INDEX KEYPRC@ Introduction - This book came about due to many request from locksmiths through out the U.S.A. that are looking to get into this type of work. The methods presented here are not the only way to do this type of work but is the way | do it. The reader must remember that this is being done by and presented by someone with many years of experience. Taking this into account when you start out, this is a slow process unlike learning about a new machine or piece of new software. il It will take about 3+ months for you to reach a basic understanding how this type of work comes to- il gether. EEPROM work requires a great deal of patience and time. Taking many notes and picturesqa as you start will be a great assistance to you later on. The methods I use as examples here are not the only way it can be done. Itjust gives you a basis of understanding the techniques as a way to start. When working with electronics on a vehicle a simple misstep can create an costly repair. < YOU MUST PROCEED WITH CAUTION AND SAVE THE BINARY FILE YOU ARE WorKING 4% WITH FIRST! = Al of the equipment shown is what we use on a daily bases but is far from all the equipment that is ggg out there in various types you can use. We try to present as much equipment as we can to give the broadest perspective. The various vehicles we show here may in actuality be some what diferent i in the area you work. Consider these to be merely examples for you to begin the process of getting “il into EEPROM work. Working on the vehicles shown in this book may or may not be the same even’ though the year, make and model are. There are always some small differences. Remember we i write this as a guide for you. You must start from here to proceed to collect and share as you ex- i pand into the EEPROM work a On Key Pro Web there is a beginners Group in the social area where many members are learning fi the process and contributing to it for others. tg a ae I have been working as an automotive locksmith for about 20 years and began getting into the EEPROM side of it about 4 years ago. | travel and teach classes occasionally. | am the Secretary for the Texas Locksmith Association at the time of this writing. My hobbies are flying helicopters, playing soccer (the real football), and enjoying time with the family. Without the support of my wife and family none of this would be possible. Contributors - There are many, many people who have helped me with this venture. If | have left you out it was not my intent but here are a few; Jay Barker, Kem Dowden, Chad Edwards, Jason Frank, Josh Heath, Nicky Lopez, Michael McFadden, Adam McKenzie, Jeremy Phillips, Dane Smolensky, Brandon Tucker, Jennifer Richards, my best friend Sean Preuss, and my father, Jim Hetchler. If | missed you please let me know so | can correct that error in the future additions. Difficulty - Inthe top right corner of each vehicle there will be a two (2) part section that will be color coded Removal Voading The left side is ‘Removal’ and the right side is ‘Reading’ The color will indicate the degrees of difficulty. With 7Lue being easiest up to Removal being the hardest. The Yellow (1°. =) and Orange (7@ea:lisg) being in between. 1 Introduction Key Pro USA LLCKEYPRC@INDEX KEYPRE@ Warranty - We do not imply, express, or offer any guarantees/warranties on the work a hota ag this book. This book is expressly to be used as a guide for furthering your ventures into FROM Work. You purchase of this book expresses your understanding that you proceed doing this work under your own responsibility. You agree by your purchase that we will not be held re- Sponsible and we assume NO liability for any failures or damage done by you while you proceed to attempt to work within the processes shown within the publication We offer NO support for this type of work, we do not endorse nor support any of the equipment shown within these pages. The items we use in this work is shown here merely as a guidance on how to proceed to accomplish your goal of producing a working product The techniques used in this and future publications are shown merely as a guide to you the reader to give you a start on how to use the tools shown. It will also show you how to understand the sys- tems presented. There are many different types of tools that can be used beyond the ones shown Those shown are just what we currently use and is by no means an endorsement of those products As you learn and move forward you will determine those tools and techniques that will work best for you. ERRORS AND CORRECTIONS. Please send all correction notes and suggestions to EEPROMBOOK@KEYPRO.COM. | have a current policy of only adjusting year and models to. immo type, based on personally seeing them. Therefore please do not send me notes such as “2008 Mercedes is so and so system.” Your assistance with corrections will greatly help me improve future editions for the industry. Thank You. Skills - There are certain skills you should acquire before you attempt to get into this type of work. Among them are: Identification of Transponder types - You must know the various types of tran- sponder (chips) out there and how to identify them. There relationship to each other and families. EEPROM Theory - There is a book by Jeremy Phillips that will greatly help you along with this. The purpose and use of Binary Files. Knowing and identifying the location of Pin #1 These are but a few of the examples. Computer and tools- Know how to use, identify, and how to save files to your computer Soldering - This requirement is first and foremost before you proceed to trying to do EEPROM work. You must know how to take devices off and successfully put them back on in working order. We suggest you work with remotes for cars by taking the devices off working re- motes, putting them back on to see that they continue to work, is a good way to practice. Another would be buying a cheap calculator and doing the same thing. But it is imperative that you can do these skills well. Model Reference - On the following pages we will list an index of the models by; Make, Model, Year, Reading device, whether it is a direct read or conversion. The difficulty factor and the pages to be found on. Key Pro USA LLC Introduction‘Table Of Contents Acura Acura Audi Audi Audi Audi Audi Bentley BMW BMW BMW BMW BMW BMW BMW BMW BMW BMW Bmw BMW Cor NSX RL AG AG AG As 7 ntinental 300’s 300's 300's 500's 700's x3. x3 x3 x5. x5 x5 z3 1997-05 1996-04 2001-05.5 2001-05.5 2005.5-09 2004-06 2001 2005-09 1996-06.5 2006 2006 1995-03 1994-01 2000-05 2007 2007 2000-05 2006-07 2006-07 2002 AR32 AR32 XProg AR32 smok AR32 Orange 5 AR32 AK90 smoK AK90 AK90 AK90 AK90 AK90 SMOK AK90 AK90 sMoK AK90 Tango Tango Tango Tango Tango Tango Tango Tango IKeyClone Tango Tango IKeyClone IKeyCione IKeyClone Tango Tango IKeyClone Tango Tango IKeyClone Table of Contents Removal Removal 2 ar hoe. aa Removal pie ceeat Ta Reesting Key Pro USA LLC Honda 1 Honda 1 Vag Vag 6 Vag 12 Vag 26 Vag 45 Vag 26 BMW 7 BMW. BMW 4 BMW 7 BMW 7 BMW 7 BMW 4 BMW4 BMW 7 Bmw4 BMW1 BMW7 4444 PUSS A MOAR AAA AAA AAAAAAAAAAAAAAAAAAAAA‘Table Of Gentens Acura Acura Audi Audi Audi Audi Audi Bentley BMW BMW BMW BMW BMW BMW BMW BMW BMW BMW BMW BMW NSX RL AG AG AG As 7 Continental 300's 300's 300's 500's 700's x3 x3 x3 x5 x5 x5 1997-05 1996-04 2001.05.5 2001-05.5 2005.5-09 2004-06 2001 2005-09 1996-06.5 2006 2006 1995-03 1994-01 2000-05 2007 2007 2000-05 2006-07 2006-07 2002 AR32 AR32 XProg AR32 SMOK AR32 Orange 5 AR32 AK90 sMOK ‘AK90 ‘AK90 ‘AK90 ‘AK90 AK90 SMOK ‘AK90 AK90 SMOK AK90 Tango Tango Tango Tango Tango Tango Tango Tango IKeyClone Tango Tango IKeyClone IKeyClone IKeyClone Tango Tango IKeyClone Tango Tango IKeyClone Table of Contents ‘aera i ae [csp ea AG ae Reading Reeding Reading. Honda 1. Honda 1. Vag Vag 6 Vag 12 Vag 26 Vag 45 Vag 26 BMW 7 BMW1 BMW 4 BMW7 BMW7 BMW7 BMwW4 BMW 1 BMW 7 BMW 4 BMw4 BMW7 eee RRhRRRRAhbAhAbhhAhhAbbbAbbd Key Pro USA LLC‘Table Of Contents Buick Cadillac Cadillac Cadillac Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chevrolet Chrysler Chrysler chrysler Chrysler Chrysler LaCrosse Catera cts DTs Camaro Cruze Equinox HHR Impala Malibu Malibu Pick Up Sonic Suburban 300 300 300 Crossfire Concorde @©Key Pro USA LLC 1999-04 2007-08 2007-08 2010 1997-01 2008 2006-08 2010-13 2011-13 2010-13 2009 2006-09.5 2005-07 2013 2006-09.5 2012-13 2006-09.5 1999-00* 1999-00* 2006 2004 1999-00* AK90 —IKeyClone Removal Reading ‘AK90 Tango Removal © 4) SMOK Tango Removal AR32 Demon? Orange 5 Removal | Rez AR32 Removal AR32 Removal Readi AR32 Removal TF AR32 Removal Reading AR32 Removal Reading AR32 Removal Reading AR32 Removal Orange 5 Removal Reading AR32 Removal Reading AR32 Tango Removal Reading AR32 Removal Reading AR32 Removal Reading AR32 Tango Removal ooding sMOK Tango Removal Reading Orange5 ‘IKeyClone == Reading. AR32 Tango Removal Waa ting Table of Contents BMW 7 BMW 4 BMW 1. GM 17 omé GM 17 GM 17 GM 17 GM 11 GM 17 GM 1 GM 17 GM1 CHRY 6 CHRY 1. CHRY 23 MB 20 CHRY 6‘Table Of Conte Chrysler Chrysler Chrysler Chrysler Chrysler Chrysler Dodge Dodge Dodge Dodge Dodge Dodge Dodge Dodge Freightliner Freightliner cmc cmc Honda Honda Concorde Pacifica Sebring Sebring Sebring Town & Country Durango Grand Caravan Intrepid Intrepid Sprinter Sprinter Stratus Stratus Sprinter Sprinter Acadia Pick Up Element Prelude 1999-00* 2004-08 1998-99* 1998-99* 2006 2004-07* 2004-06 2004-07* 1999-00* 1999-00* 2002-06 2007-14 1998-99* 1998-99* 2002-06 2007-14 2008 2006-09.5 2007 1997-02 Orange 5 AR32 AR32 Tango Removal ia Ee oa OrangeS Tango Removal Reading anaes SMOK = Tango. Removal nse = AR32 Tango Orange 5 Removal OrangeS = Tango. Remove! SMOK = Tango AR32 Tango Resmovul Orange 5 | zeasult Removal OrangeS Tango Resoval SMOK ‘Tango AR32 Removal AR32 Removal TMPro —IKeyClone Reseoveal AR32 Tango Removal Table of Contents Reading bos 73 one ieeiye Reading. Reading Reading Reading Okey Pro USA LLC nts CHRY1 CHRY 11 CHRY 6 CHRY1 CHRY 17 CHRY 11 CHRY 23 CHRY 11 CHRY 6 CHRY 1 MB 13 CHRY 6 CHRY 1 MBS MB 13 oma om4 Honda 5 Honda 1. BOBS SESAAAAAAAAAAABAAASAABAAAAAAAAAS £383 8 SS ae‘Table Of Contents Infiniti G35 2004 AR32 © IKeyClone = Reading Nissan. a etonuie 2003-04 |) ARS Removal Reading Isuzu Isuzu Rodeo 2003-04 = AR32 Removal Reading Isuzu Jaguar XType 2003-2004 sMoK Tango Removnl = —_Jaguar1. Jeep cone 1999.00 AR32. = Tango. Removal ©.) CHRYG Jeep acer 1999-00 Orange 5 | zest Removal Reading CHRY1 Jeep fos 2005.07 SMOK Tango Removal Reading CHRY2 Jeep Liberty 2005-08" AR32. Removal Woodin. CHR Lexus ES300 1997-01 AR32 Pe) Reading © Toyo Lexus ES300 1997*-01 Red Pen Mer Reading | Te Lexus GS300 1998-01 —AR32 7 Reading Lexus GS300 1998-01 _—- Red Pen Reading To Lexus Gs400 1998-00 AR32 | Reading | Toyota Lexus GS400 1998-00 Red Pen at tsi Resdig)}) Toyota 9 Lexus Gs300 1998-01 — AR32. (iis 0 Reading | Toyota t Lexus GS300 1998-01 Red Pen Reading Toyota Lexus 1s300 2001 AR32 Fn) Reading | Toyota. Lexus 1s300 2001 —- Red Pen aac! Toyota 9 Lexus ts400 1998-00 © AR32 Bites it! Toyota 1 Lexus Ls400 1998-00 Red Pen Reading Toyota ® Lexus 1x470 1998-00 AR32 i) Reading Toyota’ Lexus 1x470 1998-00 Red Pen Toyota 9 Okey Pro USA LLC Table of Contents 4Table Of Contents: Lexus Lexus Lexus Lexus Lexus Lexus Mazda Mazda Mazda Mazda Mercedes Mercedes Mercedes Mercedes Mercedes Mercedes Mercedes Mercedes Mini RX300 RX300 $c300 $c300 sc400 sc400 626 626 Miata Miata MPV MPV Class ML300. ML320 ML430 ML500 SLK320 Sprinter Sprinter Cooper 1998-03 1998-03 1998-00 1998-00 1998-00 1998-00 1998-99* 2000-02* 1998-99* 2000-05* 1998-99* 2000-04* 1998 1998-05 1998-05 1998-05 1998-05 2001 2002-06 2007-14 2001.05 AR32 Red Pen AR32 Red Pen AR32 Red Pen Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 Orange 5 SMOK AK90 brereeerasta Csi SE ae ae Siete Tango Removal Tango Removal Tango Removal Tango Removal Tango Removal Tango Removal IKeyClone Removal Remavel Remeovol Removet IKeyClone Tango = Removal Tango mere! IKeyClone Removal Table of Contents Reading Toyotad « Reading Toyota9 @ « Reading Toyota Reading Toyota ® [ Reading Toyotai « Reading Toyotad 4 te Reading Mazda 4 og Reading Mazda1 a Reading Mazda 4 @l Reading Mazda . : a Reading Mazda 4 a Reading Mazda 1“ ee Reading MB20 qgy FF a Reading MB1 = Reading MB1 @ Reading MB1 = - Reading MB1 @& . o Reading MB20 qo eta dic ves @ « thiag y (MB 13 i « Reading BMW7 ce 2 ©Key Pro USA LLC ‘‘Table Of Contents Mini Cooper 2006 SMOK Tango Removal § = BMW1. Mitsubishi Raider 2006 SMOK Tango Removal Reading CHRY 23 Nissan 3502 2004 AR32 © IKeyClone Recht Nissan Altima 2005-06 AR32 IKeyClone = Reading Nissan 1 Nissan Frontier «2008 AR32 IKeyClone == Reading Nisa Nissan Maxima 2004-07. = AR32_—SsIKeyClone Reali Niss Nissan Pathfinder 2000 OrangeS = Tango Removnl Manding Pontiac —Torrent 2009 AR32 Removul Reading N Porsche 944 1999-04 TMPro Removal Roadiny Porsche 9411 Turbo 1999-05 — TMPro Removal Readixg Porsche Porsche Boxter 1997-985 AR32 Tango Removal Reading Porsche S Porsche Boxter 1998.5-08 TMPro wee Removal Reading Porsche 1 Porsche Cayenne 2004-06 = AR32 Nancometas ert) tir a) Vag 26 Rover Freelander 2001-04 AK90_—IKeyClone Revsowul BMW7 Rover HSE 2003-05 AK90_—IKeyClone Resovnl Reading BMWT Rover HSE 2008 Orange += Tango Removul Reading Rover 4 Rover HSESport 2006-09 eat aad eee Rosse! Reading Rover7 Rover LR3 2005-07 ©Key Pro USA LLC Table of Contents‘Table Of Contents Saab Saab Saturn Subaru Subaru Subaru Subaru Suzuki Toyota Toyota Toyota Toyota Toyota Toyota Toyota (Delco) Toyota Toyota Toyota 9-3 — 2004.5-09 9-5 — 2004.5-09 Outlook 2007 Forrester 2014-2015 ‘WRX 2015 XVCrosstrek 2013 Impreza 2013.5 XL7 2008 4Runner 1998-00* 4Runner 1998-00* Avalon 1998-04* Avalon 1998-04* Camry 1998-01* Camry 1998-01* Camry =1998-99* FiCruiser 2010.5 Highlander 2000-03* Highlander 2000-03* AR32 AR32 ee AR32 Removal ZedFull Removal ZedFull Removal ZedFull Removal ZedFull Removal AR32 Removal AR32 Bee nee ts Red Pen eerie AR32 inne Red Pen Peer AR32 rca Red Pen Bese G! AR32 pans AR32 Tango | Wassevst AR32 er is Red Pen . caalaaa Table of Contents feeds. Keel, eae Reading Reading Tee Reading Reading Toyota 9 Okey Pro USA LLC Seaaaikea @e Saab1 ary cma = Subaru 1 = Subaru 1 “e Subaru 1 eae = Subaru 1 eens = OM came “~¢ Toyota 1 eargy =% Toyota 9 qamrgg =e Toyota t qanragg —S Toyota 9 avg “ ¢ Toyota t gg ‘ & Toyota 9 ge “« Toyota 16s @ Toyota 23 : Toyota 1 : 2 Ss s 3DTU UBS E SESE SESE EEE EEEESCS Table Of Contents Toyota Toyota Toyota Toyota Toyota Toyota Toyota Toyota Toyota Toyota Toyota (Delco) vw vw vw vw vw vw vw Land Cruiser 1998-00 Land Cruiser 1998-00 MR2 2001-05 MR2 2001-05 Prius 2001-03 Sequoia 2003-08 Sienna 1998-03 Sienna 1998-03* Solara 1998-03* Solara 1998-03* Solara =1998-99* Beetle 2000-05 Cabrio 2000-04 cc 2007-13 Eurovan 2000-04 Jetta 2000-05.5 Passat 2006-10 Touareg 2004-06 Okey Pro USA LLC ‘AR32 Red Pen AR32 Red Pen AR32 AR32 AR32 Red Pen AR32 Red Pen AR32 Orange5 Tango AR32 Tango Orange 5 Tango AR32 Tango XProg Tango Orange5 Tango AR32 Tango Table of Contents ore eet) Feeer ee, 7 ger 24 oar Pa! Removal Remevn Reading Reading Rasding Reading Reading ding Repding eae (eer pees Toyota 1 Toyota 9 Toyota 1 Toyota 9 Toyota 29 Toyot: Toyota 1 Toyota 16 Vag 45 Vag 38 Vag 32 Vag 38 Vag 20 Vag 32 Vag 26: 0 0 Fr) Q) 5 0 Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo Volvo 30 c70 s40 s40 s60 60 $70 s80 $80 v4o v70 v70 xc90 xc90 2008 2004 2000.5-04.5 2004.5-07 SMoK Tango Orange5 Tango Orange Tango ‘MOK Tango 2001-2004 ane Tango 2005-2008 1999 AR32 ‘Tango OrangeS Tango oc ma ee 2005-2006 2004 2000 2001-2002 2004 2005-13* Non Prox. AR32 Tango OrangeS Tango OrangeS Tango Tango Tango AR32 Tango Table of Contents pea! emia Reading Ribble ZZ Key Pro USA LLC Volvo 1 Volvo 18, Volvo 18 Volvo 1 Volvo 7 Volvo 24 Volvo 18 Volvo 7 Volvo 24 Volvo 18 Volvo 18 Volvo 7 Volvo 7 Volvo 24 5 PARRA RRR RBA ABABA RAAAABAAAAAABAAARAAAADocumented Date: 101715 Programmer: Tango Module Location: Near Driver's Left Shin Read In or Out: In Circuit Usable Transponder(s): 7935, 7930, 7931, ELM PIN et in BIN: No [Clone Out or Convert BIN: Cloned Out Keyway: HU92 4.Most models listed first require the lower kick 2.Still in place, we can already tell it's EWS4 panel to be removed. The Target Module is usu- because of the white label with black writing. ally located on the driver's side “A” pillar, 6 to 10 EWS3 has green text (8 or 10mm) inches straight up. secures the EWS4 in Idefine this as a“Clone Out” type sys- future. I understand that this isn’t tem vs the Conversion purely to clarify cloned out in a more conventional defi- {hat when the BIN has been pulled once, nition. As these are not clonable with or feading of the device izmolongernec- without the BIN. Ain unusual example Sesary to produce atransponderinthe that doesn't fall into either group. | a ey Pro USA LLC BMW !3.Here is the module on the bench Same socket, same off white plas- tic box but black text reads 5.If you open the SMOK Help Files, search EWS4, this solder points image should be found. 