Technical details - BMW CAS3 Remote production

[XProfig]

Hello all,

in the past I learned a lot about programming remote data (RSK Hi/Lo, Remote ID etc.) to a 5WK49125 PCF7945 CAS3 key. With this knowledge I implemented the related functionality in the open source hitag programmer project https://www.digital-kaos.co.uk/forum...tag-Programmer
Now I would like to understand the procedure at CAS3 side as well.

Question: How to learn a Remote to CAS3?
In this thread I would like to collect some info on the technical details.

For testing, I programmed both the remote and Hitag2 data read from an empty key slot in CAS3 to a 5WK49125 key. This key was able to start the car, but the remote did not work.
When producing a key with e.g. Hitag2 v3.1 tool, a modified CAS3 EEPROM bin is generated, which is supposed to be programmed back to CAS3. After doing that, the remote would work.

But when ordering a new key from BMW dealer, both Immo and Remote is working straight away, without programming anything to CAS3.
Key question: What makes the difference to a dealer key?
What data is required on the key in order to make CAS3 automatically learning the Remote?

Just for comparison, below the situation for the immo:
Producing a key working with the CAS3 immo is quite simple. Write the Hitag2 data corresponding to an empty key slot of CAS3 to the key. As soon as that key is inserted in the car, CAS3 learns the key's Hitag2 ID to the corresponding memory slot. From then, the key is able to start the engine. Writing any data to CAS3 EEPROM is not required.

I would appreciate if some experts with deeper knowledge could provide some info.

Thanks in advance to the people sheding some light on it.

Best regards

[mbi]

For testing, I programmed both the remote and Hitag2 data read from an empty key slot in CAS3 to a 5WK49125 key. This key was able to start the car, but the remote did not work.

I will share my experience.

I transferred keys from one CAS to another successfully (remote works). And I programmed a new key also (remote works). Using AESHiteger.

In CAS3 0L15Y before Hitag2 data block:
at adres 0x068 there are 10 bytes (11th byte is crc),
at adres 0xA74 there are 10 bytes (11th byte is crc),
at adres 0xA80 there are 10 bytes (11th byte is crc),

10 bytes coresponding to 10 key slots.

After you program Hitag2 data and remote data (using your tool in AESHiteger) for empty key slot you have to do one more thing to make remote work.

For every of that three 10 bytes rows, you have to change byte corresponding to the key slot you are programming.

You have to change this byte (in every row) to byte the same as it is for working remote. In most cases, working remote are (were) in two first slots.

I'm attaching example for programing key on slot 9.

[XProfig]

Thanks a lot for giving a first idea. But for using that method, I need to modify the CAS3 eeprom after having the key prepared.

When you get a key from BMW dealer, you don't need to change anything on CAS3. The key works right away. This means that CAS3 automatically learns the new key.
My question is, what data needs to be written to the 5WK49125 EEPROM to make the CAS3 autmoatically learn the remote?

[rokibar]

I am not expert for bmw but this is interesting for me also. Bmw have key data base for all theys cars. Logicaly they are some synhro bytes for autosynhronisation in key from dieer but it will stay mistery.
This is my thinking only.

[fuzz1]

https://www.google.com/url?sa=t&sour...4B-DhorBIHS6Ar



Check this. Maybe it might be helpful to you.

[XProfig]

https://www.google.com/url?sa=t&sour...4B-DhorBIHS6Ar



Check this. Maybe it might be helpful to you.

I already know this document. But unfortunately it does not help. It describes the protocol between Remote and car.
As I wrote in the initial post, we do not have problems with getting the Remote to work in general. We already know how CAS3 memory needs to be modified and we know which data to write to the Key.

This thread is only about "how to make a CAS3 learn the remote automatically, just same as it does with a key ordered from the dealer (Remote ID, RSK Hi/Lo, Key Nr. and config programmed to key before)".