Citroen Xsara|| 2001 remote

[mahmoud10th]

how can i know remote TYPE from remote signals ?

[mahmoud10th]

Digging in BSI
in the left my BSI
in the right another BSI dump from search which it might have a remote or 2 keys i don't know ?




if some one have the experience with this dumps and where is the remote id stored please inform me

Sharaf

[Zmann]

All egg-shaped remotes are made by Delphi and all should be ASK (but not with PSA encryption I think). They are about one generation older than the current rectangular shape or the right remote in your photo. There should be no FSK at that time.

If you're interested in learning PSA remote this thread should be interest you.

[mahmoud10th]

. If you're interested in learning PSA remote this thread should be interest you.

i have opened that thread many times but nothing useful for citroen xsara it's about Peugeot 307 and i think it's a little different from each other

[mahmoud10th]

As deferent between Xsara and C3 in lexia can add remote code or change it
But in Xsara you can't because the option is not available .

Sharaf

[mahmoud10th]

All egg-shaped remotes are made by Delphi and all should be ASK (but not with PSA encryption I think). They are about one generation older than the current rectangular shape or the right remote in your photo. There should be no FSK at that time.

Yes ASK


this data test with KD 900


and this with KD-X2 captured by mobile camera

all the data above for my remote

used Base Conversion app I got this hex [2CAC]

DEC: 14075466820780
BIN: 00 1100 1100 1101 0011 0011 0011 0011 0010 1100 1010 1100
OCT: 314646314626254
HEX: CCD33332CAC

Other app I got this hex [CB2B]

DEC: 219929168683
BIN: 11 0011 0011 0100 1100 1100 1100 1011 0010 1011
OCT: 3146463145453
HEX: 3334CCCB2B

Sharaf

[Zmann]

Can you please check your Xsara BSI para on Immo page and see if there is an encryption type detail, and it shouldn't be PSA as in 206 I guess ?

Then I'll post more later

[mahmoud10th]

Can you please check your Xsara BSI para on Immo page and see if there is an encryption type detail, and it shouldn't be PSA as in 206 I guess ?

Then I'll post more later

I have asked a friend to get this info to me only found this info on seder / service box

Sharaf

[mahmoud10th]

433.92 MHZ HETERODYNE !!

If you recommend other tool to check with it I will try to deal with it

The BSI Vin number is:

VF7N1NFUB73206027

Sharaf

[mahmoud10th]

keydiy PSA CIR40 programmed with sbb ok

@autoTkey said at ********KD900 remote generator******** thread :
18th November, 2017, 10:28 AM

Just spent an hour trying the same thing. KeyDIY still no good for the K-line PSA cars...
It was a Peugeot 307, year 2001.
I tried:
- 307 OLD FLAT A NB Multifunction (car didn't accept it)
- 307 OLD FLAT B NB Mulitifunction
- PSA CIR40
- PSA CIR41
- PSA CIR43
- PSA CIR44
- PSA CIR46
- PSA CIR51 Peugeot 406 2001-2004
- PSA CIR53 (car didn't accept it)
- PSA CIR57 Peugeot 307 2001-28.03.2005
All were accepted by the car except where noted else. Meaning they start the engine, but don't lock/unlock the doors.

Also I think it's the same as Xsara

Sharaf

[mahmoud10th]

Today i have made a test just to see what will happen
- started to read the PCf7936 inside the keys i have (my key&used keys) using ZEDBULL with HITAGE2
First key

EBDFF612

already learned with lexia before with new PCF7936 with the original flip remote
second

E6484B12

already learned with lexia before with keydiy remote all in one
{but no remotes working }
third

0214AA13

used / second hand
fourth

14E08B13

used / second hand

- toke the BSI out of the car and read the 95040 eeprom and searched for the first key hex and found it in two parts
first part was in offset 20

EBDFF6

12 was missing !!
second part was in offset 1A0

EBDFF612

was complete as HITAGE2 readings
- so i started to change some
i putted the third key hex data instead of the first key
- saved and retrieve every thing back tried to start the car
the car passed the security lamp but the engine didn't started
i don't know why
At the end of playing i restored every thing back because the car didn't started and no remote works .

[Zmann]

Nothing meaningfull, HETERODYNE is the name of part of RF demoduration technique.

Also, ASK/FSK are moduration mode not encryption type.

If need to read more about RKE system you may try to search for a pdf coded AN1200-07 published by Semtech. Anyway I just quickly re-try and found that Semtech might replace the doc with something else not any more "RKE Demo with Encrypted Rolling Code" but with the same AN number

I found the doc is good for basic understanding of RKE system. The remote codes you metioned from my old image you repost are technically called "Header or Network ID". It's the part of plain text data in RF package when transmitted. PSA treated this part of the data by tying it to each of their car models (at that time) and the correctness of Network ID is managed by BSI software.

But seems this's applicable only to the car models that use remote made by Valeo (topic of the thread I mentioned) which they called them PSA encryption as seeing on my previous attachment. But the Delphi remote is completely something else, anyway I hope it might be a bit useful to know.

ps. I've written a draft of this post since yesterday and before seeing your new more posts now.

[RFRemotes]

EBDFF6 is your remote code as well as both 2C0549 and 8EA958 from other dump (with PIN G9QC)
Your key can be unlocked with ISK 191F2218477E (for PIN SEYF) or ISK 221F19187E47 (for PIN FYES)

[mahmoud10th]

Nothing meaningfull, HETERODYNE is the name of part of RF demoduration technique.

Also, ASK/FSK are moduration mode not encryption type.

If need to read more about RKE system you may try to search for a pdf coded AN1200-07 published by Semtech. Anyway I just quickly re-try and found that Semtech might replace the doc with something else not any more "RKE Demo with Encrypted Rolling Code" but with the same AN number

I found the doc is good for basic understanding of RKE system. The remote codes you metioned from my old image you repost are technically called "Header or Network ID". It's the part of plain text data in RF package when transmitted. PSA treated this part of the data by tying it to each of their car models (at that time) and the correctness of Network ID is managed by BSI software.

But seems this's applicable only to the car models that use remote made by Valeo (topic of the thread I mentioned) which they called them PSA encryption as seeing on my previous attachment. But the Delphi remote is completely something else, anyway I hope it might be a bit useful to know.

ps. I've written a draft of this post since yesterday and before seeing your new more posts now.

thank you

[mahmoud10th]

EBDFF6 is your remote code as well as both 2C0549 and 8EA958 from other dump (with PIN G9QC)
Your key can be unlocked with ISK 191F2218477E (for PIN SEYF) or ISK 221F19187E47 (for PIN FYES)

thank you for the isk
but what can i do with it
dose this belong to crypto hi , crypto low of the factory coding in hitag2 ? or i am wrong
and how can i detect the remote id ?
or add it
still not clear for me , as i am new for this remotes