I made a spare key for an X1 with CAS3. Tango declared it a CAS3+ crypto and asked for spare key, DME dump or ISN. It failed to read working key! Option available to me was DME ISN. I loaded cas eeprom into CAS3 Editor. Editor extracted a long ISN in 3 rows
F8 9F 5C FA D1 5B AE 47 F4 B5 61 0D 7E E9 82 80
07 60 A3 05 2E A4 51 B8 0B 4A 9E F2 81 16 7D 7F
52 35 F6 50 7B F1 04 ED 5E 1F CB A7 D4 43 28 2A
First, how many bit ISN is that? 16 or 48bit. Tried row 1 in Tango, failure. Tried row 2, success!!! Made a key then the drama started,
> Key is recognized and cluster comes on
> Crank, no start!!
> DME/EWS tamper DTC
Started car with original key in comfort, with engine running, slotted spare into key slot. Tossed original key far from car. Remote key works perfectly and can now start car. Leave car to go to sleep. Crank, no start with spare key!!! I have to start var with original, then spare will take up if slotted into key hole with running engine......until cas goes to sleep, then it forgets the spare!!
I need to understand what is happening. Expecting Yanhua mini in a week or so to try make a third key just to test again. Any ideas? I am suspicious the ISN I used from CAS is not 100% correct. maybe I could read DME ISN but I have no tool yet to extract DME ISN and i dont trust tango clone to do it since it failed to do an MSD81 dme dump I tried before. Someone who had read this car's DME ISN before claims it kept changing with each read. I dont know whether to believe that or call them crazy
Bookmarks