KE) KE Y KEYPRC@INDEX {EYPR Fa SE armen seein casera scauiteertaaece Eon pac open ae, Soares onan tageeieeea crete rot to wrk th he processes shou whe putaon "Me YouRozneo Wie offer NO support fortis type of work, we donot end ‘ Work, we donot endorse no support any ofthe equipment shown within these pages. The toms we use in this work is shown hore meraly as & guidance on how io proceed to accomplish your goal of producing a working product, The etnies used inhi and fate sbeaons ae shown mer kato are shown mere guid to you the reader to.ghe yous star on how o sete tos shown hi ao show you hewi nderana ee tems presened, Ther are many torent prs lola can bo wes beyond oon sho Those shown atest what we cet se ards by no means an endorsement of hee prot ‘4s you ler and move fxwar you wil starr thos ods and ecu at i werk Sat yeu Pease send all correction notes and suggestions to EEPROMBOOK@KEYPRO.COM.| have a current policy of only adjusting year and models to imme type, based on personally secing them. Therefore plasee do not see me notes such a 2008 ‘Mercedes is so and so system" Your assistance wth corectons will geal help me improve futwe editions forthe Industy. Thank You, ‘Skills ‘Thete are certain skils you should acquire before you ate o get into this ‘yp of work. Among them ae Identeaton of Transponder types ‘You musthnow the various types of tan ‘ponder (chips) out there and how o identi them. There relationship o eachother and fais, EEPROM Theory “Theres book by Jeremy Philips tat wl greatly hep you along wth this. The purpose and use of Binary Files. Knowing and dentiying the locaton of Pin #1 ‘These are but afew ofthe examples Computer and tools Know howto use, identity, and how to save fies to your computer. Soldering = This requrementts fest and foremost before you proceed to yng todo EEPROM work. You must know howto take devices off and sucestflly put hem back on ‘working order. We suggest you work wth remates for cars by aking the devices of working re motes, puting them back onto see tha hey continue to wor, Is good way to practice, Another ‘would be buying a cheap calculator and doing the same ting, But tis imperative that you can do these skis wel Model Reference - _Onthetolowing pages we wi ist an indo ofthe mas by tree rode! Year Reading device, wheter ks a dec read or conversion. The dtc factor and he pages tobe found en ‘ekey Pro USA LLC IntroductionTable Of Contents ‘outa ‘aust Model sx ae x6 xs xs Years) ( ficatcs 199705 1996.04 2002055 2001055, 2005509, 200808 2007 2000.05 200807 Rea ana2 Anse Xrog, ana2 ‘smox. orange 5 naz aso ‘smox nso. anoo. Koo Koo ssmox Koo Not Standards oe Tango Tango Tango Tango Tan Taneo Tango Tango Tango meyCione Table of Contents Removal Reading ofTarget of Target Removal Reading Romuewal Reading Roading. Key Pro USALLC Page: veg28 vag 45, vag26 emw7 Bmw mw a mw 7 enw 7 enw 7 emwa oma. emw7 enw a mwa ew 7 adc a 2a o 2 2 2 2 =a 2 a = = =@ a = AdddMAAAAAAAAAAAAAAAAAEEWUVVVFVUVUT TUITE EEUU RUE URE EUESELUL LULL ee eee ‘Table Of Contents MAKE Mode! Bmw za Bmw 2a Bmw 2a Buick Lacrosse adie catera cate Ts caattae Ts Cchovlot camaro Chevrolet craze Chevrolet Equinox Chevrolet HHR Chevrolet Impala Chevrolet Chevrolet ‘chevrolet Pick Up ‘chevrolet Sonic Chevrolet Suburban Ccnyster 300 Cchyster 300 Cchryster 300 ennyster Crossfire Cohnsler Concorde okey Pro USA LLC 2on1a3 201013 2006095 200507 2013 2006095 201213 2006005, 1999.00" 199900" 2006 2004 1999.00* Read/ aKso Ko ‘smoK Orange S naz ans2 ana2 naz ans2 naz naz orange 5 naa naa naz naz orange 5 ‘smox orange 5 ans2 Converter MeyClone Tango Tango Taneo Tango Tange Tm Tengo Tango Tango Tango TMPro Tango Tango Tango ‘KoyCione Tango “abe of Contents Removal aaa Ramat Removal Parsarad Pomerat Romovnl omen Roading Readlaa Roadie Reading Fanuiaal ew 7 eww 4 oma7 oma oma7 oma oma conny cone conny23 ma20 cones ee41Most models ised first require tho lower Kick panel tobe removed, The Target Modules usu fal located on the river's side “A pila, 610 10 2S in place, we can already tei’ EWS4 because ofthe white abel with black writing EWS3 has green text. (8 10mm) secures the EWS4 in3.Here is the module on the bench, 4.Freed from the box, here is the ‘Same socket, same off white plas- board, Our Target Device tic box but black text reads 2186 S.Ifyou open the SMOK Help identy, clean, and | usually presolder Files, search EWS4, this solder 2 bitof solder to each pon. Then soder aa points image should be found, ‘colored lns othe points. 7 ttl preitresear ctor renee Seria een ee ees poraeeetes Pecsirieuacnc nas aeSave Save Save. File As always use a 10.Now we need to open the file in the 41.Click the Blue le Open But: 12 Mak sxe aa ton, then the ORGS Meine he ov ws ~ eee hat happens isthe Tango isolates the transponder the fat me i tuned tion. Ths fe when wl lock and then art to rl myn wt the vehicles memory. Shs exlans why we only have to etract the BIN once but a0 cannot cone the transpond: fers. Vth that saved BIN you wil ever nave ‘ura the fe again and ean also produce ‘more wansponders. Tis also gives us the abi ‘ty to ovet de postions in the BIN with new traneponders, an option the dealer eannat fer 13.Watch the money go into your Ts srs bank account, and then return the {,2 parts and test the key. « ee ee ‘exer PoUSALLE owe : UUVIVITIVITI TIVITYiste fst require the lwerkick Stil in place, we can aieady tol its EWS4 anelicbe removed. The Tage! Meas is vsu- because ofthe wile label with black writing ‘aly located onthe vers side pila, Go 10 EWS3 have green text. sesso) Sa (Gor 10mm) Sem vs the Conversion purey to clalty sloned aut ln ammorecentondnet ‘Okey Pro USALLG3.Here is the module on the bench. 4.Freed from the box, here is the ‘Same socket, same off white plas- board. tic box but black text reads Sfyou open the AKSO Help Fies, this solder Glen, clean, and | usualy presolde abit points image should be found. {have found hat of solder to each point. Once soldered, you diferent color have been used by various man- can see the colo issues but thes Ufacturers butthat the numbers ae accurate. rate based onthe numbers, 7. Here is the orientation and col- 8.And just as a bonus, here are ors that my AK90 utilize. Keep in the rear solder points that some mind that yours may differ. prefer to use. #1 VE #6 (Key Pro USALLCwert AxSO conned othe PC, Clk tuo 12 Rea WS vn me en aI nda tiedadeetypecTnen selec stodieebepowssh-op.n Pens Sea a) Hee soldered ve CicKOK otc kn Soca Wren a ca Se aanaanana “Tho press can ba compete wih he AKODDUT12_Mae sure an eich BLE the Tango Select hel slol you would sift; keto use. And Button | a => ee srt Ramee"! 0° into YOU TE vmer pers be Teco eons bank account, and then return the jfeineintne BIN nat must ve places on he parts and test the key "ger oon 2 eee fst tin ted inthetgnion, Tiss when wi cck and hen B® © start rotinsyne with the vericle's memory Tis tetana oy we cy hve ic onroct ina EBNonce tt sto cana clon ne vanapond Wt at saves BIN you lever have fo terrane fe apain and can also produce more Vanpendre Tale ge she ab tyre overt postions the Sil Uansponse's an opt the dealer ean eer. key Pro USA Le‘Model Years remove the oP 4.0n these 2.0pen the ebow rest, Rovers the holder, straight upward, Set aside. Great place to store he screws you are about to be Femoving next ‘See the ‘Appendix for the more ‘ekey Pro USALLE ‘ww3.Remove these AOOOObORRRARAL Now the lager vim around the top of em == 6.The fhocertercnrela cana sited on Bg E Side to side, revealing he Target Module. = ; mountedlo aa = the drivers ag side ofthe Key Ger erator> 13.This window gives afew more ‘4 (I know the: details and the option to Open the fmarorae eran eceghictalem alone in File. Click Her nonetheless.) —_—". ee . << ‘Koy Pro USALLC18We know bat ne IKC has accepted the be- 18.18 can seo at. sot muse there were no ener messages an the be glen lta org dstance Wom o ust exaing a “nis screen deplays useful fe) as tone rere ah Rey rere ore man info uch as keys programmed and the syne coder You can aso veut esting onpenaer 17 Nerify that an acceptable transpond- 18.Then er, here @ 7935, is located on top of the and then vey that TP Generated OK" ay IKC hardware as shown on the top. __ea"8. This can take 20 to 48'seconds, new bin file to be generated or named, This is our cue that a rewrite of the de- vice is unnecessary. So return every- thing to the vehicle and test your work. | ™y have provided the following pictures of different locations you may find the EWS modules. A vast majority of them ‘are located near the driver's left foot and are EWS3 generations. See also the BMW immo system spreadsheet we have provided in the Appendix. Key Pro USALLC eww "1AAAAAA AAA addddbaaas 2 eww (Key Pro USALLC.Ise opal hy i ‘ve i yp oo. ocuenedDae: 1185. (Device Reader: ORGS ‘Programmer: ZEDBULL plus EEPROM Applications "Nd St et eo Ad he pon pt Doe 02 adie Oe Otero a Tanne a4 500 foetepeat Trent BIN Enel No PIN tein BIN Fin Tbelieve Ihave listed all examples ofthis system above, check any programmer ‘manuel that listsimmo#l or type #1 and the lists should be sniar. = = = ~ - = = - = - B® tonmestot ie carmodels, he apenance ota Ti @ RadDomeLEDontnetop of necash stow. 2 OUT ese ” ” = = = = 2 » e » * . » s Jon te wndshei nd sighy oe passangess_ OF antenna around the ignition lock ‘eof theca, 2a sob eaten oe mo sy tem Have ie cstomer check Before you uate Key ProUSALLC CHRYSLER< 4.Remove the 2 or 3 720 that secure: 3.Remove the T20 that se- Shroud around the column, Some cures the tilt handle in place. times a skinny shafted driver is required s ia 5 Lookng straight up ftom the floor here isa 6 Here is our Sentery Key Immo Module gg} ew ofthe Tame *SKIM.” Different vehicles will use varia- ‘and remove he sine SUt: on indesign but the boars the same. cap tnbersene Mewoponatatgelehe issrciine ice tecw na Sh aeeeeteegi ne © om below on hat favor cued ator fame sido, Then swich IRB oU _- ‘CHRYSLER, okey PIOUSA LLC9. Fi usual with an unknown module, | choose to desolder the device. It's only 8 legs. 11 recommend conning te deve tos adap toc at your eariest convenience ust be cattul wih these “Clam Shell fype asthe release lever is easy to bump open and eject he device, (key Pro USA LLC __ tempt would be aread under 24.C028 lly our Target Device, 24.6028. AS 10.Re hi Hot Air. And remove the di 12. Now insert the loaded adaptor in- to the ORGS hardware, | recommend using bright nail polish to mark your PIN 1 orien- tation on the adaptor and the ORGS to speed up the process til you can remem- ber in the future Chip was 24.002 0 we use that I the prograrmer ‘tunon come von, find save vary ead along the roam Common CHRYSLER,c us displays 22m TPKE Bl Chek OK ond we a What we already know. Place your choice of ‘8. Gacause we coed afey cuore IN. at tat Ppeaeee mae Whe Sul sotMLOMMN Sire oerchnn cncetrscnmsureraonnn cc” = = = = = = = = = = = = - - = = = = = - - = - = = = = = = = = = = = = 2 key Pro USALLC ‘CHRYSLER 5KEYPRO@ CHIRY = Make | Model) Wears “comer =e eae ‘paris | —eoveonod | — mer “enruen re eoeet ‘mara oo CaRrereeiin poves INTREPID 98-2008" woe task | ge [nero | mae ev Render AND sae “at Moa SKIN : ede actin Arendt een “get Deve C28 ea ior Ot Ont Crt ‘vn ampendr 40585010) ote raapnder D6 TP or IN Engi No acini ra ‘Gone Ot Come BIN Ether oyna 57 Telieve Ihave liste al eramples ofthis system abo programmer opnossive cries tenes 2. Our is the SKIM euece land ee es” or antenna around the ignition lock. tow te windvd or sight gets Site otthe cx = eo ye3.Remove the T20 that se- 4Remove the 2 or 3 720 that secure FT 7 the shroud around the column. Some- cures the tilt handle in place. times.a skinny shafted driver is required 5. Looking straight up ffom the flor, here is a6 Here is our Sentery Key Immo Module ew ofthe Toe sue “SKIM, Different vehicles wil use varia and romovo tho sinale $2cUr- ong indesign but the boars the same “Lhe cover snaps of, Butthe Target devce is 8,So | alternate between heating each onthe reverse The two points that e010 the pin and lifting from below on that area are the only connection fete board The same side, Then switch tli its Out lug stays attached tothe board. (CHRYSLER, (Key Pro USALLC9. Finally our Target Device, 241028. As 10.Remove the Hot Air. And remove the de- vice from the circuit. Usual with an unknown module, | choose to desolder the device, It's only 8 legs. 1. Sometmes you fd yourself wih the proper tool but oot. Pomona ae desired foro cul Buthey ef couse wrkin an eu station al, ust ont choot outa the por mashes 13.From the AR32 software, PGDN and ar- row over to your desired device, Note there isn a 241.028 selection, the closest device is 241.02, co we cursor over and INS'ert. CHRYSLER. 42, An aldy but a goody. Ifyou happen to own. an older version of the ARS2 hardware, this is similar. Newer harsware owners can easily follow along, 14:Venty all dip switches and adaptor post tions. No voltage switches on this older hard ware. But out of crcl, voltage is far less im portant Key Pro USA LLC.18. Option 3 Read Dev FaQalang Bed Bevis nt Buta, Tis 18.1 a very simple fom of Binary an waTplfead the SN He and place | guage you can see the VIN and IN. See Spey otitinta your PC temporary emery the Appendix fora ful transiaton chart {7 JESC‘apeback'o the ARS2 main screen and Op 18.Option Dis Fle ak tion & Compare Device with Buf a na fons aren nt ofyou (ring, btm let Green Zor Err ou gs! ‘more permanent area ofthe PC's memory Pick ‘8 geod fie name. remember wih ths ie you never have to pl the Target acule again 49.Connect the Tango to the PC 20.From this screen Click the and start the interface. USA> “File Open Button. Then your Chrysler> 300M> 2002 (24C02). AR32 File. CHRYSLER UUSEESES VULUEBEUEUELELEBLELLELELELLLELUCEUES21-The Bue “T Button shows us the PIN we 22: you select 4, the Tango wil verde that already know. The Red “We? Button wit *2Posiion withthe Y160 ete. you select an 0 allow you to select helype of transponder Sd Poston and one of clenabie Vanspon-gg ould ie i lace te sot ya sees, 0%. Taa0 wl cone ont oop dal Sly eee 8 23.So either choice has its pros and Asa side note, | attempted to read this, cons. If you decide to use a 4E, then device in circuit with a jumper ground: the Tango must convert the file and ing the crystal, Failed repeatedly. rewriting of the device is necessary, But the transponder is more stable and less expensive and more avail ble. The clonable options are a bit ‘more expensive but they save you re- ‘writing the device. Saving the BIN is essential to recovery and either clon- ing or acquiring the PIN in the future. AAAAAA Date Notes Date Notes: oil a CHRYSLER, key Pro USA LLCALA Glance, Documented Date: 1715 Device Reader AR Programmer Tange with Stare “Target Mode: SKREEME Modul cation: Around he gin “Target Device 9500 8 80 (S010) Read nor Ot n Cit ale Taneponderh 76 or BUN Enarypta No PN acin sine OR Sond, ‘Clone Out or Convert BIN Coversion Keymay:V157 on Tau This a limited number of veh : them on the road but there is litle hop. the port so EEPROM gives us the turer cooperat Pee “The Pactica ie most chatogingt pul of hese models 3 we wiluset ero main example Wo ll {atk abo the oer moses towards the and one secton Is also the onlyin dash exami =| ' ' ' ' ' ' ' ' ' ' ' ' ' ' 1 na tampon ' ' 1 ' ' ' ' ' ' t t ' t t 2 Sta by loosening he tim panel hat goes around the gniton eck. Is hal in wth snaps and one serow at the very baton hal usu leave pace CHRYSLER "3.Normally | can move this trim 4 The Trim around the shitter can be ur- ‘snapped, allowing access to the one serew away far enough tohave working lh teignton ven place. Set em room. If not then see the next step. aside and press on. =] 5.Immediately you should notice two 8mm 6 Between picture 6 below and 7 you ‘ls to remove from the ignition face area. can see where itis. Itis located at the ‘The third one is in an odd position bottom of the lock housing at 6 o'clock 7.Astandard 1/4” drive wrench with SNewpune acer ck te dah. Th = ‘an 8mm socket should reach easily. ewer he mocule arcund to expose the = = Bo erete ens! oosen that secure the Taget Module oto lock = . (CHRYSLER (Key Pro USA LL ie et = = = - = = . a s9.Now the Target Module can be _10Heris cur SKREEM moduie cose up. disconnected and moved to the {ou.se open the casei you choose but he target device vl be on the reverse se bench for further service os \ ae ee 11.Remembering this is a Pacifica Module, 12 Her ar the SKREEMs ste y sce Ate Hite devios Jat below te of is secton you wil fn tempat, Pact and © Shoot for a postage stamp size hole. AST earned re 43,These modules can contain eithera_14,.Make the appropriate device se- 195040 or 95080 device. Soget out your fection and then verify all your AR32 ‘scope or light or micro camera and deter h settings and positionin, mine this while you start up the ARS2 sw. iP Swit ae are 9: (key Pro USA LLC CHRYSLER.15We are reading in circuit so start atthe 16.Locate PIN 1 and connect the Pomona lowest voltage setting, Then increase as you to the deviee inthe proper orientation. attempt readings. Check Be 17.Something like ee this Into Buffer, 18.0ption§ Bute: Eater, splays he ead. yeu 20,Fist prot ater the Green Good Comaare gotat F's or 00s, mepect you connections. fis "Put some thought no your {ding he Pomona ater ted. Same su? Some techs assoc Incteave votage oe stp. Repeat process 50- | Sg ther invoice numbers and BIN fe names, a A WaddddAddad CHRYSLER ‘key Pro USALLC.Z1,GonnectStat the Tango, USA> Chyler 22 Nex! the Bl ‘Fle Open Buton Select your Pacioa> 2008 85080) or 95040, whichever you ARS fe. Andi the fei acceptable, the Tenge have, Yeu can use these seicton for altiee wil give you your options screen for his vehice, ‘odes, g0 to Jeep Lert or Town County. - eee 2aALbw Se ofpubloabon ie Tango omer have fe 24 Save he new Tang in, J nt order) PIN cispayooten or msinemo ayn Ober urn se ander aycremuarons Te fesse vocse TiGhave his teature, sowewilroces ax we do ot san -You nes ere hacen 0 carpe Seamer stuantayig Pent veorne non, teneion oem ocorocnt (ino Tango ond Sih ed ten 1 rogram Devee tom Ge Fae (PC) — . , hou > ses ee Seo Bstronypeteenmec ATs Heanecnnnsscwnnetnns see the folder the file should be in. Scroll 3 not ecane ne Green Comparison Nessage down then “F3" to Program per the bot- then cack connections and settings and ty again. tom ight comer ‘CHRYSLER27.4 youre comms Pac ley, and be Cav Toun County sles. 1 ct pode a own lures te te mo evapo eae a a nao ere hn he ast. Oe 2 stmt ce aid arden he Target oases are vty exrytoremore, Know orevou ‘Bale he Caravan needs he posaga samp cin he boxe accen the devew bute tery ors nt toons i: art | 28.Below is the template for the Grand Caravan and Chrysler Town and Country. You can Xerox this individual page and cut these out of the copy or make your own out of quarter inch grid paper. = vide ddd 29.Here is the Pacifica module. | must stress that working near circuit boards with rotary cutters has risks. Practice reduc- @s stress and increase confidence, Why would you not? ‘CHRYSLER (©Key Pro USALLCVPUVUBUSEDESESESUSESUEEEBEEELELELEEEEELEELEES YPRC®): CHIRY === Make Model Years 7 co aoe “arpt Module SKIN Module tation Arndt eiton “Target Deve: SK35G 64 OFF) Read nr Out Out of Crt Original Tanapondr ole Tanpundee 6 BIN Encrypt No PNeteln BP Cane Out or Conver BIN: Coveson Keynay 157 4 Our target module is the imme ring 2 kis aight removal, but he lower shroud can around the ignition lock. Start by be removed from the dash. | do nt remove the ‘securing the bottom shroud. !overkick panel but some technians prefer to ‘Cam entrnct the PIN code for key pro- Graimring trom the port: Rnd with am SET yee immering tote vehi- inlets ofaed parts available a ‘ekey Pro USALLC CHRYSLER, ses3.You can unbolt the bracket that secures. 