reading dumps & calculators for pin and key codes

[ray-ray]

is he the only one that is willing to share?why is there such a hold back on these info. i see other in these forum that can do the same thing and give out key logic from dump. if there getting it from zen bull or ad900 to get the logic then lets play with dumps. we can crack it with all the bright minds in these forum.

[JIMMYQ]

is he the only one that is willing to share?why is there such a hold back on these info. i see other in these forum that can do the same thing and give out key logic from dump. if there getting it from zen bull or ad900 to get the logic then lets play with dumps. we can crack it with all the bright minds in these forum.

ive shared all i know which is about ~~~~ all

[ahl]

..why is there such a hold back on these info.

Because it takes time, money and effort to work out the relationships.

The OP asked for input and received virtually nothing but 'gimme' and 'me too' messages in return. Hardly an inspiration for him to want to continue the project I would think. There are some very smart people on this forum but there also appears to be far more that are just after a free ride.

Ray-Ray, I know that you, Fallen and several others are working very hard toward finding the answers, so please don't think I'm having a go at you people.

Most of the answers can be found on this very forum in the lost keys and immo off request threads. Compare the dumps that are posted with virgin dumps and the key solutions that are posted in replies. Be careful though, as some of the solutions that are provided are wrong.

Ok, rant over and time to provide some constructive input.

There are 4 keys in Fallen's Landcruiser sample.
His extraction program has provided him with the values for key 1. Convert the key data his program provided to TIRIS and compare that to the dump. The individual keys will then stick out like dog nutz.

The early 8 bit toyota stuff is simple enough to work out. The 16 bit and crypto ones are a bit of a puzzle though.

[Fallen]

Ok, enough of the "add me to the list" spam.

I just run my dumps through my TMpro and it spits out the key, to me it's a bit like witchcraft.

Believe me guys, if I knew how it works I would of written a guide on it!

Here is a starting point for us all.
I took this dump off a 4C 2000 Toyota land cruiser today and this is the key data that it spat out.

7E476569C000000000DF377E0000

This key data is stored somewhere in the 32 lines from this dump.
Impress us all and show us where it is somebody!

[Bishop c4]

Ok, enough of the "add me to the list" spam.

I just run my dumps through my TMpro and it spits out the key, to me it's a bit like witchcraft.

Believe me guys, if I knew how it works I would of written a guide on it!

Here is a starting point for us all.
I took this dump off a 4C 2000 Toyota land cruiser today and this is the key data that it spat out.

7E476569C000000000DF377E0000

This key data is stored somewhere in the 32 lines from this dump.
Impress us all and show us where it is somebody!

this is the location of the keys
Key 1: 7E E2 A6 96 03 00 00 00 00
Key 2: 7E E2 A6 96 03 00 00 00 00
Key 3: 7E 5E A7 96 03 00 00 00 00

key 1 master
key 2 master
key 3 valet

about the tiris values no info yet
Regards

[cammy25]

Hi guys ,

here is a source file for a transponder machine for 4C. Its in PASCAL.

[ahl]

If one is going to post information gleaned from this forum on another locksmith forum, it would be considered good form to not claim the work as one's own.

At least have the decency to credit where the work came from and that you are not the original author. Then you may not look like such a dik when you post incorrect details for the transponder, also pilfered from here, and again claimed as your own work.

It kind of shoots your credibility to sh!t.....

[Digital Auto's]

How about a link/clue....

[cammy25]

If one is going to post information gleaned from this forum on another locksmith forum, it would be considered good form to not claim the work as one's own.

At least have the decency to credit where the work came from and that you are not the original author. Then you may not look like such a dik when you post incorrect details for the transponder, also pilfered from here, and again claimed as your own work.

It kind of shoots your credibility to sh!t.....

Is ithis towards me??
if it is ....WHAT THE ~~~~ ARE YOU TALKING ABOUT???


here is right one Geps

[PremierD]

Right people .. The original poster said .. PM me for information ... nothing about lists or signing up please keep it to the subject being discussed

[Fallen]

Thanks for the input ahl.
I'm pretty sure I can see the keys but I am unable to see the correlation between

E2 A6 03 00 00 00 00 and 7E476569C000000000DF377E0000

E2 in hexadecimal is 226

EAA60300000000 in hexadecimal is 63795876551720960

I take it there is a TIRIS conversion that I have to use?
As in E2 =7E47

[ahl]

I take it there is a TIRIS conversion that I have to use?

It depends on what you are using to read the chip or to extract the key data from the dump.

If there is no sign of the 'Tiris' the decoding application is presenting you with, it's usually because the key data is being output in hex. There's a few ways to do the conversion, but we'll see if anyone else is going to stump up with some input before progressing with that.

Cheers!

[gazzaull22]

Thanks for the input ahl.
I'm pretty sure I can see the keys but I am unable to see the correlation between

E2 A6 03 00 00 00 00 and 7E476569C000000000DF377E0000

E2 in hexadecimal is 226

EAA60300000000 in hexadecimal is 63795876551720960

I take it there is a TIRIS conversion that I have to use?
As in E2 =7E47

All 4c carbon transponders start with 7E

If You read a 4c transponder with a key cloning machine this is a example of what u get.

7E0426CF000000
00006A177E0000

If you notice
7E 0426CF 000000
0000 6A17 7E0000

In red will always be the same with any 4c carbon transponder.

In yellow is the key data which will be in the dump.

In green is some sort of check sum or calculation.

So the green part is what is need to be worked out, thats as far as i got.

[ahl]

Beauty! We're getting some more participants.

As gazzaull22 says, the immobiliser dump contains the TIRIS value of the key. That's why a transponder programmer that displays TIRIS makes life a whole lot easier. You can work the Hex to TIRIS conversion out manually but it's just not worth the effort when there are easier ways to do it.

The dump doesn't store the '7E' bytes from the key data as it's redundant information as far as it's concerned. The checksum is used in some types though.

So, first of all. Make sure you are using TIRIS values and then start studying dumps, or be like Ray-Ray and do some experiments. Watch for what changes when you program or clear a key. Things to look for are blocks of data that are grouped together. Data that is repeated three to four times. Data that changes each time.

Look for anomalies in dumps that are submitted to the forum and compare them with known good examples. There are dumps that are very similar to Fallen's sample, but from different models produced in different countries. There are subtle differences in those immos that have fooled the script kiddies several times over.

That'll do from me for the time being... NEXT!

[Digital Auto's]

So the yellow part of the data above is connected by a direct algorythm (tiris) to what you actually see in the dump. the green bit isn't a key for the algorythm by any chance.

If thats the case, can anyone explain the algorythm????

I'm not trying to take away anyone's crown jewels here, but it would be nice just to see it work that once. Its got me interested now and I'd like to crack it out of curiosity. If no one is going to cough up, we need to get as many toyota key examples as possible. I'll trawl the net tomorrow and try get them presented on a excel for comparison. This can't be to hard....