IR Doctor

THE LEGEND WEB

THE LEGEND WEB
THE
UserLEGEND
ManualWEB
THE LEGEND WEB

ND
THE LEGEND WEB
for
GE
THE LEGEND WEB
THE LEGEND WEB
LE

IRLEGEND
THE DoctorWEB
E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

THE LEGEND WEB

THE LEGEND
Overview WEB
THE LEGEND WEB
THE LEGEND WEB
This software and accompanied drivers are intended for strictly personal educational purposes

ND
only and it's use is sole liability of customer. All further consequences of any other possible device
THE LEGEND WEB
commercial or illegal use is subject of user's choice and responsibility.
GE
THE LEGEND WEB
The drivers, provided are original Cypress® inf-file and original Cypress® library files, which
compatibility to Your current operating system is subject of Cypress® technical notes and bulletins.
THE LEGEND WEB
LE

Any further questions of misbehaved CyUSB library to be forwarded to Cypress® Support Desk.

THE LEGEND WEB

E

Hardware serial number is visible in Windows in “My Computer” /“Properties” / “Hardware” /

“Device Manager” - selecting the device - “Properties” / “Details” / “Device Instance id” and Serial
THE LEGEND WEB
TH

Number (8 digits and / or characters) is shown after VID (Vendor Identifier) and PID (Product
Identifier) of the interface hardware. The method, described above may vary, depending on exact
operation system You are using, but in general is the same. This unique serial number eases
THE LEGEND WEB
identification of Your hardware in manufacturer database, providing You corresponding initial software
and further updates.

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

THE LEGEND
How to use WEB
THE LEGEND WEB
When software starts, if hardware is properly connected, You will see the following
(button/labels if not active, this means You did something wrong):

THE LEGEND WEB

THE LEGEND WEB

ND
THE LEGEND GE WEB
THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

Press “Read” button and put IR interface into EIS, in the place of original key.
THE LEGEND WEB
TH

Software waits endless for this to happens and reading is started when EIS detects the key inserted.

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND WEB
After Hash data is read and shown on screen, remove IR interface from EIS, not to cause
excessive overheating of EIS coil. Be sure that You see all Keys Hashes, numbered from 1 to 8, and
GE
THE LEGEND WEB
also so called “Service Hash” (also called “Dealer Password” or different, depending on people's habit
to name it) and also data about unique identifier of EIS should be present. All these records (Hashes
and SSID) are needed for further calculation of new Key for the car or adapting other modules –

THE LEGEND WEB

Electronic Steering Lock (ESL), Electronic Control Unit (ECU) for the engine or transmission modules
LE

- “7G-Tronic” (ETC), ISM, etc... modules, which are related to FBS® system.
Upon completion, screen should look like:

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB
It is good practice to read every EIS several times and compare files. Proceed further ONLY if
You receive same data in each reading. IR channel could get disrupted by external light, dirty surfaces

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

of IR interface or EIS itself, etc... see the below screen-shot – omit such readings!!!

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
Always mind integrity and equality of sequential files read – it is Your own responsibility to
THE LEGEND WEB
take care of proper device functionality by keeping it intact and in safe operational conditions.
Except Hash data of EIS, IR Doctor reads also status of EIS itself and Key Hashes (if enabled
will have green background / if disabled the background will be red). Also counters of each Key Hash
THE LEGEND WEB
LE

is read - that is VERY important parameter which should match the counter of the Key itself. If the
counter in EIS is lesser than corresponding Key counter, then car will be unable to start. This could be
fixed by decrementing Life counter of Key. Also EIS counter shows if EIS itself is operating properly.
THE LEGEND WEB
It happens that Key is working normal, but EIS itself has problems with EEPROM memory and is not
E

decrementing / processing hashes normally. If several entries of valid Key doesn't decrement EIS
counter or corresponding Hash is not changing, that is sign of such malfunction. There are also other
THE LEGEND WEB
TH

failure symptoms, which could be diagnosed with Hashes / Counters information. Just look for proper
alignment of data in EIS and Key. Any misalignment is a hint for searching the problem – i.e. faulty
coil or optical components or faulty soldering of EIS components could lead to Key not being detected
THE LEGEND WEB
and car unable to start – You could identify such faults by observing Hashes of EIS.

Information, being read is automatically saved in two of the most popular formats for bin-files,
THE LEGEND WEB
related to MB. File, sized of 512 bytes is for SKC® software and another file, sized 87 bytes is for
server calculations. Two folders are created by software - “read” and “archive”. Inside “read” folder
You will find all EIS, read by You, saved in above mentioned two formats. Every EIS file is named by
THE LEGEND WEB
it's unique SSID. So, it is very easy to identify the needed data and process it further. Every time same
EIS is read file is filled with the latest Hashes data, so You do not need to worry about file validity. For
tracking any changes of EIS data, second folder “archive” contains all tries to read any EIS. Files are
THE LEGEND WEB
named by EIS unique SSID with added date and hour, so it's very easy to roll back the data to any
specific moment You need it. Also this guarantees that newer files will not replace the older ones. This
“archive” folder could grow with time, so have a look at it regularly and clean it if not necessary data is
contained.

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

NEW SOFTWARE

To ir doctor we added to the menu new 221 and new 164 EIS models for reading hashses, in previous
version the new 164 eis and 221 eis only read the ssid and the actual valued now with this update u can
read full hashes
THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
In version number V1.1421230 now u can check if your EIS is series or replacement as per picture
below THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

1-To start read the pass, 1st choose from the menu your correct EIS , than press read and after that u
will get all hashes

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

After u press double click on the picture you will get another menu press read .

