KE) KE Y KEYPRC@INDEX {EYPR Fa SE armen seein casera scauiteertaaece Eon pac open ae, Soares onan tageeieeea crete rot to wrk th he processes shou whe putaon "Me YouRozneo Wie offer NO support fortis type of work, we donot end ‘ Work, we donot endorse no support any ofthe equipment shown within these pages. The toms we use in this work is shown hore meraly as & guidance on how io proceed to accomplish your goal of producing a working product, The etnies used inhi and fate sbeaons ae shown mer kato are shown mere guid to you the reader to.ghe yous star on how o sete tos shown hi ao show you hewi nderana ee tems presened, Ther are many torent prs lola can bo wes beyond oon sho Those shown atest what we cet se ards by no means an endorsement of hee prot ‘4s you ler and move fxwar you wil starr thos ods and ecu at i werk Sat yeu Pease send all correction notes and suggestions to [email protected].| have a current policy of only adjusting year and models to imme type, based on personally secing them. Therefore plasee do not see me notes such a 2008 ‘Mercedes is so and so system" Your assistance wth corectons will geal help me improve futwe editions forthe Industy. Thank You, ‘Skills ‘Thete are certain skils you should acquire before you ate o get into this ‘yp of work. Among them ae Identeaton of Transponder types ‘You musthnow the various types of tan ‘ponder (chips) out there and how o identi them. There relationship o eachother and fais, EEPROM Theory “Theres book by Jeremy Philips tat wl greatly hep you along wth this. The purpose and use of Binary Files. Knowing and dentiying the locaton of Pin #1 ‘These are but afew ofthe examples Computer and tools Know howto use, identity, and how to save fies to your computer. Soldering = This requrementts fest and foremost before you proceed to yng todo EEPROM work. You must know howto take devices off and sucestflly put hem back on ‘working order. We suggest you work wth remates for cars by aking the devices of working re motes, puting them back onto see tha hey continue to wor, Is good way to practice, Another ‘would be buying a cheap calculator and doing the same ting, But tis imperative that you can do these skis wel Model Reference - _Onthetolowing pages we wi ist an indo ofthe mas by tree rode! Year Reading device, wheter ks a dec read or conversion. The dtc factor and he pages tobe found en ‘ekey Pro USA LLC IntroductionTable Of Contents ‘outa ‘aust Model sx ae x6 xs xs Years) ( ficatcs 199705 1996.04 2002055 2001055, 2005509, 200808 2007 2000.05 200807 Rea ana2 Anse Xrog, ana2 ‘smox. orange 5 naz aso ‘smox nso. anoo. Koo Koo ssmox Koo Not Standards oe Tango Tango Tango Tango Tan Taneo Tango Tango Tango meyCione Table of Contents Removal Reading ofTarget of Target Removal Reading Romuewal Reading Roading. Key Pro USALLC Page: veg28 vag 45, vag26 emw7 Bmw mw a mw 7 enw 7 enw 7 emwa oma. emw7 enw a mwa ew 7 adc a 2a o 2 2 2 2 =a 2 a = = =@ a = AdddMAAAAAAAAAAAAAAAAAEEWUVVVFVUVUT TUITE EEUU RUE URE EUESELUL LULL ee eee ‘Table Of Contents MAKE Mode! Bmw za Bmw 2a Bmw 2a Buick Lacrosse adie catera cate Ts caattae Ts Cchovlot camaro Chevrolet craze Chevrolet Equinox Chevrolet HHR Chevrolet Impala Chevrolet Chevrolet ‘chevrolet Pick Up ‘chevrolet Sonic Chevrolet Suburban Ccnyster 300 Cchyster 300 Cchryster 300 ennyster Crossfire Cohnsler Concorde okey Pro USA LLC 2on1a3 201013 2006095 200507 2013 2006095 201213 2006005, 1999.00" 199900" 2006 2004 1999.00* Read/ aKso Ko ‘smoK Orange S naz ans2 ana2 naz ans2 naz naz orange 5 naa naa naz naz orange 5 ‘smox orange 5 ans2 Converter MeyClone Tango Tango Taneo Tango Tange Tm Tengo Tango Tango Tango TMPro Tango Tango Tango ‘KoyCione Tango “abe of Contents Removal aaa Ramat Removal Parsarad Pomerat Romovnl omen Roading Readlaa Roadie Reading Fanuiaal ew 7 eww 4 oma7 oma oma7 oma oma conny cone conny23 ma20 cones ee41Most models ised first require tho lower Kick panel tobe removed, The Target Modules usu fal located on the river's side “A pila, 610 10 2S in place, we can already tei’ EWS4 because ofthe white abel with black writing EWS3 has green text. (8 10mm) secures the EWS4 in3.Here is the module on the bench, 4.Freed from the box, here is the ‘Same socket, same off white plas- board, Our Target Device tic box but black text reads 2186 S.Ifyou open the SMOK Help identy, clean, and | usually presolder Files, search EWS4, this solder 2 bitof solder to each pon. Then soder aa points image should be found, ‘colored lns othe points. 