4.The Target Module on the bench. the immo ring to the column, orinmy Label says this is an Immo 3. A small cease, | slide the module off the bracket flat head removes the cover easily. ‘And there is a surprise underneath ‘5.The device isnt visible. Ithas tobe on Gif you are fortunate enough to wn a sol- the reverse of the cicult board, The 2 r+ der sucker, these should be no problem, | ‘al pins hold the board in the plastic box. have fux, wick and a simple solder station. car 7.But that will work. Apply ux to the Wek, then lasso the iron with the wick This method can remove the large oun of solder ar0und ie pins 8.You can see here in the close up that most of the solder has been extracted =Pa Pin 1's plainly Putin th Bns visible. Make sue you mark te board or oie 121 searched “Data Sheet 3K58G" and the first result was a web eight that shows the Mask translation onthe fist page. Mask orla emblem, The third row is called the Mask Usually a number, eter, rum ber, number, letter format. Occasionaly the fist, ‘number will be absent. In short, this Mask trans- Saree ere Sete a Meu tw Comprtion sresoooen somortne de. | 7 Hees On SEE oe ere should have noticed the smallcompe-edevestomiscaren Wings aoa. rents near the device. So protect them with thermal tape or poster tack etc zm (Okey Pro USALLC ‘CHRYSLER, a15.Now we open the ORGS sw and se- 16, Once the device is selected correctly, lect our device under SelectType>4- note in the bottom left corner, the ORGS, ™ > MCBBHCSOBAB32. adaptor that is required is displayed. 0 4 = = = oe = mulls Sd a 17.If you own the ORGS with all 18. Fux the pads and iegs, square he eves its adaptors, dig thru them and Pisin as) eae ee ee = al = locate this one, if you bought the, of the legs don't have pads to solderto, = a ed = = os = Serer rS (oC SOK ete eaal etereerne me eee and installed into the hardware, _ 20.nce at Waconnacton oases The adaptor only inserts in one di- watch the pop up overly al goes wel rection. You EEMNe |can always . click the hel menu in the sw for more details or in- structions.24.This is our first BIN file. But __22.Click the Yellow “C’ompare button and We shouldn't trust it til we com. inthe bottom let ofthe screen you should pareonetime Teceive the ‘Compare Ok’ message, 23.With a good compare, we can save the 24,Connect and Open the Tango sofware file. Menu Bar> File> Save > Region USA> Sebring then name the file something appropriate. ‘Note the sight aiflerences in the device identifier. 25.The Blue “F'ile button and 25. The Tango recognized the te, so the ‘options screen comes up. To see the PIN, then Glick the “i” button. There are 5 keys pro- you just created. srammed aready ~ eee CHRYSLER 2‘Make ‘mee ‘00% co ‘MAGI Desementd Date 1205 Device Reader SMOK Prana Tango Target Mole: SKIM Madole Lotion: Ao thin Tare Devi LSD 00H Read ino Ot In Celt ria Transponder Uahle Transponder: 736 Apt tape BIN Encrypted No PIN ten BING in lone Outer Conve BIN: Coveson Keymaye V1 In your OBD programmer this system i probably called “CAN |". The PIN canbe pulled nd [Programme via the OBD by most programmers. This section wil be sel you eve" ma te (te that refues fo program thr the ports these CAN Is gto ‘communication break downs between modules res » CAN recep (evar ore and mare oqueaty “First pop the trim around the 2.Behind that panel is 2- ignition out with a small flat head. 755 ¢6 remove first, eee atone om camect me Sores iraciansnateyeacenainew mere SE ae lo Bera cHRLER 23.Remove the trim around the cluster to gain access to the final attachment ‘With the lower kick panel removed you ‘should have plenty of room to remove the single Torx screw that tans the target ‘module tothe ignition assemble 7.Here is closer view of the board. Our Target Device is here. And 4.Now the final T20 is accessible, re- move it and push the ignition assem- bly into the dash area, 6 Here is a close up of the module's label on the bench. A small flat z a 2 3 z 3 g 5 ez 8 This device happens to have the extended Motorola part number on the first row, MC9S12DG1288. Ifit had not then we could “Google” search the and got- ten the same results With this info we can go to the SMOK help folder and see ifit has any further in structions. (CHRYSLER Key Pro USALLC - = = = = = = = = = = = = = < ame mg — = ~~ s x :SMO eel eceive @ DOC fle wih he 10.These selctons should rest nt im Wiring diagrams. HC12> MCU> age. Thisiscaled a Pin Out For any given, UnSecured> MC9S120128 (a0Leq) Mask, one of thse exists, and tells Us the pur = anil 080 foreach og Atonely aso as os, what legs must be attached to read out the EEPROM data Inside. Hence the 4 colored legs. You can solder to those ‘exact points, but that's Weky. There is another way, urna al 12. The probing should resistin omating closet this Keepin mind ther are ater boards, 2 my cover a couple ones pn oust ‘and then tet points on the board near hat leg. Youare ooking for 0.00, resistance. You ‘can solder to| that pont i stead ofthe leg direct, 1.Clean the points and then flux. Then 14. Attach the adaptor end to the solder the colored lines from the SMOK SMOK hardware, then the SMOK adaptor. Here is my example soldered. usb to the PC, and then start the SW. (Key Pro USALLC (CHRYSLER, 521¥ren ou ey, cn a unt anpondarn 22 evening goes wel the Targo wl ak you ‘the Tango, select a key sot, and Click the Red "W ae im ape te toname the new converted fle containing the ado ea esn2 enete Peed” yansponder, and hen emi you tow that eae capa Ha lat le back'o he deve Backto he SMOK s F".> 206 ey Se se 8 SE 23We assume the SMOK is sil attached to 24 With the new Tango fe loaded, the target board and device ype ssl selec The status bar across the fedetc. Click the Open File Buton. Then locate bottom wll fke @ moment ofl then lock for ‘and select the Tango fle just create. the Writs OK message inthe daioab 251 leave you with he alder ports founsen 2 Date:_ 2004 Durango an 2008 Rader AeOUCANSe® Notes ove but nl enact the save. Soe prepared ‘ut some ena tne and rovghtite base you run to esa of cca co Lk PRG@ CHRYSLER a (@xey Pro USALLCYour target module Is the antenna around the ign! tion. This immo systom was widely use by GM for a few years, resulting ina large range of examples. The shape of the antonna changes by model, 50 there may be slight differences nits design. Main ‘entifior is the 95040 on the antenna board. This section should apply ifthero is one presen. Some- where between 2008 and 2009 GM changed the de- ‘sign and I beliove they removed the key data trom | Sa | Ge cets pn vohicor withthe ignition very ey to remove andnevea, Ae | RSENS Tithe cotenn: Conversely hough wo have many other routes Complote thintrenepondes, nove none ou (Koy Pro USALLC vidoes sdddededdadddtake many forms due to the wee epread use of the system over diferent veh cles. This ie Cadilc. So far, "have found fits eck ‘mounted lock wit acco plus, Lunt about the beginning of £2000, his section should ap ly. Remember tie afi to se our programmers, Tango, IKeyCione, TMPro, et, to de- fine the system because year ranges and models tond tobe diferent rom region to region. ST band. Norms not al that pra ever seme of th fede Le, O15. Faure the Nance {ittdeca pero the doves pe. Ss te Apert fora weak down ofmanuscueramarings aN 5, Once you select the device, this home ‘soreen comes up. At the botiom are al the hardware settings. Compare and very every thing is set properly, including the voltage ‘Key Pro USA LLC 4. Here is another example. As you can soe they 2Usee sna fat ead release the tab acura the Deter ofthe arena cane expose the boar Wie are coking fora 64080. I havnt found ay var7. Your star up connections shoud look ike ead Dee nto Bute ( Storage) this. Occasional, he the adaptor vt eed tobe adjust fedt0 complete the wing pro cess, Outside of that, the only th er adusiment would be (eta clean read ‘Aays compare before saving ARAM AMAA AA AA Ad ad ddd dUdK RG ‘er toDik Fee 42. Connect and start the Tango. itn Option P Set One Pay ena! anand cout Cobalt works. aesthe Bluo “F" Open immp __14-The ie pared wt no ror metegen, ea Then select the ite you just ‘ese Fie See or Fie Not Recagnrs: We saved from the AR32 aie an ways Taneponaet one aoe | “es — ‘15.Vetythereis an acceptable wansponcerin 16. The first pop 3 fst Pop up screen isthe fle nam: SeiTaroe nartesrs ing screen for the new fle the Tango has PCF7838. You can use a Mtns cy ‘created (add "Tango" to orginal the Sees eect og ‘name). The next pop up is poorly iarectaea tereiecrt phrased, in my opinion, butts a remind Honda V key, With 9 erthat the new file that Tango created ‘simple understanding of ‘must be written back to the device to com= ‘eansponder relationship plete the transponder making process, ‘and commonaities, you Can utiize almost very discarced Sj tey cicxino peo-wrtes | Or 17. With our Tango file, return to 18.Atthe botom, the AR says cick ALT" the AR32 and select option 1. !22#2allthefles nthe direciony. Then ‘Key Pro USA LLC19.1 Clicked F3 but received a comparison eror 20. Remember this note from the AR32 de- ‘atthe bottom you can see. "New Device In- vice setup instructions? It suggests that you Stale fs asking # you woul ko fo atemptthe move switch 2 up onthe ARS? adaptor boar rogram again. 21, Move switch 2 to the up position 22. Again the AR32 will try to pro- with a pen, small pick, etc. Then gram the 95040, now with Switch 2 for new device installed question. on the adaptor in the up position 22.7 ie we rece he Gren Go Compa, 2 False roe etre a aon message meaning that tho file spccossful to appropiate sta ter wa chorea you wi ar wrote othe device, Opton Zero then "Yo cos the program, Ret everything and get padKEYERO@) G.I." Tat Mole Antes Tg ee 3562 FEO) Radnor Oto Crs Ora Tamed ‘ae Taped 09rH US This is an example of vehicle that GM used widely overseas but had a poor recep tion herein the states. They are relatively rare to see these days and these factors all add up to.an increased pay check for those that are prepared. To be that pre: ‘pared tech, make sure you have the appropriate key shell to house the transponder ‘upon completion. There is no substitute shel for the B61 keyway to my knowledge. 10urTage osu ie area arandsenton. 2.There are tree philips screws to remove Youwareedamechascalhy to cance Beem". fom the lower shrOUG an also remove the fete ey cde toma O90 oprah oe hich is usually lock tight tation wo. renfocced (recline mt codetrom the OBD. Tae Ing the Pit irom the mamutactares SCooproprammerstinat might be abiete This will mostiieety come witha. STkOaictguarames teosnaccese Ba EEPROMers ony "Pin Codes? We sopetiattyin we omsty soamplen. Thore- dan'tncodine rnin PIN coaes.™ ou 6 ‘okey ProUSALLEaif aa a oa Zod aoe she LIE ie aaion to staahverical Adthn”“6 Here you can see the angle used 19 the correct angle. You wil need a0 degree 200858 the retainer. Once depressed tool ora smal allen vrench to ht the retainer. YOU can give the key a pull outward. Ih 2 7.You can see the retainer and the ig- 8.Close up of the Target Mod- ca u 12 “UWle, The lid is easy to pop off. bo removed to remove the antenna key Pro USA LLC8.Unfortunately the target device ison the re= 10 mand wick verse, Sowe will have to desolder the 2 anton YoU nave a so sat or ‘na points to remove the board from the box are not toi ie here ia 8 connection 11.Now that they are separated 12 Stnby wenttyng andimating BIN onthe the box can be set aside andwe fin \nonsscuesst vistas ‘can move onto the Ta aeons to cele devs 13 Locate this HCOSBIC7OSE adaptorforthe 14. With the device inserted into the C0195 Insert the device ito the HCOS se adaptor, insert the adaptor to the ORGS hardware. The writing on the adaptor and hard- ware should face the same di- rection, (key Pro USA LLC om a21.Conr Stat the ZedBullinteface__22,From the Pop Up select Open Phelan na Cane ucmal Fle. Then select he ORGS le we a just saved. ‘yourusable clonabe transponder Place it into the Zed eral and Cick Ok. Done. Amos. 25. The most challenging part ofthis whole job is also the last step, returning the Target Device to the circuit. This will require your advanced soldering skills. With practice they are simple, Clean excess solder from the legs and the board. Flux both and start soldering the legs back to soldoring, Make sure everything is squared up. Make sure PIN 1 is orient- ed correcty. Put all of your practice to luse and you willbe fne. Return every- thing and test it out 10Dacomened Date 0 Programmer IMP pls Module 3 rat Module: Antenna Modal asin: Around gation Cinder “are Devi 2157) 4 OF) Orginal Taney Pulp [habe Tampon 6 HN Enya No [PNet i Not Standard yma 0 on ‘As with many of the other GH systems, this one was used ona large range of vehicles. This process dificult, therefore it will not bea standard method fr me personaly. And further ag ‘more, this means that! do not know the extent of vehicles using ths. I would make a guess gag timation that your example is a ctcle lus, n dash, and prety early, ay 2004-2008, ou ag, ‘are probably dealing with one ofthese. Our knowledge gaps will shrink with time. 4.Jf your car has similar features to 2.Start with the only easy item i this example, the chances increase {0 remove from this vehicle. The that yours is the same immo system. ignition bezel. ‘key Pro USALLCVVPUSESERERE REDRESS 3.Now remove the panel on the driver's side end of the dash This will ex- pose to remove. '5Youcannow esiy access th tana sn rove ihe lockevinder with a working meckania key. | am not showing a pctire oe retain: because yo anno i it you shoul nate reacing th book 7.Unsnap the center console cover and remove the conical shaped piece of the a,c, vent that rests in the top area of the console, We will need the room (Key Pro USALLC 4.There are to remove the lower dash panel. It should be free to set aside at that point. sae 6 in the top ofthe cluster bezel. The bezels attached to the tp of he column shroud. Disconnect these attacnes parts and set thom asige, 8.These 10mm head bolts are what al the fuss about, There ae 3 of them, screwed from the engine side into the rear ofthe dash | wil ty to show the orientation ofthe picture. 3 eB. :Hopefully this illustration will help 10.