7.Start the SMOK, then Secured> Eeprom> MC9S12EE. The easiest way to determine secured vs unsecured is the number of wires you soldered. 4 wires is un and 6 or more wires will be secured 4.Freed from the box, here is the board. AAAAAA wore tase 6.ldentify, clean, and | usually presolder a bit of solder to each point. Then solder, the colored lines to the points. 7 total. AAAAAAAAARA rvVyy) 8.This is an example of the unverified BIN. Before saving the file make sure to All SMOK status reports are displayed in the Dialog Box in the bottom left. doe * ml ©Key Pro USA LLC eee eee aaa ek k kaka9.Save Save Save. File in the top left, then Save. As always use a name that you can locate in the future. Som a RETA 11.Click the Blue ‘File Open But- 12. Make sur ton, then the ORGS5 saved file o> see — a Sereeal 10.Now we need to open the file in the Tango. Region Europe> BMW> EWS4 eee HpereTHaaepE ire an allowed transponder is in the Tango. Select the you would like to use. And Click the ‘Write Button = o 13.Watch the money go into your bank account, and then return the parts and test the key. erect ae Aeet “OKey Pro USA LLC This system doesn't require that the device be rewritten. What happens is the Tango isolates the info in the BIN that must be placed on the transponder for the vehicle to recognize and accept the transponder the first time it is turned in the ignition. This is when it will lock and then start to roll in sync with the vehicles memory. This explains why we only have to extract the BIN once but also cannot clone the transpond- ers. With that saved BIN you will never have to extract the file again and can also produce more transponders. This also gives us the abil- ity to over ride positions in the BIN with new transponders, an option the dealer cannot offer. BMW 3KEYPRO@ Make 1.Most models listed first require the lower kick Documented Date: 101815 Programmer: Tango Module Location: Near Driver's Left Shin Read In or Out: In Circuit Usable Transponder(s): 7935, 7930, 7931, ELM PIN etc in BIN: No ARAAAAAT Keyway: HU92 2.Still in place, we can already tell its Ews4 “ll Panel to be removed. The Target Module is usu- because of the white label with black writing ally located on the driver's side “A” pillar, 6 to 10 EWS3 have green text. inches straight up. 2 y tom vs the Conversion purely to clarify that when the BIN hi reading of the device is no longer nec- essary to produce a transponder in the mulled once, nition. As th BMW (8 or 10mm) secures the EWS4 in fature. clos inderstand that this isn’t in amore conventional defi- __ are not clonable with or without the BIN. An unusual example that doesn't fall into either group. Key Pro USA LLC3.Here is the module on the bench. 4.Freed from the box, here is the Same socket, same off white plas- board. tic box but black text reads Spr Te a na —_ ~> =) => => =) =} =? =) = 8 5.If you open the AK90 Help Files, this solder —_ 6 Identify, clean, and | usually presolder a bit points image should be found. | have found that of solder to each point. Once soldered, you different colors have been used by various man- can see the color issues but these are accu- ufacturers but that the numbers are accurate. —_ate based on the numbers = ee ul aS . eee ) bs LS : 7. Here is the orientation and col- 8.And just as a bonus, here are ors that my AK90 utilize. Keep in _ the rear solder points that some mind that yours may differ. prefer to use #1 as > | is is is rt i #6 ©Key Pro USA LLC BMW410 Click the Read EWS Button in the right column and you. ‘should see the progress in a pop-up, then a Save As win- dow will appear already populated with a great fle name, that includes full vin, device type, and the date. Save it ‘9.With the AK90 connected to the PC, Click the drop down menu under the device type. Then select 2L86D (Cable). If we are soldered up, Click OK. nue BY 11.The process can be completed with the AK90 but 12. Make sure an allowed transponder is in for variety's sake, start up the Tango. Click the Blue the Tango. Select the you would “File Open Button, then the AK90 saved file. . Cee —— > £$ © i PEEEEELLEL 43.Watch the money go into your _ This system doesn't require that the device be = rewritten. What happens is the Tango isolates bank account, and then return the the info in the BIN that must be placed on the parts and test the key. transponder for the vehicle to recognize and — “= accept the transponder the first time it is turned in the ignition. This is when it will lock and then e¢ start to roll in syne with the vehicle's memory, This explains why we only have to extract the BIN once but also cannot clone the transpond- ers. With that saved BIN you will never have to extract the file again and can also produce more transponders. This also gives us the abil- ity to override positions in the BIN with new transponders, an option the dealer cannot offer, 6 BMW Key Pro USA EEG| At A Glance. Device Reader: AK90 Target Module: EWS3 ‘Target Device: 0D46J (52 PLCC) Original Transponder: ELM BIN Encrypted: No Clone Out or Convert BIN: Cloned Out 1.On these Rovers, the See the Appendix for the more common locations. Okey Pro USA LLC from that time pe- primarily use this Rover Documented Date: 110315 Programmer: IKeyClone Module Location: Varies See Appendix Read In or Out: In Usable Transponder(s): 7935, 7930, 7931, ELM PIN etc in BIN: No Keyway: HU92, RV4, BMW 4 track 2.Open the elbow rest, and remove the cup holder, straight upward. Set aside. Great place to store the screws you are about to be removing next cation. See the Ap; listing of EWS typ4. Under the trim around the base of the 3.Remove these shifter, are . The trim around t from under the cup holder. shifter can be moved to access them all. 5.Now the larger trim around the top of the center console, can be shifted from side to side, revealing the Target Module: i" mounted on 1” drivers side of the shifter gear 9) We box. White Box Approx. is: x 2° Xai 7 ene AA 8 Typically there is enough wire slack to move: 8mm head the box to the void where the cup holder was po aay removed. Disconnect the single plug and take bolt secures the EWS to the bench the box in Remove it and start working the EWS backwards to- wards the cup holder. sania 8 ©Key Pro USA LLC AAAAA AAA AA ARARRA RDA A AAA3.This is a 4.Here’s the board removed from the box. Our standard Target Device is an 0D46V. It's a 52 leg Plastic EWS3. | have Leaded Chip Carrier (PLCC). Note seen them re- Placed with the following gen- eration by the dealer, i.e. an EWS4 where an EWS3 was originally. 5. It is very important when dealing 6.Connect the AK90 hardware and with these EWS1-3 that you verify that start the software. Verify that the the device is Mask 0D46J. Sporadical- oper devic ly throughout its use, EWS can con- tain 2D47J selected 7 Both |, and the makers of the AK90 can- 8. Clean the lacquer off the 52 legs, not express how important it is to not read either use chemicals such as Zip a 2D47J as a 0D46J. You “Must” do it Strip or abrasives like this wire brush — cs 47. moet’ ¢ voad 20475 Okey Pro USA LLC9.Make sure the adaptor is oriented properly 10.With all settings and connections established, to Pin 1. | find that you cannot just clip this on. lick the Read EWS button. There is both a More likely that you must hold it downward as _ visual and audio effect (ticking) as the AKO reads. you attempt the read. The read takes approx. a 20 to 30 seconds. If it fails, check for lacquer = residue and adjust the adaptor to reestablish the connection. Soe 11.Once the AK90 recognizes the BIN file, 12.Connect the IKeyClone to the PC it will auto open the Save As Window, and and start the SW. Utilities> Key Gen- auto name the file based on the info read. erator> Key By Dump> BMW> EWS 2g os _. The IKC simplifies the ‘module selection process by not requir | ing EWS 1,23, or 4to be identified. Just open ‘any EWS Bin under this selection and it will identify and open tho = options screen. 43.This window gives a few more 14Select the AK90_saved file. (| know the . s file name doesn't match the previous images, details and the option to Open the 444 you are smart enough to follow along, Bin File. Click Her: nonetheless.) Key Pro USA LLC15.We know that the IKC has accepted the fle be- 16. We can see that 3 of 10 slots are occupied, $0 | will nae there were no error messages and the options _be selecting a slot a “long distance” from the last existing uuttons illuminated. This screen displays useful __Key, as to not interfere with keys ordered from the manu- info such as keys programmed and the sync code. facturer. You can also overwrite existing transponders. er, here a 7935, is located on top of the and then verify that “TP Generated OK!" a IKC hardware as shown on the top. pears. This can take 20 to 48 seconds. 19. Note that the IKC did not require a new bin file to be generated or named. This is our cue that a rewrite of the de- vice is unnecessary. So return every- thing to the vehicle and test your work. | have provided the following pictures of different locations you may find the EWS modules. A vast majority of them are located near the driver's left foot and are EWS3 generations. See also, the BMW immo system spreadsheet we have provided in the Appendix. Key Pro USA LLC BMW12 BMW ©Key Pro USA LLCKEYERCO CHRY = Make Model Years cunvaen Bee SHRYSLER CONCORDE 1999-2000* CHRYSLER SEBRING 1998-1999* DODGE STRATUS 1998-1999" (Calla analy ester ane Booee aia jexe2000" | Note: Grand Cherokee with the full vin ask if it's —— ——" — isn’t optional. They all ‘sentry key equipped. EP GRAND CHEROKEE seee-2000, have this type immo. ALA Glance. Documented Date: 101815 Device Reader: ORGS Programmer: ZEDBULL plus EEPROM Applications ‘Target Module: SKIM Module Location: Around the Ignition Target Device: 24.C02B Read In or Out: Out of Circuit Original Transponder: 4D64 (8 SOIC) Usable Transponder(s): TPX2 or EH2 BIN Encrypted: No PIN ete in BIN: Pin ‘Clone Out or Convert BIN: Clone Out Keyway: Y157 1.0n most of the car models, the appearance ofa 9 Qur on the top of the dash, just be- low the windshield and slightly to the passengers side of the car, is a solid indication of the immo sys- tem. Have the customer check before you quote. is the SKIM or antenna around the ignition lock | ei And in following sections Iwill cover thia __ that the Ball requires an expensive C Procedure using other programmers ble Transponder. There protocelshave which cam use ID¢4 Twat enon boon updated im lateriEA products such as quickly ncnciec we ian the Zed-Full and will allow for more inex. | Sect ©Key Pro USA LLC CHRYSLER eee eee< « < 4.Remove the 2 that secure 3.Remove the T20 that se- i troud around the column. Some- . ; rod cures the tilt handle in place. times a skinny shafted driver is required a 5. Looking straight up from the floor, here is a_6.Here is our Sentery Key Immo Module view of the “SKIM.” Different vehicles will use varia- and remove the single secur- ting in design but the board is the sam ing screw. ‘pongo = PUG tween heating each#™ elow on that witch till it lifts out. 7 The cover snaps off. But the Target device is 8 So ate k on the reverse. The two points that goto the pin a areal are the only connection to the board. The P" plug stays attached to the board. ear F 2 CHRYSLER ©Key Pro USA LLC9. Finally our Target Device, 24LC02B. As usual with an unknown module, | choose to desolder the device. It's only 8 legs. 11. | recommend confining the device to it's adap- tor at your earliest convenience. Just be careful with these “Clam Shell’ type as the release lever is easy to bump open and eject the device. = 13.With the ORGS connected, start the SW. Click the Type Button in the Menu Bar. If you noticed our device is a MicroChip Brand, which may not always be the case but ORGS does seem to make a distinction. Groups> 1 EEPROM> MicroChip> 24LC02 ° Okey Pro USA LLC CHRYSLER 10. Hot Air. And remove the de- vice from the circuit. 12. Now insert the loaded adaptor in- to the ORGS hardware. | recommend ° 7 using bright nail polish to mark your PIN 1 orien- | tation on the adaptor and the ORGS to speed up the process till you can remem- ber in the future 14.Also Note that our device is actually a 24LC02B. The closest selection that ORGS had under Micro- Chip was 24LC02 so we use that. If the programmer doesn't recognize the file, the next thing | would at- tempt would be a read under 24LC02B under a dif- ferent manufacturer. This would not be an unusual situation to come upon. And save every read along the way till the program- mer recog- nizes. Al- ways a way to return Common sense prevails.15.You should be ready to “R’eadin 16.Lets get the Green in menu bar. This should re- SAVE out of the way and nan sult in a similar BIN as this example. discuss this BIN file for a momeniay 17.Both our VIN End more importantly, our 18.But if we have a ZedBull, we don’t need are right in front of us. Nothing else no stinking PIN codes. Connect and Start the would is needed to program the car via ‘SW. Extended Functions> the OBD port from here. See the Appen- dix for BIN to PIN conversion chart courte- sy of Chad Edwards@SOS Diagnostics. 