7 ttl preitresear ctor renee Seria een ee ees poraeeetes Pecsirieuacnc nas aeSave Save Save. File As always use a 10.Now we need to open the file in the 41.Click the Blue le Open But: 12 Mak sxe aa ton, then the ORGS Meine he ov ws ~ eee hat happens isthe Tango isolates the transponder the fat me i tuned tion. Ths fe when wl lock and then art to rl myn wt the vehicles memory. Shs exlans why we only have to etract the BIN once but a0 cannot cone the transpond: fers. Vth that saved BIN you wil ever nave ‘ura the fe again and ean also produce ‘more wansponders. Tis also gives us the abi ‘ty to ovet de postions in the BIN with new traneponders, an option the dealer eannat fer 13.Watch the money go into your Ts srs bank account, and then return the {,2 parts and test the key. « ee ee ‘exer PoUSALLE owe : UUVIVITIVITI TIVITYiste fst require the lwerkick Stil in place, we can aieady tol its EWS4 anelicbe removed. The Tage! Meas is vsu- because ofthe wile label with black writing ‘aly located onthe vers side pila, Go 10 EWS3 have green text. sesso) Sa (Gor 10mm) Sem vs the Conversion purey to clalty sloned aut ln ammorecentondnet ‘Okey Pro USALLG3.Here is the module on the bench. 4.Freed from the box, here is the ‘Same socket, same off white plas- board. tic box but black text reads Sfyou open the AKSO Help Fies, this solder Glen, clean, and | usualy presolde abit points image should be found. {have found hat of solder to each point. Once soldered, you diferent color have been used by various man- can see the colo issues but thes Ufacturers butthat the numbers ae accurate. rate based onthe numbers, 7. Here is the orientation and col- 8.And just as a bonus, here are ors that my AK90 utilize. Keep in the rear solder points that some mind that yours may differ. prefer to use. #1 VE #6 (Key Pro USALLCwert AxSO conned othe PC, Clk tuo 12 Rea WS vn me en aI nda tiedadeetypecTnen selec stodieebepowssh-op.n Pens Sea a) Hee soldered ve CicKOK otc kn Soca Wren a ca Se aanaanana “Tho press can ba compete wih he AKODDUT12_Mae sure an eich BLE the Tango Select hel slol you would sift; keto use. And Button | a => ee srt Ramee"! 0° into YOU TE vmer pers be Teco eons bank account, and then return the jfeineintne BIN nat must ve places on he parts and test the key "ger oon 2 eee fst tin ted inthetgnion, Tiss when wi cck and hen B® © start rotinsyne with the vericle's memory Tis tetana oy we cy hve ic onroct ina EBNonce tt sto cana clon ne vanapond Wt at saves BIN you lever have fo terrane fe apain and can also produce more Vanpendre Tale ge she ab tyre overt postions the Sil Uansponse's an opt the dealer ean eer. key Pro USA Le‘Model Years remove the oP 4.0n these 2.0pen the ebow rest, Rovers the holder, straight upward, Set aside. Great place to store he screws you are about to be Femoving next ‘See the ‘Appendix for the more ‘ekey Pro USALLE ‘ww3.Remove these AOOOObORRRARAL Now the lager vim around the top of em == 6.The fhocertercnrela cana sited on Bg E Side to side, revealing he Target Module. = ; mountedlo aa = the drivers ag side ofthe Key Ger erator> 13.This window gives afew more ‘4 (I know the: details and the option to Open the fmarorae eran eceghictalem alone in File. Click Her nonetheless.) —_—". ee . << ‘Koy Pro USALLC18We know bat ne IKC has accepted the be- 18.18 can seo at. sot muse there were no ener messages an the be glen lta org dstance Wom o ust exaing a “nis screen deplays useful fe) as tone rere ah Rey rere ore man info uch as keys programmed and the syne coder You can aso veut esting onpenaer 17 Nerify that an acceptable transpond- 18.Then er, here @ 7935, is located on top of the and then vey that TP Generated OK" ay IKC hardware as shown on the top. __ea"8. This can take 20 to 48'seconds, new bin file to be generated or named, This is our cue that a rewrite of the de- vice is unnecessary. So return every- thing to the vehicle and test your work. | ™y have provided the following pictures of different locations you may find the EWS modules. A vast majority of them ‘are located near the driver's left foot and are EWS3 generations. See also the BMW immo system spreadsheet we have provided in the Appendix. Key Pro USALLC eww "1AAAAAA AAA addddbaaas 2 eww (Key Pro USALLC.Ise opal hy i ‘ve i yp oo. ocuenedDae: 1185. (Device Reader: ORGS ‘Programmer: ZEDBULL plus EEPROM Applications "Nd St et eo Ad he pon pt Doe 02 adie Oe Otero a Tanne a4 500 foetepeat Trent BIN Enel No PIN tein BIN Fin Tbelieve Ihave listed all examples ofthis system above, check any programmer ‘manuel that listsimmo#l or type #1 and the lists should be sniar. = = = ~ - = = - = - B® tonmestot ie carmodels, he apenance ota Ti @ RadDomeLEDontnetop of necash stow. 2 OUT ese ” ” = = = = 2 » e » * . » s Jon te wndshei nd sighy oe passangess_ OF antenna around the ignition lock ‘eof theca, 2a sob eaten oe mo sy tem Have ie