you save and the id of your transponder that start the car.I will make for you.

Sent from my SM-N960F using Tapatalk

[leynad72]

I don't have the original eeprom 25AA040 of the car. I have only the original PCF7936, which works and start the engine. The rest of the card is from scrap, from another car. The dump from this eeprom will help you virginize the card?

[leynad72]

These are the files, I hope is what you need. Thanks.

[gogu]

hello,
write this dump to eeprom, put a good batery on the card and then write again on the car.

[p1et]

Hi @gogu

Is it necessary to read/write 25040 eeprom in circuit? I don't understand why .pdf manual describe only that way.

[gogu]

Hello,
No.you can also desolder and read/write with UPA.

Sent from my SM-N960F using Tapatalk

[leynad72]

Hello. Unfortunately, it didn't work. I tried with Can Clip ann Renolink on 2 different cards, but without success. I don't know if it has something to do with the original eeprom data from the card I try to program. If I don't ask you too much, meanwhile I found the dump which I saved from this card. Maybe you can help me with another virgin dump. Thank you.

[leynad72]

So, back again. I finally made it, the virgin dump was ok. Thank you for your help. I was unlucky, cause the both inductance antenna coils from my cards were broken. By the way, were can we find theese coils? The measures around 60-65 ohm resistance.882194

[arosta]

So, back again. I finally made it, the virgin dump was ok. Thank you for your help. I was unlucky, cause the both inductance antenna coils from my cards were broken. By the way, were can we find theese coils? The measures around 60-65 ohm resistance.882194

Thats why unlocking of this card is so painfull.. You never know is your used card is good in 100% or not. Too many resitors and chips legs in that cards (popcorn) + 15years old PCB = problems so many times. Even if frequency work well and PCb looks perfect, you dont know if it will work or not. And many times when you are doing programming of new card, old card of consumer stop working becouse of some bad solders in his card (and you have to open his old card without damaging and try to fix it) problems problems problems

[VakRam]

Good evening. I read the whole topic. I found very useful information.


I have an Espace4 with my hands free (3-button key card). One key card. I want to make a second one. Broke the key. Dump with eeprom 25AA040 considered. There are clean pcf7936A.


Do I understand correctly my further steps to make a second key card for my car.


1-Write a virgin dump in her prom key.
2-Put a clean PCF7936A into the key (is it necessary to prepare pcf before binding?)
3-Register this key card using Renaul Can Clip to my renault espace4.

[gemiozo]

1. You are reading 25AA040
2. You reset the memory with Renault ECU Tool (you can use PCF7936 from this card or new one).
Refer to the Renault ECU Tool Card Reset Guide for a description.

[VakRam]

Good afternoon. I bought a Renault ECU Tools over the weekend. Linked the card today. Everything worked out. Thanks to.

[sabinescu2006]

Hello ! I was on my mobile and couldn't download. I solved it
Thank!

[p1et]

Hello,

How to read that 25AA040? I tried with vvdi prog and it read file as whole zeros. In xprog 5.0 I don't see this memory type, I tried as 95040 and other ST / Atmel but no luck.

UPA can read it? I mean old UPA, not new UPA-S?

[Titix]

Hello, p1et, I am now reading it with chinease carprog as 95040 no problem. Using A4 adapter, but the color scheme is all messed up, so it is good to open the adapter and rethink what is what.

[Titix]

Also I'm trying to understand the eeprom.
The observations I made so far are that there is information of the vin number, then a bunch of F's after which is info of the pcf.
Is the someone with Renault Ecu Tool willing to "Virginize" the dump, so I can check how the rest will change?

[Kurtkoeln]

Hello, does anyone have a schematic of the Laguna 2 / Espace IV key card with Keyles Go and 3 buttons (Open, Close & Light)

And how do I get these cards virgin?

[Kurtkoeln]

Hello, how do I get to the EEProm, or what data do I have to write on it in order to be able to send it to the steering wheel lock, the steering wheel lock can be read out with the ch 341a and the chip 24C04 and the steering wheel lock checks whether the Map fits the WFS.