19.You can Click Open File or 2 t Feat yf 20.This should be the result. Your Options Bull is the Auto BIN Identify. Sir Screen for this immo system, with all the de- the file anywhere on this scre tals Usabl , Usable Transpon: pens. Wonderful at helping id - : 1 ; flee! TUPro and Miraclone also h: re. _ and Click on the images in the bottom left 3 r 4 aoa eae eee ee CHRYSLER ©Key Pro USA LLC21.Clicking Calculate Pin Code displays 22With a TPX2 inthe Bull, | Click OK and we are what we already know. Place your choice of done. Because we cloned a key out of the BIN, all that Usab is necessary is to return everything and test. No rewrite Ie Tfansponders in the Bull aerial, Glick — orihe BIN on the device ls needed wren cloning out Date: Notes: Date: Notes: Date: Notes: ©Key Pro USA LLC CHRYSLER 5PRG@ CHRY = =~ Make Model Years CHRYSLER 1999-2000" CHRYSLER 1999-2000" CHRYSLER 1998-1999" 2 once 1998-1999" fri wih tenulvnask ts aaa ware I opines Tey al sentry key equipped. ae IGEAND CHEROKEE ae have this type immo. ‘At A Glance. Device Reader: AR32 ‘Target Module: SKIM Target Device: 24LC02B Original Transponder: 4D64 (8 SOIC) BIN Encrypted: No Clone Out or Convert BIN: Either 4.On most of the car models, the appearance of a on the top of the dash, just be- Jow the windshield and slightly to the passengers side of the car, is as tem. Have the cust before you quote. way of checking, use a antenna t mine if you are dealing with an immo cauipped vehicle. Ifyou have not purchaxed ofa in sues with a problem vehicle also. ‘one, this inexpensive tool can be very CHRYSLER indication of the immo sys- Documented Date: 101915 Programmer: Tango Module Location: Around the Ignition Read In or Out: Out of Circuit Usable Transponder(s): 4D64, TPX2, or EH2 PIN etein BIN: Pin Keyway: Y157 AAAARAAAAABAA 2. Our istheskim or antenna around the ignition IOCK. egg rms from many different vendors. are small enough to hang on your keys yagh that they can symptoms poeeeeeaeeaha Key Pro USA LLC3.Remove the T20 that se- 4-Remove the 2 or 3 720 that secure cures the tilt handle in place. the shroud around the column. Some- times a skinny shafted driver is required 5. Looking straight up from the floor, here is a_6.Here is our Sentery Key Immo Module view of the Disc “SKIM.” Different vehicles will use varia- and remove the single secur- tions in design but the board is the same Le Meira yy, ce | EM c¢ * ee 7.The cover snaps off. But the Target device is 8 So | alternate between heating each on the reverse. The two points that goto the pin and lifting from below on that the board. The probes erence em same side. Then switch till it lifts out plug stays attached to the board ¢ EK ©Key Pro USA LLC CHRYSLER 79. Finally our Target Device, 24LC02B. As 10. usual with an unknown module, | choose Hot Air. And remove the de- to desolder the device. It's only 8 legs. NCBTOMInG circuit. BRABABBABaABAABAS 11, Sometimes you find yourself without the proper 12. An oldy but a goody. If you happen to own tool but a job to do. Pomona’s are designed for in cit- an older version of the AR32 hardware, this is cuit, but they of course work in an out situation also, similar. Newer hardware owners can easily just don't shoot it out of the clip or smash the legs. follow along, ae ae 13.From the AR32 software, PGDN and ar- 14, Verify all dip switches and adaptor posi- row over to your desired device. Note there __ tions. No voltage switches on this older hard- isn't a 24LC02B selection, the closest device ware. But out of circuit, voltage is far less im- is 24LC02, so we cursor over and “INS’ert. portant CHRYSLER Key Pro USA LLCPESSSESSSESSESSSEESESESSEESEEEEEEEEEEEEEEEEE 15.Option 3 Read Device int Buffer. This 16.In a very simple form of Binary lan- wilattempt to read the BIN file and placea guage you can see the VIN and PIN. See corr ue your PC temporary memory the Appendix for a full translation chart, ‘EEA NICE [aTo MPT 17."ESC"ape back to the AR32 main screen and 18.Option akaa Allinstruc- more permanent area of the PC’s memory. Pi tions are in front of you. “Y"es to start at Buffer Be- 2 good file name, remember with this file you never have to pull the Target Module again 49.Connect the Tango to the PC 20.From this screen Click the and start the interface. USA> “F’ile Open Button. Then your Chrysler> 300M> 2002 (24C02) AR32 File Gur. > «es CHRYSLER 9 Key Pro USA LLC« 21.The Blue ‘i’ Button shows us the PIN we 22. you select 4, the Tango will override that already know. The Red “Write? Button will key position with the Y160 etc. If you select an oc- @ allow you to select the type of transponder _“UPied position and one of the clonable transpond- ers, the Tango will clone out that occupying data. wouwould ike to place inthe slotyou select. or. tie 12 asl e % 3% @eeE 23.So either choice has its pros and Asa side note, | attempted to read this og cons. If you decide to use a 4E, then device in circuit with a jumper ground: wg the Tango must convert the file and ing the crystal. Failed repeatedly. << rewriting of the device is necessary. But the transponder is more stable and less expensive and more availa- ble. The clonable options are a bit <= more expensive but they save you re- = writing the device. Saving the BIN is « essential to recovery and either clon- Chrysler> 22.Next the Blue ‘F'lle Open Button. Select your Pacifica> 2005 (95080) or 95040, whichever you _AR3? file. And if the file is acceptable, the Tango have, You CaN Use these selection for allthree will ive you your options screen for this vehicle, models, or go to Jeep Liberty or Town Country. » @ee 23.At the time of publication the Tango doesn't have the _24.Save the new Tango file, do not override the or PIN display option for this immo system. Others such as under any circumstances. The Tango gives you the IKC have this feature, so we will proceed as we do not _ standard, "You need to rewrite the device to complet eed the PIN, Select a key slot Place a usable transpond- message, then its back to the AR: er into the Tango and tion 1 Program Device from Disk File to complete thi PC Memory) a ‘EES 25.Then type the file name or ALT “D’ to 26.Back at the Command Screen in the bottom left and 'S’kip if you change your mind. If see the folder the file should be in. Scroll a ct receive the Green Comparison Message down then “F3" to Program per the bot- then check connections and settings and try again tom right corner. CHRYSLER Okey Pro USA LLC27. AS you read, this covers Pacifica, Liberty, and the Caravan/Town Country sisters, I did not provide tear down pic~ tures of the other two examples because they are easier to remove than the Pacifica and then the Target Modules are very easy to remove. Also as previously Stated the Caravan needs the postage stamp cut in the box to access the device but the Liberty does not. Just pop the il Liberty Skreem open and the device s right there 28.Below is the template for the Grand Caravan and Chrysler Town and Country. You can Xerox this individual page and cut these out of the copy or make your own out of quarter inch grid paper. 29.Here is the Pacifica module. | must stress that working near circuit boards with rotary cutters has risks. Practice reduc- @% es stress and increase confidence, Why would you not? CHRYSLER ©Key Pro USA LLC eeu ddassddaadSSS SESS DOU UU UU BSE ESSE SESE EEEEEEES KEYPRCG) CHIRY == Make Model Years CHRYSLER SEBRING 2006 ALA Glance. Documented Date: 102315 Device Reader: Orange 5 Programmer: Tango ‘Target Module: SKIM Module Location: Around the Ignition ‘Target Device: 3K56G (64 QFP) Read In or Out: Out of Circuit Original Transponder: 46 Usable Transponder(s): 7936 BIN Encrypted: No PIN ete in BIN: Clone Out or Convert BIN: Coversion Keyway: Y157 1. Our target module is the immo ring 2. It is a tight removal, but the lower shroud can around the ignition lock. Start by be removed from the dash. | do not remove the securing the bottom shroud, !ower kick panel but some technicians prefer to. [ cM With some advanced EEPROM | can do both, and even utilize can extract the PIN code for key pro- from the port. And with an gven more limited number of tools you on a huge numby can “marry” the immo ring tothe vehi- in lots of used parts ©Key Pro USA LLC CHRYSLER 173.You can unbolt the bracket that secures 4. The Target Module on the bench. the immo ring to the column, or in my Label says this is an Immo 3. A small Case, | slide the module off the bracket flat head removes the cover easily. And there is a surprise underneath. 5.The device isn't visible. It has to be on 6.If you are fortunate enough to own a sol- the reverse of the circuit board. The 2 aer- der sucker, these should be no problem. | ial pins hold the board in the plastic box. have flux, wick, and a simple solder station. 7.But that will work. Apply flux to the 8.You can see here in the wick, then lasso the iron with the wick Naatnceneniheccldanhas This method can remove the large amount of solder around the | been extracted.9.From here, | alternate heating each of the pins and applying lifting tension. “Seesaw’ the board upward, Until it clears the pins. There is a risk of pulling the pins Out of the plastic and severing the antenna connection 11.The collection of dots on the top row is the The third row is called the Mask Usually a number, letter, num- ber, number, letter format. Occasionally the first number will be absent. In short, this Mask trans- lates to how this device was configured internally Tg = Google” Free- scale or Motorola, or data sheet and the mask for a more specific break- down of this de- vice type. PT Cree et Mt 13.We are ready to desolder. But you should have noticed the small compo- nents near the device. So protect them with thermal tape or poster tack etc innit i Okey Pro USA LLC CHRYSLER 10.Finally we can see our Pin 1 is plainly visible, Make sure you mark the board for orien- tation of the device when we return it. Lets more specifically identify this device 12.1 searched “Data Sheet 3K56G’ and the first result was a web sight that shows the Mask translation on the first page. Mask See the Appen- dix for a Mask to Configuration spreadsh PROM contents of The Text Mow MC68HC908AZ60 2574Y MC6SHC9OBAZ60 (4374¥) XCBSHC908AZ60 (SH62A)* MC68HC90SAZ50A GKSSK) MC68HC908AS60 (3574) MCOSHCO08 ASGOA (1L871) MC68HCOSAZ3: Reacts 14.Circle the device with your hot air, and gently lift the device from its comers. With practice and pa tients and perspiration, this should be easy. If you're Nervous, you are missing o ingredients.15.Now we open the ORGS sw and se- 16. Once the device is selected correctly, J lect our device under note in the bottom left corner, the ORGS MC68HC908AB32. aa that is required is displayed. Qe Tipe WCBS vCRBHCSORG idx Of NCHRNCIE Ad] [ Ready ees S84) |GUIGHOB MOMS — | ¥ rmccany Ai78 if you own the ORG5 with Ai 18. Flux the pads and legs, square the device on the adaptor with PIN 1 Oriented. Now you its adaptors, dig thru them and should be ready to solder the legs, note most locate this one, if you bought the. of the leas don’t have pads to solder to. OResa i loseaian la carte Priritiiit cc ian Sool * at you will AAU f [ac have to ws Eeluad 3 oa order this ST 908560/Az60 ) fo-lae 19.Here is the device soldered and installed into the hardware. OUCHHCRE Um GInentR ean Ieagnvand The adaptor only inserts in one di- watch the pop up.b6X to verify all goes well 20.Once all the connections are established, rection. You - ) can always iced click the hel, menu in the Uy sw for more details or in- structions. CHRYSLER ©Key Pro USA LLC annnnniiAAAAMAAdAdadadadadadaDODD DDDPDREPERDE EDP 21.This is our first BIN file. But 22.Click the Yellow “C”ompare button and we shouldn't trust it till we com- in the bottom left of the screen you should receive the “Compare OK” message. are one time mie 5 ioe rr er EQ 23.With a good compare, we can save the 24.Connect and Open the Tango software. file. Menu Bar> File> Save orSave As> —_ Region USA> Chrysler> Sebring> 2001 i then name the file something appropriate. (MC68HC08). Note the slight differences in the device identifier. cara aed “File butto 26. The Tango recognized the file, so the 25.The Blue “File button and options screen comes up. To see the PIN, then double clickthe ORGS lick the “i button. There are 5 keys pro- ’ id already file vou ust created eS [ & =—3* &Se & ©key Pro USA LLC oe27.When you are ready, insert a us- ble transponder into the Tango al and select the desired key slot. ————— iS 2 S © S og cote 23.This message reminds us that since we converted the file, not clone out, we must rewrite the device to complete the program- ming process. : Tongp hes generacea « nev f110: Te complete tay making che m 4 Soieteave nore bays use she new eile 25.Assuming the device is still installed in the ORGS, Click OK to confirm write ose os seer mes te 22 CHI \S- 22.Now that you are prepared, Click the Red “Write button and then this pop-up allows you to name the new file. Remember NEVER overwrite the original fle a < 4 « « « a « « « @ @ a a 4 | 24.Back at the Orange 5, Open the File we just created on the Tango. Verify that the BIN populates the backround. —— Zetec = Lan[oowir ies JO 26.In the bottom left of the ORG5 home screen you should get the Write OK message. Don't forget you still have to desolder and re- solder the device to the target board FF FF FF FF FF FF FF FF FF FF FE FF FF FF FF FE FFF FF FF FF FF FF FF FF FF FF FF FF FF FP FE FEF FE FF FF FF FF FF FF FF FF FF FF FF FF FF FFP FP FF FF FF FF FF FF FF FF FF FP FF FP FE FFF FF FF FF FF FF FEF FE FF FF FF FF yyy uy rT} vy oy ‘Wit ok Bs] @ wD IRYSLER Oey Pro USA LLC. 25440 DRRAoR SALKEYPRC® CHR Make Model Years ED ‘GRAND cnenoKez | 2005-2007 CHRYSLER 200 a0oe DODGE DURANGO 2004-2006 MITSUBISHI RAIDER 2006 ALA Glance. Documented Date: 102415 Device Reader: SMOK Programmer: Tango ‘Target Module: SKIM Module Location: Around the Ignition ‘Target Device: OL8SD (80 QFP) Read In or Out: In Circuit Original Transponder: 46 Usable Transponder(s): 7936 oF 7941 (remote not support) BIN Encrypted: No PIN ete in BIN: Pin Clone Out or Convert BIN: Coversion Keyway: ¥157 In your OBD programmer this system is probably called “CAN 1 Programmed via the OBD by most programmers. This section will b one that refuses to program thru the port. As these CAN I's get o communication break downs between module error more and 1.First pop the trim around the 2.Behind that panel is ignition out with a small flat head. T20 to remove first. more freq Mae that not only will not pull the PIN with those major programmers but if you get by most of the major OBD programmers. _ not program thru the OBD. This resulted in fast forward 10 years andInowhave me having to find another solution and personally run into atleast 4examples _ EEPROM work provided that. ©Key Pro USA LLC CHRYSLER 232 3.Remove the trim around the 4.Now the final T20 is accessible, re- Cluster to gain access to the final Move it and push the ignition assem- attachment. _ _ bly into the dash area. Ss 5.With the lower kick panel removed you should have plenty of room to remove the single Torx screw that retains the target label on the bench. A small flat module to the ignition assemble head will remove the module cover. a a 7.Here is closer view of the 8.This device happens to have the board. Our Target Device is extended Motorola part number on . Our Target Device Is the first row. MC9S12DG128B. If it had not then we could “Google” search the and got- ten the same results With this info we can go to the SMOK help folder and see if it has any further in- structions. here. And SHRYSLER Key Pro USA LLC a CHRYSLEF y9.You should receive a DOC file with the 10. Those selections should result in this im- SMOK for wiring diagrams. HC12> MCU> 298. This is called a Pin Out. For any given UnSecured> MiC9S12DG128 (80 Leg) __ Mask, one of these exists, and tells us the pur- — ssa 5 Pose for each leg. Additionally, it also tells us what legs must be attached to read out the EEPROM data inside. Hence the 4 colored legs. You can solder to those exact points, but | that’s tricky. There is another way. 3 11.Using an OHM Meter, attach one probe to the leg if and then test points on the board near that leg. You are looking for 0.00 resistance. You can solder to that point in- stead of the leg directly. 12. The probing should result in something close to this. Keep in mind there are different boards, and Sq will cover a couple of those pin outs at the end of this section 13.Clean the points and then flux. Then 14. Attach the adaptor end to the solder the colored lines from the SMOK SMOK hardware, then the SMOK adaptor. Here is my example soldered. usb to the PC, and then start the SW. - ©Key Pro USA LLC CHRYSLERMotorola> MiC> UNSECURED> ton. And your status reports will di: EEPROM> MC9S12 EE UNSEC _2Yin the dialog box in the bottom left. ————EEE————— tN 17-Then before you save, Glick the Veriybut: 48 WVe are ready to open the Tan- og ton. This ensures we did not receive an in- correctly read BIN. Then File and Save top left JO SW. USA> Jeep> Grand to archive the original BIN before conversion. Cherokee> 2005 (9512) a Ca ad coe = ad a on a 7 = 19.The Blue “F'ile Button should open 20. The Tango recognized the file. id the folder you typically use for BIN files. Shows two keys in the file. The “I” Locate your SMOK file and open it button will display the Login aka PIN. ” aa mee 7 Ss ee 26 CHRYSLER ©Key Pro USA LLC21.When you are ready, place a usable transponder in the Tango, select a key slot, and Click the Red ‘W'tite button. Remember if you try to use a remote head key, the remote doesn't program with the transponder like it 22.If everything goes well, the Tango will ask you to name the new converted file containing the transponder, and then remind you to write that \goes.in the OBD programming Tango file back to the device. Back to the SMOK 4 Key Pro USA LLC aaa ee ORO RA DADA DADA AAADADAAAAAAAAAARAAA1. Here is another example. As you can see they 2.Use a small flat head to release the tabs around the take many forms due to the wide spread use of the system over different vehi- cles. This is a Cadillac. So far, | have found if it is column mounted lock with a circle plus, until about the beginning of 2008, this section should ap- ply. Remember it is difficult to use our programmers, Tango, IKeyClone, TMPro, ete., to de- fine the system because year ranges and models tend to be different from region to region. 