cstomer check Before you uate Key ProUSALLC CHRYSLER< 4.Remove the 2 or 3 720 that secure: 3.Remove the T20 that se- Shroud around the column, Some cures the tilt handle in place. times a skinny shafted driver is required s ia 5 Lookng straight up ftom the floor here isa 6 Here is our Sentery Key Immo Module gg} ew ofthe Tame *SKIM.” Different vehicles will use varia- ‘and remove he sine SUt: on indesign but the boars the same. cap tnbersene Mewoponatatgelehe issrciine ice tecw na Sh aeeeeteegi ne © om below on hat favor cued ator fame sido, Then swich IRB oU _- ‘CHRYSLER, okey PIOUSA LLC9. Fi usual with an unknown module, | choose to desolder the device. It's only 8 legs. 11 recommend conning te deve tos adap toc at your eariest convenience ust be cattul wih these “Clam Shell fype asthe release lever is easy to bump open and eject he device, (key Pro USA LLC __ tempt would be aread under 24.C028 lly our Target Device, 24.6028. AS 10.Re hi Hot Air. And remove the di 12. Now insert the loaded adaptor in- to the ORGS hardware, | recommend using bright nail polish to mark your PIN 1 orien- tation on the adaptor and the ORGS to speed up the process til you can remem- ber in the future Chip was 24.002 0 we use that I the prograrmer ‘tunon come von, find save vary ead along the roam Common CHRYSLER,c us displays 22m TPKE Bl Chek OK ond we a What we already know. Place your choice of ‘8. Gacause we coed afey cuore IN. at tat Ppeaeee mae Whe Sul sotMLOMMN Sire oerchnn cncetrscnmsureraonnn cc” = = = = = = = = = = = = - - = = = = = - - = - = = = = = = = = = = = = 2 key Pro USALLC ‘CHRYSLER 5KEYPRO@ CHIRY = Make | Model) Wears “comer =e eae ‘paris | —eoveonod | — mer “enruen re eoeet ‘mara oo CaRrereeiin poves INTREPID 98-2008" woe task | ge [nero | mae ev Render AND sae “at Moa SKIN : ede actin Arendt een “get Deve C28 ea ior Ot Ont Crt ‘vn ampendr 40585010) ote raapnder D6 TP or IN Engi No acini ra ‘Gone Ot Come BIN Ether oyna 57 Telieve Ihave liste al eramples ofthis system abo programmer opnossive cries tenes 2. Our is the SKIM euece land ee es” or antenna around the ignition lock. tow te windvd or sight gets Site otthe cx = eo ye3.Remove the T20 that se- 4Remove the 2 or 3 720 that secure FT 7 the shroud around the column. Some- cures the tilt handle in place. times.a skinny shafted driver is required 5. Looking straight up ffom the flor, here is a6 Here is our Sentery Key Immo Module ew ofthe Toe sue “SKIM, Different vehicles wil use varia and romovo tho sinale $2cUr- ong indesign but the boars the same “Lhe cover snaps of, Butthe Target devce is 8,So | alternate between heating each onthe reverse The two points that e010 the pin and lifting from below on that area are the only connection fete board The same side, Then switch tli its Out lug stays attached tothe board. (CHRYSLER, (Key Pro USALLC9. Finally our Target Device, 241028. As 10.Remove the Hot Air. And remove the de- vice from the circuit. Usual with an unknown module, | choose to desolder the device, It's only 8 legs. 1. Sometmes you fd yourself wih the proper tool but oot. Pomona ae desired foro cul Buthey ef couse wrkin an eu station al, ust ont choot outa the por mashes 13.From the AR32 software, PGDN and ar- row over to your desired device, Note there isn a 241.028 selection, the closest device is 241.02, co we cursor over and INS'ert. CHRYSLER. 42, An aldy but a goody. Ifyou happen to own. an older version of the ARS2 hardware, this is similar. Newer harsware owners can easily follow along, 14:Venty all dip switches and adaptor post tions. No voltage switches on this older hard ware. But out of crcl, voltage is far less im portant Key Pro USA LLC.18. Option 3 Read Dev FaQalang Bed Bevis nt Buta, Tis 18.1 a very simple fom of Binary an waTplfead the SN He and place | guage you can see the VIN and IN. See Spey otitinta your PC temporary emery the Appendix fora ful transiaton chart {7 JESC‘apeback'o the ARS2 main screen and Op 18.Option Dis Fle ak tion & Compare Device with Buf a na fons aren nt ofyou (ring, btm let Green Zor Err ou gs! ‘more permanent area ofthe PC's memory Pick ‘8 geod fie name. remember wih ths ie you never have to pl the Target acule again 49.Connect the Tango to the PC 20.From this screen Click the and start the interface. USA> “File Open Button. Then your Chrysler> 300M> 2002 (24C02). AR32 File. CHRYSLER UUSEESES VULUEBEUEUELELEBLELLELELELLLELUCEUES21-The Bue “T Button shows us the PIN we 22: you select 4, the Tango wil verde that already know. The Red “We? Button wit *2Posiion withthe Y160 ete. you select an 0 allow you to select helype of transponder Sd Poston and one of clenabie Vanspon-gg ould ie i lace te sot ya