THE LEGEND WEB

Reading process wil take from 10 sec to three minutes after reading success u will get the below image
and software wil save the password in the same file folder (now your file is ready to be calculated
using SKC or online server

THE LEGEND
file named .bin for online and file named SKC for offline
After success reading check below image u will get the password WEB
NB : this software works on EIS with motorolla with processor 908 and 912 like 203 220 209 211 etc

THE LEGEND WEB

…(not working on NEC EIS for some motorolla EIS not possible to get the password by IR anyway
software will show password not read and if u get message time out press read again .

THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB
Also we have added the option to disable any key number with IR check the below pic

ND
Choose the number of the key u want to disable and press disable .

THE LEGEND GE WEB

THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

When you are done go back to the main menu press READ and keys which u have disabled are in red
color

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

Here are how produced files look in Hex Editor and corresponding displayed Hashes Data:

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
THE LEGEND WEB
THE LEGEND WEB
LE

The file shown above is for Server calculation and contains the Key Hashes in required
swapped format. Note that EIS password at address 0x48 is empty – 00...00. It is not possible to read it
via IR channel. THE LEGEND WEB
E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
There are some differences in IR commands processing, depending on model and year of
manufacturing. Older models do not provide full information – i.e. hash counters are not present.
Also EIS behavior is different – some models allow continuous IR communication, while others
THE LEGEND WEB
support only sporadic one-shot IR command mode. Further are given some examples:
Remarks on W210

In the case of W210 body (E-class and similar) some very important information is missing –

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

there is no current hash indicator, so to be sure You are reading always up-to-date hash information,
You just need to spend few minutes to repeat reading process up to 4 times. After first reading observe
only hash data for “used” keys and remember displayed values:

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
THE LEGEND WEB

ND
THE LEGEND GE WEB
Put present keys for car (in that specific example only Key 2 is present) into EIS (no need to
THE LEGEND WEB
switch to Ignition position – it is enough just to put key into EIS) and remove it after few seconds.
Read EIS again with software and observe if hash information for it has changed. It might need to
repeat that sequence up to 4 times until hash read has changed:
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
At the moment You notice change in hash data, please, stop inserting that specific key into EIS

THE LEGEND WEB

to be sure data read is latest. Repeat above steps for all keys You have for that car. At the end, You will
have EIS files, containing latest, up-to-date current hashes!!!

Remarks on W220

WWW. THELEGENDWEB .COM IR Doctor

 IR Doctor

In the case of W220 body (S-class and similar models) EIS is designed for short IR
communication mode. So, to overcome that limitation it is needed to follow software instructions and
remove and insert IR interface when asked. At start software invites You to insert IR as usual:

THE LEGEND WEB

THE LEGEND WEB
After every portion of data read, You will be invited to remove the IR interface:

THE LEGEND WEB

THE LEGEND WEB
And insert it again into EIS to continue with reading process:

ND
THE LEGEND WEB
At the end (10 re-inserts) all data will be read and button “Read” will become active:
GE
THE LEGEND WEB
THE LEGEND WEB
LE

THE LEGEND WEB

E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
All EIS files read are located in same folders like already described for newer EIS models.

THE LEGEND WEB

To complete the data in above noted files, You should use our NEC
78K Doctor / MOT 05E6 Doctor products! Have in mind, that IR Doctor
can't read EIS password, which is vital part of MB ® FBS immobilizer
WWW. THELEGENDWEB .COM IR Doctor
 IR Doctor

system and You can't use IR Doctor files for direct generation of new
Key content. Proceed further to NEC 78K Doctor / MOT 05E6 Doctor
User Manual to complete the process.
THE LEGEND WEB
In some occasions it is needed to replace existing EIS unit with new one. That could be due to
EIS failure or in situation when car has no keys at all – i.e. all keys lost or stolen... To complete that
THE LEGEND WEB
replacement process pain-free and save efforts and money on ordering expensive parts and services
from MB dealer, You could simply transfer data from existing unit to replacement EIS. You could alter
EIS password to whatever You like. You don't need to read EIS password from Key in such situation if
THE LEGEND WEB
You are going to program completely new set of Keys. Same applies when car has no Keys at all or
when is not possible to read EIS Password due to Key malfunction or not-supported NEC 78K MCU.
Using Hex-Editor open SKC®-file and change 8 bytes of EIS Password at address 0x1B9 to whatever
THE
You choose to be the new EIS password:
LEGEND WEB

ND
THE LEGEND GE WEB
THE LEGEND WEB
Save this file and now it is ready to generate new Key content with SKC® software or other
THE LEGEND WEB
LE

available online or offline solutions. The file will be needed by NEC 78K Doctor to prepare “Grey
Key” for transferring the EIS data to new (blank) unit. Consult NEC 78K Doctor User manual for
further instructions.
THE LEGEND WEB
E

THE LEGEND WEB

TH

THE LEGEND WEB

THE LEGEND WEB
THE LEGEND WEB
Important remark: There are EIS units, that could be read only if they are in car or queried by
diagnostic software, which keeps them working. Powered-on only EIS units goes to stand-by mode if
THE LEGEND
no data is passing via CAN bus, and it's impossible to read them.
WEB

WWW. THELEGENDWEB .COM IR Doctor