| gained access fo each of the to visualize the locations ofthese _ three from these points, hence the removal of all the panels, 4 44.The Ignition 42, The bracket, target module, module is now and remainder of the ignition as- hanging. You ‘sembly, are now separated. can see the ous bolts we removed. And 2torx to re- lease the Ta got Modul 13.Your module should resemble "4 !tweow we are ooking for 64 OFP, we kn this one. Ifitis terribly different than tua ine poor ale nt seaeres ‘They ae tension Yyou might be on the wrong track, neces. You can pop he board upwards.TEIDESR aera bebe on wast cence le 16 Mark PIN 1 on the board. At the ‘entended seer ate che cevce Many times ony VerY least take a picture with your ‘ho Maskisand yous ransnto See the Append phone and hope it doesn't die. 17.Insulate and Isolate the device, | __18.Using your developed metnodclogy, apply chose to use tack for this job but thermal lg tension and hat ait remove the device je has its benefits and imitations also, "The ercut. Selina safe pace to coo! Also Nee eee. aco coo price to removal is ens 19 Locate the ORGS S0SASSOIAZ60 adap-20.nsert os SST C Retro sed ta ses sca er “RANGES ve ere eee pate (key Pro USALLC om myKey ProUSA LLCKEYPR This applies to Non-PEPS vehicles only. RACs [Bacomind Bae Disk Reade ARS [gramme Tago per Salwar “Target Mode BEM Moat Lcton: Vries ec a aie) “Target Deir C16 SOIC) Read nr Oana ‘rial ansponder Pin [IN eye No [Gone Oster Conve BIN: Cmnenian Koro ni —— on Tangy 1. From the passanger side of the 2.Remove the panel by hand vehicle, we can easily and quickly and set aside. The BCM is al remove the target module, ready exposed for removal. U {GM examples. is characteristic included, ‘main example. Atthe end afte secon, use ofan HU100 koyay, cary year range fhave ined pictures of cher locaton | =2010=2013, and onanaly equipped wit have encountered on ther vehces, This thefist generation GM fp remote haya sytem was widely used, ke many other e ou key Pro USA LLe anereeeeeppppnnAAAAAAAAAhaddacaneS.sconnectthe wie hamesses, and move ‘aside. They can only match one socket and are Alleolor coded, so there i no enance of econ. 5-The Board slides out ofthe box ater your: lease the around the plugs. You an also see the label withthe plug colors al labeled 7.1 have decided to use the AR32, | con- nected the hw and started the software, aged Down and Arrowed over to the de- vice type; 24016. Press ‘INS'ert (key Pro USA LLC 4.Push two plastic tabs downward along the bottom edge of the 8CM, Then it slides out by hand, No Tools {6.Qur Target Device is almost inthe center on this example, however Ihave seen them on Beh ‘ides of the ard the only 24018 on te board. Note Pin terentaton, See magnification, 8.You will be forwarded to the op- tions screen for that device. The hw settings are along the bottom,9.My experience and knowledge alow me to fee! 10.With ll connections established and stings comfonable reading hese meet wihout adjusted, wecan 3-Reac ‘rounding, Do what = comforable 6 you. Out cf Remember start at the lowest votlagesetng, No Gratis tho satest in tems of cxruton risks. reason to sk earuption wth fll 5 vo et 11.Optio 42 Should ook simi. We stil need to vey display what the AR32 just SW In nee na cB the device's memory. ‘ogranmer you can be done in 12 mines 18.ESC back o the options screen and then n.compatison, you can AS: We are hop- 'ARQ2 prefers 8 charac- ing fora Green Zero Comparison Ertors Mes: ter fle names. Example: LASTBVIN.BIN at sage in the bottom right of the window. the end should be habit with all eadiwriters. (Key ProUSA LLC20.Back at the AR32, option 1 21. Arrow over to the Tan- a go file, then F3 to Program. «@ = 22.Then withthe) 2. Proasammina Completa in Grain the hardware and settings still intact. peje” yo asc ona teat your Return te Mode and est your raneponder fesieed 2010 Buick f LaCrosse My oy enssdssdsdaddadddd |2013 Chevy Malibu (Drivers Left Knee) 2010-2013 [| P24 EN | 2013 Malibu Circuit Board, Note Chevy Camaro] © EEPROM is on reverse from pro- cessor side vs Cruze example 2012 Chevy Equinox ‘Key Pro USALLC om 2Node action se ofl ain panel [keto Ov nh [Dab Tampunder oF TS TKS [Gee Osx Conr BING out Ifyou use a reflash technique to program these it requires a Red Key 4 and Black Key and additional programming though the OBD Il With gy EEPROM work, merely pull the data offthe device and you are done. jt |-Tre Tage Moa fhe wnt st nee 6h 2. Remove te sae pillps ling Tis Pan met dct inne wi ie seesrgclura. Yow gn then gt hase. You should nowbe able to SH Ivete pln wer pane! ana you mi 90 onthe (Key Pro USALLC assdAAAAdAdadaddadad3. Here is the immo box underneath itis held. 4 Once you remove the two plugs. wih box in ‘onto the column with two 10mm head bolts. hand, you can pop it open. At his point you can Release the box then disconnect the two locate your tagel device. a 3045 or equivalent ‘5. Youcan ays rend is 84 3CA0 seve ube ‘ves tacky havea irr eniteron Asin” fouthedevea, Looking she Agee IUIMTUP ute oeicely sonesesce oust be temo heed ied cqer wh sstraceabsr- Uae pe naa boton sm oss bush 7, The device options sereen shouldbe sia to 8. Very thatthe seres of thi, with LABR ithe top et and your hardware Det aetna seting deplayed along the botiom bar tow toe a a DVVPPVEPVE TTT TTSTOSS SDDS DSSS SESS SEE EEE EOOES9 The ra2iarow at. Fumi 'sngee Bust terhsl coc megelmensn ference mahi on ap he ee 1. once yout" he proses knee Soeur appear chage Lets sae fw gt aoud ‘hough Opto ure er sous dep stan ine Dis eels at sO ecbck you comers Sra sstnge Con jaune ky sone 12 Once we have a vertied Read, Save the fein mediately. Opfon A” ard that can be easy lest later Customer names are net my fiat ene fora fle name but wil work a pinch Now tom (10 Thea Ino screen "Do you want to sat reading a the foecinning ofthe fle” For us alvays yes. For loner industries hi i 9 use! ably ofthe AR. 42, We must verify the read before saving Hit ESC to return to the AR32 home: ‘sereen and then Option 8 Compare Device with Buffer, aka "Reread the device and make sure what you just read matches What you curently have inthe buffer.” “4 Hook up the Tango> Region Asia> Honda> CGars> Give» 1985(83C48) Note the discrepancy in Year and Models because of regional fer. {ences inthe Tango's Customers. UK vs USA ete Key Pro USALLC PAPMAAdAsAeseeeenanane 22222000088~ [ese raneponder 86 [risecin ae No ond igh Sect Took ‘This is an excellent beginner job. The Target Module is simple fo pull and service. The device is a standard 8 Leg 24C03 that is easy to desolder etc. The ‘mechanical key code is accessible and a common inexpensive blank is used. 1. This she dash area view. yourvehicles 2. Qur Target Module isthe antenna around. steering wheel or cluster design are different, the ignition. Stat be removing the three youmay not be dealing with tie exsctsystem. screws holding the lower shroud on. cutsnentnsappineteaemhingpesion ples andes «24604 on te antenna, Uobtccncion)uowererstnce demottn: hese steps itlappiyteyou.Macingam SEAIPSTANTR Serpeccetany sate ttenttying programmer te FPres SERUTUDEL NS swat gron wim Srminctone, comes very help when TMA ane Mttcsay netityes eaump win smedale thet yowremet rare SRST Ta atewyoam ofthese enum tesepperted. ee Honda key Pro USA LLC3.Shvoud set aside, you can access the fest 4To access the final pips, uncle 2 small Philips that secures the tamet tothe uss going tothe aeril and tne key chime lock Redsing, One right inthe font, poled at_Then positon your sight otha you can ook up from the oor area tos the final see SYou os ssethesrszgong!trv psc G.The module should be free to screwisverydthettacces,neete roses '@ke Out of the vehicle, And back Vise grips and patence are your best frends. to the service area “eho is close p ofthe otie's a, Youmaran ves sideways because the witing goes both ai. minal tba canna co 9 tectons The label ison the cove, use a fat hea to remove that cover Set aside. (key Pro USALLC . ® ® ® . 2 ° ° » 2 2 e 2 2 2 2 2 2 2 2 2 = = 2 = 2 2 2 o a a , e ,Stench oo oma cs cont ee ee laden Coa cs comme. cocoa anton cut, | suggest insortng Kino the adaptorfor_ for the TMPro, We have a 24C family the programmer you willbe using fst prio ty. You don't want o dp this tiny memory devs 14. With the device installed, connect the adaptor to the TMPro hardware. Set Dale ah TMPro usb to PC. Start the SW. ‘connector like this. PIN 1 to PIN 1 orienta: tion throughout Make sure S (key Pre USALLC15.With all the connections estab- lished, and the sw running, ek the Read. re, lace the cur- “7-Once he TMPrO reads the deve, tw ao ‘ently the BN and depny he optons seen fr that syst. You can eet reagnars he Hons DEREERERERESELSEULEEE 419,From the IKeyClone home screen we go Usiities> Key Gonerator> Key By ‘Dump> Honda> ‘ekey Pro USALLC device button, 16.The device selection pop- Uup should appear. Scroll down Sand select the device type, 24C04, Then OK on the next pop -up to proceed, 18.As usual, select a searcha- ble and/or organized file [Eee name. Date or Invoice number may work if your volume Sisn't too = high, 20.The options screen for tis vehicle should ‘come up. A few more details and models listed, but most important theTaree Module 10 Marg Device aL Cush SOI) [inal Tanponde Meee 8 iN Enea No {olls, Lets have a look a hs prety si 1. Tho presnce oo backing, vale round De metal faceoff ion, is the eatin a he p- {onal memobize sytem. Mave te custo ook beleive ot 2c il be enaros key Pro USA LLC Proereer eda plas EEPROM Appling ble Tampons Mega Isuzu was in wouble in ts ial years but she went out witha bang. They added an op lalimmmobilizr systems tomo oft vehicies right atthe end, Is 6 PIN, At this time, acquiring that number i geting dificult Buti isnt a proces. 2. Just above the perce! is na bracket. One 10MM bot secure onthe top edge. Two smal pigs need sieconneon 8, A o ODD. rfind itjust as easy to do them via EEPROM and more successful on the first attempt. Good Luck. oI3. Horeisthe mo box onthe Banch. The is you do et pct yuo met fipeup and open. Removalathe Boar tom Sarna rata sa i ewe as a box's ecu and unnecessary. (e122 cane anon comarca BN 5 Solder abridge between either PINK point 6. chose my points and applied a small bead of and anather point, PINK or “Ths solderbotween hem You should fee safe us thors the oscilaor which stops the MCU fram ng this technique, however desoler he sal sending aut destructive commands, ‘at should you fel nervous outta in crc 7 Now we are prepared toread the target de- 8. Vey all switches, including vice Open the ARS2 sofware, PgDn and arfow geting, and the Pamonabbon cable Is [Ser overtoou device ype then Ince. You plunged ino the Left postion and the Brown {an also type “DOLCABB and poss ene ain a RAAAAAAAAAAAAAAAA AAA AAAA AAA A AACA A MARS9.ARS2 is set ips i place and he ator isa to felt From the AR home seen select fetion o ar 7 11 Once you hit"Y" the process s so quick the screen doesnit appear to change. Let's see if we got a read though Option 5 Butter Editar, should diepiay a screen tke ths. 13. Once we have averied Read, Save the fle immediatly ‘and Can be easly lead ate, | dont suggest Cus- tomer last name fr security reasons. (comms) ‘key Pro USALLC Fd" The queslon that appears alto baton of line screen is ‘Do you want to sta reading at the loeinning of he fle” For us always yes. For leterinaustes this is 2 useul abi ofthe AR 12, Return to the AR home and option to verify the BIN. Always “Y” Read from the start. The is 14. Lets take a moment and return tothe bur that the only EEPROM equipment you have isa reader AR22, Orange 5, Miniro, Welln, you this sytem the pn is plan language and ina ‘at location. sways at 75 and 76. Program via the OBD withthe found PIN, 385121, The nal step betore the ZedBull does its 22. Final ZB step. Verty your produced tran- ‘magic, fs naming te ie tis about to create, AS. sponder (Precaded) isin the Zedbull antenna, always | suggest adding the Convertors name And then lick OK. We wl to the ongina fle name fe 44601317Bullbin return othe ARQ2 for the final steps of tis vehicle. 23: Now retunothe ARS2 sofware we reed. 24 ere rewbys soul eet eB ce pyogtam te BUI IN othe devin hopeuly st tespin nae Ao. Bilal conneciea.Opton 1 Proyam Deven tm aes Ne ey rn ‘Disk File,, then ALT “D" to view the files. ene 25. From the fle selon screen, MtFF3'Fo pro- 25. Assuming you get the Green Prearamming ftums tothe home serean Complete mossage at the bttom, you ae done Any Messages means revit all setings and connocs an ty again Return everthing ti ight locaton and test transponder funtion, These veh are becom ing cxeasingly rae butityou are the toch that's prepare, you arete tech fo got pa. (Key Pro USA LLC Isuzu » . . . 2 = = = = 2 2 = 2 2 2 = = = 2 = 2 = = = = = = = = = = = = = 2 2 - 2 » 2 e -[FeeaNoisie Omer Module tains truest ane Frat Device 7508 ZORA [rn ‘rn Tampon DO ‘ae Tn the part and foc unknown reasons, personaly ave hed sues programming this ster ths the O20, Fortunately programming «hey tra EEPROM wotk creatively easy and gives the ‘svantage of ot hang erase he existing key. required by ihe OBD programming. Oe (hart worked on recently, could not be powered up with junipers or battery bores owere is ‘rer 0 an seve when prog following these steps. 4.Here is an interior view from the pas- 2. Start by unsnapping the trim around the ssenger side. Weneed to remo the instrument cluster. Shouldn't need more ‘gauges to access the Tara: es = ‘The tmmo system on this ve- takon into account. This is a hiicle is relativelyeasyto -‘Tibbe key,sobe prepared to workon,howeverthome- cut the key before taking the chanicalkey mustalsobe job. They impression eas Tagua ‘Key Pro USALLC anne mAAaAnansanaaaaeaie3. Set this layer of the trim tothe 4.Remove the 4 Philipps that side, itis thin and you could also secure the next layer of the trim. damage the vent pretty easily. 5.Again set it aside for %,7etna\srniee remove seoue ‘Target Module in place. Be gentle as the safe keeping. lear fronts tend to get brite over the ye: 7. Tilt the cluster outward ®.And you should be able to ac- cess the two plugs that must be as much as possible. gicconnected — i (okey Pro USALLCjg, 10. Remove the Torx screws 9. Front and back Views. na the perimeter ofthe cluster 11. The back haif of the cluster should now: ieee) separate fen be cla on. Sat tas 8 of the cluster to re- Secs Gn conetconarmnateitbady,” _ move. Careful not to move the needles, 13.Now the back ofthe target. 14. Our target device is module should separate from the ee almost dead center on Sy the module. (key Pro USA LLC i AAA AAAAAAAA AAA AAAAA AMAA AMAA AAASWYVVVVDEDEDEEEED {5 Fom scone ven can sa he te.keeping in mind that we have a prt on he Sampatenen mics owt Tnktien oar lok othe SMOK help les and Suan saeghtim ciccmmcacrmemsnse,” Talc tis dagram tout device using the aire torts Mask nis case, OL26M equals. J MCEBHC- 912060, win nis romiedge Ohm Metro tack down our solcer points on me por 17. | start with one end of the meter on the leg identified in the diagram, then probe each one of the points in the port. There should be zero resistance be- tween the leg ® and the point © © In this case the probing result- fed in these points here. 18, Here is one final view wit the leads sol- 10. From the SMOK se ered tothe circuit. Connect he other end of 44Cl)> Motorola» MC> HC12> UNSECURED> the adapior fo the SMOK hardware then the EEPROM> MCSSHC912 EE UNSEC usb tothe pe okey Pro USALLC28 elect a hy sl sopoprte omy custorers sie 27 Next pop-up, after clicking save, is the ove aammgaartcer O80) he Toes, standard reminder fom the Tango tat the ‘See spullapear requesting ourame me teen at device must be written with this new bin fie 28, Return tothe SMOK. 29. The bar along the bot- land select the Tango produced ie tor wil take approximately 15 seconds Minoan “mowime Progressinthebotlom le. scroll and fhould verify its success | i Date: Notes! key Pro USALLC guar 61. The presence the nro eauped vehicle canbe. 2 The mn bon aad one ack ie oe owe determined fom te posengerwndon “OFF ACC” sch pana en fess car Una te bx ean be i of Sno inbearpasemeimeesiios! toca bea amy srt Wont ae or Be vay ; Mazaa ‘key ro USA LLC i MTT OTter and use sofware to arslte and hen follow On 586 No funy be desire ea wh he O29 1: tuee postr tack as an solo andlor tt ender be coer De Imyetarat aon pesaie setng ard appx S200. dv iota From stout ch amay ere Seve Yo 31 Sige that bows ontalege 2 secs persis‘9. Now thatthe devices paced noi adeptor. wo 10 We ot elinders rpm comet ic Me Si sect) owt nr WebeOrmges atin ington aee eteenotcscad Se ae ae Sn mecuetaa URE no ANCES Pert : ee Sane soso” ease iene San eae 11 Excellent work, Notee the word code in pain language in the BIN? IT) Fle> Save> Las IN. Or the Diss Image. ors er T3Now tse to opanthe Tango sotwcre Moke 14. Hara i the daa seen forthe Mazda ‘hese hariar a emce, es os2- 20> ode, gles some quck deta, Click {reterencs back othe abe onthe nn Bom Seed te oy us Maza key Pro USALLC PPAR A AAA A Of a“eter tat acnci seyag tage. cttequremttetbe sinh sacs ceaininea fete a espe epop wp Then OK nape youwl ters BI {tye une sans, wn ws Sarayes stare be ow tear ot we must the memory te cevce win avec we we pong, ne nyu Beret ee eee ee ne tote Tango pernad compl evar Yoveuvattaumiotesae tyne me crqra” SPENT aking proens Nove back the O05 18 An ofcourse, he reminder pep tling us ‘rp acne | oa | 418. fhe Org5 i sll open and connected as sms aa itwas atthe beginning ofthis exercise, thon "nes phonies mies, anes click the Lup top. And Select, the Tengogetortes le Doub Chex | Oe “Okey Pro USALLC Mazda ‘Uae Trnopond 55900 8 ern E Mazda Koy Pro USA LLC AAAAAALAAAAEEIAAAANA3. The nema ute wou be oat the Sel Nar ber and use sofware to varlte tr hen allow On Board Procedures prem on soporte anapond © Bt sometimes things 99 bad Maybe we have a 5. start my hot ar at alow pressure seting ‘and approx. 300C. From about 1 inch away 1 Circe the device from atop angle that blows fon the legs. 2 second per side circles. 77 Hook up your ORGS and start the software Click the then Configura- tion 44MTRK> Group MC5SHCOS> Chip> McesHCos86 “Pkey Pro USALLC WUEBVEBEYYY FRemowed fot bx, secu the boat for desaidering boards akendy marked for device ointaton on. oir cone DertKEYPRO@ Wlercedes © . ) reeds a sar mda rb nein, Tey orients icy ond ore seiner. Ts {Stine cntpan, Yuku pal one nodes ver tisor tte uge mde: Ten one You ave ‘pwede te Fret Mle conten yo il econ’ 64 QF ate be reno feet Tl 67 ‘py ne conponiebeafaa aseeon rt re ivf oth i oe ro wan 8 LAs | stated, you fist need to pull the en- 2.The Target is located inside and under gine control fromunder the hood. This the fuse panel. Start by removing the cov- Target Module is called an “AAM Ad you will need 3 720 diver key Pro USA.LLC. =a <= <« <« = = = = = = = = a a a2 Bumovo aprox seven-20 screws tom he Remove the back section ofthe fuse ‘pein cline cse Sore oftesces are panel cover. Set aside but be aware a Hestvertymeyate there may stil be screws hanging on to it. = 5 that contains 6, Disconnect all the plugs along the bottom the fuses and relays, staight upward Once sage, Then you wl need to release lited past he bottom, sot the bo holding the Target Mocule, aka AM comer on the ed the fuse block ‘and one, Ton the outsise ofthe "L."This oneisypicaly 8 There are no extemal cues a5 1 Try towork the module off whether this module contains the immo da- equally on the top comers, Ihave also seen the tg or not. Open the module now to find out if bs break due to cooked removal r J — (Okey Pro USALLC Mercedes BonzSime board ots ihe his, youateingsedthace. 