sees, 0%. Taa0 wl cone ont oop dal Sly eee 8 23.So either choice has its pros and Asa side note, | attempted to read this, cons. If you decide to use a 4E, then device in circuit with a jumper ground: the Tango must convert the file and ing the crystal, Failed repeatedly. rewriting of the device is necessary, But the transponder is more stable and less expensive and more avail ble. The clonable options are a bit ‘more expensive but they save you re- ‘writing the device. Saving the BIN is essential to recovery and either clon- ing or acquiring the PIN in the future. AAAAAA Date Notes Date Notes: oil a CHRYSLER, key Pro USA LLCALA Glance, Documented Date: 1715 Device Reader AR Programmer Tange with Stare “Target Mode: SKREEME Modul cation: Around he gin “Target Device 9500 8 80 (S010) Read nor Ot n Cit ale Taneponderh 76 or BUN Enarypta No PN acin sine OR Sond, ‘Clone Out or Convert BIN Coversion Keymay:V157 on Tau This a limited number of veh : them on the road but there is litle hop. the port so EEPROM gives us the turer cooperat Pee “The Pactica ie most chatogingt pul of hese models 3 we wiluset ero main example Wo ll {atk abo the oer moses towards the and one secton Is also the onlyin dash exami =| ' ' ' ' ' ' ' ' ' ' ' ' ' ' 1 na tampon ' ' 1 ' ' ' ' ' ' t t ' t t 2 Sta by loosening he tim panel hat goes around the gniton eck. Is hal in wth snaps and one serow at the very baton hal usu leave pace CHRYSLER "3.Normally | can move this trim 4 The Trim around the shitter can be ur- ‘snapped, allowing access to the one serew away far enough tohave working lh teignton ven place. Set em room. If not then see the next step. aside and press on. =] 5.Immediately you should notice two 8mm 6 Between picture 6 below and 7 you ‘ls to remove from the ignition face area. can see where itis. Itis located at the ‘The third one is in an odd position bottom of the lock housing at 6 o'clock 7.Astandard 1/4” drive wrench with SNewpune acer ck te dah. Th = ‘an 8mm socket should reach easily. ewer he mocule arcund to expose the = = Bo erete ens! oosen that secure the Taget Module oto lock = . (CHRYSLER (Key Pro USA LL ie et = = = - = = . a s9.Now the Target Module can be _10Heris cur SKREEM moduie cose up. disconnected and moved to the {ou.se open the casei you choose but he target device vl be on the reverse se bench for further service os \ ae ee 11.Remembering this is a Pacifica Module, 12 Her ar the SKREEMs ste y sce Ate Hite devios Jat below te of is secton you wil fn tempat, Pact and © Shoot for a postage stamp size hole. AST earned re 43,These modules can contain eithera_14,.Make the appropriate device se- 195040 or 95080 device. Soget out your fection and then verify all your AR32 ‘scope or light or micro camera and deter h settings and positionin, mine this while you start up the ARS2 sw. iP Swit ae are 9: (key Pro USA LLC CHRYSLER.15We are reading in circuit so start atthe 16.Locate PIN 1 and connect the Pomona lowest voltage setting, Then increase as you to the deviee inthe proper orientation. attempt readings. Check Be 17.Something like ee this Into Buffer, 18.0ption§ Bute: Eater, splays he ead. yeu 20,Fist prot ater the Green Good Comaare gotat F's or 00s, mepect you connections. fis "Put some thought no your {ding he Pomona ater ted. Same su? Some techs assoc Incteave votage oe stp. Repeat process 50- | Sg ther invoice numbers and BIN fe names, a A WaddddAddad CHRYSLER ‘key Pro USALLC.Z1,GonnectStat the Tango, USA> Chyler 22 Nex! the Bl ‘Fle Open Buton Select your Pacioa> 2008 85080) or 95040, whichever you ARS fe. Andi the fei acceptable, the Tenge have, Yeu can use these seicton for altiee wil give you your options screen for his vehice, ‘odes, g0 to Jeep Lert or Town County. - eee 2aALbw Se ofpubloabon ie Tango omer have fe 24 Save he new Tang in, J nt order) PIN cispayooten or msinemo ayn Ober urn se ander aycremuarons Te fesse vocse TiGhave his teature, sowewilroces ax we do ot san -You nes ere hacen 0 carpe Seamer stuantayig Pent veorne non, teneion oem ocorocnt (ino Tango ond Sih ed ten 1 rogram Devee tom Ge Fae (PC) — . , hou > ses ee Seo Bstronypeteenmec ATs Heanecnnnsscwnnetnns see the folder the file should be in. Scroll 3 not ecane ne Green Comparison Nessage down then “F3" to Program per the bot- then cack connections and settings and ty again. tom ight comer ‘CHRYSLER27.4 youre comms Pac ley, and be Cav Toun County sles. 1 ct pode a own lures te te mo evapo eae a a nao ere hn he ast. Oe 2 stmt ce aid arden he Target oases are vty exrytoremore, Know orevou ‘Bale he Caravan needs he posaga samp cin he boxe accen the devew bute tery ors nt toons i: art | 28.Below is the template for the Grand