Have a Renault Espace BJ. 2007
2.0 dci / 173 hp with Keyless Go

Would be very grateful for help and ne instructions or help.

[castin]

So, back again. I finally made it, the virgin dump was ok. Thank you for your help. I was unlucky, cause the both inductance antenna coils from my cards were broken. By the way, were can we find theese coils? The measures around 60-65 ohm resistance.882194

Use coil from ScenicII/MeganeII/ClioIII HF Card - work OK, tested by me.

[HelloWorldSpec]

Hello. somebody with ret can calculate isk hi and lo for pcf unlock? thx

[kostelectronics]

Sorry, a bit late!
Your ISK: 35 82 90 45 0C 75 , your PCF7396 ID should be: BD 1F AB 11
hope this helps :)

[kostelectronics]

Here is the solution! Free for all!
Don't forget the thanks button :)

[p1et]

Thank you very much, that is what I was waitinf for :) If only I would have that info before, I wouldnt waste so much time because I already tried to clear those cards with a bad virgin dump some other member posted here... And now I don;t have original 25aa040 data from any of those cards, also original pcf7936 are all lost as I just threw them out and put new one prepared per instruction of that person.

So basically I trusted that given solution and overwritten 3 cards with that wrong virgin dump, without saving original dump. So now I have multiple second hand keycards witgout it's original eeprom file, can I make them virgin somehow? I think it should be possible still.

Please see the attached .txt file, it's from Renault ECU Tool I believe.

I don't have a tool which will give me the ISK from the car, I have various of tools whih can program those cards but none will give me the ISK so at this moment I can't do it per your instruction to program blank PCF to the car, then unlock it using ISK and put correct values into virgin file.

But looking at this Renault ECU Tool manual, I should be able to put page 0 (transponder ID) and page 3 (psw) of BLANK transponder accotding to this R.E.T text file into your virgin file and then program card and I believe it should also work, right?

Because virgin dump must be universal and we just need to put correct transponder ID's in it's file? That way, during programming they both should 'marry' with themselves and all work, do I understand it correctly?

[kemaster]

Thank you very much, that is what I was waitinf for :) If only I would have that info before, I wouldnt waste so much time because I already tried to clear those cards with a bad virgin dump some other member posted here... And now I don;t have original 25aa040 data from any of those cards, also original pcf7936 are all lost as I just threw them out and put new one prepared per instruction of that person.

So basically I trusted that given solution and overwritten 3 cards with that wrong virgin dump, without saving original dump. So now I have multiple second hand keycards witgout it's original eeprom file, can I make them virgin somehow? I think it should be possible still.

Please see the attached .txt file, it's from Renault ECU Tool I believe.

I don't have a tool which will give me the ISK from the car, I have various of tools whih can program those cards but none will give me the ISK so at this moment I can't do it per your instruction to program blank PCF to the car, then unlock it using ISK and put correct values into virgin file.

But looking at this Renault ECU Tool manual, I should be able to put page 0 (transponder ID) and page 3 (psw) of BLANK transponder accotding to this R.E.T text file into your virgin file and then program card and I believe it should also work, right?

Because virgin dump must be universal and we just need to put correct transponder ID's in it's file? That way, during programming they both should 'marry' with themselves and all work, do I understand it correctly?

He prompts if used blank new transponder, getting it programmed to the car first. And then unlocking it with car's ISN. In his pdf I see page 3 modified(crypto mode enabled) and after that putting it in dump. So I guess you can't take page 3 of a blank transponder directly and write it to 25AA040

[p1et]

I think it's possible because if you do it with R.E.T, you select if you have original PCF7936 or if it's lost. If it's lost, you put ID of new blank Transponder and it creates new (virgin) eeprom with it's ID written in adress 180 in HEX editor of 25aa040 dump and 1A0 adress row 07 - it's page 3 value which doesn't change from original 25aa040 file and this value it's tell us to write to blank transponder.