10. No red connectors, No Immo iat THIs module contains gurTane data here, Return this module to ar todesolderandstipfosteo1 the car and move to the next step. 11.Once the false module has 12.Remove the kick panel above the been returned, move to the interi- pedals. Couple plastic retainers and or of the vehicle. ‘a couple Philips screws and it drops. Wis 43,Directly above the gap between the 14 You do not need to remove the entre mod brake and parking brake is th Ue. Locate a ‘and slide it out, leaving the rest hanging, Mercedes Benz ‘Okey ProUSA LLC15\Here you can see the EAM Target 16. On the bench, open the Target Module out ofits socket. Andits Module box and turn the board over. 17. Our true Target Device is. 18. Now whether dealing with the here. is the Mask. Mark EAM or AM, you should be pre~ the board with P pared to desolder the 64 QFP. 19 Locate the O5B/X GFPS4 acapterforthe ORGS. 20 re a “There aeresisors one suc hi ata | arte ever A en ag ele a Mercedes Bonz 2 a 2 a a 2 ° , ° , ,24 .Locate HCOSB/ Zine s#OrP aaptormo me 1c05B ‘plug. Remember tha all the writing on HC705B adaptor. oe mates 23.Now 24.From the ORGS sw, you can in- ji | 4-MTRK> stall the SAMAR Vicssticos> nicestic70sKs2 adaptors 5 into the top of the OR- G5 hard- ware. And start the 25, With hardware and sofware sot. Cick the 26 Assuming the BIN appears in the win- e you get any boot dow, before anything else, ferore oF rea errors, chock the salering and to verify the read cee cmmeadosos 5 Mrcedes| ey Pro USALLC83. Of course you have sighed relief when the ORGS read and then the Tango recognized it, but the most challenging portion of this job is returning the QFP 64 Device to the circuit. Remember the ba- sics. 1) Clean the board of old solder, flux and lacquer. 2) Verify the device lays flat and square and Pin 4 oriented on the board before fluxing. 3) Use plenty of flux. 4) Solder a couple opposite corner legs down to establish the flat and squareness. 5) Solder the re- mainder of the legs with your chosen method, 6) Return the mod- ules and parts. 7) Check function. Immo issues on these are indi- cated with “No Start” in the odometer display. 8) GET PAID. The bottom ask if you Inoperabio key "oe Koy Pro USA LLC AANA TATA 0 0008[AtaGies Daren Dat Deve Render Grange — ‘eae Fanponde9 15,181 {his isa great introduction toa slighty more involved "EEPROM" jab uses it uilioes a 64 (quad fat peck MCU. But fortunately it can be road in circa withthe ORCS. These can use ‘multiple types of MCUs however they are allroad tho same, Maybe your or el locks Use one ofthese vans fora service vehicle. This would be a great epportniy fo practice 1-The Target Module is an ICU behind the 2. Start by removing the two screws instrument cluster, This is an easy module in the top of the cluster bezel toremove.3.Once the screws are removed, 4.The removed bezel, exposes the bezel can be unsnapped and two more T20 screws holding set aside the top cover for the cluster. ae a S 6, Unscrew he nal wo T20 that secure 5. Unsnap and set frei cur tine a Tote aside the top cover. — mcomnecton‘orthe custeris hinge ~S 7.Pull the top of the cluster rear-_ 8.Remove the target module, and ward and downward. The ICU is unplug it to take back to the easily seen and accessible. bench: « « « oi Mercedes Benz CkeyProusauc9.The label of the Target Module _10.Remove the back cover and on the bench. Visually verify yours then is similar before proceeding. securing the board into the bo: I 411 The circuit board removed from the box. 12.We need to check the ORGS before we (Our Target Device is easily seen now. Re- proceed. Connect the hardware and start the ‘member they can be sifferent device types. SW. Select Type Button 3-05 Immo> Mer- This particular one is 1L02M, ‘codes> SprintorVito 08AZ32A (L52H) 13.In the ORGS sw Click Help> Chip Info. This will display the solder points for the adaptor. FO AsiKEYPRE@ Device Render SMOK [Mrocammes Teo “Tape Modal Mole Loco gion Module “age Deve MCSI20 128 Read nor Ot nC rina Transponder 6 Gable Trane 96 IN treo PINeecin INN ey ‘This version ofthe Sprinter sa bit more involved than its previous incarnation. The Target _Modile is mare complicated to remove, The solder poins forthe SMOK are sigh smaller. So once you have conquered the Teme version, ive is E2S based system an attompt Ths isan ‘actuated ignition system, se donot attempt te fun the ignition lock prior fe programming. lied * 2.Remove two T20 screws ‘aka EZS, And its surrounded bya bunch of screws and plastic. from the lower dash panel. oe ‘these vehlotos using his Immo nystom when you are dene, The only adaitional Nave hmewsfaure rate tor tne lgmie lon media Wis Gre techniques you ‘cTivore you willbe capabie ofvopine- [pWTigliden mosaiandnavelthe, echieveshlawhenwe getetozerto that Fipummecrenayteriantavan sep. a oo — = = 3 Mercedes Benz (key Pro USALLC3.Remove the Small 4.Thenthe Larger 5. Now you can ac- Panelbelow the Panel under the cess headlight switch, steering column, to remove. 6.Unsnap and remove the Bez- 7, el around the radio and AC controls. Lots of plastic told ya This will give you access to yet an- other 120 screw in the gap between the AC vent and the cluster bezel trim and.set law : » aside. It 8 would be » easy to break if you lean on it. okey Pro USALLC Mercoen Gene10. Back on the left side of the column, 11.Thalsrightfoks, Remove the clustor. ft remove the T20 screw below the light | "SNPS straight towards the rear ofthe van suitch tached tothetoptrim. Sion Cle mesh wetness with this process. 12, Disconnect the single pug to the cluster in Fe ads a eo uong a small Orhan cgi ave", unscrew the ignition bezel. located in the top of the cluster “cave.” es Faroe ove, £23, 5 ac Suan av oTeT eT eres isoed ond © aPMar Tate Gelert oreo moved to your soldering station. Note It says EZS on the labelVecknaflthecasetoninetortiae 17-Remove the back ‘care ofthe plug pins that come thru the case. half and set aside. 18.Remove the two small Torx 19.Here isa front and back view of screws from the front of the ig- the circuit board nition module. Then the board Verily yours is similar. ‘and what tne amounts to the ig- nition lock wil slide out \ the back, 20 you open the SMOK help doc and goto 24, his is what SMOK provides He cr eevee 10 determine where to solder the adaptor leads to. arcades Benz (Key Pro USALLC22. Here is a blown up version, for our sight challenged readers. Fire uy the solder iron. llow is ingide rrreleles? 24.Now connect the solder adaptor to the SMOX hardware and the SMOK Usb to the pe. Start the software. 25 Heres even a closer view of my adaptor soldered tothe points, use a small section of speaker wie fo ease the coax connection as it seems slightly more dffeuitto solder. 25.Mei MCU> Motorola> MC> HC12> Te ‘ppeors tobe puzel Rs Bolfile. Even though it gives a warni ‘never had an issue adding33.You will be prompted to save the new bin file containing the new transponder in the Tango. Sa hare rate fr Rl ores « a a sume you have the common sense to re- tum to the SMOK and Open this new Tan {0 converted file. Write the fil to the de- Vice, assuring itis sil soldered up. Then. esolder and return tothe Sprinter Re- ‘member the ignition wll not tur il a pro= {grammed transponder is nionuved tot | ‘stronaly recommend chock tiple times as you start puting the back together, You don want to che ‘once and get dane to find out connection Is loose, Eventing the same for reading n= JEEPROM, but you must gon exa step and read the Fah daa by eelecing vom he |SMOK options. Mercedes Bone 34,And reminded that the device must be rewritten to complete the transponder adding process. ———_———r you ever need to replace an ignition module, yu wil ned o alo copy ove the Fash data rem the orginal device tote donc. fvc= HoTa> Secura> Fne> NOBST2> acs 2aseFLS SEC Wn bot saves soerup | ano ard wea fs of Ofer another bay | Key POUSALLG, aannananaaaaaaaaaaaididdDevice Reader Orange ‘Programmer: KeyClone [Fewenoiic cu Nols nai Bl iret her feztboen teen c Read In or Out: Out of Circuit [Oven Tmpmnen90 =~ Tampude 8.T ee inne Bt Stand lor Ot Convert 1 Gone Oot ey on Tames ‘his module Int erbly cet o remove, however when youd gt the mode i ate ‘you mil ave to desolder a 64 QFP. I may have been the condition of my part ‘r maybe not, but in removing the target module, mir damage occured. the section so that you might 20! make the same mistakes. A.The Target Module is located behind the 2. Stat the process by removing the fuse Instrument cluster. A few layers are be- panel cover on the driver's end ofthe snd the module currently. dash. ‘okey Pro USALLE4, Now the lower dash should drop down. Disconnecting all the wires is unnecessary. 3.Three Philips head screws secure the lower dash in place. ij Bieri the damage | montioned ear. IAs carefully a= poor ‘This thin piece of trim broke on both sides. My ‘snap the cluster trim from the ‘example was an early year, $0 maybe this is less front of the cluster. Iealy on ltr years, but bo careful ether way. bo 7.There are 4 Philips head 8. The cluster should be free now screws to remove that secure _ to pull outward. Disconnect 2 lev- the cluster in er type plugs from i's back. Mercedes Henz ‘©key Pro USA LLC. aannAAAA AMADA HNH10110000400400 AAA AEN9. With the cluster out of the 11.Remove the board from thé box. Make your pin 1 mark on the 10. The module is only held in with way, you can see the target ICU, Sal Plastic clips and there are two plugs to release. e board before proceeding too far. touse ther- mal tape to protect the surrounding compo- be shy with the tape, it isn't expen sive and ‘can save you tons of trouble. (key Pro USA LLC 44, Use your practiced techniques and gently lft the device out of circuit Carefully let it coo! in a safe location Mercedes Benz 12. Here is a slightly closer view. 1D69J equals MC68HCO5X32‘Locate the 086% OF adaperfortne ORGS. 18 stomevoas corey Ace us ‘There ae restos ontnesrtaca athe prt hat | Suse cave up heathen eter e as ce ha ‘We cred eda cir ye fo 17.Locate HCOSB/ ‘monte ht le ng ont ep tng HC705B adaptor. 19.Now = = 20.From the ORGS sw, you can in- [i 4-MTRK> stall the pial s: MC68HC05> MC68HC705X32. adaptors + =e = into the top of the OR- G6 hard- ware. And start the software. 2 Mercedes Bera Key Pro USA LLCBUEVVUVESVSSTIESUTSD DRED DDSESEeTTSTTCUEETES “Target Modale BOM “Tonge Devi Lk SOIC) Orginal Transponder Filips BIN Ene No pepe KeyClone penser 6 When the BCH number will ot erat va the O5D, you ook ai the sicher on the module. What happens if that sticker missing or damaged? Hore’ azoluton tht doesnt require either num: ‘ber beceuse BIN conversion results in « progranned transponder. Thi is an excellent beginner ‘example, no desoldering, simple device and easy reroval 4. Heres interior view ofthe dash area. Note the unmarked immo ight at approximatoly 2 o ‘dock in reference tothe anaiog clock A 2. The targt module leated behing a smal pan ‘tonto diver sie A pila, behind thee fot {eat The cover easy removes fora beter ew ‘This section would be con- BCM conversion system. See sidered a general guideline the end of the section | = ab- for any Nissan orInfinitiin breviated descriptions of the carly yearranges ofthe BCM Modules that apply. ‘okey Pro USALLE eee Nissan 14 dule) is 4. Remove the FIM along the door fame and 3 The the black box wih the wht label Remove he cet aside, Then remove the 1°! covering the a above the fot rest {CA andthe surrounding electronics. pp eer) 5. Unplug the tives plugs going nto he BCM. 6. ee thoso iarbanas Andityou choose to remove te ent bracket §e-7 yen an meteaicuny wort he BOM to securing he BCM. tar be removing the Soci nachos oe at tine OF 10MM bolt atthe base. OF the plas tabe by wedging the diver between simlartos wih your module. Note the part hum the bor and the metal racket, Do what werks brs et, and most portant ou usualy the8. Using a smalfat head you can work around the perimeter of the box and release the plastic ‘abs holding the back of the box on, s 11. Now that we have located our target device, we can connect our AR32 tis computer and star the ARS2 software by double clicking th, EPROM icon onthe desktor, 13, The device options screen should be similar to hia, with LOBR inthe top let and your hard ware settings deployed along the botom 10. Hore isthe BGM circuit boar roe of ts box From the help les of programmers tke the Tan {908 TMP, | know to ook for an SOR device 42. withthe ARS? sofware up and running, ther type your device ino using the PGON anc cursor arrows sro to the device type and it INSERT to select fom screen 14, erty that the series of wer connected to thei pos 8 ‘Nissan15. Once altho sotings are correct onthe AR. hardware attach the Pomona (Blue ip) tothe device, The brown wire on the ibbon cable ‘oud goto pin one. 17, Option 5 (uter Eder) shows us what was justread out ofthe device. Cick it and the ‘s2f66n should go from hs 19. Locate the C thats de ‘ated tothe same NICU that our You ‘can determine this because a 2 wil proxy Nissan 16. Option 3 onthe ARS2 software, READ DE- VICE INTO BUFFER, isthe command we use to extract a copy ofthe BIN inside the device. Press "Yt read frm beginning of the BIN 18, Tothis. However you can see there appears tobe no information here. Increase the voltage and tr to Read again, which Idi, to zero re- sults, Se deselder or try ths 20. Fux tho exposed legs on each ide ofthe nd solder a jumper from one othe oth the erystal rom allowing the MCU to interfere with our device reads, a a a a « « « « « s se s os = = e e se « s =e = « = a a « a «a «a «a «a «a « « « a key Pro USA Lic20, Reconnect the Pomona ip, and return to 21. We haven vee this BIN but do youre ‘step 18: Read the device again. Hopefuly the member the 1 to PN conversion? Look ‘esis of option 5 (Butler Ector wil lok similar closely, use your magination to see they re to this. here inthe fe 21. From the main AR eeoen, Lets select option 22. fall's well you wil ecele a GREEN Zero '8-Compate Device to Buffer Selt-explanatory Errors Found message inte bottom ght you tite, the AR2 wil reread the vee and com- receive a RED enor count message, acjust he are the orginal reat foow up read, pete and ty again. Green is Good 22. Upon receiving the Green Zero Erors Mes- 23. Now attach your KeyClone to the PC and 296, prion one is saving the BIN fl Start he supporting sofware you haven used will save tothe the programmer ia wile, dont be surprised computes dive afer you prove a fle name. there aro updates nooded. Aways improving ‘Key Pro USA LLC » » » > > » » » » e . . 2 > e 2 e » s » > . s » » » » . ® ® » » » » » , ,‘ight File ‘okey Pro USA.LLC28, With the appropiate transponder on the hardware, and the ‘Cick the Gen te New Key button, The TP Generated. OF ‘message in the daleg box means sucess, = (=) 31, Now retum to the AR32 software, we need to rogram the"IKC" BIN tothe devie, hopefully stil all connected. Option 1 Program Devic rom Disk Fila, then ALT “D"to view the es 138, From the fe selecton screen, it"F3" fo x0 are returns to the home scree ‘gram. The Benet {-P"}o proceed programming. 'S Ski nt me screen (Key Pro USA LLC, 30, Now Clik the “+= A" button, ep right and Select afl name for future searchabity |just 9 he programmers name to the lst fle ee area 32, Use the arow keys, lt he fe thatthe IKC created, Koep in mind tat he ARS2 only splays 8 character fio names. New fle may 3p ears as “4m 185-1 bin’ ve 4mB1BS08IKC: in 23, Assuming you gt the Groen Programming Someta mestage atthe bottom, yu are Sere. Ray Messages means revit ‘eto rermove the soldered on grounding mper rom sop 20. Return everyting os ght Caton and test ransponder function. Probably rot an everyday station But probably ig bucks Important the knowesoePARAARAAAAPAAAAAAAANAAAAAAAR EERE ERE REEEEEES 8 Nesan key ProUSA LLC |BIN Enc No PIN tin 6 No ‘his particular unt was sen by 3Jockzmiths balore Irecered te call. They had al wed various 02D ‘Programmers, bot legit and ler !atemptod witha oy ORD options. Everything fae wt Performed te folowing procedure. Iwas paid wel a 08 Should you succeed where many have aed. Hope this belps 1.0ur 2. Remove around the ignition lock. Itis easy remove, he column shroud. And the single bot tat se the lock housing See the next mage lar system is that many ODE programmers cannot com- fmunicate with this antique ‘@key Pro USALLC Nissan 93. Here is another angle with the 4nd there isthe bott. tis a Philips and serewdriver inplacetohsip 3 rue mataatona socket be vod reference th It's location. 5.Other than the single bolt. nothing 6 ,Pop the cover off and our Tar- else holds the module in and the ign get Device is immediately visible, tion lock doesn’ interfere with removal. is in the form of a 44 Leg PLCC. So this is one of the easiest ‘of the mod: les to get in hand. Great | to snag at the pick-your- own-parts ¥ FE lets .With some research, you can de- 81s your racteedecniquestodesolir the 44 Leq device, Remember to insulate the termine that this is a Texas InStru- ssrrounding components. Mark Pin 1 or take ments TMS370CO02. But by look- spite ing this sys- tem up in the Tango soft- ware prior to the work, I knew what to expect aeee sannaadssaasassdannaaaqnngqnn ae8.0nce The device is ree moved, lo- catethe TMS adap tor for the Org5. t should look similar to this one. 11.Load the adaptor withthe device mounted init into the Org5 hardware. | do not recom mend in staling the adaptor then the device Be- cause of the extra stain tis would cause to the hacd- 13.1f everything is set up, Click t Green “Read Button and hope- fully a BIN appears in the window. damaging the adap- tor. 412.Now open the Org5 software and Click the Select Type Button. Then MCU> TI(TX Instru.)