Caravan and Chrysler Town and Country. You can Xerox this individual page and cut these out of the copy or make your own out of quarter inch grid paper. = vide ddd 29.Here is the Pacifica module. | must stress that working near circuit boards with rotary cutters has risks. Practice reduc- @s stress and increase confidence, Why would you not? ‘CHRYSLER (©Key Pro USALLCVPUVUBUSEDESESESUSESUEEEBEEELELELEEEEELEELEES YPRC®): CHIRY === Make Model Years 7 co aoe “arpt Module SKIN Module tation Arndt eiton “Target Deve: SK35G 64 OFF) Read nr Out Out of Crt Original Tanapondr ole Tanpundee 6 BIN Encrypt No PNeteln BP Cane Out or Conver BIN: Coveson Keynay 157 4 Our target module is the imme ring 2 kis aight removal, but he lower shroud can around the ignition lock. Start by be removed from the dash. | do nt remove the ‘securing the bottom shroud. !overkick panel but some technians prefer to ‘Cam entrnct the PIN code for key pro- Graimring trom the port: Rnd with am SET yee immering tote vehi- inlets ofaed parts available a ‘ekey Pro USALLC CHRYSLER, ses3.You can unbolt the bracket that secures. 4.The Target Module on the bench. the immo ring to the column, orinmy Label says this is an Immo 3. A small cease, | slide the module off the bracket flat head removes the cover easily. ‘And there is a surprise underneath ‘5.The device isnt visible. Ithas tobe on Gif you are fortunate enough to wn a sol- the reverse of the cicult board, The 2 r+ der sucker, these should be no problem, | ‘al pins hold the board in the plastic box. have fux, wick and a simple solder station. car 7.But that will work. Apply ux to the Wek, then lasso the iron with the wick This method can remove the large oun of solder ar0und ie pins 8.You can see here in the close up that most of the solder has been extracted =Pa Pin 1's plainly Putin th Bns visible. Make sue you mark te board or oie 121 searched “Data Sheet 3K58G" and the first result was a web eight that shows the Mask translation onthe fist page. Mask orla emblem, The third row is called the Mask Usually a number, eter, rum ber, number, letter format. Occasionaly the fist, ‘number will be absent. In short, this Mask trans- Saree ere Sete a Meu tw Comprtion sresoooen somortne de. | 7 Hees On SEE oe ere should have noticed the smallcompe-edevestomiscaren Wings aoa. rents near the device. So protect them with thermal tape or poster tack etc zm (Okey Pro USALLC ‘CHRYSLER, a15.Now we open the ORGS sw and se- 16, Once the device is selected correctly, lect our device under SelectType>4- note in the bottom left corner, the ORGS, ™ > MCBBHCSOBAB32. adaptor that is required is displayed. 0 4 = = = oe = mulls Sd a 17.If you own the ORGS with all 18. Fux the pads and iegs, square he eves its adaptors, dig thru them and Pisin as) eae ee ee = al = locate this one, if you bought the, of the legs don't have pads to solderto, = a ed = = os = Serer rS (oC SOK ete eaal etereerne me eee and installed into the hardware, _ 20.nce at Waconnacton oases The adaptor only inserts in one di- watch the pop up overly al goes wel rection. You EEMNe |can always . click the hel menu in the sw for more details or in- structions.24.This is our first BIN file. But __22.Click the Yellow “C’ompare button and We shouldn't trust it til we com. inthe bottom let ofthe screen you should pareonetime Teceive the ‘Compare Ok’ message, 23.With a good compare, we can save the 24,Connect and Open the Tango sofware file. Menu Bar> File> Save > Region USA> Sebring then name the file something appropriate. ‘Note the sight aiflerences in the device identifier. 25.The Blue “F'ile button and 25. The Tango recognized the te, so the ‘options screen comes up. To see the PIN, then Glick the “i” button. There are 5 keys pro- you just created. srammed aready ~ eee CHRYSLER 2‘Make ‘mee ‘00% co ‘MAGI Desementd Date 1205 Device Reader SMOK Prana Tango Target Mole: SKIM Madole Lotion: Ao thin Tare Devi LSD 00H Read ino Ot In Celt ria Transponder Uahle Transponder: 736 Apt tape BIN Encrypted No PIN ten BING in lone Outer Conve BIN: Coveson Keymaye V1 In your OBD programmer this system i probably called “CAN |". The PIN canbe pulled nd [Programme via the OBD by most programmers. This section wil be sel you eve" ma te (te that refues fo program thr the ports these CAN Is gto ‘communication break downs between modules res » CAN recep (evar ore and mare oqueaty “First pop the trim around the 2.Behind that panel is 2- ignition out with a small flat head. 755 ¢6 remove first, eee atone om camect me Sores iraciansnateyeacenainew mere SE ae lo Bera cHRLER 23.Remove the trim around the cluster to gain access to the final attachment ‘With the lower kick panel