3. 95040 as we expect to see. This particular one is an ST” brand. Normally not all that important, however some of the readers, i.e., Org5, require the manufacturer to be selected prior to the device type. See the Appendix for a break down of manufacturer's markings. 5. Once you select the device, this home screen comes up. At the bottom are all the thing is set properly, including the voltage. “Okey Pro USA LLC hardware settings. Compare and verify every- perimeter of the antenna case to expose the board We are looking for a 94050. | haven't found any varia- tion, ie., the use of 94080. It's always a 95040 device 4, Fortunately, we will be using the AR32, which just quires the device type. So connect the hardware and s the supporting software. Use PGDN and cursor arrows highlight the proper device, 95040. [The 6. Voltage should always be set at its lowest setti start, in or out of circuit as a habit. Increased voltage, increases chances of corruption, and we are reading in circuit. Next connect your Pamona Blue Clip.7. Your start up connections should look like this. Occasionally, the set off dip switches) on the adaptor will need to be adjust- ed to complete the writing pro- cess. Outside of that , the only oth- er adjustment would be to get a clean read Always compare before saving will display the BIN file. You must. i00k at the file before the compare, because you could have received all FF's and a compare would give a Green Good would read all FF's again ase 4 ii Deut heel Peet St SuCgeasseeaeess Ren 11, Save it then Note that it will save this in C:.\EPROM. You can change the save location with Option P ‘Set Drive/Path” should a need occur Cree Read Device into Buffer (PC Storage). Select "Y" When asked to read from beginning. You might catch a glitnpse of the in the bottom right. 4 Ss = 10. Esc back to the main screen, and the In other words “Is what fst looked at, the same as what the AR32 can see in thedlevice at this moment?” We read it, looked at it, and got Good Compare 12. Connect and start the Tango. AAAAAAD AAA Ahh eeseaagad a Cobalt works a ry e ¢ AAR RIRPRRAR Key Pro USA LLCTUT e eee eee eect es 13. Click the Blue ‘F” Open Immo 14, The file opened with no error messages, like ‘| 5 4 Incorrect File Size” or ‘File Not Recognized.” We File. Then select the file you just really have only one option with this system, Select saved from the AR32. a Slot and a Transponder into it ese © 15.Verify there is an acceptable transponder in the Tango hardware, PCF7936. You can use a circle plus key, or in my 16. The first pop up screen is the file nam- ing screen for the new file the Tango has created (add “Tango” to original the case a transponder | will name). The next pop up is poorly harvest from this miscut phrased, in my opinion, but it is a remind- Honda V key. With a == er that the new file that Tango created simple understanding of must be written back to the device to com- transponder relationship plete the transponder making process. and commonalities, you ae can utilize almost every discarded “junk” key. Click the ts» wy ~ 17. With our Tango file, return to 18. At the bottom, the Be as an : the di lor’ he the AR32 and select option 1 Hevreenerces ot you caif cursor arrow to the desired file name. Op¥pe the file name. Then Key Pro USA LLC19. | Clicked F3 but received a comparison error 20. Remember this note from the AR32 de- at the bottom you can see. "New Device In- vice set up instructions? It suggests that you Stalled” is asking if you would like to attempt the move switch 2 up on the AR32 adaptor board Program again Posse ster Ya ott Uy me iia 21. Move switch 2 to the up position 22. Again the AR32 will try to pro- with a pen, small pick, etc. Then gram the 95040, now with Switch 2 for new device installed question. on the adaptor in the up position. to ey 23.This time we ret 1 Good Compar. ison messag} wrote to the device. Option Zero program. Return eKEYPRO@ 2 G. M. — rs Codiae aay 997-2001 This system was only used on this vehicle. There ~ Ninn are no other American examples, and all are . — transponder equipped. . : AtA Glance. Documented Date: 102815 Device Reader: Orange 5 Programmer: ZedBull ‘Target Module: Antenna Module Location: Around Ignition Cylinder ‘Target Device: 3D33J (52 PLCC) Read In or Out: Out of Circuit 15 (1997-1999) or 7935 (1997-2001) | Original Transponder: 33 Usable Transponder(s): ‘BIN Encrypted: No PIN etc in BIN: VIN, Mech Key Code, and PIN | Clone Out or Convert BIN: Clone Out This is an example of a vehicle that GM used widely overseas but had a poor recep- tion here in the states. They are relatively rare to see these days and these factors all add up to an increased pay check for those that are prepared. To be that pre- pared tech, make sure you have the appropriate key shell to house the transponder upon completion. There is no substitute shell for the B61 keyway to my knowledge. s to remove Keyway: B61 4,Our Target Module is the antenna around the ignition. 2. There are three phillips scre You will need a mechanical key to complete the removal frorn the lower shroud and also remove the of that target. There are programmers available toex- tract the key code from the OBD or generate itthe old _tilt knob, which is usually lock tight fashioned way. reinforced. ‘These cms be very challenging to e=- tract the PIN code fromthe OBD. The _ing the PIN from the manufacturer. This will most likely come with a fee. few programmers that might be able to But EEPROMers say “PIN Codes? We do this cannot guarantee 100% succe: | especially in the early examples. There- don’t need no stinkin PIN code: a GM 6 ©Key Pro USA LLC3.Here’s the =e 4.Both top and bottom shroud should be free now. be removed to remove the antenna: = aaaaaaddaaaada 4 " ee = = : Key Pro USA LLC «~ Se fe & *~ = i9.Unfortunately the target device is on the re-_ 10.Remove excess solder with flux and wick. If verse. So we will have to desolder the 2 anten- you have a solder sucker, they work great for this. Na points to remove the board from the box. careful not to lift while there is still a connection. eparated 12.Start by identifying and marking ont board. Then isolate and insulate with tack or thermal tape. When you are set, start applying y 11.Now that they are s: the box can be set aside and we can move onto the econ Sey CJ Pra roi) ct Crtrir {p iL 13.Locate this HCO5B/HC705B adaptor forthe 14 With the device inserted into the Org5. Insert the device into the HCO5 side. adaptor, insert the adaptor to the ORGS hardware. The writing on the adaptor and hard- ware should face the same di- rection Key Pro USA LLC GM15.The hardware should end up looking like 16.Moving over to the ORGS software. Click the this. | suggest al- Select Type Button. Then make selections 3-05 Immo> Opel> HCOSBS, This selection harkens back to the European origins of this import car. ways inserting the device before in- serting the adap- tor. This should , lessen the strain and wear and tear on the main hard- ware. Think of it this way, the adaptor is cheap- er to replace. 17. If you have not made the wise pur- 18.You should be set to Click the Green chase of the Immo SW for ORGS, here is “R”ead Button. This is a small, simple BIN. how to select the device the alternate way. It should appear in the window quickly. raMiuenateredtecnkeyrcs ms 20-6ut moving on. File> Save Gifs chded Ye ASCs Uc by caveipes and 5 i pooranmersto sight simpy the bnery codewneng we at YOU earliest convenience. can take advantage as it makes it easier to see more common ©Key Pro USA LLC R9R RRB RAAB ABARBARAABAAAARAABAABAAAAARAAAABAAAABBAALAASESSUSSSESSESSSSSSSS ESSE Se eeeeseeeeeeeeeeees 21.Connect and Start the ZedBull interface. 22.From the Pop Up select Open The first selection in the menu bar is Extended p; I Extended we Functions. Then Eeprom MCU Applications. Pile. Then Cacia ie CE just saved. [Peeper HEU Appian ab. 23.Here's the options screen for this immo system. 24. If you Click the Transponder Programmin: Gives us more details and if you cursor around abit Button this pop up allows for you to select you will find surprise images. The buttons along the ~—_ your usable clonable transponder. Place it into bottom will clone oyt a key and display the PIN code. the ZedBull aerial and Click Ok. Done... Almost. 25. The most challenging part of this whole job is also the last step, returning the Target Device to the circuit. This will require your advanced soldering skills. With practice they are simple. Clean excess solder from the legs and the board. Flux both and start soldering the legs back to the pads. | find when components are too close, sometimes it is benefi cial to remove them to facilitate re- soldering. Make sure everything is squared up. Make sure PIN 1 is orient- ed correctly. Put all of your practice to -. oe and you will be fine. Return every- Se thing and test it out. ©Key Pro USA LLC GM 10KEYPROG G ~ IVE. ts a a! [AtAGlance, 3 Documented Date: 103015 Device Reader: Orange 5 —__| Programmer: TMro plus Module 138 [Target Module: Antenna ~_____| Mosdute Location: Around Ignition Cylinder == oc a [Original Transponder Phillips 46 | Usable Transponder(s): 7936 BIN Encrypted: No Clone Out or Convert BIN: Conversion | Keyway: B106 ‘As with many of the other GM systems, this one was used on a large range of vehicles. This process is difficult, therefore it will not be a standard method for me personally. And further ‘more, this means that | do not know the extent of vehicles using this. | would make a guess- timation that if your example is a circle plus, in dash, and pretty early, say 2004-2008, you are probably dealing with one of these. Our knowledge gaps will shrink with time. 1.If your car has similar features to 2.Start with the only easy item this example, the chances increase to remove from this vehicle. The that yours is the same immo system. ignition bezel ita wae © wony Challenging wehicle bet! again, it would have to be avery specific for removing the target module and and paying job. But now it is part of our then to have to desolderthetargetde- _ knowledge arsenal. Remember this info vice. This system uses a 64 leg QFP (see also allows for module swapping, definitions). Worst part wasIonlydid should that situation ever come up. this for this book. To go thru this trouble i GM OKey Pro USA LLC 1 MDPETTTTTTTYTITITYTYTYTYTTIYYTTTTTTTTYVYVDURE SE SESE SSSSECECSCSESEESCEEES 3.Now remove the panel on the driver’s side end of the dash. This will ex- pose to remove. 5.You can now easily access the retainer ar the lock cylinder with a working mechanical key. | am not showing a picture of the retainer because if you cannot find it, you should not be reading this book 7.Unsnap the center console cover and remove the conical shaped piece of the a.c. vent that rests in the top area of the console. We will need the room. SrA! ‘Okey Pro USA LLC 4 There are to remove the lower dash panel. It should be free to set aside at that point. in the top of the cluster i The bezel is attached to the top of the column shroud. Disconnect these attached parts and set them aside. 8.These 10mm head bolts are what all the fuss is about. There are 3 of them, screwed from the engine side into the rear of the dash | will try to show the orientation of the picture.9.Hopefully this illustration will help 10.1 gained access to each of the to visualize the locations of these three from these points, hence the Screws. removal of all the panels. SA 12. The bracket, target module, and remainder of the ignition as- sembly, are now separated 11.The Ignition module is now hanging. You can see the we removed. And 2 torx to re- a lease the Tar- mm G) get Module. 43.Your module should resemble 14.|f we know we are looking for a 64 QFP, we know it isn't on this side. Fortunately the this one. If it is terribly different than are not soldered. They are tension you might be on the wrong track. connections. You can pop the board upwards. < « « a 4 1 ad d ‘ 4 - “a a a ad « td a « “ = « om « s a % x 2 a a a a " 13 GM ©Key Pro USA LLC15. This is the reverse of the board. Our target device is a 2L87J aka MC68HC908AZ60. Both the Mask and the feet a ame mne)board. At the extended identifier are on the device. Many times only VTY least take a picture with yo! the Mask is and you must translate, See the Appendix oy) 17.Insulate and Isolate the device. | 18.Using your developed methodology, apply chose to use tack for this job but thermal ifting tension and hot air to remove the device tape has its benefits and limitations also, 2M the circuit. Set in a safe place to cool. Als 20.Insert tor. Clean the adaptor of any old solder or _—_the sol- flux. Apply new flux to the pads and the legs. dered adap- Make sure to orient PIN 1 correctly. Square tor to the itup. And solder the device to the adaptor. left side * socket of the ORGS. i} It only goes PTT in one way, don't force it. Connect the hard- ware to the PC. Start the sw. pee Okey Pro USA LLC GM21.Click the Select Type Button, then 22.Once you are set, Click the Green ‘Read Bute make selections as follows. C uration ton. If you don't receive any error messages, 4-MTRK> MC68HCO8> MC68HC908AZ60 ‘en Click ‘Compare to verify the original read. Fe Sopiupuaey EAE 23.Again assuming the Compare goes well, 24.Plug your TMPro in and Start the sw. then the next immediate step is the SAVE. EF No reason to select the module for this ther File> Save or Click the Save Button. vehicle. Simply Click Open File But- Name the BIN appropriately Glick the Open ERs Eee meme [ON Select your freshly saved "ORGS file. And the TMPro will auto SeS2R" detect what type : “BIN file it is and open your options 4 Screen for that sys- 25.The TMPro options screen looks like this. It 26.When you have loaded a 7936 into the gives us the details, usable transponder etc. If TMPro Hardware and are ready, Click the Pro- you load an unknown BIN file into the sw this gram Transponder Button. This pop up asks way, it will act the same, therefore this tool is if you have any currently programmed keys so (scm V°'Y Useful to sort BIN's sxx that the TMPro doesn't a or maybe figure out if _ overwrite them. Typi- you even read the cor- cally | imagine the an- rect file. If you haven't swer will aways be purchased the module, “No”. This would be the in the bottom left corner worst way to produce a “Module Not Active!” will duplicate BUtin safe cle piay My ener parts of the world may- “Ready” as | have pur- be its their only choi ce. chased this a la carte ie previously, ©Key Pro US ee ee a pance-ncacn a pe ic.27.The TMPro is now telling you that 28. This final screen lets us it has created a new file containing i mplet- the ‘aushoncer that you had loaded Bhow thet ‘ae in the hw, and that J it has named that Click OK and we have to one. file, “yourfilename” move back to plus TMPro.bin the ORGS to And it reminds you to rewrite the 2 rewrite the Tar- get Device. ™ device to com- plete the process. 