BMW X1 "forgets" duplicte key made with Tango clone! How now? CAS3+ 0L015Y (512k)

**Willisodhiambo** · 10th February, 2019, 05:46 PM

I made a spare key for an X1 with CAS3. Tango declared it a CAS3+ crypto and asked for spare key, DME dump or ISN. It failed to read working key! Option available to me was DME ISN. I loaded cas eeprom into CAS3 Editor. Editor extracted a long ISN in 3 rows
F8 9F 5C FA D1 5B AE 47 F4 B5 61 0D 7E E9 82 80
07 60 A3 05 2E A4 51 B8 0B 4A 9E F2 81 16 7D 7F
52 35 F6 50 7B F1 04 ED 5E 1F CB A7 D4 43 28 2A

First, how many bit ISN is that? 16 or 48bit. Tried row 1 in Tango, failure. Tried row 2, success!!! Made a key then the drama started,
> Key is recognized and cluster comes on
> Crank, no start!!
> DME/EWS tamper DTC

Started car with original key in comfort, with engine running, slotted spare into key slot. Tossed original key far from car. Remote key works perfectly and can now start car. Leave car to go to sleep. Crank, no start with spare key!!! I have to start var with original, then spare will take up if slotted into key hole with running engine......until cas goes to sleep, then it forgets the spare!!

I need to understand what is happening. Expecting Yanhua mini in a week or so to try make a third key just to test again. Any ideas? I am suspicious the ISN I used from CAS is not 100% correct. maybe I could read DME ISN but I have no tool yet to extract DME ISN and i dont trust tango clone to do it since it failed to do an MSD81 dme dump I tried before. Someone who had read this car's DME ISN before claims it kept changing with each read. I dont know whether to believe that or call them crazy

**K1nd3r** · 10th February, 2019, 05:52 PM

if new key not locked, repeat procedure

**tomvleeuwen** · 10th February, 2019, 07:59 PM

These three ISN's are just each others inverse (1st and 2nd) or half of the bits are flipped (3rd). I never figured out why CAS stores the ISN in 3 different ways but it is always like this.
The first ISN is the one as stored in the CAS that can be decrypted using working key to get the DME ISN. Or you can read the ISN directly from DME.
You can't just choose one of those and hope it will work.

TL;DR you need long ISN from DME or page3 from working key.

**Willisodhiambo** · 11th February, 2019, 09:36 AM

Tango failed to read working key! I may have to try get DME ISN with Autohex but someone who did a key before me tells me the same thing happened. Not sure whether to believe that or not.

Ill try another key and see.

**Willisodhiambo** · 11th February, 2019, 09:42 AM

I did not check if it is locked or not. I recall Tango asking which option I wanted, locked or not locked. The PCF options for locked PCF7395 different from the PCF I had (ending in 45) so I choose the option with correct PCF version PCF7345. Not sure if this is an issue.

**igorr** · 11th February, 2019, 02:32 PM

Originally Posted by Willisodhiambo

Tango failed to read working key! I may have to try get DME ISN with Autohex but someone who did a key before me tells me the same thing happened. Not sure whether to believe that or not.

Ill try another key and see.

scorpio forum

**EMCE159** · 11th February, 2019, 02:41 PM

Originally Posted by igorr

scorpio forum

He is using clone

**holbi1** · 11th February, 2019, 02:48 PM

This is clone Tango or ori?

**holbi1** · 11th February, 2019, 08:52 PM

So be carfull guys

**dijo** · 11th February, 2019, 11:17 PM

Originally Posted by Willisodhiambo

I made a spare key for an X1 with CAS3. Tango declared it a CAS3+ crypto and asked for spare key, DME dump or ISN. It failed to read working key! Option available to me was DME ISN. I loaded cas eeprom into CAS3 Editor. Editor extracted a long ISN in 3 rows
F8 9F 5C FA D1 5B AE 47 F4 B5 61 0D 7E E9 82 80
07 60 A3 05 2E A4 51 B8 0B 4A 9E F2 81 16 7D 7F
52 35 F6 50 7B F1 04 ED 5E 1F CB A7 D4 43 28 2A

First, how many bit ISN is that? 16 or 48bit. Tried row 1 in Tango, failure. Tried row 2, success!!! Made a key then the drama started,
> Key is recognized and cluster comes on
> Crank, no start!!
> DME/EWS tamper DTC

Started car with original key in comfort, with engine running, slotted spare into key slot. Tossed original key far from car. Remote key works perfectly and can now start car. Leave car to go to sleep. Crank, no start with spare key!!! I have to start var with original, then spare will take up if slotted into key hole with running engine......until cas goes to sleep, then it forgets the spare!!

I need to understand what is happening. Expecting Yanhua mini in a week or so to try make a third key just to test again. Any ideas? I am suspicious the ISN I used from CAS is not 100% correct. maybe I could read DME ISN but I have no tool yet to extract DME ISN and i dont trust tango clone to do it since it failed to do an MSD81 dme dump I tried before. Someone who had read this car's DME ISN before claims it kept changing with each read. I dont know whether to believe that or call them crazy

Post your Ori Cas dump " ORI Cas Dump"...
post screen that you get when reading your key with Hitag...

**Willisodhiambo** · 13th February, 2019, 07:07 AM

I don't have the Key with me but will read key and post.

Here are the dumps, original and the one for spare key in position 2. I over wrote that position so comfort access works straight off