removed you ‘should have plenty of room to remove the single Torx screw that tans the target ‘module tothe ignition assemble 7.Here is closer view of the board. Our Target Device is here. And 4.Now the final T20 is accessible, re- move it and push the ignition assem- bly into the dash area, 6 Here is a close up of the module's label on the bench. A small flat z a 2 3 z 3 g 5 ez 8 This device happens to have the extended Motorola part number on the first row, MC9S12DG1288. Ifit had not then we could “Google” search the and got- ten the same results With this info we can go to the SMOK help folder and see ifit has any further in structions. (CHRYSLER Key Pro USALLC - = = = = = = = = = = = = = < ame mg — = ~~ s x :SMO eel eceive @ DOC fle wih he 10.These selctons should rest nt im Wiring diagrams. HC12> MCU> age. Thisiscaled a Pin Out For any given, UnSecured> MC9S120128 (a0Leq) Mask, one of thse exists, and tells Us the pur = anil 080 foreach og Atonely aso as os, what legs must be attached to read out the EEPROM data Inside. Hence the 4 colored legs. You can solder to those ‘exact points, but that's Weky. There is another way, urna al 12. The probing should resistin omating closet this Keepin mind ther are ater boards, 2 my cover a couple ones pn oust ‘and then tet points on the board near hat leg. Youare ooking for 0.00, resistance. You ‘can solder to| that pont i stead ofthe leg direct, 1.Clean the points and then flux. Then 14. Attach the adaptor end to the solder the colored lines from the SMOK SMOK hardware, then the SMOK adaptor. Here is my example soldered. usb to the PC, and then start the SW. (Key Pro USALLC (CHRYSLER, 521¥ren ou ey, cn a unt anpondarn 22 evening goes wel the Targo wl ak you ‘the Tango, select a key sot, and Click the Red "W ae im ape te toname the new converted fle containing the ado ea esn2 enete Peed” yansponder, and hen emi you tow that eae capa Ha lat le back'o he deve Backto he SMOK s F".> 206 ey Se se 8 SE 23We assume the SMOK is sil attached to 24 With the new Tango fe loaded, the target board and device ype ssl selec The status bar across the fedetc. Click the Open File Buton. Then locate bottom wll fke @ moment ofl then lock for ‘and select the Tango fle just create. the Writs OK message inthe daioab 251 leave you with he alder ports founsen 2 Date:_ 2004 Durango an 2008 Rader AeOUCANSe® Notes ove but nl enact the save. Soe prepared ‘ut some ena tne and rovghtite base you run to esa of cca co Lk PRG@ CHRYSLER a (@xey Pro USALLCYour target module Is the antenna around the ign! tion. This immo systom was widely use by GM for a few years, resulting ina large range of examples. The shape of the antonna changes by model, 50 there may be slight differences nits design. Main ‘entifior is the 95040 on the antenna board. This section should apply ifthero is one presen. Some- where between 2008 and 2009 GM changed the de- ‘sign and I beliove they removed the key data trom | Sa | Ge cets pn vohicor withthe ignition very ey to remove andnevea, Ae | RSENS Tithe cotenn: Conversely hough wo have many other routes Complote thintrenepondes, nove none ou (Koy Pro USALLC vidoes sdddededdadddtake many forms due to the wee epread use of the system over diferent veh cles. This ie Cadilc. So far, "have found fits eck ‘mounted lock wit acco plus, Lunt about the beginning of £2000, his section should ap ly. Remember tie afi to se our programmers, Tango, IKeyCione, TMPro, et, to de- fine the system because year ranges and models tond tobe diferent rom region to region. ST band. Norms not al that pra ever seme of th fede Le, O15. Faure the Nance {ittdeca pero the doves pe. Ss te Apert fora weak down ofmanuscueramarings aN 5, Once you select the device, this home ‘soreen comes up. At the botiom are al the hardware settings. Compare and very every thing is set properly, including the voltage ‘Key Pro USA LLC 4. Here is another example. As you can soe they 2Usee sna fat ead release the tab acura the Deter ofthe arena cane expose the boar Wie are coking fora 64080. I havnt found ay var7. Your star up connections shoud look ike ead Dee nto Bute ( Storage) this. Occasional, he the adaptor vt eed tobe adjust fedt0 complete the wing pro cess, Outside of that, the only th er adusiment would be (eta clean read ‘Aays compare before saving ARAM AMAA AA AA Ad ad ddd dUdK RG ‘er toDik Fee 42. Connect and start the Tango. itn Option P Set One Pay ena! anand cout Cobalt works. aesthe Bluo “F" Open immp __14-The ie pared wt no ror metegen, ea Then select the ite you just ‘ese Fie See or Fie Not Recagnrs: We saved from the AR32 aie an ways Taneponaet one aoe | “es — ‘15.Vetythereis an acceptable wansponcerin 