Fiat Grande Punto PCF7946AT

[evisdaci]

Hello everyone, i want to make a remote key for a Fiat Grande Punto 2007. I have a new remote key with a new virgin transponder PCF7946 and i need to programming. I have read eprom 93C86 from BSI and i have try with abrites clone, now key start the car but didn't work like remote. I haven't expensive tools to do this, i have zedbull clone. I have try with EFfi v2.7.2 to precode transponder but no success. Please any help how to solve this problem

[jodge]

Hello
tmpro2 one of the tool is able to programm with the remote part correctly. Module 59 (http://www.tmpro2.net/software-module-59)


But i'm curious if somebody can explain this...Bcose i not understand at all.

According the NXP pdf (http://www.nxp.com/documents/short_data_sheet/HT2X_SDS.pdf) in the HITAG2 (in crypto mode) there is 8 pages, nothing more.
(All pictures hosted in dropbox just close the popup with "No thanks, continue to view")

In this picture (https://www.dropbox.com/s/242ix1az0b8esj4/bravo_key_info.jpg?dl=0) the first part is the fully working original remote
The second part is new remote only the immo part working you can see the differences the user pages are empty. (programmed via CN900)

The second picture (https://www.dropbox.com/s/ipn2n31uxje7a9t/bravo_edited_key.jpg?dl=0) is the edited transponder, (with Handy-Baby) all pages are corrected. (BTW all available fiat key(for me) contain the same data page 3 to page7 B6AA4854)
and still only the immo working.

[evisdaci]

I don't know why didn't work mate when all pages are the same. So with my abrites and zedbull i haven't chance to make remote to work ? If it needed i have another virgin PFC7946 chip

[jodge]

i found the search button. :D Here is the explanation for you and me (partial)
http://www.digital-kaos.co.uk/forums/showthread.php/587744-FIAT-GRANDE-PUNTO-2006?highlight=fiat+remote

abrites orig, zedfull and tmpro2 no more players in the fiat game

[p1et]

Zedbull ori and miraclone also precode remote for those cars. Also make sure you trying to add delphi remote for this particular car, not marelli.

[evisdaci]

I understand so with my tools can't do that. Can do this by putting the transponder ID on BSI eprom dump ?

[mikajna]

The second picture (https://www.dropbox.com/s/ipn2n31uxje7a9t/bravo_edited_key.jpg?dl=0) is the edited transponder, (with Handy-Baby) all pages are corrected. (BTW all available fiat key(for me) contain the same data page 3 to page7 B6AA4854)
and still only the immo working.

First three pages in transponder memory are needed for car starting Crypto Low, Crypto High and TMCF...than move to remote pages because PCF7946 is transponder with remote, BUT because cloning chips are structure like pcf7936 they have user pages for some other functions, in those pages cn900 just copy last page he decode from your pcf7946 (TMCF PAGE), because PCF7946 dont have user pages, you could put all FF in user pages 4-7, car will start...and your user pages you get while decode transponder are usless for remote cracking, many people already try that

[jodge]

First three pages in transponder memory are needed for car starting Crypto Low, Crypto High and TMCF...than move to remote pages because PCF7946 is transponder with remote, BUT because cloning chips are structure like pcf7936 they have user pages for some other functions, in those pages cn900 just copy last page he decode from your pcf7946 (TMCF PAGE), because PCF7946 dont have user pages, you could put all FF in user pages 4-7, car will start...and your user pages you get while decode transponder are usless for remote cracking, many people already try that

huh your post is messy a little bit for me, sorry :)
So basically the problem is the decoding part of the remote pages? When the other day i just tried with handy-baby only the 0-2 decoded correctly and the user/remote pages p3 to p7 is corrput or just random data?

[jodge]

I understand so with my tools can't do that. Can do this by putting the transponder ID on BSI eprom dump ?
yes you can add the transponder data to the BSI dump but not the remote part. You need to program the remote part of the PCF7946 with the correct data from the BSI dump.
It seem's your tools isn't able to do that

[evisdaci]

I understand mate. Thank you very much