R.E.T creates a virgin file and .txt file how to configure blank 7936 chip and it tell us to write Page3 values in it which we can see are in the modified (virgin) .bin file adress 1A0 row 07.

After we do it, it's all prepared. So if we want replace transponder and use it, no need to program it to the car first and then unlocking with ISK, then filling virgin file with Page3 values.

At least that is how I understand it. I need somebody with R.E.T to do some favor and check this for me.

[kostelectronics]

Page 3 is the password. This can not be from a blank transponder.
Page 1-7 must be correct to the correspondig vehichle, otherwise you can't learn the transponder.

To get your ISK, you need open the UCH and read the 95160 EEProm, then you have all what you need. Sorry if you lost your original data from 25AA040, that should not happen ;)

[p1et]

Page 3 is the password. This can not be from a blank transponder.

Then how Renault Ecu Tool prepare all needed data with a blank transponder, without learning it to the car before?

If we do it your method, the virginized card will only program to that 1 particular car you written transponder before. So it's like ordered by VIN from dealership.

But of course those cards exist as a NEW BLANK, not VIN precoded and you can program it to any car. Renault Ecu Tool virgin method makes them ready to program to any car, that's clearly written in their instructions manual. Even if you change transponder for new.

Their method only need ISK for unlocking original PCF7936 from same card we have eeprom.

Hope I'm clear, thats only in theory. If I have a car like this to test, of course I will makes some tests.

[kostelectronics]

Then how Renault Ecu Tool prepare all needed data with a blank transponder, without learning it to the car before?

If we do it your method, the virginized card will only program to that 1 particular car you written transponder before. So it's like ordered by VIN from dealership.

But of course those cards exist as a NEW BLANK, not VIN precoded and you can program it to any car. Renault Ecu Tool virgin method makes them ready to program to any car, that's clearly written in their instructions manual. Even if you change transponder for new.

Their method only need ISK for unlocking original PCF7936 from same card we have eeprom.

Hope I'm clear, thats only in theory. If I have a car like this to test, of course I will makes some tests.

This gets very interesting now! Until now, i thought, the PCF7936 must be pre-programmed according to the car's ISK. (i never created a dealer-key transponder for this car, because i have no tool that can do this)
I wrote a virgin transponder according to your .txt file few posts ago and it worked!!!
After programming the virgin transponder to the car, i read it again and it's locked with the car's ISK.
Look what changed after programming:

Next experiment is, to program the data from the virgin Transponder to the virgin 25AA040 and see what happens :) it's only the Transponder ID and Page 3.
I come back soon with news! :) Maybe i have to modifiy my guide after these news!

[kostelectronics]

It worked! HAHA
next experiment is only to put the transponder ID to the 25AA040 without Data from Page3 of the transponder and see what happens then.

[p1et]

This gets very interesting now! Until now, i thought, the PCF7936 must be pre-programmed according to the car's ISK. Next experiment is, to program the data from the virgin Transponder to the virgin 25AA040 and see what happens :) it's only the Transponder ID and Page 3.
I come back soon with news! :) Maybe i have to modifiy my guide after these news!


It worked! HAHA
next experiment is only to put the transponder ID to the 25AA040 without Data from Page3 of the transponder and see what happens then.

I told you :) So my observation/studying of original and virgin 25aa040 files, in connection with correct transponder settings by R.E.T instrutions wasn't wasted, that's good.

So now I can use any of my cards which both original 25aa040 eeprom and transponder is lost.

Big thanks to your manual for virginizing it. Because of your work, now I perfectly know how to virgin those cards, without help of Renault Ecu Tool and without replacing original transponder for new. That's the best method.

But also big and special thanks for your awesome extra quick experiments with new transponder, that was very important for me because personally I wasn't able to make those test by myself on the car. Now if I have a customer, I will have correctly prepared cards.

So together we made a good job,

Thank you very much, appreciate! :)

[kostelectronics]

that was a nice work! now we can re-use old cards, creating completely virgin cards, creating transponders, modify 25AA040 dump to an existing transponder, everything! I holpe somebody can profit from our work now!
BR Matthias