16. The first pop 3 fst Pop up screen isthe fle nam: SeiTaroe nartesrs ing screen for the new fle the Tango has PCF7838. You can use a Mtns cy ‘created (add "Tango" to orginal the Sees eect og ‘name). The next pop up is poorly iarectaea tereiecrt phrased, in my opinion, butts a remind Honda V key, With 9 erthat the new file that Tango created ‘simple understanding of ‘must be written back to the device to com= ‘eansponder relationship plete the transponder making process, ‘and commonaities, you Can utiize almost very discarced Sj tey cicxino peo-wrtes | Or 17. With our Tango file, return to 18.Atthe botom, the AR says cick ALT" the AR32 and select option 1. !22#2allthefles nthe direciony. Then ‘Key Pro USA LLC19.1 Clicked F3 but received a comparison eror 20. Remember this note from the AR32 de- ‘atthe bottom you can see. "New Device In- vice setup instructions? It suggests that you Stale fs asking # you woul ko fo atemptthe move switch 2 up onthe ARS? adaptor boar rogram again. 21, Move switch 2 to the up position 22. Again the AR32 will try to pro- with a pen, small pick, etc. Then gram the 95040, now with Switch 2 for new device installed question. on the adaptor in the up position 22.7 ie we rece he Gren Go Compa, 2 False roe etre a aon message meaning that tho file spccossful to appropiate sta ter wa chorea you wi ar wrote othe device, Opton Zero then "Yo cos the program, Ret everything and get padKEYERO@) G.I." Tat Mole Antes Tg ee 3562 FEO) Radnor Oto Crs Ora Tamed ‘ae Taped 09rH US This is an example of vehicle that GM used widely overseas but had a poor recep tion herein the states. They are relatively rare to see these days and these factors all add up to.an increased pay check for those that are prepared. To be that pre: ‘pared tech, make sure you have the appropriate key shell to house the transponder ‘upon completion. There is no substitute shel for the B61 keyway to my knowledge. 10urTage osu ie area arandsenton. 2.There are tree philips screws to remove Youwareedamechascalhy to cance Beem". fom the lower shrOUG an also remove the fete ey cde toma O90 oprah oe hich is usually lock tight tation wo. renfocced (recline mt codetrom the OBD. Tae Ing the Pit irom the mamutactares SCooproprammerstinat might be abiete This will mostiieety come witha. STkOaictguarames teosnaccese Ba EEPROMers ony "Pin Codes? We sopetiattyin we omsty soamplen. Thore- dan'tncodine rnin PIN coaes.™ ou 6 ‘okey ProUSALLEaif aa a oa Zod aoe she LIE ie aaion to staahverical Adthn”“6 Here you can see the angle used 19 the correct angle. You wil need a0 degree 200858 the retainer. Once depressed tool ora smal allen vrench to ht the retainer. YOU can give the key a pull outward. Ih 2 7.You can see the retainer and the ig- 8.Close up of the Target Mod- ca u 12 “UWle, The lid is easy to pop off. bo removed to remove the antenna key Pro USA LLC8.Unfortunately the target device ison the re= 10 mand wick verse, Sowe will have to desolder the 2 anton YoU nave a so sat or ‘na points to remove the board from the box are not toi ie here ia 8 connection 11.Now that they are separated 12 Stnby wenttyng andimating BIN onthe the box can be set aside andwe fin \nonsscuesst vistas ‘can move onto the Ta aeons to cele devs 13 Locate this HCOSBIC7OSE adaptorforthe 14. With the device inserted into the C0195 Insert the device ito the HCOS se adaptor, insert the adaptor to the ORGS hardware. The writing on the adaptor and hard- ware should face the same di- rection, (key Pro USA LLC om a21.Conr Stat the ZedBullinteface__22,From the Pop Up select Open Phelan na Cane ucmal Fle. Then select he ORGS le we a just saved. ‘yourusable clonabe transponder Place it into the Zed eral and Cick Ok. Done. Amos. 25. The most challenging part ofthis whole job is also the last step, returning the Target Device to the circuit. This will require your advanced soldering skills. With practice they are simple, Clean excess solder from the legs and the board. Flux both and start soldering the legs back to soldoring, Make sure everything is squared up. Make sure PIN 1 is orient- ed correcty. Put all of your practice to luse and you willbe fne. Return every- thing and test it out 10Dacomened Date 0 Programmer IMP pls Module 3 rat Module: Antenna Modal asin: Around gation Cinder “are Devi 2157) 4 OF) Orginal Taney Pulp [habe Tampon 6 HN Enya No [PNet i Not Standard yma 0 on ‘As with many of the other GH systems, this one was used ona large range of vehicles. This process dificult, therefore it will not bea standard method fr me personaly. And further ag ‘more, this means that! do not know the extent of vehicles using ths. I would make a guess gag timation that