> TMS370C002. 14.Just to be sure, before saving, Click the Yellow “C”ompare Button, to verify the accuracy,21 Back at the Org5, Open the Tango File with the ‘and double cl utton, “a 23.With the BIN fle correctly rewritten to the device, you have to cross the most ait- ficult bridge to complete the job. Remem- ber the basics when soldering the device SITE FOR PROFESSIONAL LOCKSMITHS, back, remove the excess solder, clean lacquer away, square the device on the pads, Pin 1 orient- ed, see the appen- Date: (Key Pro USA LLC Nissan 0iar Dre ees ——=oe “Target Device: 93LC66A (SOIC) . Read In or Out: Out of Circuit = rn ra racine _— Not Olam ne Os Cor BN Gv err ge a] ‘his is another example ofa high end vehicle tha is classified at tho easiest level of EEPROM work, The Target Module removes without any tools, The Target Device isa standard sized 8 leg. And if you can make a mechanical key fora VW, you can do this one using the same methods and tools. ‘These vehicles ulize an electonicaly acu 2.The PAS unit, our {ated ignition. Wait until ater the programming |s complete o attempt tuning the ignition lock 1 Porsche ©key Pro USA LLC TAATAAAT TATE AEEEEE3.This is the view ofthe ook- 4. But you do remove the seat hiss the view ing from the brake pedal towards the back The solo tem securing the PAS tothe vehicle i seat. dont remove the seat to remove the pls scrowat te base of the front edge, ‘And disconnect tvee plugs. 5:Here is the label on top of the PAS 6 Plastic tabs secure the lid on module, tomake sure you didn't around the thin edge. Our target manage to pull the wrong module. device is almost dead center. 7.Thsdovice's a gStCGEA, which ndicatosa 8. or take a Megamos 48 aysiam. i you encounter a 93LC55, CUE Ws hat my exami an exact mac to ‘move tobe 1907 Boxter section, as you are Yous, Insult, Isoe ard Ds ean wih TS system wih sight derences, _lape hee. Note hv close hose c Key Pro USALLC : = = = = = = = = = = = = = = = 2 Lal wo Lal | ll Lal e al 2 ° e " e e z e e Z Z ia8.You can solder the now desoldered 10.Connect device to the TMPro adaptor einsa vom board, or Iload thedeviceintoa us" clam shell type adaptor and then in-Tatpro hard. srt that into the d ware. And the [ill TMP;ro tothe PC via usb. went ahead and loaded » usable tran- ‘sponder into the aerial 11. With the Software up —_12. Then from the pop up window, seeand run- “ay Select the ap- as w= _ propriate de- ning, Click vice. In tis the Select case, 93066, and Raa ‘as TMPro ab- breviates the Memory device type ul vice : down to its a petee most simple —— 2 identi. 12th he TMPro here are minimal steps. 14 Now that we have already load- arta eden aa selact 92086, : eee & ceptable tran feadeandaus. | sponder into ‘denies the BIN | the hardware, fle to capi waiaralreacHil yeeros 3 3 Poche fay Pro USA LL‘Model Deve Renda ARE eee rag Tat Male PAS Medan: Uae Dive Se age Dee 3.64 6 9010 Read ner Out Ou of Get Sa ale Tampondagy TS TR IN Frere No PINatcin BIN: Ne i ‘hiss another example ofa high end vehicle that i classifi atthe easiest lovel of EEPROM work. The Target Module removes without any tls, The Target Device isa Standard sized 8 leg. And ifyou can make a mechanical key fora VW, you can do this one sing the same methods and tool. ‘These vehices vize an aectronically actu: 2-The PAS unit, our stedigntion. Wat unl after he programming |s complet to atterpt turning the igrton lock 5 Porsene DKey Pro USA Lic3.This is the view of the © look= 4. Buf you do remove the seat this s the view ing from the brake pedal towards the back The sole tem securing the PAS tothe verics f= Seat. don't remove the seat to remave the _@ plastic screw at tho baso of th front ego, 2 ‘And disconnect thre plugs 5.Here is the label on top of the PAS_6. Plastic tabs secure the lid on around module, to make sure you didn't the thin edge. Our target device is manage to pull the wrong module. near the large MCU on the board 7.This whchindicatesa 8M Megamos 13 system. tyou encounter a 93086, pote + move tothe 2003 Porsche 911 secton as you a. YOU, sus ate a8 De ‘dealing wih a 48 system wih sight diferences,'ekhee And nt (ere) POUSALLE Ponte .10. Wh he ARB2setnre up and uring, 2.bad thaldevice iio aeaee: ther type your device in or using the PGDN and. tor as quickly as possible 0 YOU cursor rows scolltothe device type and ht lessen the chance of dropping it_ !NSERT to select fom screen 11. The device options screen should be sim- 12 Very thatthe series of lar otis, with 93C56 inthe top left and yaur ARS2 ae set corectly, and aso the hardware settings cispayed along the bot- fo start and the de vice conecod tothe let postion, Option 3.on the ARS2 software, READ DE- 14, Option 6 (utr Edy) shows us what was VICEINTO BUFFER. isthe command weuse just readout of the deve Chek tand the Yoeetact a copy ofthe BIN inside he device, screen should go frm ths, Press“ trea fom begining ofthe BIN @ dl e oe e eo oe os oe oe oe es = = e- = = -« =- «= = = <= = <= 715 Tots lfyouset some dla, that's good you do. 16, From the main AR22 screen Let's se 15 Tome rom the main ARS2 screen Lats select op ‘ten inrose he votage check a setogs rd ton 8 Compare Device to Buffer. The AR32, a ee ee rand men Weave yl eread the device and compare he rial econ ok 6% fead to teflon up read. ‘7-Malliswellyou wil recive a GREEN Zero 18, Upon een the Green Zero Erors Message, Errors Found message inthe botom gh Ifyou prety eneis sar he SIN ie receive a RED error count message, adust the il ave fo amore secu lip, ee. and ty again ation of your enoosng ater you pos ae noe 48, Moving over'o the Tango, remember the 20. The Tango Info screen fr this systom. should appear. telus that we winged a TS region is where the car company is based, |E (OF TKSSS! to complete this process Porsche ie German so select Europo> Por. ‘sche> Boxter> 1996 (93058) ‘key Pro USA LLCROVER ® & Make Model Years 4 Fang = = = = : = = = = = = = 4Thisigntion wi ot un unt programmed van- 2 Our ponder nrodueed tothe ack. you make the inthe top, center of the upper dash ‘mechanical key fest. dont attempt totum sock Just below the can--—— er othe winds3 Pop the speaker cover saighiup Asmat! 4. Three torx serews hold the speak- fathead wilhep to unsnapit The cover would 6” in ‘be easy to break if you lean on or drop @ tool thr it 50 | would set tina safe pace 5 tubby OF 6 Disconnect and remove the speaker. Again W@8 it 8_how much would it suck e drop acriver close towhere the windshield meets the dash. through the font of hi speaker laying onthe Careful not io swing the wrench into the glass. drivers side oor? Probably $800 atthe dealer. ze ee 7 ifyou can lok straight down, from inside or Atp that got tom a great fckerith was to ‘outside he vehicle through the windshield, leave the box mounted, pig the module, and YoU can see the Target Module mounted to open the back of th box. Then you can slide Srewall, behind the radio, the ch tke an EWS un — —9:Here's the board coming out of 10, Overalll view to make sure the dash, We can take ito the sta- your board is very similar. tion for the simple soldering job. 11,And this is our c 12 you hook up the Org5 to the PC and 16381206128, Fortunately we Under the following do nothave to desolder this 80 Leg GFP. Rover> 14-This wil display the O195 ‘pinout forth 13.Now EM EREMISHCAIEIY Mosatar. Bosicaty wet vies toe te Oro ‘eed ogo to what points onthe board. For Help then Chip Info. iss wornin need te 4 wre adaptor ‘Okey ProUSALL Rover 3‘Shee my vermon cine pat trees forse” 16.And this is another angle with ‘ard They proteus wih aneasy solerpoin' ens my adaptor soldered to the board. rect canmuneaton wit he Target Davies Latinamesemansaracticee 18Assuming the Org5 is stl con- fmt Savon cha uncl ooo ne ur ate figured as you did in step 12, You onthe Onpsnewareas seen beion Slackwiroiop. are ready to "Read the Device 19.With a potential BIN file, we 20.And with that good compare, need to verify it with the we can save by selecting before we save. Or the Save As Button ekay ProUSA LLC AANANENE100000027.With the file loaded, Click the 28. The write status will rite Button and then con- 4 scroll in the window. co HETEIRTTTIREETE 20 Than ust for safe measure, Ido ‘This time com- from the ICU, and retum it to the ve~ (he BIN loaded curecty nthe O08! pang BI ened earenty n2O705'2 Ficte, With a matching transponder = and properly cut key, you should be cereeeraess? able to turn the key in the ignition. angnaggacagaa Rover key Pro USALLC‘Lifts a Rover in the range of 2005- _2.Start by moving the passenger seat 2009 and uses an HU%01 10cut keyway, back, you are about to spend some time than you should be following this section. laying on the passenger side floor. (key Pro USALLC Rover 73:The CEM aka large fuse block 5 Then unscrew the 2 Philip scraws that s0- cure the lower kick panel. These screws ‘ay retained inthe panel 2 don ull them fly out 7 The glove box is made to unsnap and ay ‘on on th floor whe ei atacned atthe hinge Ihave not found an ecient method of remevng the entire box assembly. ‘4. Remove the small corner panel, that would) be directly to the right of the passen- gers right foot. No tools| needed, it {6.You shouldbe abe to remove the lower Kick panei now. Thre is 0 ‘isconnect. Set itn the back seat, youre go- ing to need the ream. 'BNow we can see the vi be opening and closing the box multiple mes ing the removal and return of he modpin are atic. forere you go [[10. Bottom view showing one lof the 10mm head nuts and the bottom plug, There aroha the ‘Soo that nee Tero frat nto nen fat you can look svaight upwara rom the floor. you can see the mod Le needs os off those sts, it 13 Probably had otal from te picture but 12.Its a bit snug but the large rte s about the size oa shoebox module should drop down. —cutinnaithorizentay. Ths is obviously the“V4Here’s the back, andthe two sockets you ‘are going to have a hell ofa time reconnecting shot unused, Remove the {6 Her isan overall ew ofthe Board Access fo the oe ia snot necessary te complet the Job. Attn request of the Tro manufactures | ‘nll notbe playing the pin out fortis device. He feserves ta fr purchasers of sofware and a¢ap- for These foe puta lot oftme ard werk int im proving our capitis, so respect is choice, 18 Here is the website description of software module 181. Keep in mind that the year ranges and models listed ‘may not apply to all regions of the world, Note: If you use a remote key, the fob functions will operate after pro- yramming with the TMPro, 15 Nor around the perimeter of the case, and separate the font and back haves ofthe mod ‘Ue, There fn need to remove any ofthe fuses ‘rom the rot ‘7.80 wil show you the Targot Dvd, a PIC. processor 18F3620 (64 Leg GFP), And advise {ou that you wil need the TMPro sw and the sol deron adapt: they salto readwrte this deve. 49,Once you have the required adaptor soldered on, connect the TMPro to the pe and start the soft- ware. We must first read the de- |g vice. Then PIC18F6620 (181).20.0nce you have Moule an selected Eom. the HPI ine doves, mr’) 3 ‘the TMPro rar othe Target oat Bascal | will read Iythe same the device mn serpion as and then from ne web auto iden- ES cin oont tity the aa foronta system ee ornate ae 22 Myou Gpeseuesean 5. ask you — a a Usable evting ‘wanspond ays. ie, TWP. nthe you are TwPt0 sot ready to knows what 24 Aer yo TH OS Very make that SUE SESIE compact choiee, the simplified TMPro aut ‘operation matically with the places the TuPro transponder Desoider into the BIN the adaptor file and e- |) aia, writes the [amram the key on Target De- [fees the vehicle. vice with the ot Pan rw Ne ey Po UsALLC RoverAA Glance, Mot Standard, Documented Date: 125115 Deve Rade: A gep TMP Fiogomm 1th par Modal Farge Device LCA SOLO) Rend In or Ot Oxo Ciel [iia ramoponden 741 (6) sable Tanponder i nan ceptable ball HIN EnayptNe PN dcin IN: No 2:The Target Module is called the CIM. ttis located where the steering column shroud would normally be 4.This immo system can be simply identified by the presence ofa as opposed toa standard metal ignition. AaB Key Pro USA LLC 4» » » » » » » = = = = = = = = = = = = = = = = = = » = » * * 2 ” ° ° ° ° ° ° ‘There are two holes onthe back ofthe 4 have provided these pictures of he spring steering wheel tha allow accoss fo the springs. with the airtag off so tal you can understand that secure the airbag assembiy tothe front of the moton required to tlease tern Ths is the whee! ‘wit no tension appied tthe spring nN ‘5 Here | appl tension to move the sping tothe 6 Now the airbag shoul pull straight back release positon, Once one side released, 1 wards You can disconnect the wires attaching & {indit helpful to wedge that side to prover ive. and set aside. Murphy aw says place the 2 snapping, then release the other side's spring, bag somewhere safe wth the met side Jn 7 Use a T50 Torx sever to ‘at 8.With the wheel removed, You can the center ofthe whee! and ten pul the now remove the CIM. Try not to ‘whe atraight off backwards. A whee! puller is Dy move the clock spring too much. not needed (Key Pro USALLC@.Unsnap the leather boot from 10!fyoulook between he aash an te back of the dash, and pull it backwards, 50 {r:,’’netoranstenes tveiow) nat ned that you can access the column. toe releasedto side the module backward, (=) 411.The whole module, tum signal 12. Release the electrical plug by sing handle and all, should now slide Pe [04 a> avay fom tne base ofthe con- Pei efecaring shat rector. The medule shouldbe free now. 1311 usually clamp the module into a vise 14 There are from by the clock spring front, Then unsnap the back ofthe module. Two are easily seen, the leather beat fom the back of he andthe third is under the white sticker. module You can the turn signal and wiper han les but it is not nec essary, 5 SAAB Key Pro USALLCdoen rer eater not crt thatthe beard 16, Little bit of glare, but not in the ‘tends to stay in place but be aware itcan tout fea of the Target Device. You are ‘and etuming he wile boars very feat _Igoking for a 93C family EEPROM. 17 83.686, lent and maf the board with your pin 1 erentabor: We don' recommend Sharpie }ype makers as lacquer nner wil cy odn work, but stonger pout a remove them 19 Insulate the surrounding components 0 they don't scoot across the board withthe applied heat and air pressure, ger nanm (Key Pro USALL21.Load the desoldered device ino the adap 22.At the AR32 software, you can either toc for your intended EEPROM reader. Tiss type in the device type or scroll to it using AR32s outofexcuitclam shell. use ‘Arrow and PGDN buttons, 93C66-8Bit 23:Veny al evtches and connections. This sree 24 Here the out of circuit adaptor wth device has all requredsotings, oxcop votge which! joaded, isin the left positon for 83C family. Al sully start low and go higher uni uccess. But connections and settings have been confirmed ‘ny outof cut, he kis votsishamiess. Sra we are ready to Beoly 25 Start with Option 3-Read Device Into 26. Now we need to see what is in the Buffer “Y'es to the question at the bot. PC's buffer, aka Temp Memory. Op- tom, Wedo want to start atthe beginning. tion will display it. ‘key Pro USA LLC27.Here isthe view of the Buffer. Itlooks 28 ESC back othe home screen. And then like data, as opposed to a bunch of FF's OPton 8-Compare Device with Bute, which (oF 00's which would be a bad rend, ‘ereads the device and compares to what you Just viewed, Green Zero Erorss good news. ‘29.With a good comparison, prioty one is Op : He/AGHMEutere Duk Fielche enon 00a Yes to the question of name than the re lusedbeon nin, if you would like to save the entire ‘ecation atic, file at the screen bottom, 31.Connect the TMPro tothe PC —_32.From the Open File pop up, and Click the Open File Button. You m= do not have to tell the TMPro what type of vehicle itis be- cause it can auto recognize the BIN file when it sees it. ‘Okey Pro USA LLC saa 633.Not only does the TMPro auto populate the sereen with su ton and then your Optio simply follow ens, and the prompts pertinent info aren | guide you butalso auto | based on displays the | ie! pao you Pacote P38 | have a work ing transpond- | premewrsiSeme oF oF not 35.This pop-ups asking fyou havea 36 After you have followed those Weistuaten trou Kae eacengney” Prompts, you will be reminded that place it in the TMPro *% the new file must be written to the Soitwil notover. (Eps device to com- tes po- stion ana chick es. ates ae lost pace = usable key inthe Thipro ana ee ST-Ale status ber along SNonmunte ne Ris aren, the bottom will scroll, and a list of the saved BIN files to select from, then you will teceive this message that the transpond- erhas been programmed into the BIN.39.From the list, Locate the new 40:The AR32 verifies one more file and according to the bottom of time that you would like to Program the screen, F3 to Program. ‘oF Skip programming, "P" or 'S.” 41 Programming Complete in Green means Date ‘everyting went successfully. Cick N'o to say Notes: ‘that you de net want o program another de vice,NN Doe Reser Zot. OOM rns 21 pe ROM Apo ge Ns By pt) [noon Ar De et age er On oie sia 30KG [Rann w On Ose Cra Oana Tapio armed BE [BN octet No Nain BS No "Gone Out or Convent BIN: Conversion Keyway B10 4.The Target Module, BIU, is on the driver's side, above the lef foot rest. 1 Subare key Po USALLC IPPPPAPPPAAAADOAAAAA AAA AAAAAAERR ETRE TRCN EES‘Here is the Target Module on the bench. 