CAS3 - Added PCF7945 - 868MHz Remote not working (car starts)

[XProfig]

Hello,

I recently added a new chinese PCF7945 key to an unused slot in my CAS3. I only used EFFi with Zed-Bull v508.
How I determined the Hitag2 data:
- Crypto Hi Lo , Psw --> CAS3+ Editor from CAS dump (read by Xprog)
- User pages 4..7 --> Copied from original working key

With the new key I can start the engine now, but only the remote is not working.

What I tried:
- Copy remote data (RSK Lo,Hi, RCF, SYNC) from original key to new PCF7945 (was not possible with EFFi, had to use Zed-Qx). --> Still not working
- Check if remote actually sends data. Watched INPA RC status while pushing remote buttons. --> Ok. Data is received

Is there any possibility to initialize the remote in CAS (e.g. with TOOL32)? There are opposite statements in internet. Some people say remote data pages get written by CAS automatically. Others say remote data according to key position has to be written with key programmer tool.

Does anybody know a tool (which I can use w/o dongle HW) which displays remote data in CAS so I can program it to the PCF? CAS3+ Editor doesn't.

Please no answers like "go to locksmith" or "buy other tool". I want to get the job done with the tools I already have. It's kind of an hobby to get things working.

It would be very nice if someone could assist bringing the remote to work.

Thanks in advance for your help.

[tagirdn]

Are you sure you have an 868 frequency in your car or key? If the car is 868 frequency, which should be visible in the device, then open your key and see where the resistor is. The remote control should register automatically.


Nothing personal, but often those who make keys as a hobby, lower prices below the baseboard. then they ask for help.

[XProfig]

Thanks for your answer.

I already checked the resistor in the PCB. It's soldered to the 868 MHz position. As mentioned I am able to see data being received when pushing the remote button, so this part should be fine.

Nothing personal, but often those who make keys as a hobby, lower prices below the baseboard. then they ask for help.

I can understand your worries. But in my case I'm only interested in the technical aspect. I don't want to offer a key programming service. Regarding the time I already spent in my investigations, this would not even pay off.

[p1et]

But all this technical aspect might be worh sh1t now because many chinese boards are just faulty so you might work on it forever and it will not work. Like 50% of 10 keys which I ordered from china, had that issue that remote wasn't working so keep that in mind. Now I use only original.

[tagirdn]

In your case, it is advisable to carry out diagnostics and make a test of updating the Central lock. so remotely, you will not be able to help. the problem may just be the fuse.

[XProfig]

But all this technical aspect might be worh sh1t now because many chinese boards are just faulty so you might work on it forever and it will not work. Like 50% of 10 keys which I ordered from china, had that issue that remote wasn't working so keep that in mind. Now I use only original.

That's a good point. But I don't understand WHY the CAS should not be able to program the Remote pages. I actually am able to program it with Zed Bull, so why shouldn't the CAS be?

In your case, it is advisable to carry out diagnostics and make a test of updating the Central lock. so remotely, you will not be able to help. the problem may just be the fuse.

What do you mean by "updating the Central lock"? Updating the CAS SW? I already "carried out" diagnosis, there is neither an entry in Error Memory nor in Information Memory in CAS.

To make it clear, the Remote works just fine with the orignal factory Key. So I don't think that it has to do anything with a fuse (at least not the mechanical fuse).

[tagirdn]

Unfortunately, Google does not always translate correctly. The problem may be the fuse. You need to do a car diagnostic. If you have something to do it with. In diagnostics, there is an update menu. This is necessary in order to check the performance of one or another block.

[XProfig]

I have the original BMW tools INPA and Tool32. Could you tell what I need to update exactly?

[jacek77]

since original remote works fine its a bad key or wrong frequency. Also check if key is sending out a frequency signal

[tagirdn]

I have the original BMW tools INPA and Tool32. Could you tell what I need to update exactly?

Do not update, but pass the Central lock health check test.

[XProfig]

Do not update, but pass the Central lock health check test.

Sorry, I really can't imagine what this health check is. Could you maybe show me a link?


In the meanwhile I eventually found the problem:
What I thought I programmed as remote data actually wasn't the remote data. It was the user data Page4..7.

In Zed-Bull v508 tool, if you select PCF7942/44, then the user pages are greyed out and the Remote pages are activated. BUT if I read my PCF7945 with this setting, then the Remote pages ACTUALLY ARE the user pages. So i read out the user data but I thought it would be the remote data.
ZedBull_Remote_page.jpg

After some more research I noticed that selection between remote and user page access is actually done by BSEL bit in TCMF/PSW page.
Unfortunately in my case the TCMF/PSW page is already locked (my configuration: C8). So now I don't have access to the remote page anymore.

My guess how it should work:
For preparation of a PCF7945 key, one must write the correct Hitag2 pg1...7 first, as I also did, but without locking anything (TMCF=0x00).
When you use the key in car the first time, CAS writes correct remote data (access to remote pages with BSEL=0) first. Afterwards, it writes TMCF automatically. So in the further life of the key, remote pages have the correct data.

Anybody here with deeper knowledge of the CAS<->PCF interaction who can confirm this?

Is there a possibility to reset the TMCF config byte with Hitag2 functionality?

[PierreTheron]

Yes pages gets locked after programmming . i only did research on renault pcf,s chip to correctly preprogram the pages for central locking on sandero and NP200 before you program the key .. .
You can edit the remote pages with old clone zedbull or tango so they work correctly ..
On this vehicle i do not know the pages bytes ..
Regards

As p1et is saying brain ..exe might work on these .
Read a an unlocked key with good page date and then copy it to the chinese keys and it will work 100%

[XProfig]

As far as I see there is no possibility to edit the remote pages as soon as Pg3Lock in TMCF is set. That's what I tried to describe in my last post: For writing/reading remote page, you need BSEL=0. But changing this bit is not possible in my case, due to Pg3 Lock bit is activated (Pg3 Lock bit set means it is not possible to modify Pg3).
Or do you see any other possibility? I think it's not a matter of tool but it's given by the PCF itself.

As p1et is saying brain ..exe might work on these .
Read a an unlocked key with good page date and then copy it to the chinese keys and it will work 100%

What do you mean by "unlocked key"? I have of course crypto Hi Lo of my original key, so I can read it. But as in original key also BSEL=1, remote page can't be read out if I'm right.

[tagirdn]

You have an INPA. Make a diagnosis. We're guessing on the coffee grounds. There are many reasons. The fuse. The key. The Central locking unit itself. Stars. Day of the week.

[XProfig]

You have an INPA. Make a diagnosis. We're guessing on the coffee grounds. There are many reasons. The fuse. The key. The Central locking unit itself. Stars. Day of the week.

As I already mentioned, central lock is 100% working. Original Remote is working fine, car can be locked with this. So there is no problem with the fuse!

And as I already told there is no error memory entry.
The only thing I can see is the difference between the Status_2 of the keys:

IMG_20201219_144646.jpg


My original key is key 1, the new key with not working remote is key4.

Most likely this state shows that CAS is not able to write necessary data to the remote page because remote page acces is not possible. Thy is because I made a mistake when initially programming the PCF (as described in detail in my last post).