Porsche 996 Keyfob 12byte ID code retrieval??

[AudiS4]

Hey guys,

I have a customer with a 2004 porsche 996 pas module was changed and I recently adapted immo to the new donor pas module so the car starts and runs. However remotes/key fob/ lock and unlock does not work. Is there any way to pull the 12byte(24 hexidecimal) code from a fob?? Is there any tools that can read the remote code??? Hady baby perhaps so I can adapt remotes??

https://uploads.tapatalk-cdn.com/20220519/c6a92714a00a55cacc9aa506af5876cc.jpg
https://uploads.tapatalk-cdn.com/20220519/eb1864c705a2d7ef38fafb73f8439f9f.jpg

[Weasel3]

I think you need to get the pin from the new module.
And adapt brand new remotes.

These remotes, are programmed in with PIN.

Dont think there is a way to reset these yet.
But I might be wrong.

And also need a OBD tool, which is capable to do this programming.

[AudiS4]

I know there is a way to adapt these or pull 12byte ID but no one wants to give information how. I know of 2 people that can pull and read remote ID for adaption. However no one wants to share that information. I know that porsche themselves give you tag with every remote which has this code on it in order to teach the remote in. In addition to that learn code/pin is needed which I have. The only issue being how to pull 12byte id from key??


Sent from my iPhone using Tapatalk

[Weasel3]

I know there is a way to adapt these or pull 12byte ID but no one wants to give information how. I know of 2 people that can pull and read remote ID for adaption. However no one wants to share that information. I know that porsche themselves give you tag with every remote which has this code on it in order to teach the remote in. In addition to that learn code/pin is needed which I have. The only issue being how to pull 12byte id from key??


Sent from my iPhone using Tapatalk

Yes,
You are right about the 12byte ID.
I remember it now, when you mention it.

Not aware of any method though.

But then again.
I understand that, people does not want to share everything.
That will guarantee food, on the table in the future.
For those, who have this secret.

[AudiS4]

Yes,
You are right about the 12byte ID.
I remember it now, when you mention it.

Not aware of any method though.

But then again.
I understand that, people does not want to share everything.
That will guarantee food, on the table in the future.
For those, who have this secret.

I agree, I was just wondering if anyone else has been able to figure this out that is all. I guess i'll have to do some testing.

[brobble]

Old module available? If yes, you could retrieve the codes from dump or maybe even with diagnostic, not sure. Or copy them from dump to dump. I tested myself: Adapted remote with known code und pulled dump to find code in dump. Maybe you can catch the code by demodulating the rf-signal if you have the equiment for that. But even for that you would need one remote with known code. :-) What kind of processor is under battery holder?

Greets MR...

[PixelsFixed]

I can supply a remote board with barcode on an exchange basis if required.

AVDI can add the remote to the module from a PAS dump. Do if you have the dump from the old module, you'll be able tomadd the remote from the dump.

If AVDI does it, presumably FVDI will. Whether you want to connect that to your customer's car is another matter.

[nyandacca]

Try this.
It didn't work for me but this is correct procedure.

[AudiS4]

I can supply a remote board with barcode on an exchange basis if required.

AVDI can add the remote to the module from a PAS dump. Do if you have the dump from the old module, you'll be able tomadd the remote from the dump.

If AVDI does it, presumably FVDI will. Whether you want to connect that to your customer's car is another matter.

I do not have the original pass module or the data from it. This is the issue. If I have a good eeprom dump or the module it would be a simple eeprom swap. Do you have a way of reading the 12byte code from used remotes?? I have 6 working remotes however I only need 3. I am in USA remotes are 315mhz vs europe.

[jodge]

it sound odd to me.
128bit = 16 byte
on the barcode only 12 byte visible thus the length is 96bit
the remainng 4byte (32bit) is the remote ID?
But according the sticker the remote id is only 2-3 numeric character (depends the picture i found)

edit:
yupp, 32 bit reserved (https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/40001747A.pdf) for serial number

edit2:

overkill :D

You unable to read the key eep data but you can modd to the car data. At least according the datasheet
i never ever tried it



The crypt key, serial number and configuration data are
stored in an EEPROM array which is not accessible via
any external connection.The EEPROM data is
programmable but read-protected. The data can be
verified only after an automatic erase and programming
operation.This protects against attempts to gain
access to keys or manipulate synchronization values.