4,Release the tabs around the pe- It should not have taken more than meter of the socket side of the raeaana "Om te vehicle box. And slide the board out. 5.This is an full overview of & There are two versions of the Target 5 Device. Both 24C02 but one is the the main side of the board. serdar sized, SOIC EEPROM and Tihe cers, wpat wove cond. aNicro B1Nomalfer the device size, the pin 1 a EEPROM, Agproximately 13 the siz8 ef ways onented the same onthe board. Mark Sstandarsersion. My experiance i that hast the boars so tat you don't question yourse fem are the Micro-EEPROM winen you retum the device ‘Ke POUSALLC ” ® » ” , ,Sivawangandperedees tends 10 insite, eat, and descr. you ae fonside he working on something that could be this ex- ee tre Pensive to replace, I know you have practiced. ry mataresnsporehe PETS 1 replace, now you have ‘1-Load the device into the adaptor asap, 12. 0 that you reduce risk of losing it. The Zed-FULL adaptor, has a socket that ac- cepis DIP type de- Vices and pur- chased quick test sockets side of the Zed-FULL Hardware. der on for both oa 13.From the main menu 14.Select EEPROM/ ofthe Zed-FULL.. MCU LALELETET ENCE TERRE_ 16.Then RB 17.If you would like to see the 18.Displayed is the most important info they Zed-FULL’s Additional information oe ee ccs cine on this system, CI = » » s . » » - = => = = = - » » > = = =» - 49.This presents their very 20-Retums you to main screen, where you can Click the Green Arrows to EES scrot (noir provided meget I! (key ProUSALLC21. The final picture in their 20 Click Continue. files, the BIU part label. 23. Then from the MCU Eeprom List. Casorwiaesherevilzemtce soe 26 With all tha connections and eee x adancn ec" settings established, Click Read. eater = ‘Subaru >Key Pro USA LLC» » » » » = - 2 2 2 2 2 2 2 2 = 2 2 2 2 2 2 2 2 2 2 2 = 5 2 Tiina seren spac to tis BN Up whentheZes-FULL recognizesthe BIN, 2e--0ad an aoceptable transpond- Theres vary in in hs le, thereore vey €F nto the lite to i 29.The only options after you select a 30-The FULL warns us that al kes willbe slot are “Exit” and “Remove All" | select erase excep! the one inthe aeal At the ime Remove All out of lack of choice, {Publication this is the ony option ‘Aga here, there exsted multiple tpes lacceplbleransponder, you woud needio S2- Select oe. Bl wa have oly ne cic, ZF fatenerosto ‘once more ‘eKey PrOUSALLC '33,The Zed-FULL goes to work, con- 34.|mage File Written means the Device Verting the BIN file to include the tran- as been successfully writen. Return sponder. Then it rewrites the device, °vervthing to the vehicle and test the key.DoddoeERRERERRRRRBDDDDERDD EERE EEE IEEE EET Tort Mode BI ly Inge Uni Target Devi 240M Stand SOC) IN Foard No 41.The Target Module, BIU, is on the driver's side, above the left foot rest. JBARU === Medel | a Imola Spy rei a‘.Here is the Target Module on the bench 4.Release the tabs around the pe- Itshould not have taken more than —_rimeter of the socket side of the minutes to remove from thevehicle. box. And slide the board out. 5.This is an full overview of 6 There are two versions of the Target r Device. Both 24C02 but one is the the main side of the board. standard sized, SOIC EEPROM and AUUAATE RTE R Re eRREe CMR Pl a 7 te otheris, what weve coined: aMicro BNovmalter te device siz, the pin 1 is al EEPROM, Agroxmately 193 the sizé ofa ways oriented the same on the board, Mark standandersion My experience is that hast the board go that you don't question yourself fiom are the Micro-EEPROM ° ‘Subaru Key Pro USALLC‘The examle wl procoed a8 a Mico seed EEPROM. Olu clan dcr Tee Mon rte "ota th dfatynreases win cerease mee, Mt Soy hee re an asa es ‘And wave reader you tear, st have an EPROM I bave ne arr eras ay Sy 2 sath sal fort The Tro hasthieare, SO Fe ed tounge sane Os ‘11.Orientitproperlyon the TMPro EEPROM 12th adaptor, which 2s sated before, does have the. the device Micro pads. Make sure you solder the device installed! to the 24C location ofthe appropriate size. connect the asap torto the TwPro harcore, the TMPr0 usbte P., and ow. = 2 2 = e a a o 2 e 2 2 49. With athe connections estab- 14. This device is a 24C02, re- lished and the sw running, Click the _gardless of the micro or stand- setSclectand RENNIE ard type, Se- | Read Memory lect it and device button, Place the cur- then OK. The sor over the TMPro status |buttons mo- displays in mentarily to the bottom: see their de- EERE right bar. scriptions. SWSSVSSSSDSEDGS21.The standard reminder mes-_22.Moving back to the TMPro, sage from the Tango to rewrite you can Click the Open File But- the device to complete the pro- ton. Then Se- cess, lect the Tango file you just saved, Thi all assuming the device is ‘still attached to = the TMPro, etc. 23.The TMPro again rec- 24The device is stil a 24002, so ognizes the BIN. And our _ ™ake that selection and then Click OK. We will assume if anything last couple of a BSDSSEEEESCCCCCE button clicks can troubleshoot are Select it am sure you Baris were successful Carefully solder Memory De- “fee that tiny device back vice. subary 2 = = = = 2 2 = a a a > > - eS e e e re r re e e 5 PP okey Pro USA LLC 0Pe a ee Programmer Tag plan Salar [Mae Location: Most hind [Res tn oe Out: im Circuit ‘mis yom can be identiied asthe relash-abl Toyota and Lens earliest North American imo We We made «lot of money on these back ten th the ARSE, rebadged a Blue Chip Pr. Now consider {histo the simplest ctegory of EEPROM ob, No desodering, you can conrert or cone out {The aor ofthese vehices,ncude he Avelen 2, There will be a combination of 40mm. rape he Target Modules behind he glovebox Treemeniowercestons faliva coverovecs analec phillips securing the glove box end ‘and surrounding trim pieces. Tay | Komewitthnvelearscrowe securing ine howe examples atthe end ofthe x00 GovsboxinbatthicmakerMagecdon: tom. See the Appendis ior complete Siptatcommcs ofthe xtra topes you Mototwehlctosthatthis section apples [gettucky, your example wil ve an ender &9- Ghehood models, aethey areby far the Toyota ‘key Pro USALLCv ' & 3. Remove two philips from 4.And a Plastic cover, to re- & the top of the box void. veal another connections. ® j ® e ® 2 J a ® » we & 5. Another 10mm 6. The large lower trim removes a and should be set in a secure lo- » bolt. cation. Not sliding across asphalt. a y ® ‘ ms / 7. Two more 10mm secure the 8. And the door can fr door of the box to the front. be moved aside. fy Vv ‘okey Pro USALLG Toyota .9.Acouple more phillips se- 10. Remove the liner and cure the box linerin place. set this final piece aside. y " an ECU, 12. Typically there are two 10mm nuts se should look similar to the this “ing the module in. Look for brackets ‘coming of the top and bottom of the ECU. one. 5 to 7 plugs. Zs ° 14, You should be very close to having the 13. Here is the 10mm nut rei inyour nants Again the covers a at the top of this example. lve ange ol yea and models natal15.There can be anywhere from 16.Then usually two more se- 4 t0 6 phi 17. Atrick Ihave used since the 18, And re-securing it with the beginning, is flipping the board screws to give ita stable working over so that my device side is up. base. 19, Here is.our Target Device. Itis 20. Now that we have identified always-at address IC900 and should. the device type, we can move over be the only 93C56 on the board. _,to the AR32 and select that device. (Key Pro USALLC : s © s = E . » * * e a a = = 2 o oo e = a a a a a a a z , , Z ia 2 e cw21. Before the device options screen comes 22. There are few settings to veri- Up, the ip switch setings sereen for this de- ‘vce wil display so that you can setthe hard. Y and then we are ready to at- 25h a sting and switches ready Opton 24, We need to look atthe possible 3-Read Device into Butler. "Yes o the "Read BIN Fle, sail 23 Butler Start queston athe botom fet ; hl ‘ display what the AR32 just read out. 25-This isa very simple BIN fie. you are 28 Jutiobesurect he, athe stare dots familar wih Traraponder Theory by Joomy —Ci=7 Sopa Ovens Dlr ended ery Php youhave seen tis le expainedin P22" aga ypu acaerytes Sack seta [ Oe 3SWUVVUVUUUUEEEEERUCE ECT C CCC eeTTTTe 27. We are now ready to Option A-Save Bult: €F to Disk Fle. se the lat 8 forthe fle ‘names, then place them in manufacturers ‘named folders. 29, Now we have a potential good BIN, we ‘can hook up and start the Tango. Region Asia> Toyota> MR2> -2004 ECU (93056) | ea U w Tapes ie 31 The Tango didnot give any error messag- fs, and the Key Sats populated, so we know the Tango accapted the file. Select akey slot, 28, "Yes to the Save Detined Butter Range {uestion. I you needed to only save a small Bit ofthe fie you could define a ciflerent ange wth “Options 30. Now that the Options screen for this system is open, Click File then Open. 32. You wil be prompied to select he tran ‘ponder type. Based on this selection vl de termine if you must ewe the BIN tothe co vce, Cone Out vs Conversion.wena chemigtncnnat, 4 Tangonaadyou onan he Seorrcon ct Seaman cnc cecoemaemmmmaye = He tat H be writing to, 38. Youhave seen this reminder fom 16, Wit the device stil connected tothe the Tango ifyou have been doing any 'AR32, Option 1- Program Device trom Disk EEPROM work wih &, The device must be r@- File, At the botiom s says ALT-D will display ‘writen to complete the programming, al the fles inthe current path {38 Baton et comer ay press ‘Progam and i67: Locate the Tango file, arrow ‘then watch the status in the bottom right comer. toit, and the bottom says F3 to al gos wel you sou be able tore he Program. mdi othe vice and eck he ey unten sKey Pro USA LLGFor two Lexus models , the GS and IS, the ECU is under the hood, (driver's side near the headlight. Remove five 10mm bolts, to access the ECU. Bay POUEALE Remove various screws that se- Jcure the behind the seat storage icompartment's liner. The module is behind the carpet, mounted to the rear fire wall.KEYPR@@ | TAtactance, See [Fret Note ECU (Domep Trg Device 9656 S010) signal Transponder Teas 46 | tit No [Cenc ute come Bie ‘hs secon is sing some aterative method and ol promot anne of inang ate he Ds We are going toa la tte derc, mach ke edition rfc. Ten led dae citer transponder th cr known master Wo sing, Hope you eno is baci, reign ston “LFor his section we wil use avery simple &x- 2. Locate this black cover, remove ample, 2001 Lexus 18300, The Target Module a eceimeen ‘Sunder tne nood nar the crversheachgnt_ thee TOmm bolts from its pe (Key Pro USALLCpire a white plastic cover 4. Unplug the ECU and move the that protects the wire hamesses. plugs aside so that can access the retaining nuts. AS 5, Remove two 10mmnuts that. The ECU should be ‘secure the module in it's weath pase ee. *" ready to lift out of the box. 7This label can take many forms 8. There can be as few as 4 screws ‘over the many years and models but this example has 7 philips to this system applies too. remove that secure the lid on. i a" (ekoy Pro USALLC9.With the lid removed, there are 1° Each car model uses a slightly different two more screws securing the board, the most important thing is that you can locate a 93056 at circuit board address 10900. ‘1. This particular EEPROM isa Faith” 42. Remove the’ lacquer from the Brand. Indicated by the large butthiigon- jo Romove.the Iy important with certain readers, i the Orgs, device.using either chemical or abrasive assistance. f13.For Crccaulsuper beter nape ontucee his ve-rsneronau, hicle we ill be peg a en nee Toyota (okey Pro USALLC418-The pon loader ves a great desgred Pogo pin 18 Orc yout nO i 281 on ate py ee annecton fer aching othe Target Deve ust Sushave ben wren dovs Crone Pe pn eatin pin and carey pus tsvaght es! osctngon ne cps to own to touch allo Press te program buton, 0 hey thas tonto 5 seria west we 17. Now we can move over to the 18. 5— Other Applications then ZedBull or similar cloner'to write 4_ Manual Programming, the string to a usable transponder. iti 20, Now we are ready to use the Zed- Re MS cutie bpd a key etro. as 4C which is Option 6. Let's get the string from the red pen.21. This wil splay the key tring thatthe OS 22. Here is the beginning of the wheel sting programmedontothedeviee string. Either write it down or | 28 ether program button to serll hu ae ‘pscel bunch it straight into the ZedBull 23, Here are the first 4 char- 24 And the next four. acters input into the ZedBull. plugged into the ZB screen. 25 And soon 26. Till all of it has been ‘key ProUSALLC27.With the entire ‘key string entered, ress the right arrow bution The next. 20: Use the Up/Down screen comes up, and asks youtose- arrOWS. lect a usable transponder. The choices areal onable 4 types The end re # Sultis the same so choose whichever ‘works for your situation and inventory a 29. Place your transpond- 30. And then Click the er into the ZedBull aerial. Right Arrow again. 32, And atthe end, the Bul wi reread the 31. The display will cycle oscrenierand very tekey sting you ule repeat he posts, Clk he thru the status messages. woud ike to repeat he process eon 4 (Key Pro USALLC‘33. Retum the ECU tothe vehicle, remember 9. wil not eave the clonabe transponder the Red Pen Looder placed a BIN onto the do- wth the customer Butl can use its a Master ‘ice and then showed us the Ke strings that t_Key to “Pedal Dance another transponder in wrote tothe BIN 35, So the Master transponder goes othe 36. You will ned to know where the immo ignition. Then follow the OBP procedure to lights to complete the OBP. The IS300is in ‘Add another transponder for the customers the cluster but they can be found in various final key, ocatons around the cabin Date: Notes: ae 15 Toyota ‘key Pro USALLC|? Devoe CEN DR ERICH GHPEGG [Rin oO nC [Origa tnspenterteamse = BN ep No [Clone Out r Conver IN: Ether [eer Te Toy top 40 5 ‘They are getting few and lar between, however you at some point may have ie pleas lire ofrunning into an early Toyota/Lerus that contain a Delco CU vs the mach more {common Denso ECU. Thave recently run into 9 ofthe Delco that sme technician reat ike a Denso. Te major problem is that these technicians are “Plashing "an EEPROM on te Denso bu the daa is store on a 2 Leg PLCC device, So as are. = z 2 “sult they are damaging the circuit by reprogramming an improper EEPROM. a es es “1. You can detamine tne presets ofthe mo sys- 2 you also deterine the Tarot Moc ie behind ‘smb he LED Sect einithe cuter. Tis tra glove bx and thas an ary oe mee, tossrtmsen youneve a Dec, ist that youhave an 19971999, the cance of eneaurn alco creases. This varie isa 98 Carey3.The first bolt is a 10mm under _4.The other bottom comer of the the trim of the passenger’s glove box is retained with a single door, lips. 5.This glove box has 3 philips __&.Now eto shout te feo pl dom: ward and rearward, Up til this pont, here is along the interior upper edge, this ae ne es ee and number varies with models. the two previous Toyota sections 7.Now that you can see you should 8, IF you follow the ECU upward, have noticed immediately doesn ook ike the majority ofthe Target Modules we eficoun- tO the top bracket there should be terin these models a 10mm nut to remove. ir ‘ Key ProUSALLCO There is another 10mm nut on the 10. Here is our Target Module back bottom bracket also. The ECU should on the bench. The label reads Side out the Bottom ofthe void. Delco, just to solidify your fears. ‘11-A helpful tip is to mark the brack- 12. Now you can separate the two ets prior to removal so that they don't halves of the case and set them to Confuse you upon returning them. the side 13.Just another reminder, wo ae not Treicnsangn nA ita looking foran EEPROM. This ECU ut- So's ur toscana ene lizes @52|eg PLCC. | have seen afew soe manta union ‘mask sels, but tis a: sways in the samteloca- tion ands the only 52 leg on the15. Using the arrow keys and —_—_—16. Once selected, the settings screen will PGDN locate our device type in “spy for this device. Both . the AR32 software. and the ac etane 18 Ad hei rere asap cle 1 17. These are the switches Me Acucayentie eae eats ‘on the main AR32 hardware. should vod want to contact them for one. Set ts) 49,The adaptor must inserted ful- 20. Per the instructions on the adaptor, Itatheleftperthe standard connect the orange we fo he +8 vo pace tnd the ylow to the ground ak Vop Toyota ‘okey ro USALLC ann21.Now attach the plug end of your 22. Remember the legs are numbered ribbon cable to the AR32 adap. COUNTER CLOCKWISE stating at pin 1 tor, Everything is clearly marked, M20? robe ends to the ents eg ggggggcer 23.The end result shoud look ike this, The micro cips sometimes have trouble holding (n, and the rabbery lacquer can interfere al 24. With alll the connections estab- lished, with the slide switch near i's center Rested Step | Hi Olgt {key ProUSALLC Toyota 20 WIVISISSIyBD27. From bis port n-wecantsatiiedevce 28, Option 5 Buffer Editor will henre - display what the AR32 just read into the buffer. 29. This file looks very similar to a 30."ESC'ape tothe device options typical one from a standard : sereen, and then pare Device 93¢56 EEPROM Buffer. “Y"es from the Buffer Start. 31, With a good Comparison, we ca 32. And as always, “Y"es to the lenose agenericram® question of do you want to fortis article, however | sungest something much mote speciic as @ standard practce. _ save the entire BIN file.reeeme Fnes [Mote taco Ate nl Ban Glove Bo ae eran eterna the O30, you may vary wel have rin into one of ese, [wuld sy Hin evry 15 or do map be a gocd chance of encountering one that tines parte ICU ers a standard rene hi ser oab venion, The mode! wasn a huge eller fr Toyota x, they ar lead aie wacommon 2 egal in ny erumauon. See on ther tte below abot cise conversions are deal with |. You con etemine the presents ofthe ro sytem 2. Once you feel you have confirmed a eset coon The oxen Separate ICU system, the Target Module Pica you have run oa vpaae CU spt at Batyautee annoys tl is above and behind the glovebox. « eKeyprousauc «3. Now open the glove box as far as Thon ree hepa wcctragimasen. 