29.Back at the ORGS, assuming the —_30.The BIN file should appear in the window. Now 8 ees 7 you can Glick the Red ‘W’tite Button Then OK. , Click Open if ™ ™ device type is still selected, Click O} EN Verify that “Write OK" appears in the bottom left File then select your new TMPro file. corer. All done. Start the tedious reverse process. Date: Notes: aS Notes: Okey Pro USA LLC cM 16Module Location: Varies (See end of article) Read In or Out: In Circuit | Original Transpond Usable Transponder(s): 7936 "BIN Encrypted: No : PIN etc in BIN: PL Clone Out or Convert BL | Keyway:HU10 —— og 1. From the passanger side of the 2.Remove the panel by hand vehicle, we can easily and quickly and set aside. The BCM i ady exposed for removal. Convers GM examples. Its characteristics included main example. At the end of the section,! _use of an HU100 keyway, early year range have included pictures of other locations! =2010-=2013, and originally equipped with have encountered on other vehicles. This __ the first generation GM flip remote keys. system was widely used, like many other a cm Key Pro USA LLC asonenepnhARaAsanennaneaddedatacaceccateeues3.Disconnect the wire harnesses, and move 4.Push two plastic tabs downward aside. They can only match one socket, and are all color coded, so there is no chance of recon. @l0ng the bottom edge of the BCM nection errors when we return the module. Then it slides out by hand. No Tools 5.The Board slides out of the box after youre- 6.0 is almost in the center o lease the around the plugs. You __ this example, however | have seen them on both can also see the label with the plug colors all __ sides of the board. It's the only 24C16 on the labeled board. Note Pin 1 orientation. See magnification 7.1 have decided to use the AR32,!con- 8 You will be forwarded to the op- nected the hw and started the software. tions screen for that device. The Paged Down and Arrowed over to the de- vice type; 24C16. Press “INS"ert. iN ©Key Pro USA LLC GM 189, My experience and knowledge allow me to feel 10.With all connections established and settings comfortable reading these in circuit without adjusted, we can 3-Read Device into Buffer, grounding. Do what is comfortable to you. Out of | Remember start at the lowest voltage setting. No Circuit is the safest in terms of corruption risks. reason to risk corruption with a full 5 volt setting. Pry ae eed beatae 11.Option 5-Buffer Editor, will 12.Should look similar. We stil need to verify it. . + . But for you techs that only have an AR32 cur- display what the AR32 just SAW iN fently, sho Pi) is sight there. With it and an OBD the device’s memory. programmer you can be done in 12 minutes. ae 2 SUM ete Oe eas l ee ee Ee PROGRAM DEUIGE PROM DISK PILE : 1 Pe Aa eo Me aa aa 4 JT a eee coe a eS ee Pia a0 BEE EER HEE: age sree) Pee lame Adis Steers Ae - CHANGE DEVICE TYPE eer ey erry 13.ESC back to the options screen and then 8 14.With a clean comparison, you can A-Save -Compare Device with Buffer. We are hop- Buffer to Disk File. AR32 prefers 8 charac- ing for a Green Zero Comparison Errors Mes- ter file names. Example: LAST8VIN.BIN at sage in the bottom right of the window. the end should be habit with all read/writers. Taga) S EPREPROM+ PROGRAMMING SYSTEM — US.9P | bc at (ee ay td Teor oa NSE ae Tree aay ee rene eet mete eae cy ae aone Ennoncs> [ue cHECKSUn Semi CONTINUE = PATH ST Le Phe VERIFY DEUICE IS ERASED EARS TCs at aaa Roar Key Pro USA LLC15.Hook up the Tango, and start the 16. You can then Click File then SW. Region USA> Chevrolet> Open. From that pop up select ze> 2008 (2 17.Assuming no error messages i.e. The Red ‘W’ Button will “Incorrect File Size” or “Check File” display; write the transponder in the the options screen should display like this. hardware to the selected key 5 =~» &@€e & aa the ; : so Magnifying ¢ = o © ects identif onder in eee al SES the hardware, ie. “That's = be Key #1”. And oes ’ . the Blue “i” Button will di Bette ce o play any important info in 4 the BIN, i.e. “Pin 4642”. a 19.The reminder from the Tango and Click the ‘W’rite Button. The Save As pop-up ‘ appears and give you the opportunity to name the that the device must be rewritten to new Tango File containing the new transponder. complete the process is standard. ‘Tango has generated 4 Mew fire b7is8177eango bin To complete key making the wenory content of the immobiliser mist be replaced with the new To ekente more keys use the new fig. | Key Pro USA LLC om 2020.Back at the AR32, option 21. Arrow over to the Tan- Then Al go file, then F3 to Program. BAMA view all the files 22.Then with the 23. F mming Complete in Green in the aa ae till intact, P2tom tight comer means we are all done: ardware and settings st Intact. Return the Module and test your transponder. a = a a a a a a « “* ag eg « 2010 Buick LaCrosse , ew Fuse pan- el unclips Key Pro USA LLC 3 538980090000000082013 Chevy (Drivers Left K x be g 2010-2013 2013 Malibu Circuit Board, Note Chevy Camaro EEPROM is on reverse from pro- cessor side vs Cruze example i 2012 Chevy Okey Pro USA LLC GM 22KEYPRC@ Hi Oh IDA se At A Glance. Documented Date: 100915 Device Reader: AR32 Programmer: Tango Target Module: ICU Module Location: Base of column behind panel Target Device: 93C46 (8 SOIC) Read In or Out: In Circuit ‘Original Transponder: Mega 13 Usable Transponder (s): T5, TK5551 BIN Encrypted: No PIN etc in BIN: No Clone Out or Convert BIN: Clone out Keyway: HD103 If you use a reflash technique to program these it requires a Red Key and Black Key and additional programming though the OBD Il. With EEPROM work, merely pull the data off the device and you are done. 1. The Target Module for this unit sits under the dash almost directly in line with the steering column. You have to pull the lower panel and you will see it on the column, 2. Remove the single phillips holding This Panel on then set it aside. You should now be able to see the mounted to the column. =) ‘This system was only installed in three used again after programming it could erase all the data. It will at the very least put it back in ‘Program’ Mode momentari- mothod of transponder generation re- ly. Once done via quires a ‘Red’ programming key as part of to revert back to the OBD procedure and ifthe ‘Red’keyis Red/Black Key programming. Honda ©Key Pro USA LLC aa bnnhAdbhddddddddddddddddadaaaaadadeedeeeedPBSBSSSSSSSSSSESSSSSSSSSSSSSSSSSeeeeESeSeeeeeve 3. Here is the underneath, it is held onto the column with two 10mm head bolts. Release the box then disconnect the two 5. You can always read this as a ‘93C46' device but the device itself may have a different identifier on it. As in this example it reads as a Prepare the device by removing the red tinted lacquer with acetone or a fiber- glass brush. this, with in the top left and your hardware settings displayed along the bottom ‘Okey Pro USA LLC 4.Once you remove the two plugs, with box in hand, you can pop it open. At this point you can locate your target device, a 93c46 or equivalent. IHONDA LOCK MFG. CO.,LTD MODEL:HLISi0 ISC:ASS/CNR210 6. Connect the AR32 to the pe, start the softwai find the device. Looking in the serial EEPROM: 93/95 series you wil find Use the ‘Insert’ button to s he device in questio 8. Verify that the series of are set correctly, and also the te vice connected to the left ¢ Brown wire to the right. Honda 29. The AR32 is now set. Pomona Clips in place. Now from the AR home screen select option The lead going into the Pomona goes onto PIN #1. The PIN #1 location is always in the bottom left comer as you read the markings on the top of the device The device may have a ‘small indentation show. ing PIN #1 location. The Bag red dot here indicates it ara 11. Once you hit “Y” the process is so quick the screen doesn't appear to change. Let's see if we got a read though. Option 5 Buffer Editor, should display a screen like this. Ifit displays all FF’s or 00's recheck you connections and settings. Can you find the key strings? rrr rrr BERCerentcy 3 PreePeerristiit) 3333335: PEEPeEPRreeeeiac PREP Peeerents ieee FI 13. Once we have a verified Read, Save the file im- mediately and that can be easily located later. Customer names are not my first choice for a file name but will work in a pinch. 3 Honda < < “a 10. The question that appears at the bottom of the screen is “Do you want to start reading at the | beginning of the file?” For us always yes. For other industries this is a useful ability of the AR. : « a a a ‘a a a = x ms « 12. We must verify the read before saving. & Hit ESC to return to the AR32 home « screen and then Option t = h Buffer, aka “Reread the device and “ make sure what you just read matches what you currently have in the buffer.” . a il a @ 14.Hook up the Tango> Region Asia> Honda> Cars Civic> 1995(93C46) Note the discrepancy oq in Year and Model is because of regional differ- ences in the Tango's Customers. UK vs USA etc. OKey Pro USA LLC15.Now that the vehicle is select- 16.Select a Black Key Slot, Key 2 or 3 in ed, Click the “B’lue Open Immo _ this example, there is rarely a reason to give s the customer a Red “Programmer’ Ke’ File Then your AR32 file, : 2 y => «ase ~ AEE 17.Place an acceptable transponder | 18. There will be no reminder from the Tango to rewrite , the device because it isolated the key string in the BIN in the Tango, TS is the cheapest op- J File and wrote ito the TS, so nothing changed in the tion, and Click the Red “W’rite Button. 8!N. Retum everything to the car and check functionality. — You can write more transponders in the future from the BIN File without removal, assuming the car has not been reprogrammed. Should you need the OBD port on the Acura RL, see below, as it is located in an odd location. Notes: — Date, Notes: — = 2 » D> =) > => =) = = =) =) >) =) =) > 2) =) = » = - - -) -) A a a a > A a “a 2 2 2 > 2 2 2 2 2 2 2 2 2 2 2 2 2 a a 2 a A a a a a a a a = 2 2 a a a = - a a a “ 2p Okey Pro USA LLC Honda9 For this 10.We are ready to apply our hot air. Circle the desoldering I have chosen to use device and watch for the solder to liquefy. Then to isolate and insulate the device. Slightly more lift the device with your choice of hand tools. expensive Don't drop it than poster tack and re- ally only one time use, itis easy to ‘apply and remove. Great for straight line work 11.Once the device is removed from the ci- 12. This is the EEPROM adaptor board: cuit, | suggest ting it into the for for the TMPro. We have a 24C family the programmer you will be using first priori- eeprom so we can use any of the 24C ty. You don't want to drop sations that the device will fit on this ti 13. My clam shell adaptor inserts into the DIR. 14.With the device installed, connect connector like this. PIN 1 to PIN 1 orienta- the adaptor to the TMPro hardware tion throughout Make sure not to accidentally TMPro usb to PC. Start the SW. ~,zc, AZ RARBARABRABAARAARARARARARAARABAABAAAAAAAAAALUU UFO eee SECU CCC Cee eS 15.With all the connections estab- lished, and the sw running, Click the Select and Read Memory device button. Place the cur- sor over the buttons mo- mentarily to see their de- —mmmer= | SCriptions. aeeace 17.Once the TMPro reads the device, it will auto identify the BIN and display the options screen for that system. You can see it recognizes the Honda But the bottom left purchased this capability. But | can still read the device with the TMPro. All modules are a la carte with the TMPro system This module is das #104. SAVE the BIN 3 right away. 19.From the |KeyClone home screen we go Utilities> Key Generator> Key By Dump> Honda> Odyssey> ID46 24C04 aPre i ie: Pe Try ‘Okey Pro USA LLC ea ei 16.The device selection pop- up should ep Eeae Scroll down “and select the device type, 24C04. Then OK on the next pop -up to |——=— 18.As usual, select a searcha- ble and/or organized file ~ name. Date ~ or Invoice “number may work if _ your volume : 3 <= isn't too pene ete high. Pie 20.The options screen for this vehicle should come up. A few more details and models listed, but most importantly the Ope: n Immo21.Click the File and Open Op- tions, and then select your Pro saved file. T ri — Cee Few | 23.1n the bottom, left corner select a key slot. In the bottom, right corner select either a CN3 clon- able or Generate New Key which is the 7936 se- lection. So you can either clone out or convert. ". That's because the IKC needs you to Click the Save button and name the new IKC file a a Honda 22.The IKC accepted the file and we know this because the conversion option buttons illuminated along the bottom. 24.1 chose Generate New Key, and used a 7936. This. conversion of the BIN will require rewriting the device. Had | selected the slightly more expensive route, and cloned a ‘on3 out ofthe BIN, the rewrite would not be needed. Note middle left TP Generated..0K is IKC speak for “done.” as wf =| ==. 26.Return to the TMPro software, Click the Open File Button. Module 104 Honda info 8 should load up if the TMPro recognizes the & file. The final step is 8 Click the Select and === aati Write Memory De- vice. 24C04 and OK. The status bar along the bottom should fill, just like | your bank account in a few minutes. Reas- semble and test. : —> ©Key Pro USA LLC osgagaaaaaPRO& ISUZU Removal ALA Glance, Device Reader: AR32 Target Module: ICU Target Device: 93LC46B (8 SOIC) Original Transponder: Mega 48 BIN Encrypted: No Clone Out or Convert BIN: Conversion Isuzu was in trouble in its final years bu al immobilizer systems to two of its ve PIN. At this time, acquiring that num folks. Lets have a look at this pretty sin 1. The presence of the black ring, visible around the metal face of the ignition, is the indication of the op- tional immobilizer system. Have the customer look before you drive out so you will be prepared. the PIN for one of these,! difficult to program via the ©Key Pro USA LLC LLLLLARERRRRRRER ERE she went out w Documented Date: 092615 Programmer: ZedBull plus EEPROM Applications Module Loc n: Above the Gas Pedal Read In or Out: In Circuit (Grounding Required!) Usable Transponder(s): Mega 48 PIN ete in BIN: PIN Keyway: HD103 s right at the end. Its securec d ber is getting difficult. But it process 2. Just above the the target module sits ina bracket. One 10MM bolt secures it on the top edge. Two small plugs need disconnection OBD. I find it just as easy to do them via EEPROM and have found that they canbe more successful on the first attempt. Good Luck. Isuzu 13. Here is the immo box on the bench. The lid 4 Biiiao0 not protect yoursel bY eg fips up and open. Removalofthe board from ‘eslseng shoring he oir We are abut o exe nally power the the MCU powers during that the box is difficult and unnecessary. : \ , the NCU can send a random command and corrupt the BIN. 5. Solder a bridge between either point 6. | chose my points and applied a small bead of and another point or This _ solder between them. You should feel safe us- shorts the oscillator which stops the MCU from_ ing this technique, however desolder is the saf- sending out destructive commands. est should you feel nervous about the in circuit. 7. Now we are prepared to read the target de- 8, Verify all switches, including setting, and the Pamona/ribbon cable is vice. Open the AR32 software, PgDn and arrow scroll over to our device type then Insert. You _ plugged in to the Left position and the Brown can also type “93LC46B" and press enter wire is to the right Brown wire to Isuzu Key Pro USA LLC PPPTTTTTVVVVVTVTVTVIVITTV VY YVYYYYYTTV lly yyy9. AR32 is set. Pomona Clip is in place and the (10. The question that appears at the bottom of to itself. Fromthe AR __|the screen is “Do you want to start reading at the home screen select pption beginning of the file?” For us always yes. For 7 lother industries this is a useful ability of the AR eee! 14. Once you hit *Y” the process is so quick 42 Return to the AR home and the screen doesn't appear to change. Let's see if we got a read though. Option 5 Buffer. Option to verify the Editor, should display a screen like this. BIN. Always “Y” Read from the a ae what\we are looking for. as ere eet ee cee moeec 13. Once we have a verified Read, Save the file 44 ets take a moment and return to the buffer immediately. and that | the only EEPROM equipment you have is a can be easily located later. | don't suggest Cus- reader. AR32, Orange 5, MiniPro, Wellon, you tomer last name for security reasons. can remove the bridge and return the box. In > eal] this system the pin is in plain language and in a usr 3 static location, always at 75 and 76. Program via Pe ‘ the OBD with the found PIN, 3651 rrr eos aT aN Pat) Lx aera it Ae a, Okey Pro USA LLC45. Connect your ZedBull (ZB) hardware to PC and 17. From the Open File pop up> Double Click your newly start the interface. The Top Right Tab; Extended S2ve4 ‘AR32 file. In this case, Last 6 of the VIN Funetions> then EEPRt i 44601317.bin. If you are familiar with cloud data storage, | EEPROM MCU Applications. ‘suggest storing all BIN's there to protect against PC failures. 