Reusing old Peugeot/Citroen remotes type 73373067B,C

[mihotd]

In Citroen and Peugeot the remote is precoded with the transponder. Changing transponder makes the remote stop working. In other words transponder and remote are matched in factory. When you program new transponder it must contain also data for remote. This is needed for BSI module to recognize rf transmissions from the remote.
You can reuse old remotes if you know what kind of data to write into transponder. It is placed in USER 0,1,2,3 pages in PCF7936.
Actual problem is retrieving data from an old, used remote and then put it into blank transponder.

Here is a way to get this data. We need several things to do this: some used (but still working) remotes with fresh battery.
A kind of "reader" based on PIC12F629 and a way to get the data into PC (I use so called USB-to-TTL converter), only RX channel needed and software is the ordinary HyperTerminal for windows (or some of xxxCOM apps if you're using Linux)
Here are the pads used on the remote.
Next part coming soon ...

[workdamnyou]

Good work mate...

Looking forward to seeing how this can be done.

[mihotd]

Part 2: Info, schematics and hex

All needed to build the reader is attached.
To get data open HyperTerminal, make a new connection and in screen "connect to" choose COMx (where USB to UART is).
In COMx properties window press "restore defaults" then OK.
If you made everytthing correctly you'll get a screen like attached one with remote data when you press a button.
This data is different each time (only first two bytes remain the same) and this is expected, data from remotes is scrambled and rolling code.
Calculator to produce transponder data exists (not free service though) and output is 4 bytes, which must be written in PCF7936.

Here is the point where I need your help guys: I need data from some old remote + old transponder (paired ones!) to figure out how these calculated 4 bytes are written into transponder.
Building all this stuff described above is a boring job, I agree. Also needs some effort and knowledge but if there are interested people I think we can resolve this whole problem which stays here for years.

BR

[kerekt]

question : how to read 7936 with Hitag2 if PIN is known ?

[mihotd]

question : how to read 7936 with Hitag2 if PIN is known ?

There is no PIN for transponder. Did you mean SK (secret key 48bits) ? If so, you can read it with tango hitag2 by entering 6 bytes in the key field for crypto mode (not password mode).

Actually all transponders from peugeot I've seen are locked
It seems that USER pages can be read only on new, prepared for programming in car key (new couple of 7936 + remote pcb from PSA)

[igorr]

how to open PSA reader

[ninja123]

is there not a way/equipment that can read the data from the IC on the remote board? Surely then after reading a couple of new ones and reading pcf7936 pages from the same remote - before programming, we could work out what data and where etc.

I dont mind butchering a few new ones if we are getting somewhere with this, but only a few as they are so flippin expensive!

Building that stuff above looks a little past me but ill have a go....

ninja

[paul_12345]

is there not a way/equipment that can read the data from the IC on the remote board? Surely then after reading a couple of new ones and reading pcf7936 pages from the same remote - before programming, we could work out what data and where etc.

I dont mind butchering a few new ones if we are getting somewhere with this, but only a few as they are so flippin expensive!

Building that stuff above looks a little past me but ill have a go....

ninja

if you read a new key you will have the data to reprogram that remote to another car, trouble with used remotes you have not got that data and the remote will only broadcast the rolling code.

So you would need to know the algorithm the key is using so you could turn the rolling code back into the orignal data.

This is what the OP want to figure out i.e. get a load of samples of data to try to figure the algorith.. although could be very hard

[mihotd]

I have calculator for [rolling code] -> [original data]
But don't know how it is written into transponder.
Only a guess: 4 bytes of original data into USER0 page and inversed values of these written into USER1 page.

Also there can be aadditional coding in body module, that's what i want to figure out

[paul_12345]

so your the one that offering the 4 byte from rolling code for $$$$$ then you want others help to finish your project ??

If you really want to solve why not post calculator!

[ninja123]

ok, i know there is no rolling code algo stored in transponder pages, only solid non rolling data, so, any algo's used here are either in remote or bsi, i presume bsi, as a re sync procedure is available and works all the time.

And how can you get samples when then transponder is locked during programming?

The only way I see is reading new/virgin remotes/transponders and working from there.

I just dont know how to move on from this or I would....

ninja

[mihotd]

so your the one that offering the 4 byte from rolling code for $$$$$ then you want others help to finish your project ??

If you really want to solve why not post calculator!

I can find out the remaining things for this algo alone but I think it's not worth the effort. I already spent a lot of time and money to get there, so i will not post calculator now, maybe later time (it is not a program in fact).
If someone wants to calculate data from rolling code I will calculate it, no problem (and not for $$$$ !)

Nobody is is obliged to help me, i can do it alone, just want to save time and money, that's all.

[kerekt]

how to find this 6bytes in bsi to read transponder in crypto mode?

There is no PIN for transponder. Did you mean SK (secret key 48bits) ? If so, you can read it with tango hitag2 by entering 6 bytes in the key field for crypto mode (not password mode).

Actually all transponders from peugeot I've seen are locked
It seems that USER pages can be read only on new, prepared for programming in car key (new couple of 7936 + remote pcb from PSA)

[mihotd]

how to find this 6bytes in bsi to read transponder in crypto mode?

I think these bytes are stored in NEC cpu internal eeprom. One of available tools for reading is NecProg programmer.

[mihotd]

Finally I get it. Here is how it works.

Decoded four bytes from remote are written to its corresponding transponder in USER0,1,2 pages. For example we have a remote with bytes E7D020A5, here A5 is remote TYPE, other 3 bytes are remote ID. For such data you must write to PCF7936 the following:

USER 0: 55E7D020 - remote ID, first byte is always heading 55
USER 1: AA182FDF - inverted USER 0 bytes
USER 2: 0A55FFFF - stands for remote type A5 (Pug 307 in this case)
USER 3: no matter - can be FF's (usually some date is stored here, say 05112003 for 5 NOV 2003)