4. couple philips screws secure ‘senge side: Now the box ont shoud remove the top box liner in. Remove them, and sot aside. then snap the liner downward, ay) 5. Setthe liner aside then look There's no way o take a petro ofthe IC. straight upward about in the cen-_ Si!sty vast isms bast his ter of the void behind the air bag. te accessed wina socsetand wrench 7.Unplug the ICU, and move to 8. Here is the board. We can lo- the bench. Remove the end cov- cate the single EEPROM in the er and slide the board out. circuit. It's a 93C66. (eKoy Pro USALLC 248. Clean the bie lacquer of wth abrasives or 10. evice chemicals of yout choice. We can now read ble. Orient it propery. Start the top ofthe device. And mark pin onthe up the AR32 software and soloct 2508. board) ==" and desolder the device “.Once the device is selected, the Dip 12.Confirm that your setting are Switch Settings screen will display 80 gimilar to the ones below. Press a that you might configure the hardWare. any key to proceed! 18 Option 3- Read Device into Bufer.™m®= 14, Now lets look at the binary file simple funson son 3 comenand tothe EEPROM {ovend out iscontenisin Binary Language T»e in the buffer by using ‘Sats wil qk cela in he baton rant15.Your BIN file should look simi- 18 To ease cur fears, rir to wasting tine lar to this one. It appears tobea auaabaitie.< ot AUER dane Bier. The Green Zero Errors message means we can save tis a8 an accurate BIN 17. Saveis Open ‘A: LadBtinsmyfomatl ce. 10 Fore be lat 8 wok le when they are Some tee ue var og. desctpre nae ncra organized fle" by Make eh exp BN fu nats model even pm STE Mot rie fore est fy Sas, cou8 le tetetonesen Coercibece: etre: oy under BIN FILES= Toya AMCESEAD BIN 19.Nerngo oe Tare Aa Tower =, 20, Lets have a quick look at the qreetton tis Fl Crusarhas some ect intre Green Book aka (Key Pro USALLC Topo oa28 I select key slot 5, loa! a facto Fy harvested "%" into the Tango ‘and Click the "W'te Key Button, 31. Tango confirms that thas $2 Retun ote ARG2 assuring i al cor created anewfilethat contains OSV rnen aio to duniay nee at the factory °G" transponder. lena i> so «| the file -"Pteoram fom bur star. The Green 33. Arrow to or type in the file rsrmng Conse means we can name. F3 programs the device. move tne device fom the ARS2 and solder it ‘Key Pro USALLC» » = 3. There are also a couple philips 4.The panel should start to release, dis- behind the hood release lever. <2Nnect the various electrical connect E ‘018 going tothe switches inthe panel =» 4 s = = = = = = = = 5.Only car that | can think ofthat secure this RTM te coco: ut ett racht io lac, x to complete the job. needs to be removed also ‘key Pro USALLCterenor tye ae easngaheed resnar 10. The board easily ‘gees to th ignition. The large plug i high nthe slides out of the box. a “V1.Here is a closer view of the Target- 12,Prepare for desoldering. Clamp Device. Only 931066 in-the dircuit. the module’if you would lke. Iso- Locate and mark pin 1 on the board. atethe device with tape or tack zs 3 14.Once cooled place the device Seat ep aminietorclieng tent into the adaptor for your reader! writer. In this case the AR32's,18,0nce the AR32 has connected this screen aopenrs ques eccea nao naae 16. Here is our device, 931.86, ‘They are broken into family groups. PGDNang iN the SERIAL EEPROMS 93 arrows fo move around, thenINS‘etto select. AND 95 SERIES. 17 Once the device is selected, the Dip 18 Confirm that your setting are ‘Switch Settings screen will display £0 similar to the ones below. Press that you might configure the hardware. 3 key to proceed cr ae tie roy Se ores as ESTNONINE ZCI IG ots look at the binary file fo end outs contents in inary Language. The 3 (key Pro USALLC. SUSTUSVSUTUTUDUSESEEEEELEES USES ERENT TIIIzaT21,Your BIN fle should look similarto 22 comp this one. As with many Toyota ICU files, The Green Zero Ero message means, the info repeats muttiple times in the BIN. we can save this as an accurate BIN, 1S Sees opin X imBbinam msec 24 Forme hela B works fie when they ae Seni re ver org este amas ha_crgarze in flrs by Make fe hs exaple ‘serosa een ym Se Tao wet oreo of my day coud Sorage under IN FILES> Toyota» CASTEBIN 25. Moving over to the Tango, Jaen Bronson ‘Asia> Toyota> Prius> Immo Box> bres any deat 4 vacances “2004 (93C66), ve uk te Gren Bok o o o o « « = = = «a « « « a « « « « « «33. Tango confirms that it has created a new file that contains the factory “4C" transponder. ‘34 Retum to the ARS2, assuming ts all con- ‘ected sil, Option {= Program Device from Diek File. Then 35. Arrow to or type in the file % foreman pate san te Anszado etes | name. F3 programs the device. testing sada riad wince Tete 37. Iffor some reason the tran- sonder doesn't work, remember WWUUNIVEL LU MGn Bi you always have the BIN file. You eee ‘could do as we did with the Red 2 :swnessernniestcamminn mann Pen Loader and the IS300. Clone *™™™rnemvcrretonssatunet men avalue out of the BIN and then aoe “pedal dance” another transpond- eee Caren er into the vehicle. Here is one of ele the most common sau pedal procedures FoOvOnr 36 Toyota Key Pro USA LLCIMA Glace Dacumenied Dat ee [Derk tent nS — BOG Gtimndiard | roan Tare ex Sta Tage Mole CU Vm Tang S| Nodal Lc Race Csr an a “Target Device: 81086 (6DIP) ead In Out ts Cat with Grounding (Original Transponder: 4087 Usable Transponder: 4D, ADS? TA fr acre ne Nain No Clone Out or Com INE Reman TRE This is another example of a Toyota that cannot have keys generated va the OBD. This generation of Sequoia uses an Immo Control Unit (ICU) and Toyota's usu (procedure for key generation requires a virginized ICU and 30 minute initialize tion. Thru EEPROM of coarse none ofthis is necessary. The Targ fo €aled very high in the dash between the Instrument Cluster and Radio, acl is e337 fo remove, I would recommend 20 minutes for the frst ine removal 4.Here is an interior view with 2. Start the simple process with remov- ing the bezel around the instrument the appro face.. Two phillips here to remov rey ‘Unc the ensty Pris example, his Fare Grtimouate te rtativeiy easy to remove Biutineteqwota sold very wollin Worth innon Py atnotonatons oh on ‘Minicles meretore they weather tho Ue Teetme ato son quite afew (exey Pro USALLC Toyota3. The cluster bezel should re- 4. There are 4 more of those phil- move and be set to the side. !'ps securing the cluster to the dash. = 5. There will be 2 0r3 plugs to release fom 6 Now our is visible. I's the rear ofthe cluster. Seti aside so you about 3 inch by 3 inch by 1 inch black plas- Son ropa screw avert teclearort box wih a wht label and blue wig oft Taigy ray 4 7. Removing the whole box and 8, Use a small flat head or knife bracket is tedious. | find this a little to release the end cap off the bit easier. Unplug the single plug. box. Don't drop it into the dash Toyota Key ro USALLC9.Now we can simply @ 10. Toread and write this ird out of the box and save ‘successfully while in circuit, we » 5 » » » ® _allthat removal time. will need to ground the oscillator. » » » © © » » ® » ~ a Toyota> Sequoia> Immo tracted from the Immo Box. Box> 2005- (93066)» = 28. you uae a clonal transponder his pop “Thi choeisalsobeees on up a net appear Butsince | changed the etn arrose a> Sie once my 4D, | wl Rave to name nd teu the lato he Tare! eves ee 29.The standard reminder pop up 30.Assuming all connections are stil from Tango requests we rewrite the established, 1 Program Device from device to complete programming. Disk File. Alt-D to see the file list. 5 =.> 206 31.Arrow down to the Tango con- 32. ‘P'rogram from buffer start. The Verted fle and F3 to program. #32 stoves tho wnt, bit you can always do ery eo 68276052tango.bin is displayed at38, The Green Zero Errors Message 94. Las stop before return the Target at the bottom right is the indication Module the vehicle is that the device programmed comecty, °F Solder to re-enable the osciatr,Deve Render og ears [Target Module: tnatrument Chater Mose cation Where he Inarament Ctr Ges Hanger Device 16 @ SOIC) Read no Ot Out of Cit [Original Tansponder Mega | abe Tapert BIN acy vo Nain BIN Fn [Clone Out or Convert BIN: Conversion yay HU 4. Here isthe target module, the cluster. 2, Start by removing the upside down “U" Many of the VAG group clusters come out in shaped trim, between the column shroud a similar fashion. And many times they store and the cluster. Small lat head works fine the key data. Hopefully this insight will help youn the future. Note the . oy key Pro USALLC5 5 ” 6 23. There ar: cer the tim 4, Th Linder the tim_4, This opening canbe accessed by removing ‘hat hold the Guster botio in. Remove them bid the snap'on pans on the end ofthe dash. I your ‘hey are prone to drop down nto the dashifyou hands are smal enough you can push the back are hasty, Newer models se Tork 120. ‘ofthe cluster cut and then grab it fom the front Ve 4 Pal 5.Continue working the cluster out unt you 6. bitof glare fom the sun but you can see ‘can reach behind i, Use suction cups on the have already been disconnected lear front to assist in geting ahold of the tar- Renovo the remaining connectors and move ‘9 module and puting i straight out to the bench to take the custer spar, 8. Next to the blue plug and green fewer Whonietoc down ake ave nce seer plug yOu Will find SSietartacionemimotcy that myst be removed fst ekey Pro USALLC9, Use a smal at head to 10, On each end ofthe citer, hey ued a sighty around tho perimeter ofthe module. Hyeuhave ferent abo koep Rlogether Inet heft head ‘rouble, place a business card or smarty in _and lease theta gene nto break the a th gap formed as you move ram ane sie othe ‘there prevent fam snapping closed again, "1, Remove the clear lexi font and seaside in a 12. The reat abs hlirg he Boar te back tsfelocaion Protet trom dep atch ard _hafote ce Again ue srl fi Ped aa gery Gust yu st down next to yur cuter, you may move rem ova ane ire boar at hese ire pend an hour leaning athe shavings ost of fh i“. aah bc oc Vib ay ono LEAN sta a ne tyr ‘wim chase aragng the gee ‘elitr Win ot taino lean octet Ses2 a ee ee ace nee > lv Ss eae ae Grintatonorretum- Seadme gest ot tier on arog sae tel ce ‘17 Now inser th adaporinto the Xprog8_—_ terres shoo leg socket. The diagram on op shows how to ouch dvi, ‘property oront he device, Make sie to con: oe ‘ect usb to PC. prryy fo 19. The 20 cco Re tn Aa eB ‘And the Xprog is ready to read the Parcs over at ct an onectar device if everything is set correctly, *¥2s0e tyosaetsaeosree, corte etn up. 07 Po USALLE21. Once you have a good con- o oe o firm, Save the file asap. Click Save . o . P anerareteopmpac ats are eslers? 24Now your new BIN fe containing the Tran- eimai temercaleiersebondr you just woe in needs anew rae ea ‘wither Add Tango to the Mle nameif that works foryou. Never ovewit the ogi BIN. ’ Se ae aaa 25. Return tothe Xprog, whichis all connect: 26, Click Yes o confirm you wish to wrt the ‘ed hopefully. From the Xprog software click device. Wait fori to confirm write, then the Open Fle Buon then select the newly desolder device and retum to cluster. Return saved Tango Fle all the parts and test ransponder function, (Key PIOUSA LLCUUVUVECES HEHE ESS SaTTTTeCTCC" [Target Module: tetramer 4. He‘e isthe target module, the cluster. 2. Start by removing the upside down °U Many of the VAG group clusters come out in shaped trim, between the column shroud ‘a similar fasbion, And many tees they store and the cluster. Small flat head works fine the key data, Hopefully this insight wil help {you in the future Note the | Tien wal, vor soda, and Seat Rea | group they have always ben it Sinchy kent programming tra the | Sep, Zatoneip sendy your nerve (okey Pro USA LLC veg 63. There are under he tim ‘thatals the cluster bottom in. Remove them but they are prone to drop dowm nto the dash you ‘are hasty, Newer models use Tore 720, , ‘Continue working the cluster out unt you ‘can reach behind it. Use suction cups on the Clear front to assist In getting ahold of the tar- {get modille and puling it straight out 7, Th font and back vas othe stanat St 4. This opening can be accessed by removing the snap on panel onthe end of the dash. f your hands are small enough you can push the back ofthe cluster out and then grab it from the font S —_= \S 6. A bitof glare from the sun but you can see. has already been disconnect- fed. Remove the remaining conectrs and ‘move othe bench to take the cluster apart 8, Next to the blue plug and green plug you will find a that must be removed first. Re (okey Pro USALLC:8. Use a smal fathead to releac those tage 10. On each endothe csr, hey used a slighty ‘around the erimetr ofthe module, you have diferent ab tokeep together Inet te ft head trouble, place a business card or simlarfemin and lease the tab, gente net to break ho tab, the gap formed as you move from ane sie othe ‘other to prevent it fom srapping closed again, 11 Remove the clear plexi fion and se aston © 12. The a al ie ng he board he tock ‘af locaton Protect fem sop, sotch ard ate ie ease Again sear ahead ae Set {ust Hfyou sti down next your cuter, you may ‘move hom aswars arate toss mins se Qu key ProUSALLC15.| use standard techniques toremove the device, folate wih postar tack therma! tape, Note rlentation for return. 1. Very thatthe sens of 8 switches or fare set correcty, and also the. to start ana the device connected the 2 this will record the BIN file into the temporary memory of the PC. snot ee vlan ca be move te m1 Ss lbcaue ey nay opr ran tat aber USA LLCcoor earn Eee. From ere you tan 2 ow lw Fresno, He SC mon rm sake het yu pt puled The oe aad og ar save Dak 24.For our purposes, we always an ‘means save the goed compared BIN leo tbe eee alii ‘more permanent memory cfthe PC. Give ta WTO eH EH) name, Have a system for naming BN Beginning to end vo 10 ‘Key Pro USALLC27.Now your new BIN fe containing the Tran- 28 Back tthe ARS, Opin 1 Program De- ‘ponder you just wiole needs anewname. vice from Disk Fle Either type the file to thefilenameifthat works ramen or it ALT D" to view al he fles and Select rom the it saved in C:EPROM, 29. Once the fle is selected, you willre- 30. roaram is Complete Data Verification turn to the AR32 home and be prompted is Correct. Sounds good to me. Progra Then 31 Disconnect al hardware Solderthe Device Date backin place, PIN fo Pad, and then check he ‘hic fnetonalty. Arathor goodiob WellOone. NotesTARA Glance Target Moder 25 (Serng Lok Made) Tags Device 1156 CSSI2DGI39 (OFF Original Tansponden Moga WE be Tampondr . ’ ® . . . . ® » . e ® . e e ® e p e Pp P PB P e e P Kamar3.From the Tango help, we gainabit —_4. | feel its prudent to survey the more knowledge. Uptop, wegst amore column to get a better direction to detailed description of the To. Proceed in tal allowed keys is always good to know i also, The most important bit we get from this isthe appearance and location of the ‘Seems to be on the bottom ofthe column '5, When we pull out the steering tit handle, we can see the target module, So lets start puling parts to get there. 6. Remove this side panel and 7, Two more bolts hold the lower kick ane ppanelin place. Remove those and start di then you can access two 8mm Connecting any wires that may be inthe way. head bolts to remove8.With the panels removed, the target 9. We can star by removing the ‘module is much more visible. You will that go through the center of te also start to notice the ridiculous nur, mile Much ike when encounter healess ber of screws holding it in bolts, | usea punch or carpenters nai eet and hamine to back the screws out Torx 20 10.The only attachments | con- —*1 Theres: to back out sider easy 0 remove ate these nye 20" ‘cutter and back them out with a flat head drive vathak FeNedwalaridertacchin down Tere 13.You can sea the: re fo holding the colunn to the =" you are reading ahead. You may want ens gled with it for acme iorinte a faeries ereyraveauc om WVU ssssssssssessseseVCTei 15 Now you shoul be ble fo stand the column ae ponte wheal Tisgans you acess Twa cle has a tele- More 12 tat la between the op of the a trea and nettle oe rrment scoping col- ae umn. There- fore, this shaft can slide out of the column housing. 16.There she lays in the shrapnel_17 Here is a front and back view of and tools of her demise. Now to the target module on the bench. extract her secrets. Note the around the motor side of the module. ie skewlae! them using whatever 49.Once the lid is removed Ginoede rote sna alone tetieea, 17 actuator system for the steering look is ex- posed Basically an Arm, and —— % Vag pkey Pro USA LLPUPECECEEEEEEEEEELELELESEUEESSIISSES 20. 1L59W is Our Target 2! !¥outwntte module over, youwitsee that secure the gear and Device. You can catch a Ms saroy nt tos fares ton Device. You wether asso ee othe glimpse of it from an angle bose is ono Puno Osconmet under the White Gear. Feet mvc scree Bake 22,The 7 solder points that SMOK re [osed. Yau wit have dstrninalthe doves you re quires are as, leonng atcan be Yeag wth he some ses ponte follows xc oe round 24.Here is a close-up of the SMOK 25.Here is the clearest, closest help picture you should have re- picture | could ceived with the hardware/software. capture. Henee the reason for pin out diagrams versus taking real world example pictures (okey Pro USALLC ves 16the PC, and start the Software, Menu Bar> Device> Select Device (Ctri+S). 