16. From the pop up EEPROM MCU Applications screen click the Open File bujton. You can also browse the ZB's EEPROM capabilities from these 2 drop down menus. 19. With the ZB programming a transponder to the BIN is a 2 click process. Step One, is the Button Here, Transponder Programming. This doesn't mean program the transponder to the BIN. It represents preparing the transponder for acceptance to the immo sys- mx tem. Place a Mega 48 into the ZB ariel and Click S11 it. You Should get a successful message below. 48. Now our BIN is opened and recognized. What hap- pens if you click on the image of the Immo Box? Note The Key image isn't appropriate for North America, we have to look past small errors such as that due to reg Step Two, here, Create Image File, is a term — used frequently to mean Conversion of the load- ed BIN to include the transponder currently in the ariel eon ; F This is self-explanatory. imam 21. Next this pop-up. Add Key will insert the appropriate transponder data into the next 20, After you Click Create Image File, This pop- available slot in the BIN file. Note: There are up should appear. If there where multiple ac- only 5 slots in this system. Soo ove oy will ceptable transponders, you would need to erase all 5 slots and then you can return to Add choose. But here we have only one choice Key. Now that all slots are available, the ZB will - add transponders into the slots numerically 5 (¥ Imaj Menu =| Add Key Remove Key EURSpto Isuzu Okey Pro USA LLC one oo nhnngangggdddddddeeeggengaddee eee eeeeBUVUUEVESEUEUUUUUTESSGRRRGGUUEUEEEEeeeeeeecE 21. The final step before the ZedBull does its 22. Final ZB step. Verify your produced tran- Magic, is naming the file it is about to create. As sponder (Precoded) is in the Zedbull antenna always | suggest adding the Convertor'sname And then click OK. We will to the original file name ie 44601317Bull.bin return to the AR32 for the Py final steps of this vehicle. 3 SSS 23. Now return to the AR32 software, we need to 24. Use the arrow keys, scroll to the file that the Bull crea program the “Bull” BIN to the device, hopefully _@. Keep in mind that the AR32 only dispiays 8 character still all connected. Option 1 Program Device from _ fie names. New file may appears as °446013~1 bin’ vs a ae *44601317Bull bin’ But if you locate the Original BIN, the Dei Eles then ALT D) to view the files Bull BIN should be the next one to the right. 25. From the file selection screen, hit/F3"fo pro- 26. Assuming you get the Green Programming gram. The software returns to the home screen Complete message at the bottom, you are done. d ‘Any Red Errors Found Messages means revisit all settings and connects and try again. Don't for- get to remove the grounding bridge from step 6. Return everything to its rightful location and test transponder function. These vehicle are becom- ing increasingly rare but if you are the tech that's prepared, you are the tech to get paid “Okey Pro USA LLCKEYPROG JAGUS Re Model Documented Date: 011716 Reader: SMOK Programmer: Tango Target Module: Cluster Module Location: Instrument Cluster “Target Device: OK7SE, 0L26M (112. QFP) Read In or Out: In C (Original Transponder: 4D60 Usable Transponder(): 4D60 BIN Encrypted: No PIN ete in BIN: No Clone Out or Convert BIN: Conversion Keyway: Tibbe 6 Cut past, and for unknown reasons, I personally have had issues programming this system thru e OBD. Fortunately programming a key thru EEPROM work is relatively easy and gives us the antage of not having to erase the existing keys, as is required by the OBD programming. One nat I worked on recently, could not be powered up with jumpers or battery boxes however this was not an issue when progr following these steps. 4.Here is an interior view from the pas- 2. Start by unsnapping the trim around the senger side. We need to re ne instrument cluster. Shouldn't need more: gauges to access the Targ > than a small flat head. The immo system on this ve- taken into account. This is a hicle is relatively easy to Tibbe key, so be prepared to work on,howevertheme- cut the key before taking the chanicalkey mustalsobe job. They impression easy. 1 Jaguar OKey Pro USA LLC ween pnnnhndddddddddddddddddeedeaeeeeeeeeeeee3. Set this layer of the trim to the 4.Remove the 4 Philipps that side, itis thin and you could also secure the next layer of the trim. damage the vent pretty easily. 5.Again set it aside for 6. The final 4 Philipps to remove secure the Target Module in place. Be gentle as the P Jear ft ar safe keeping. clear fronts tend to get brittle over the years v 7. Tilt the cluster outward 8And you should be able to ac- cess the two plugs that must be as much as possible. disconnected Jaguar Okey Pro USA LLC10. Remove the Torx screws around the perimeter of the cluster. 9. Front and back views. 12. There are of the cluster to re- place that airt cannot contaminate it badly. move. Careful not to move the = a needles. 11. The back half of the cluster should now separate from the clear front. Set it aside in a 13.Now the back of the target 1 4. Our target device is module should separate from the ae almost dead center on ees the module. 3 Jaguar ©Key Pro USA LLC. ou napaannannnaagagagagagaaaggagagagagagaaaaeRE Oo ee 15. From this closer view you can see the 46 Keeping IMEEMthat we have a port on the Think of it as the OBD por for this module, These ports usually provide D020: | look to the SMOK help files and us with a straight line of communication to the main de- Match this diagram to our device using the vice in the circuit Motorola Mask. In this case, OL26M equals c MC68HC- 7 912D60. With this knowledge, we can use a |. Ohm Meter to track down our solder points on the port. di7zall start with one énd i the meter on the leg identified in the diagram, then probe each one of the points in the port. There should be zero resistance be- tween the leg and the point. » In this case the probing result- fed in these McBaHCSTZOTI28A 18. Here is one final vi view with the leads sol- 19. From the SMOK select device menu, dered to the circuit. Connect the other end of | \MCU> Motorola> MC> HC12> UNSECURED> the adaptor to the SMOK hardware then the — EEPROM> MC68HC912 EE UNSEC usb to the pc. Okey Pro USA LLC er A21.The current status is displayed and updated 20.Now click the Read button, with every step in the dialogue box in the bottom left corner. Click Verify to confirm a good bin file and if all is done correctly, the bin file will appear in the window. was read the first time and matches again file Will ApPe A NS WOW TT Asents tent 22.Assuming you recei 23. Connect and start the Tango sw. Under ; region Europe, select Jaguar> X-Type pen OKmessage, (MC68HC912). This large family of MCU’s is ly click the Save button. commonly referred to as 912's. = So. 24. Click the Open File Button 25. Our only two options for this system are and locate the original SMOK into the file or the magnifying glass button, which identifies if and gag where a transponder is located in this file binary file. rrevarediy' ; peo ©Key Pro USA LLC26 I select a key slot appropriate for my customer's situa» 27,.Next pop-up, after clicking save, is the tion. Place a usable transponder (4D60) in the Tango, _ then Click the Red"W'tite bution, Immediately after this standard reminder from the Tango that the Pop-up will appear requesting you name the new bin that + device must be written with this new bin file. contains our transponder. 28. Return to the SMOK, Click the Open File 29. The red status bar along the bot- button and select the Tango produced file. You can follow the progress in the bottom left window. to scroll and should verify it’s success. Date: Notes: Key Pro USA LLC Jaguar .[ae A Glance. | Device Reader: Orange 5 ‘Target Module: ICU Programmer: Tango rake Pedal | Module Location: Above the B | Read In or Out: Out of Circuit es Device: 3D33} (52 PLCC) | Original Transponder: Temic 8C | BIN Encrypted: No PIN etc in BIN: OBP Word Code ‘or Temic TKS561A Usable Transponder(s): Temic 8C. Clone Out or Convert BI 1. The presence of the immo equipped vehicle can be determined from the passenger window. “OFF, ACC. ON, IGN” in black plastic means immo equipped M Keyway: MZ31 2.The immo box is located on the back side of the lower kick panel on these cars. Usually the box can be slid off its bracket without any other labor. Worst case, drop the panel and remove it however with a practice, your doubtful perspective can changed. I will attempt to ate me techniques that have worked for me in the past. Thanks for reading. lazda ©Key Pro USA LLC SRR PAAAAAAAAAAAAAAE EE 004 0940000000040 0 0083. The normal routine would be to locate this Serial Num- 4, gp 27 and use software to transate it and then flow On- Not used much these days, and un- Board Procedures to program an appropriate transpond- fortunately must be desoldered to read with the Orange cr. But sometimes things go bad. Maybe we have a 5, Removed from its box, secure the board for solution, desoldering e 2 2 2 =) = = LC62 67 5G2B - Loeas sas sie = => = => > = on SiN sua 5, | use poster tack as an isolator and insulator. | start 6. Apply slight ling pressure under the comers of the my hot air at a low pressure setting and approx. 300C. device also in a circular motion, commer to the next and s From about 1 inch away I circle the device from atop _ on. | use a variely of home made tools and repurposed angle that blows on the legs. 2 second per side circles. ie. dental picks. Slowly it wil it as the solder iquifes a as ry aN Lola While the device coolsinajnon conductive, melt 8. Note inthe bottom, the adaptor necessary for leet proof location, hook up your ORGS and start the ‘soft. ing the device to the ORGS is shown. Locate the adaptor ware. Click the then Configuration> and insert the now cool 52 leg device squarely into the WAMTRK> Group MCEBHCOS> Chip> MC6BHCOSBS —_eft side as shown face up, pin 1 oriented correctly. Don't force it. “Okey Pro USA LLC9. Now that the device is placed into the adaptor, we are ready to insert the adaptor into the OrangeS hardware. Nothing should require excessive force to BRANGES5 eee attach. Therefore if there is resistance, step back and verify everything be- fore you break something expensive. | burned my first Org5 up with an improper connection the very first time | tried to Use it. Learn from my stupidity. We should be ready to read the device. 1 Excellent work. Notice the word code in plain language in the BIN? Osa reeEBee aos ‘S/N 6127449739= Word Co 13.Now it is time to open the Tango soft sure the hardware is connected. Asia> Mazda> 626> Make Immobox> 2000-Lucas 34AS (MC68HCOS). ‘34AS"is a reference back to the label on the Immo Box. Has | a } ey aeeegaetiey | | | 10. With all the hardware properly connected, click the The status of the read should be displayed in pop-ups and the dialog box in the bottom left. f you do get a read, before proceeding to save, click the button to verify the BIN. 12. Before you do anymore playing around or experimenting with this simple BIN file, SAVE ITI File> Save> Last8.BIN. Or the Disc Image. ————— == 14.Here is the data screen for the Mazda Module. It gives us some quick details. Click Select the file the Open Immo ‘F'ile Button you just pulled with the AA mm) soo nee ©Key Pro USA LLC <= < & = «= = “= x fe * ie x a15. Based on the situation Slots or write another 8C into the BIN file. Use of a clonable 8C will hot require rewrite of the BIN to the device, use of atypical ‘EC will require rewrite. At the time of publication, clonable 8C ‘aka TK5S61A, are hard to come by and relatively expensive, 17. Ifyou use a standard &C, this window will appear, ‘asking you to name the new BIN file that includes the transponder we are providing. Never over write your orig- inal BIN file with the new one. If something isn't correct you cannot retum to the start if you delete the original [gu HO Misc626.bin <<“ Original is precious. Flename — misc626tanga bin So 19. If the Org5 is still open and connected as it was at the beginning of this exercise, then click the up top. And Select the Tan erated file. Double Click. Sodcesusso ses Te ‘©key Pro USA LLC | 5. Mazda you can clone a key out of one of the 16.Select a key slot , Click the Red “W’ite Button. Then se- ect the usable transponder from these two choices in the pop up. Then “OK.” | image you will be using a “BJYV" factory 8C transponder. If you happen to use a TK5S61A, then skip to resoldering the device back to the immo box. a aes — ASCs 18. And of course, the reminder pop-up telling us that we must write the memory of the device with the file the Tango generated to complete the tran- sponder making process. Move back to the Org5. aa New Fe report Tango has created the new fle mic26ango bin Unload the new iletothe immobilizer memerytocompltekey || making To ceate more keys use the new file | 20. Simply click the Red “W'tite button with the hardware con nected and the device sil mounted in the adaptor etc. fan er ror occurs, check over/four connections and that the device has- int moved . Should pé straight forward. Then remove the device from the adaptor ag get ready to resolder itto the board Go to Appendex 1 for desolder/solder techniques. a _ 4YPRO@® [WA 7 Briere [Ata Glance. | Device Reader: Orange 5 | Target Module: ICU 1. The presencs of the immo equipped vehicle can be determined from the passenger window. “OFF, ACC. ON, IGN’ in black plastic means immo equipped. many would consider the de xing the easier of the two when compared to resoldering. I know many are intimi- Module Location: : Above the Brake Pedal Read In or Out: Out of Circuit hoa | Usable Transponder(s) 2.The immo box is located on the back side of the lower kick panel on these cars. Usually the box can be slid off its bracket without any other labor. Worst case, drop the panel and remove it er with a bit of practice, I believe a doubtful perspective can be changed. 1 will attempt to illustrate some tech- niques that have worked for me in the 5 Mazda ©Key Pro USA LLC APAPRAAPAAAPAAARAARAAAAAAD AAG EAG0000000000004DROARARAARRRRRRRRDRARADRADRR RARER ERR A eee 3. The normal routine would be to locate this Serial Num- ber and use software to translate it and then follow On- Board Procedures to program an appropriate transpond- er. But sometimes things go bad. Maybe we have a solution GEAT 67 5G2 tuoens 19ns $2010365¢ SIN $808148594 t a low pressure setting and approx. 300C. From about 1 inch away | circle the device from a top angle that blows on the legs. 2 second per side circles. 