Identify key bytes from Acura 2000 3.5 RL immo box dump

[zairox]

The following is an immo box dump (not the ECU) from my Acura 2000 3.5RL (L46AR / 93c46). I am trying to identify the 4 bytes of each key that Zed-Bull uses to calculate the Megamos 13 transponder data. Can somebody point them out for me please?

Also, can someone modify the dump to put it into learning mode? (Edit: this was a stupid question)

ID: 13
Transponder Type: T5

[drrimz]

The following is an immo box dump (not the ECU) from my Acura 2000 3.5RL (L46AR / 93c46). I am trying to identify the 4 bytes of each key that Zed-Bull uses to calculate the Megamos 13 transponder data. Can somebody point them out for me please?

Also, can someone modify the dump to put it into learning mode?

ID: 13
Transponder Type: T5

Why would you?EPROM is . learning key by dump.

[zairox]

Why would you?EPROM is . learning key by dump.

After reading a looot more information I realized the second question was very stupid.

This is what I have so far:

Data for keys in dump:
88 56 51 00
88 56 C1 D9
88 56 81 D2

Is that correct?

[drrimz]

After reading a looot more information I realized the second question was very stupid.

This is what I have so far:

Data for keys in dump:
88 56 51 00
88 56 C1 D9
88 56 81 D2

Is that correct?

read Datasheet before reading memory
reading 16 bit!??

[zairox]

read Datasheet before reading memory
reading 16 bit!??

Thank you for the hint.
I did look at the datasheet and it says it is a 64 bit word x 16 E2PROM and that it is compatible with the instruction set of NM93CS46/56/66.

If I read it as 8 bit, I get nonsense.

I attempted to calculate the keys using the values I posted above and I get the following:

FF 81 34 05 63 00 63 29 (88 56 51 00)
FF 81 34 05 E3 D4 23 43 (88 56 C1 D9)
FF 81 34 05 63 D9 23 3E (88 56 81 D2)

But none of these match the transponder of the key that starts the vehicle.

FF 81 C4 D8 94 F8 86 74 (this transponder works)

I am aware I can clone it using Zed Bull and call it a day, but I want to be able to add and replace existing keys to the immo box.

Can you give me more hints or point out what am I doing wrong?

[zairox]

Never mind. After three days of nonstop reading and trial and error, I found a way to add pre-programmed keys to Megamos 13 dumps (at least for Acuras and Hondas) by making a small Java app that analyzes the hex data from the dumps and the transponder data string.

It was so freaking simple, yet I had and incredibly difficult time finding anything in this forum that would indicate how to identify the values and their order from the dump, and I found nothing on how to manually calculate the transponder data from dump and vice-versa.

I will later post the algorithm and a upa-usb script to extract, add, or replace new red, gray, and black keys in these vehicles so that newbies like me have an easier time fixing these immobilizers.

[Bacigala]

681411

Here you are

[alex_r_2001]

For those I just use tango along with a t5 transponder ... At first was confusing but now simple ... That's a pretty cool app your making though I will be a great help for others that have not done them before...

[apath_e]

where can i get whatever utility you're using to display the keycodes from that dump?
i've got a RL that came into my shop - owner just bought it and was told 'it just needs a new key'
I want to make sure that the key i'm going to clone is actually in the immo box.. and for that matter, if it even has valid data in the immo box.. (the eeprom in the immo box looks like it has been messed with)

Edit - This is a 'virgin' eeprom for this immo box....

Red key - (28 79 76 2C) FF 81 04 00 CB 88 99 59
Black key - (28 81 6C 7F) FF 81 C4 32 62 66 DE 1D

[apath_e]

Literally just found out the dump i pulled is a virgin dump for that immo box...

Can anyone pull the red and black key 1 codes so I can make keys to now pair the immo box to the ecu?