28, You te now ready to click he ‘The Dialog Box at the bottom will di ‘play the current status ofthe SMOK processes. este 26. Connect your SMOK hardware to. 27.Then this pop-up, M > HOES 12IHCS 12X> SECURED> EEPROM> MC9S12 Et — 29, The should have appeare in the center “wind, but efor we know fsa good read we ‘must Verily (Compare) he read, so Clk Very Boao tes ie 31.Hook up the Tango and select > Audi> EZS> Megamos 8E (9912)‘S2.Here is the screen and options that >To ait we we kon en. me ‘are Specific to the system you are work- mas ates lias win st cure acsona = ane 34 Besides a transponder ordered specif- 35, Place that transponder into the ically for this, the only other Use of the Tango, select an Appropriate Key 8E transponder in the US. is early Honda : Fit HD113 keys, Slot and then click ‘That's what | will use townte tothe BIN file. | would suggest cutting the ranspond- ler from the key prior touse. 36 Feventhing 922s wo. hs 37.Retum to the SMOK, b should give you the opportunity to name is selected then the the converted fia. Then te RemindertoRe: Open sade tha Tac a write tha Device to compete the process38. The last item you need to see, 39.| say almost because is this Verify OK in the dialog box of the SMOK. You're Done, Almost. you have everything to re- tum to the car. Basically re- verse the whole process to retum it, however as soon as you feel enough of the car is back together to test the transponder, | would. | would say that if the module is reconstructed you can plug it in and see if it releases the steering lock motor. Ifit does, you are truly done... after you put everything back. Good Job. Well Done. Date: Date: Notes: a om key ro USALLC} ie oe" earaos! tat Tampa 4, Here is the target module, the cluster. 2, Startby removing the upside down ‘U Many ofthe VAG group clusters come out in shaped tim, between the column shrous P asimilar fashion. And many times they store and the cluster Small at ead works fine D the key data. Hopetuly this insight wil help you in the future ‘insect tone 2001 Ana RO. ao SUSLeincaisSatpertowey, VAC io BSve es ey ce chante, This roma y Setiee it te way rong toaarst ‘okey Pro USALLE va @3. There are 2 Tor: 120 head under thetrim 4. With small enough hands and/or suction ‘hathala the cluster bottom in, Remove them cups, you.can pul the cluster out of is but they are prone to drop down info the dash if “cave.” The length ofthe wires plugged into it you are hasty Older models use Philips screws. may imi his range outward CSO cher Secon us ns an | SaPeietan naa ese casen oe Soc nin oa eee esd 7. Next to the blue and green plug fete ctne nose. Hyeunoe vue pace you will find a Tear crdor arr trib gnome nou that must be removed first fp cose oan 2 veg oy PIO USA9. Place the clear cluster front ina _10.Start by safe location, Our Targot Device is They located under the 70 MPH mark. Pull straight up and try not to rotate oa them as you pull them up “1.Next Remove ths Gaikie Bicharound and 12.You can remove the entre setaside. Be careful tcan be scratched and separator fom the module, or jst atracts alot of dust fom state electrcty. Care ry tol or wire cutters 1, rot to break the “3 Now we can see the B ‘Some techs read these in cir Butjuat io be ena sat | ake Me 00 oe : x mala. As Xo weet D snd hot ar them off‘stecaaine ROM Adsoier sign 16.Here is the in and sede ne deve on ether sido. Thore 3 tare 2 for edundancy. Andi you acer £0 potethe ‘der on backwards, ust plugitintothe Xprog gram shows PIN 1. We haven't bacwars to coect hat smaller hooked BE the hard- ware to the pe yet, but do that 47 Connect he X09 he PC then Ck. 19,To read the Target Device BIN the Davee Button Frome popu Slt fie, Fist Cl 28°. "will pop up, then Click Read 19 fall goes wel your BIN fle shoud appear 20.Cick the ‘and under normal Inthatsame pop up window, Butof course conditions you wil eceive a 100% verica we. not know hisis accurate unt we do ton. nat check ver your connections and soldering, et og « « « « « « a a21. Now that the fle is confirmed, 72Move ovr oie Tang, select aso Euce= it Passa Oashnard VDO> 19983086) first things frst. Save file. US memberne are woking» Jats however de 10% ‘an organized system to name the file for future search ability, 23.Now that we have selected a module, Let’ ‘see f the programmer recognizes the fl. (ick the uo Flo Burton Then Select he El trom the pop-up window. ‘Gone dorencesin tho ward you may havo fo ty @ ow deren axon fre the BIN ecognzed. 25. To view the PIN code inthe BIN Click The ‘Blue "Button. To Identify a key already. file, Click the Magnify ‘Key Pro USA LLC 28 Once you have places an unlocked Mega 4B nto the Tango, The will quickly pop up then. ~ eee 2427/Apop up wil appear, asking yout Name the 28 etn to he Xpog. you shut i down previ New BIN fe that the Tango.teated, As be- us) restart and mae the devce selocion ‘ore, ue 9 name thal canbe fesearched and lo: aga Ike you ded ate 17 Then fated inthe future Remomber you away have Select yourmenly created this vhice's PIN number afewlcks nay. Tango le Teae 125 the last step finalizes, Once this wnteveries, you ae ready to return the RismtnenavarormimcBN Heneeteasn module othe car and test function. Congrats. | mentioned in the beginning that most techs cannot marry a donor cluster to ‘anew vehicle thru the OBD. But with what you just read you could easily do that. Simply read the BIN off the original cluster and write that file to the do for. The important info, ie., PIN, Keys, and Hand Shake Data i in that file. ‘Sowhen you transfer it over to the donor, the car will nt know the difference, Date. » aaaeugsegess) ‘Mase velo sean elecuonic sponder is programmed. Ts 4A. Our Target rein itferentlo- 2A Oftan tochs pull his mosule (Yow), but cations based on the vehicle you are work- © Is slighly smaller and closer to ingon. The Cayenne and Touareg is locat- he center console. One plastic clip holing it fed above the ctvers right foot. Remove the loner kick panel and set aside You may not he passing hy one wit EEPROM wor, you can provide = EAE yaar ae” eye ne ona customer in ery shore TMOG creunasand you ported af time, Whereas the dealers wll Zee en ccinmattown nate, probabiy requive nfo days pine te cnr TEESE ane pee, Boing towed. ———— okey Po USALLC3AHere is the Cayenne/Touareg 1B. Here is the Bentley Continental. dropping down. Start by removing the bottom back: + seat cushion. 2B The Kessy is right behind this Black 3B. There is the Kessy behind the See ee et speaker steel bracket. It's in there tight but cover may help butisnt required. it can be removed from this point. 4C. This is the body style of the 4B. The 2 wire harnesses are still Kessy equipped Audi AB, Move the connected but the Kessy is free to go to the bench, driver's seat all the way up and back20. Remove the plastic trims from the seat 3C. Move the seat all the way forward and ‘ails in the front. This exposes a Torx T47 a. Lup. Then remove the back rim pieces and (Cechnically a star) Bolt on each side. remove the T's that are exposed. 4C. | know that the Kessy is und ; the seat, butthisjobwas inte. 2C-Coming Soon. rupted before completion. Sorry 6. Once removed from its vehicle 7. Asmall flat head can release mounting, the Kessy should look the tabs on the plug end, and the similar and be identified as such. board slides out8,Our Target Device is a93C86. _—_—9. Insulate and isolate your Taruct Device Mark the board with your PIN 1 ori- (There doesntttend to be lacquer on these fentation. boards but check and clean if necessary) il “10 Hot air the device off, | tend to start *11aorecarmen ca te device nwa my desoldering at 300C but this can “Causwrseciereecsntecoston Change greatly wih environment, etc, EEPROM Tena wt slo an anon 42.In this case we wil use AR32. Con- 13,The next detaut cron the Op Sich Sat Neer refaad sta te ow. Ings When ot of rot hese EEPROM's can be read at 5 vols (hae 42 solcted). Thee is and. and fo chance for averfow power causing corruption14 Press any key to continue then fom the ‘AR32 home screen 16 From the homescreen, Optio ‘pare Device to Butfer. “Ves from reon is Good. No Errors. SAVE! 48.Moving to the Tango, select region> Europe> VW> Kessy> Hitag(93C86). 15, Onc 880, We need se thatthe butler srt fu of FFs Tete needs be he appearance ot Ste binary cade nthe Ble. Cpton 8 Ber Ed tersepay the contents ESC ret tothe Pome 7 SAVE med ten 8 ‘nt uee Onion the eves amass ish fis omoved om ihe ou whats ales Saas aes ee er, 19.Click the Blue ‘File Open Im- mo Button. And Select your AR3? filezoifhesinis scares esceensouderen te 21,Place an allowed Mme Te ndash , Select a Key SI Blue no Buon pas the ‘tute Comment Seay you by CS 68025"). then the Red ‘W" — « e « ie « e « 22.The Save As pop-up should 23.Back the ARS2, Opion 1 Proaram De appear, Selecta file name for the wice!omDisk ils he Tpe he newly created Tango file nA ea se a 24 25 ‘and you are i ‘done if you get the Green Ze N ith that green message you can re turn everything fo the car and tes function. 4 Veg Key POUSALLC @KEYERO@ ) [Gonos [Documented Date 01515 ) ease a i ae ) [Target Device: 9880 8 SOIC) [Read In or Out Out of Circa e ees —ommentoaneccos a eee ea a Y)Bovore you stomp hs ehile, you wil nen to acquire anew or wed Push FOB. This voile )) eee tlestre a standardigniion Tho key ssa romote ht pes )) We ensine. Warning. dono pce an anpograrines hey mi he sn Tick abdul deprensing te shiterelenseo remove the hy without ‘Tha ype tonite cttw system so you 2. Move tothe passenger side of the car ‘sees anton te scion snout sony Make re and give ita quick once over Our Target ee eon oduie is behind i (Key PIoUSA LLC veo{3 Thwe are? 120% nthe lp comers ftteoperg 4Theve ae tre along he boom o he box ‘Three deo? nore rotate bd at 26 whan fis closed. Thee shoul be anymore. tlds Pace be sender eorand Fort owaver, loosen he Box slow case YOU 1 ‘Thacktmarnepesargerstendio acces em forgot one Sometimes the top edge ofthe boxishard 6. The is tocated in the op to clear fom the opening. BA should top Jeff the vod. A couple of plastic 10mm peer tetera oe q aa 1 8.Once free from the bracket, the = module can be unplugged and moved to the solder station‘9.There are 6 simple plastic tabs along 10 Thote ae Tat Plas Tabs pressing inward the outer perimeter of the modo thera one edges of he pg sonata Recor rem fingernail or smal fathead can eease, ses ameg says oe esd 11-This can be alittle tricky but try 12insulate ana sotate he Make taton marks (Sharpe eam core of wth Cleaners and ux beng applied not to damage the sockets. See 13. Hot sirhe deve off using your methed. This 14 Th dovie shoul ony ake second process shoud ony take 20-0 secon from the ypeay place ese smal ones Srey ino the fino you start ling. Reduce bme wth sight rexsng adapter to mize oss risk Don ry his Incrests in temperature you find the balance. wr age devices, thy need anu27.The Write automatically verifies. 28 lean the board ‘he mode and then test the ransponder, The Bulforpeace ofmndyoucanck acon tnyegun cos oowaaaaay Forget Module ICU Farge Deven 2600 5OIS) (hig Tanepond 75510 4 able ranged 725 5 [stacy Ne aN acini Fn ‘ese voices both the Euroren andthe Cabrio, or the ost prt the dealers, a faa for kop, Th they cannot program with thar the pin amber, bil more importante wil havea bin le theo ‘Here isan interior view ofthe dash area. 2, Start by ‘The shroud had been removed prior but itis assembly It wil snap outward using a not necessary to access the ‘small flat head or similar tool Saye, Tobe completely prepared for Mefiuing thet you contd emconmtor om reg acid youwinenate camy2 other ection. Youwill et mow tthe SmaceEcysncle,vatsnamvesney” 1evisinnand. ‘ekey Pro USA.LC veg 83.Now 4, Those two parts removed will X= assembly fromthe other pose 2 philips cl side ofthe cluster. in place ‘J = 5.The bezel should be &8¢ze! gone, two more philips exposed on each side of the free to set aside NOW. cluster. 7.This is just another angle to. _&. The cluster hinges downward demonstrate where the screws from the top very similar to the are located. older Sprinters, ‘ ‘ 4 ‘ 4 4 « 4 ‘ 4 ‘ ‘ ‘ 4 ‘ ‘ ‘ ‘ ‘ Ey va Key Pro USALLC» e e eS e e e e e e & e » ® e e e a | 9:There are 2 plugs to disconnect 10.f you lookin the bottom right corner, from the back of the cluster, then jt towards the gas pedal. Our Target Mod- can be set aside. Ule is located behind the plastic bracket 11.A little 12. Astand- bit closer = ard size ERI driver ak BPS should be pele ine, able to ac- two phil- lips that cess the secure the ICU to the bracket. bracket screws 14. Here is a close up of the Valeo manufactured ICU. 49, There are two final plugs to discon- ect and the mod- ule can be taken to the bench, key Pro USALLC “015.Here is the ICU opened up. As we get is is closer you can see the Target Device in the 16.This is an top right alacant wih the plugs facing you. 171 Con the 18insuste and isolate the device with ack or tape and stant sppiving your het ai. As expe Fence increazos, use of sulators decreases. board surface before proceeding, nil 20. With the AR32 connected to the PC, stat the software. PGDN to 24 series ‘and then arrow to 24C04. Then INSert 19. | tend to set the removed hot device on top of a near by larger component to cool21.Once the device is selected, the Dip 22 Confirm that your seting are sar tothe ‘Switch Settings screen will display so ones low. Press any key to proceed. This that you might configure the hardware, Particular device has # message about 23 Frome pevovsacreen press ry key 24, Now to display the file so that eee n-Then option Foss you can verity some info was read the bottom ght use option 5- Buffer Edito 25.Thisis a512 byte fle, Yours should 26. be similar in formation and patie Press wil be our nal step “ESC apeto etuntothe previous screen, Aer amorrent you sous ecave a (Key Pro USALLC2. Lat steponthe A824 Sve rt | fc San Senter gone a3 wed te Sece ao, ring wt ‘aren ety: soars gc emaln sme! erases 29. If you glance back at the Im- mo Box you will notice the part number that Tango is referring to. 231. The key slots and other butions luminates $9 0u fl is good, congrats. If the customer or yourself ever need the vehicle PIN number, Just epen the fle and click the fresh AR32 file. 28. When you start the Tango, the re- gion is Europe> VW> Immo Box> by part Number> 6X0 953 257 (24C04) 30.Click the File Open Button on. the Tango. Then locate and double m1) #ee 22, From our point of view, then PIN is only {9004 for OBD programming or maybe swap: ping ECU's and Clusters etc. We can always produce a transponder wih this fle 1% @ ee anereenenanas'33. When you are ready, load a usa- © Then ik the Wte Buon This sa cone ble transponder. inthis case a 7035, voumseyousan pedi as many rn into the Tango hardware. ponders a you woul ie pow rin the te 35.Now you are done, return the device to the circuit board. Return the parts to the vehicle and test key function. Remember the mechanical key ‘can be HUSS or V37 keyway. Even though we used a Cabrio in this sec- tion, the Eurovan is very similar. W There is anot no 's a different part number, ai jore rare to run into, The ma this alternative imn Stay Tune& BleDeve Rader Oange Se @ [Fast Modal nue Clana [ods toa: shuld bani Original Teansponder Meramor 38 Leable Transponder: Megaman 6 Cc PN cin wn in [lon to Conve BIN Convo Keay Forthe most part, nd tht these vehicles can be completed soley wing the OBD port. Hower fer ityos ever rn ino any lindo resistance, or instance on 22000 Beet, the following process bother wih te prt and gosraight to ths procedure ait gies must farer ere in my opiion. {Here is an interior view of the cluster. 2. The bezel around tne rt ofthe clstrun- ‘snaps. I recommend using a hand on each side to {As state, this might be the easiest pro- rinamize the chances of breaking the dy plas cedure ee es 73. This reveals -4-You should be able to pull the cluster straight ieee, uta cave, On the reverse, you wl ind and need io 5. And just like that we are back at 6, On the reverse, around th the bench, WARNING: The face eter there wil be Some. of these clusters crack very easily. times Phiips, sometimes 10 Tore 6 7. With the back cover removed, 8 | have rotated the picture we can immediately see our Tar- clockwise to orient pin 1 bot get Device. and the writing is naturally oriented. (Key PIOUSALLC98 need o gamer more thin soconnect_ 10 From the Nome Screen This ‘he Ors and sat the su Select Type Canon mage snauldappea. This sh pn out rasta ‘one OS nmo> VW> Bele LOSHismy mask Yous tons inthe top certar Scorpio has labeled he maybe een. so very and eet szrngy.cagnoste pont wih 4 necessary connactons = W New Beetle ‘04 11,You will see Scorpio labeled them 12.This is how you can tell for future en- with the lead name (BKGD, Vdd, counters, line the lead adaptor up with i's Reset, GND) Not the color though. connection point on the Orgs hardware. 13, Here are the lead colors be- 14! fnd it easier to solder the leads, then attach the plug end tothe OrgS hardware ing soldered to the appropriate ye sre now ready to read the bin fle points on the diagnostic ports.Docomeiod Date 1255 Device Reader SOK Prepunmer Tango Target Module CEM Mads Lato: Abw the ngs vt Tart Device 115, 1RTIX OLOTY (12 QFP) Orin Tansponder Mega ina OD BIN Enya No {Gone Oat or Cone BIN Comenion| Keyway Volvo Tak net Kay YoU will need POD key fortis system. At the tine of Ihave been developed. Therefore I:eus0 origina factory POD ho emotes Puldin but they are separate trom the anspor Iellowing procedire, Aa OBD programmer ca be used toconpe OR rpeseh erecre este, 2.The Terpet Mode is located above the POD ypelgnenice ines yous tr tee 8 IGecwncandcOlgnton aatheryens sets passengers feet, Removal ofthe glove box is Sotitey ca au temo courte elntan be rg _Unnecessary. You wil hardly need any tools Spears ces eae Se ey cay aes yas eas eaihenpeneasttnsmennvay nova pe sated tar = joverte pronyandcpust ing: funtmaho areyouncep aneyor meee Ceaweses atocceeons two im stock, Ice that as the biggest Pesan a wen orenns! | sactasepovtncay mada key Pro USALLC voWo 1 e 2 |