7. Hook up your ORGS and start the software. Click the then Configura- tion> 4-MTRK> Group MC68HC05> Chip> MC68HCOSB6 HHH Hit ©Key Pro USA LLC 4 Not used much these days, and unfor- tunately must be desoldered to read with the Orange 5. Removed from its box, secure the board for desoldering ihe board is already marked for device orientation 6. Apply slight lifting pressure under the comers of the d vice also in a circular motion, comer to the next and so Luse a variety of home made tools and repurposed, ie dental picks. Slowly it will lift as the solder liquifies. Let the device and board cool in a safe place before handling 8. Note in the bottom, the adaptor ne ORGS is show. sssary for attach- ocate the adaptor ing the device to the and insert the now cool 52 leg device squarely into the left side as shown face up, pin 1 oriented correctly. Don't force it9. Now that the device is placed into the adaptor, we are ready to insert the adaptor into the OrangeS hardware. Nothing should require excessive force to —— attach. Therefore if there is resistance, step back and verify everything be- fore you break something expensive. | burned my first Org5 up with an improper connection the very first time | tried to use it, Learn from my stupidity. We should be ready to read the device. GE5 4 Excellent work. Notice the word code in plain language in the BIN? Ova eBREOS S08 BA mon) sem) me 410. With all the hardware properly connected, Click the Green ion, The status of the read should be displayed in pop-ups and the dialog box in the bottom left. if you do get a read, before proceeding to save, Click the button to verify the BIN 12. Before you do anymore playing around or experimenting with this simple BIN file, SAVE IT! File> Save> Last8.BIN. Or the Disc Image. S/N 5808144594= Word Cod: 13.Now it is time to open the Tango software. M: sure the hardware is connected. Asia> Mazda Immobox> 1998-Lucas 19AS (MC68HC05). “19AS" is a reference back to the label on the Immo Box. este 7 Mazda 14.Here is the data screen for the Mazda Module. Tells us some quick details. Click the Open Immo “F”ile Button. Select the file you just pulled with the esas ea hhhhhddddddddddddddddadegagedee ee eeee ©Key Pro USA LLC15. Verify an acceptable transponder is in the j Tanager cee Cana 16. The toughest part of the job Button, There is no need rewrite thedevice - femMains, soldering the 52 PLCC because we cloned a key string out of the BIN fle. back in place. If you have come this far, you should have already practiced many times. So hope- fully it should be a breeze. See the Appendix for some tips and Youtube for more videos than you could ever watch on solder- ing techniques. Notes: Date: Notes: Date: Notes: Date: Notes: Key Pro USA LLC Mazda 8ee lle arcedes Rena A SITE FOR PROFESSIONAL = wd Ney A ‘ML300 1998-2005 ML Mix20 1998-2005, Miso [1200-2008 ‘Miso0 1998-2005 At A Glance. Documented Date: 110915 Device Reader: Orange 5 Programmer: Tango plus Software ‘Target Module: AAM or EAM Module Location: Engine Fuse Panel or Drivers Shin Target Device: 0G47V (64 QFP) Read In or Out: Out of Circuit Original Transponder: 7930 Usable Transponder(s): 7935, 7930, 7931 BIN Encrypted: No PIN etc in BIN: No. Not Standard Clone Out or Convert BIN: Clone Out Keyway: HU64 on-Tangos- nade our job interes ling. They are notorious in their difficulty and over engineering. This ex- jon. You have to pull one module to verify it is or is not the target module. Then once you have he Target Module confusion, you will encounter a 64 QFP, that must be read out of circuit. I plexity as best I can. Pay close attention gured try to jen we come to the fork in the road or you could waste a ‘past mistakes and follies. nd exergy lama 1.As | stated, you first need to pull the en- 2. The Target is located inside and under gine control, from under the hood. This _the fuse panel. Start by removing the cov- Target Module is calledan“AAM’. sc ‘ou will need a 120 driver next Probably the only two positive itemsIcan duced without all the labor in the future. say about these vehicle are 1)the mechani- These also have an issue with the immo be- cal door lock is surface mounted therefore with the module when easy to generate a key for. 2) This isa \d. With the BIN and the “Clone Out” system so once the BIN is ac- rat of phase key, you can remedy this with- quired, another transponder can be pro- ut sending the unit to the de: 1 Mercedes Benz ©Key Pro USA LLC 668888000404444444444444444444446444440686SUB U OUR U Reese s eee eeeeeeeeeeEeE 3.Remove approx. seven 120 screws from the top perimeter of the case. Some of the screws are retained in their holes, so just verify they are unscrewed. a 5 that contains the fuses and relays, straight upward. Once lifted past the bottom, 7. on the outside of the “L.” This one is typically Try to work the module off equally on the top corners, | have also seen the alignment tabs break due to crooked removal ©Key Pro USA LLC Mercedes Benz 4.Remove the back section of the fuse panel cover. Set aside but be aware there may still be screws hanging on to it. 6. along the bottom edge. Then you will need to release holding the Target Module, aka AAM to the fuse block and one - a es ei tich AT eens je A 8 There are no external cues as to whether this module contains the immo da- ta or not. Open the module now to find out.9.If the board looks like this, you are in good shape. 10.No red connectors, No Immo. The seven red circuit connectors are the giveawa i et that THIS module contains our data here. Return this module to Prepare to desolder and skip to-step 18 the car and move to the next step. ™, 11.Once the false module has 12.Remove the kick panel above the been returned, move to the interi- pedals. Couple plastic retainers and or of the vehicle a 2 Philips and it drops. 13.Directly above the gap between the 14.You do not need to remove the entire mod- brake and parking brake is the ule. Locate a Release the and slide it out, leaving the rest hanging 3 Mercedes Benz @Key Pro USA LLCBee eee FTF OE 15.Here you can see the EAM Target 16. On the bench, open the Target Module out of its socket. And its Module box and turn the board over. label. UM 17. Our true Target Device is 18.Now whether dealing with the here. is the Mask. Mark EAM or AAM, you should be pre- the board with pared to desolder the 64 QFP. le u ——= 19.Locate the forthe ORG5. 20. There are resistors on the surface of this part that | square the device up. And ther Kittel legs. Note that semi-permanently cover with tack sothatthey ne stall the RANGES MC68HC05> MC68HC705X32 a ao a08 (efre adaptors into the top of the OR- G5 hard- ware. And start the software 25. With hardware and software set, Click the 26,Assuming the BIN appears in the win- Green “Read Button. If you get any boot —_ dow, before anything else, errors or read errors, check the soldering and to verify the read hardware 5 Mercedes Benz Key Pro USA LLC27.With a good compare, imme- 28.Move over to the Tango. Region diately File> Save> Name the Europe> Mercedes> Cars> ML> ei- ther AAM or EAM for your situation BIN file in an organized way. AR vo = eo geo soe Petter na Sere ieee 29.1 strongly suggest checking out the Context 30 Click the Blue “F’ile Open But- Help for this system, before and during this process to verify you appear on the right track. ton. And Select your fresh OR- Lots of great info in there with images. G5 0G47V BIN file. 31.If there are no error messages and 32. Select the desired key slot, the “Write Buttons, key slots etc., illumi- insert a usable transponder into the nate, the Tango has accepted the BIN. Tango hardware and Click “W'rite. = 317 £4 By i “ian ae =a State me EE | a Bee | om i Okey Pro USA LLC Mercedes Benz 633. Of course you have sighed relief when the ORGS read and then the Tango recognized it, but the most challenging portion of this job is returning the QFP 64 Device to the circuit. Remember the ba- sics. 1) Clean the board of old solder, flux and lacquer. 2) Verify the device lays flat and square and Pin 1 oriented on the board before fluxing. 3) Use plenty of flux. 4) Solder a couple opposite corner legs down to establish the flat and squareness. 5) Solder the re- mainder of the legs with your chosen method. 6) Return the mod- ules and parts. 7) Check function. Immo issues on these are indi- cated with “No Start” in the odometer display. 8) GET PAID. Open the file in the Tango, just as be- fore. Place the previously working key in the Tango, Click the Explore Key Button. The Tango should dispi= and at the bottom ask if you would like to Scan and Fix an inoperable key. 2 See)” rn og the file ut also solve this phase problem in the future, and get paid for it all. 7 Mercedes Benz Key Pro USA LLC anaaaaaaaaaaaaaaaaagaaaaaaaaaecaceKEYPR@E ==. At A Glance. Device Reader: Orange 5 Target Module: ICU ‘Target Device: 1L02M, 4L52H, 0J66D (64 QFP) Original Transponder: Temic 12 BIN Encrypted: No Clone Out or Convert BIN: Clone Out This is a great introduction to a slightly m quad flat pack MCU. But fortunately it can multiple types of MCUs however the use one of these vans for a service vel Documented Date: 111415 Programmer: Tango Module Location: Behind Cluster Read In or Out: In Circuit Usable Transponder(s): TS, TK5551 PIN etc in BIN: No Keyway: MB17 EPROM" job. ith the O. Maybe 1.The Target Module is an ICU behind the 2 Start by removing the two screws instrument cluster. This is an easy modul to remove. All three of the listed vehicles are sister vans. So treat anyone of them as the same must be run thru the manufacturer syste! Okey Pro USA LLC regardless of the badging. They canbe pro- complicated in-code proce: grammed with aftermarket OBD equipment about the mechanical key generation, the however some advanced in-codelout-codes lin the top of the cluster bezel to this system and actually find his via EEPROM vers: MB17 service blank must have the majority 1 of the head cut off to check the igniti Mercedes Benz 83.Once the screws are removed, 4.The removed bezel, exposes the bezel can be unsnapped and two more T20 screws holding set aside. the top cover for the cluster. Aaéaédé 6. Unscrew the final two T20 that secure 5 # U nsnap and set the top of the cluster to the dash. The bot- aside the top cover. tom connection for the cluster is a hinge. 7.Pull the top of the cluster rear- 8.Remove the target module, and ward and downward. The is unplug it to take back to the easily seen and accessible bench 9 Mercedes Benz ©Key Pro USA LLC « “ « « “ « « " a q q 4 ‘ ‘ ‘ ‘ ‘9.The label of the Target Module 10.Remove the bac and on the bench. Visually verify yours then is similar before proceeding. securing the board into the box. 11.The circuit board removed from the box. 12.We need to check the ORGS before we Our is easily seen now. Re- proceed. Connect the hardware and start the member they can be different device types. SW. Select Type Button> 3-05 Immo> Mer- This particular one is 1L02M. cedes> Sp su [El =o : 13.In the ORGS sw Click Help> Chip Info. This will display the solder points for the adaptor. = = ©Key Pro USA LLC Mercedes Benz 1014. Connect the plug end of the adaptor to 15.Now we are ready to unsecure the device for , i reading. This Is not a step we do frequently but is thelleft side of the ORGASM MMaman: and necessary here. If not done you will most likely get a set of internal PINs, forthe left connector. gn file that blank or repeating junk data IE All FF’s : SRST ee 16.See if you can locate your mask in this 17.This process can take seconds to a few list. If so, choose it and Click “OK”. OR If minutes. Once the security bytes are acquired, not, as is the case with 1L02M, Click Scan, and you can save them for future encounters. | the ORGS will brute force the security bytes. save them identical to the provided files. 18.Now we are ready to 19.Once you get some semblance the Green “R”ead of a BIN file, use the the data. ee = Oee @@jepot sog OFe FaBaG)D sos peeay ey po Key Pro USA LLC20.With a good compare, Click 21.Moving over to the Tango with File then Save. Title the BIN our ORGS file. We go Region Eu- file using your normal system. rope> Mercedes> Cars> Sprinter. 22.That will open the options screen for 23. If er 7 : 3 . If there are no errors and the this system. Click on the Blue “F'ile Open “\yy"rite Button appears, the Tango has accepted the file. Button. Select the fresh ORGS file. 24.Select whichever slot you choose. Date: Really doesn't matter since we are Notes:_ cloning a string out of the BIN. Nothing _ Ke changes in the file and with this file lim- _ itless transponders can be produced in the future. Desolder the ORGS leads and reassemble the unit. The tran- a Dg A sponder should now read as Temic 12. Test the keys. The immo light on these is “Start Error” in the odometer but you did a fine job, so you will not see it. Key Pro USA LLC Mercedes Benz 12KEYPRO@ Merc edle wn At A Glance. Documented Date: 111715 Device Reader: SMOK Programmer: Tango Target Module: EZS Module Location: Ignition Module Target Device: MC9S12DT256 Read In or Out: In Circuit ‘Original Transponder: 7936 Usable Transponder(s): 7936 BIN Encrypted: PIN ete in BIN: No Clone Out or Convert BIN: Conversion Keyway: This version of the Sprinter is a bit more involved than its previous incarnation. The Target Module is more complicated to remove. The solder points for the SMOK are slightly smaller. So once you have conquered the Temic version, give this EZS based system an attempt. This is an actuated ignition system, so do not attempt to turn the ignition lock prior to programming. 1.The Target Module is the ignition lock 2 Remove two T20 screws module aka EZS. And it is surrounded yasbunch of screws and plastic from the lower dash panel. ‘Those vehicles using this immo system when you are done. The only addition: have a known failure rate for the | step needed is to read both the EEPROM tion module. With the techniquesyou _ and Flash date from the Target Devic: sec here, you will be capable of replac- will give a brief explanation on how to ing the ignition module and have ithe _achieve this when we get closer to that programmed ready to start the van Okey Pro USA LLC 13 \ O6666644064046464646464646440404b4bb bE EREERRREEHEEEEEE3.Remove the Small 4.Then the La 5. Now you can ac- Panel below the anel under the cess headlight switch steering column. to remove 6.Unsnap and remove the Bez- el around the radio and AC controls. Lots of plastic, _ told ya oN 9.This will give you access to yet an- other T20 screw in the gap between 5 the AC vent and the cluster bezel aside. It would be easy to break if you lean on it. ©Key Pro USA LLC Mercedes Benz10. Back on the left side of the column, 11.Thats right folks, Remove the cluster. It remove the T20 screw below the light "Snaps straight towards the rear of the van. Switch attached tolffiatepitint Suction Cups are useful sometimes to assist with this process. 12. Disconnect the single plug to the cluster 43. Using a small driver, or two, and safely set aside. The final T20 screw is located in the top of the cluster “cave.” nse ew the ignition bezel. 14.The Target Module, EZS, is 15.Verify that your example is now free to be unplugged and similar to this before proceeding. moved to your soldering station. _ Note It says EZS on the label. a € € « « « ( a 4 4 4 « « « « « « « « « « « « « “ « « « « Mercede Okey Pro USA LLC a2aeaneahe16.Using a small fiat head, separate the 17.Remove the back back half of the case from the front. Take care of the plug pins that come thru the half and set aside case. [Pius Pins = 18.Remove the t m 19.Here is a front and back view of screws from the front of the ig- the circuit board nition module Then the board Verify yours is similar. » and what amounts to the ig- nition lock will slide out the back. 21.This is what SMOK provides to determine where to solder the 20.If you open the SMOK help doc and go to HC12 then Crafter.jpg (a vehicle overseas that uses this system), you will find a pinout adaptor leads to. MERCI DES Sprinter 2007 EZS ©Key Pro USA LLC Mercedes Benz22. Here is a blown up version, 23.Here is even a closer view of my adaptor 5 soldered to the points. | use a small section for our sight challenged readers. 