Reusing old Peugeot/Citroen remotes type 73373067B,C

[lidons]

I'm in your theme

I can not help unlock.

it should take into account the first preloads that has the transponder, to know how close it. I think

photos remote original
1 peugeot 206
2 berlingo 2001


precode peug206 7936.JPG
berlingo 2001.jpg


http://www.digital-kaos.co.uk/forums...de-psa-330872/

[keysph]

Im still not convinced!! There must be something to do with the pin code, as this is the only data I used from old bsi to new bsi, I did not program the vin number, and key still programmed - so the vin number is out of the question - so I think the pin has a big part to play here, pin must be written to pcf and used to unlock it or match it?? - ill keep digging...........
ninja

You did not enter any VIN but I'm sure that the BSI automatically took the VIN from the ECU in the learning procedure. When you programed the key the BSI had the VIN and the pincode inside.
Even if you know the VIN and the pin from the car that the key belongs how do you unlock it to mach it on another car?
It is known that PCF and the remote are linked together and you cannot use the remote with other transponder.
Why would you look at the PCF when the problem is the info on the remote?
When you program a NEW transponder isn't that coded with the VIN or the pin or a secret key and locked on that car???? And why doesn't work with the remote?
SO the info that must be cracked and understand is in the remote. By cracking that info you can match a blank PCF to it and only after that you my program it to new car.

You got it now? Or still not convinced?

[reks13]

I dont understand why just not program used PCB with new PCF7936 via OBD and then program buttons like in SBB procedure.
I think used remote PCB will rewrited data from programmed PCF7936

[cammy25]

You guys really dont want to understand what the topic starter is talking about, don't you?

please read his postings again and again carefully to understand.

[paul_12345]

You guys really dont want to understand what the topic starter is talking about, don't you?

please read his postings again and again carefully to understand.

if you mean the people talking about the pcf its you that does not understand what we are on about, we understand that the op is on about retrieving the data from the remote, we are on about something else.

You did not enter any VIN but I'm sure that the BSI automatically took the VIN from the ECU in the learning procedure. When you programed the key the BSI had the VIN and the pincode inside.
Even if you know the VIN and the pin from the car that the key belongs how do you unlock it to mach it on another car?
It is known that PCF and the remote are linked together and you cannot use the remote with other transponder.
Why would you look at the PCF when the problem is the info on the remote?
When you program a NEW transponder isn't that coded with the VIN or the pin or a secret key and locked on that car???? And why doesn't work with the remote?
SO the info that must be cracked and understand is in the remote. By cracking that info you can match a blank PCF to it and only after that you my program it to new car.

You got it now? Or still not convinced?

you dont understand what ninja is saying.. he is saying virgin bsi has not got remote info, yet keys already programmed to that car can be reused.

He knows that a blank pcf wont work, but if you remove the remote info from the car and reuse key then this means during the programming procedure it must be either unlocking the pcf and using the data to write back to the car, or during first programming theres more happening which allows the reusing of the original key.

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

[mihotd]

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

You're right this will be a versatile method for solving the problem. But it will be very hard to find out the connection between PIN(either VIN) and PCF key. To do this we must do reverse engineering of BSI. Maybe we can start with collecting bsi eeprom dumps and (if available) ROM dumps, I mean nec cpu based units.

p.s: The only advantage of my method is that you need nothing but a remote pcb for making working key, even without seeing original pcf/bsi/vin/pin etc.

[paul_12345]

if you had a transponder sniffer you would be able to see what password the transponder gets set to, then it may be easy.

[ninja123]

paul_12345 - im so glad someone is on my level here, this subject has bugged me for a while now, I would love to see the answer to exist in the remote data reading, but i dont think this will happen.

Here is another one for you guys to consider - I but new remotes from same supplier, I always read pcf before programming just in case its not the correct type, then I can use again with new pcf.

Yesterday, I checked the dumps of 7 pcf7936 chips, all from same type remotes, all from same supplier, and all data is the same, every page identical.

I made a key for my moms picasso and one for the guy up the road, today I got both cars together and tried to re sync each others remotes to other cars - not worked - but both remotes started life with same data.

Any one care to explain this one then?

ninja

[paul_12345]

paul_12345 - im so glad someone is on my level here, this subject has bugged me for a while now, I would love to see the answer to exist in the remote data reading, but i dont think this will happen.

Here is another one for you guys to consider - I but new remotes from same supplier, I always read pcf before programming just in case its not the correct type, then I can use again with new pcf.

Yesterday, I checked the dumps of 7 pcf7936 chips, all from same type remotes, all from same supplier, and all data is the same, every page identical.

I made a key for my moms picasso and one for the guy up the road, today I got both cars together and tried to re sync each others remotes to other cars - not worked - but both remotes started life with same data.

Any one care to explain this one then?

ninja

if you use a new pcf with the key from 1 car on the other car then I assume it still programs in?

if so then that fits in with the theory of the password being set to something specific to the car, hence why you can't reuse the 1 key on the other car as once programmed they will have a unique password specific to that car, when reprogramming on the original car it will have the same password allowing the pcf to be unlocked and programed in ok.

[mihotd]

@ninja
Several PCF7936 's with exactly identical ALL pages??? Impossible!
Something with the reading has to be wrong. At least serial number will be different.
Even on chinese spare keys they put different remote data (in pcf7922).

can you post pcf dump to see what is going on there?

[ninja123]

ill post them later, I have looked at all the dumps taken from the same type of remote, and believe me, they are the same.

Paul12345, I think the same but im still at a loss as to how this works after using a second hand bsi, as there is no vehicle specific data in the used bsi as it came from another car, and I have done these without programming the new vin into bsi.

ninja

[paul_12345]

maybe its calculated from pincode, or getting some data from ecu. Something to try.. new ecu edit pincode to the old one, then see if you can reuse key, if it works change pincode and try again to reuse.

[ninja123]

I dont think any ecu data is taken into account, Im not 100% sure, but I may have programmed keys back into a virgin bsi without engine ecu connected, in which case, pin code is only option, so to unlock the transponder, the secret key is an algo of the pin code maybe............

ninja

[cammy25]

if you mean the people talking about the pcf its you that does not understand what we are on about, we understand that the op is on about retrieving the data from the remote, we are on about something else.



you dont understand what ninja is saying.. he is saying virgin bsi has not got remote info, yet keys already programmed to that car can be reused.

He knows that a blank pcf wont work, but if you remove the remote info from the car and reuse key then this means during the programming procedure it must be either unlocking the pcf and using the data to write back to the car, or during first programming theres more happening which allows the reusing of the original key.

if the pcf password can be worked out from pincode or vin etc this is far better than any method provided you know the data from the car the 2nd key came from, as you would not have to open the key and would probably work with any PSA remote type.

Yeah Im the crazy one here....

I dont think any ecu data is taken into account, Im not 100% sure, but I may have programmed keys back into a virgin bsi without engine ecu connected, in which case, pin code is only option, so to unlock the transponder, the secret key is an algo of the pin code maybe............

ninja

Thats right Ninja123 ,Password is 100% calculated out of pin.

[ninja123]

If you know this, then do you also know the algo to break this open?

ninja