5 .peaker wire to ease the coax connection Fire up the solder iron. as it seems slightly more difficult to solder. AERTS | a Coax.'Gray, =, willis he Outside. — 24.Now connect the solder adaptor to 25. the SMOK hardware and the SMOK > Motorola> MC> HC12> usb to the pc. Start the software. Secured> q 4 q q « 4 « « « « a c « € € € € « « is j« \« « € € € € € € ® € « « « s € 4 £ & ‘ 8 a eee 26. With all setting stablished, Click 27.After what === the Read Button atus is in the dialog appears to be =| bl» . box in the bottom left SMOK even auto. a successful saves the files under a generic name inthe temple. teaq verify it with the aye eee a eee Use a file name you could remem: ber months Mercedes Ben Key Pro USA LLCPWBSBSSSSSVSSVSSSSVOSVVVVSVVVVVGGOGGCCeeUeCCeCCEEe 28, This system is a rare exception to the region selection on Tango, Usually we start with where 29. TNeEN Dodge> the manufacturer calls home. Mercedes is usuall Europe. But inthis case we choose USA to start Sprinter> 2006- (9812) 30.Click the File Open Button. —31.My understanding of this “Add Key” not . tested message, is to say that adding a key to And then Double Click the SMOK tne next available slot is in beta, but replacing file you just saved. an existing key is a solid function of the Tango 32.If you have an existing key, insert it into the 33.You will note that | added a key to the Tango and Click the Magnifying Glass Button, —_— BIN file. Even though it gives a warning, this will display its slot in the BIN. Place a virgin n issue addin 7936 in the aerial, select a slot, and Click ‘W''ite. ee Nad an iscu 9 os ns ‘ - eee “Okey Pro USA LLC Mercedes Benz a33.You will be prompted to save 34.And reminded that the device the new bin file containing the must be rewritten to complete new utranepondely in the Tango. the te transeemeen adding process. 4 5 =i e434 35.If you have made it this far, | have to as- J As | mentioned at the beginning of the section, if sume you have the common sense to re- J you ever need to replace an ignition module, turn to the SMOK and Open this new Tan- you will need to also copy over the flash data go converted file. Write the file to the de- from the original device to the donor vice, assuming itis still soldered up. Then desolder and return to the Sprinter. Re- member the ignition will not turn till a pro- grammed transponder is introduced to it. | strongly recommend che ion mul- tiple times as you start puttir dash back together. You don't w heck once and get done to find out a connection is loose. Everything is the same for reading the MC> HC12> Secured> Flash> MC9S12> EEPROM, but you must go the extra step and [J MC9S12xx256 FLS SEC, With both saved, solder up tead the Flash data by selecting it from the the donor and write the files to it. Offer another key to SMOK options. the customer since you will have the BIN's anyway. Mercedes Benz ©Key Pro USA LLCKEYPRO@ Sie ron PmoressionAt Locxsuns 5 Mic Mercedes Gheyster Mercedes At A Glance. Documented Date: 020516 Device Reader: Orange 5 Programmer: IKeyClone Target Module: ICU Module Location: Behind Instrument Cluster Target Device: 169} (64 QFP) Read In or Out: Out of Circuit Original Transponder: 7930 Usable Transponder(s): 7935, 7930, 7931 BIN Encrypted: No PIN etc in BIN: No Not Standard. Clone Out or Convert BIN: Clone Out Keyway: HU64 On Tango: This module is not terribly difficult to remove, however when you do get the modu! you will have to desolder a 64 QFP. It may have been the condition of m or maybe not, but in removing the target module, minor damage occurred. | the section so that you might not make the same mistakes. 4.The Target Module is located behind the 2. Start the process by removing the fuse instrument cluster. A few layers are be- panel cover on the driver's end of the tween us and the module currently. dash. the ignition cylinders. Make sure to ask the customer if they had key system or two ©Key Pro USA LLC Mercedes Benz 20is 4.Now the lower dash should drop down. Disconnecting all the wires is unnecessary. 3.Three Philips head screw: secure the lower dash in place. 5. As carefully as possible, un- 6.Here is the ariie This thin piece of trim broke on both sides. My snap the cluster trim from the example was an early year, so maybe this is less front of the cluster. likely on later years, but be careful either way. 7.There are 4 Philips head 8. The etcen should be free now screws to remove that secure __ to pull outward. Disconnect 2 lev- the cluster in er type plugs from it’s back. aE Mercedes Benz enh hhhhddddadadad raqeacaiaacecacaqetettes ©Key Pro USA LLC9. With the cluster out of the 10. The module is only held in with way, you can see the target ICU small plastic clips and there are two plugs to release. XY 11.Remove the board from the 12. Here is a slightly closer view, box. Make your pin 1 mark onthe 1D69J equals MC68HC05X32 board before proceeding too far. ES 13. I choose ff 14. Use your practiced techniques to use ther- and gently lift the device out of circuit. mal tape to Carefully let it cool in a safe location protect the F surrounding compo- nents. Don't be shy with the tape, it isn't expen- § sive and can save you tons of trouble. Key Pro USA LLC Mercedes Benz 2215 Locate the forthe ORGS. 16. to the board correctly. Apply flux There are resistors on the surface of this part that! square the device up. And then solder the legs. Note that semi-permanently cover with tack so thatthey do the ds are only only the few not get damaged from repeated heating pads between are 18.Insert the 64QFP adaptor into the HC05B plug. Re- 17.Locate HC05B/ reba hat a wig othe apo ered HC705B adaptor. La he re = See as 20.From the ORGS sw, you can in- |i stall the RANGES adaptors « into the top of the OR- G5 hard- ware. And start the software. , 23 Mercedes Benz Okey Pro USA LLC MC68HC05> MC68HC705X32.21. With hardware and software set, Click the Green “Read Button. If you get any boot 22.Assuming the BIN appears in the win- dow, before anything else, Press the Yellow errors or read errors, check the soldering and “C"ompare Button to verify the read. hardware. 23.With a good compare, imme- 24. Moving over to the IKeyClone, select Util- diately File> Save> Name the ities> Key Generator> M> Mercedes Benz> W140> PCF7935, MC68HC05X32 (immo BIN file in an organized way. Siemens) = . mererAe) 25. The IKC displays a very simplified info and 26. Locate and select the options screen. At this time IKC doesn't have ahelp folder such as Tango does. Inthetop ~Org5 extracted BIN file. right is the Open File Button. ©Key Pro U! Mercedes Benz28. If you do not receive any failure messages, the options 27. Place an acceptable tram- screens enoud display witha ite bt more info than te pe- vious screen. You can select inthe bottom let of the screen, sponder on the TRC aerial. ney siorinatyouwoulditke to clone out of the BIN In this case, a virgin PCF7935 ™ le ST 29. The IKC isolates the key string in the file and applies . itto an acceptable transponder. To verity all is wolt you 30. Desolder the device should dently heuansponderentiesenatas. from the ORGS adaptor, matching whichever slot you cloned out. ge ae and resolder to the circuit. Test your key functions and try to upsell that cus- tomer an extra key or just save the bitting and BIN for their return. Date: Date: Notes: Notes: a Date: Date: Notes: Notes a 25 Mercedes Benz key Pro USA LLC PIPPPPPPRAARAAAAARAAAAARRARReaaaaaaaaaaaaaaSSSSSSSOSSSSSVEVSRSSEVEeSeeeSeeeseessseeeeeee PRC@® NISSAN Model Years At A Glance. Device Reader: AR32 Target Module: BCM Target Device: L66R (8 SOIC) Original Transponder: Phillips 46 BIN Encrypted: No Clone Out or Convert BIN: Conversion Documented Date: 092415 Programmer: IKeyClone Module Location: Left of Drivers Left Foot Read In or Out: In Circuit Usable Transponder(s): 7936 PIN etc in BIN: BCM, PIN (Reversed) Keyway: X251 When the BCM number will not extract via the OBD, you look at the sticker on the module. What happens if that sticker is missing or damaged? Here’s a solution that doesn't require either num- ber because BIN conversion results in a programmed transponder. This is an excellent beginner ‘example, no desoldering, simple device and easy removal. 1. Here is a interior view of the dash area. Note the unmarked immo light at approximately 2 0- clock in reference to the analog clock. This section would be con- sidered a general guideline for any Nissan or Infiniti in the early year ranges of the Okey Pro USA LLC 2. The target module is located behind a small pan- el on the driver's side "A" pillar, behind the left foot rest. The cover easily removes for a better view. BCM conversion system. See the end of the section for ab- breviated descriptions of BCM Modules that apply. Nissan 13. The is 4. Remove the trim along the door frame and the black box with the white label. Remove the set aside. Then remove the covering the above the foot rest. BCM and the surrounding electronics nn ea 5. Unplug the three plugs going intothe BCM. —. See these enna ‘And if you choose to remove the entire bracket i, tabs? You can meticulously work the BCM etc securing the BCM, start be removing the Rea te ecxces eaorc ERENT OR 10MM bolt at the base. OR. 7. You can get a slightly larger driver and brake 8. Here is the BCM in its box on the bench, verify the plastic tabs by wedging the driver between _similarities with your module. Note the part num the box and the metal brackets, Do what works __bers etc, and most important to us usually is the for you and your customer ‘wun Ce Kas Co.9. Using a small flat head you can work around —_10. Here is the BCM circuit board free of its box the perimeter of the box and release the plastic From the help files of programmers like the Tan- tabs holding the back of the box on. go & TMPro, | know to look for an device 2) 11. Now that we have located our target device, A2. With the AR32 software up and running, ei- we can connect our AR32 to it's computer and / ther type your device in or using the PGDN and Start the AR32 software by double clicking the, cursor arrows scroll to the device type and hit “EPROM+" icon on the desktop. gm INSERT to select from screen 43. The device options screen should be similar 14. Verify that the series of to this, with L66R in the top left and your hard- are set correctly, and also the ware settings displayed along the bottom. tos vice connected to the left pc art and the de. wire to the right Okey Pro USA LLC Nissan 715. Once all the settings are correct onthe AR _16. Option 3 on the AR32 software, READ DE- hardware, attach the Pomona (Blue Clip) to the VICE INTO BUFFER, is the command we use to device. The brown wire on the ribbon cable extract a copy of the BIN inside the device. Press should go to pin one. *Y" to read from beginning of the BIN 17. Option 5 (Buffer Editor) shows us what was 18. To this. However you can see there appears just read out of the device. Click it and the to be no information here. Increase the voltage screen should go from this. and try to Read again, which | did, to zero re- sults. So desolder or try this. Option 5 z } I 19. Locate the that is dec 20. Flux the exposed legs on each side of the cated to the same MCU that our You fystal and solder a jumper from one to the oth- Patelermine this because all 3 will lose €f. This stops the crystal from allowing the MCU proximity to interfere with our device reads Nissan ©Key Pro USA LLCDRRRRRRRERERRERSSSASESESSASESAASAAAASAAAAA Aa eee 20. Reconnect the Pomona clip, and return to step 16. Read the device again. Hopefully the results of option 5 (Buffer Editor) will look similar to this.. ee, I 21. From the main AR screen, Lets select option 8 -Compare Device to Buffer. Self-explanatory title, the AR32 will reread the device and com- pare the original read to follow up read. 22. Upon receiving the Green Zero Errors Mes: sage, priority one is saving the BIN file. will save it to the computers drive after you provide a file name. ©Key Pro USA LLC 21. We haven't verified this BIN but do you re- member the to PIN conversion? Look closely, use your imagination to see if they're here in the file “48F96=1792) 22. If all is well you will receive a GREEN Zero Errors Found message in the bottom right. If you receive a RED error count message, adjust the clip ete and try again. Green is Good. 23. Now attach your IKeyClone to the PC and start the supporting software. If you haven't used the programmer in a while, don't be surprised if, there are updates needed. Always improving Nissan 523. From the IKC tabs select Utilities> Key Gen- 24. The Keymaker window pops up and gives us erator> Key By Dump (aka BIN)> "N’> Nissan> _a few more details about the system. The top Then ID46, 93C56/66. This is because we know sight File Folder Button is used to select and open a BIN file. we have a 46 transponder and 93C66=L66R. sate oe 25. Locate and open the freshly saved BIN file 26. The “Dump” bar up top show what BIN file is from wherever your AR32 saved it. Typically this opened currently. Towards the middle we can is in a file C:/EPROM. see the total keys, PIN and BCM. On the bottom we can either Clone a key to a CN3 or Convert the BIN to include a New Transponder. 28. Place your favorite brand of unused key blank here or just the transponder if you are us- ing a key shell. Must be a virgin PCF7936, in either case. Nissan ©Key Pro USA LLC29. With the appropriate transponder on the hardware, and the Slot Selected, Click the Gen- erate New Key button. The TP Generated... OK message in the dialog box means success. OATES 31. Now return to the AR32 software, we need to program the “IK” BIN to the device, hopefully still all connected. Option 1 Program Device from Disk File., then ALT "D" to view the files. 30. Now Click the “Sv 4s" button, top right and select a file Saree tu searchability. | just add the programmers name to the last 8 file =. 32. Use the arrow keys, scroll to the file that the IKC created, keep in mind that the AR32 only displays 8 character file names. New file may ap: pears as “4m8185~1.bin” vs “4m818508IKC.bin gram. The software returns to the home screen and required “P” fo proceed programming. “S' cites 3 pe ca ® EE Okey Pro USA LLC 33. Assuming you get the Green Program: Complete message at the bottom, you are done. Any Red Errors Found Messages means revisit all settings and connects and try again. Don't for- get to remove the soldered on grounding jumper from step 20. Return everything to its rightful lo- cation and test transponder function. Probably not an everyday situation but probably big bucks if you are the only tech with the tools and more importantly the knowledge. NissanDate: Notes; Date: Notes: Date: Notes: Date: Notes: | THVT T PUTT VV ATUA TUCO RULUCLLL LLL LLLELELLLL Nissan ©Key Pro USA LLCP AtA Glance. Device Reader: Orange 5 Programmer: Tango Target Module: Antenna Module Locat Around the Ignition Lock ‘Target Device: 'MS370C002 (44 PLCC) Read In or Out: Out of Circuit Original Transponder: 4D60 Usable Transponder(s): 4D60 PIN ete in BIN: No Clone Out or Convert BIN: Conversion Keyway: X251 This particular unit was seen by 3 locksmiths before I received the call. They had all tried various OBD Programmers, both legit and other. I attempted with all of my OBD options. Everything failed until I performed the following procedure. I was paid well, as you should, if you succeed where many have failed. Hope this helps. 1.0ur 2, Remove around the ignition lock. It is easy remove. the column shroud. And then access the single bolt that se- cures the antenna to the lock housing, See the next image for more reference. Another note about this partic- type. The pins from the OBD do ular system is that many ODB_ not follow our current stand- | programmers cannot com- ard, therefore causing issues | municate with this antique for modern programmers. Key Pro USA LLC Nissan A3. Here is another angle with the 4.And there is the bolt. It is a Philips and screwdriver in place to help 10mm bolt head. However, | couldn't find . F an angle that will allow a socket to be used reference the bolt's location. 5.Other than the single bolt, nothing i and our Tar- else holds the module in and the igni- get Device is immediately visible. tion lock doesn't eae removal. ips in the form of a 44 Leg PLCC 0 this is one i of the easiest of the mod- ules to get in a hand. Great wot! to snag at the pick-your- own-parts lots. 7.With some research, you can de- 8.Use your practiced techniques to desolder ferminethatthieleaclexas Instru- ‘244 Lea device. Remember to insulate the surrounding components. Mark Pin 1 or take ments TMS370C002. But by look- a picture ing this sys- tem up in the Tango soft- ware prior to the work, | knew what to expect. Asaeereaann Sah EEE 10 Okey Pro USA LLC APPPPRPRRRRARRRADADADAH 8888 98480neeeeeeeeeee