your example is a ctcle lus, n dash, and prety early, ay 2004-2008, ou ag, ‘are probably dealing with one ofthese. Our knowledge gaps will shrink with time. 4.Jf your car has similar features to 2.Start with the only easy item i this example, the chances increase {0 remove from this vehicle. The that yours is the same immo system. ignition bezel. ‘key Pro USALLCVVPUSESERERE REDRESS 3.Now remove the panel on the driver's side end of the dash This will ex- pose to remove. '5Youcannow esiy access th tana sn rove ihe lockevinder with a working meckania key. | am not showing a pctire oe retain: because yo anno i it you shoul nate reacing th book 7.Unsnap the center console cover and remove the conical shaped piece of the a,c, vent that rests in the top area of the console, We will need the room (Key Pro USALLC 4.There are to remove the lower dash panel. It should be free to set aside at that point. sae 6 in the top ofthe cluster bezel. The bezels attached to the tp of he column shroud. Disconnect these attacnes parts and set thom asige, 8.These 10mm head bolts are what al the fuss about, There ae 3 of them, screwed from the engine side into the rear ofthe dash | wil ty to show the orientation ofthe picture. 3 eB. :Hopefully this illustration will help 10.| gained access fo each of the to visualize the locations ofthese _ three from these points, hence the removal of all the panels, 4 44.The Ignition 42, The bracket, target module, module is now and remainder of the ignition as- hanging. You ‘sembly, are now separated. can see the ous bolts we removed. And 2torx to re- lease the Ta got Modul 13.Your module should resemble "4 !tweow we are ooking for 64 OFP, we kn this one. Ifitis terribly different than tua ine poor ale nt seaeres ‘They ae tension Yyou might be on the wrong track, neces. You can pop he board upwards.TEIDESR aera bebe on wast cence le 16 Mark PIN 1 on the board. At the ‘entended seer ate che cevce Many times ony VerY least take a picture with your ‘ho Maskisand yous ransnto See the Append phone and hope it doesn't die. 17.Insulate and Isolate the device, | __18.Using your developed metnodclogy, apply chose to use tack for this job but thermal lg tension and hat ait remove the device je has its benefits and imitations also, "The ercut. Selina safe pace to coo! Also Nee eee. aco coo price to removal is ens 19 Locate the ORGS S0SASSOIAZ60 adap-20.nsert os SST C Retro sed ta ses sca er “RANGES ve ere eee pate (key Pro USALLC om myKey ProUSA LLCKEYPR This applies to Non-PEPS vehicles only. RACs [Bacomind Bae Disk Reade ARS [gramme Tago per Salwar “Target Mode BEM Moat Lcton: Vries ec a aie) “Target Deir C16 SOIC) Read nr Oana ‘rial ansponder Pin [IN eye No [Gone Oster Conve BIN: Cmnenian Koro ni —— on Tangy 1. From the passanger side of the 2.Remove the panel by hand vehicle, we can easily and quickly and set aside. The BCM is al remove the target module, ready exposed for removal. U {GM examples. is characteristic included, ‘main example. Atthe end afte secon, use ofan HU100 koyay, cary year range fhave ined pictures of cher locaton | =2010=2013, and onanaly equipped wit have encountered on ther vehces, This thefist generation GM fp remote haya sytem was widely used, ke many other e ou key Pro USA LLe anereeeeeppppnnAAAAAAAAAhaddacaneS.sconnectthe wie hamesses, and move ‘aside. They can only match one socket and are Alleolor coded, so there i no enance of econ. 5-The Board slides out ofthe box ater your: lease the around the plugs. You an also see the label withthe plug colors al labeled 7.1 have decided to use the AR32, | con- nected the hw and started the software, aged Down and Arrowed over to the de- vice type; 24016. Press ‘INS'ert (key Pro USA LLC 4.Push two plastic tabs downward along the bottom edge of the 8CM, Then it slides out by hand, No Tools {6.Qur Target Device is almost inthe center on this example, however Ihave seen them on Beh ‘ides of the ard the only 24018 on te board. Note Pin terentaton, See magnification, 8.You will be forwarded to the op- tions screen for that device. The hw settings are along the bottom,9.My experience and knowledge alow me to fee! 10.With ll connections established and stings comfonable reading hese meet wihout adjusted, wecan 3-Reac ‘rounding, Do what = comforable 6 you. Out cf Remember start at the lowest votlagesetng, No Gratis tho satest in tems of cxruton risks. reason to sk earuption wth fll 5 vo et 11.Optio 42 Should ook simi. We stil need to vey display what the AR32 just SW In nee na cB the device's memory. ‘ogranmer you can be done in 12 mines 18.ESC back o the options screen and then n.compatison, you can AS: We are hop- 'ARQ2 prefers 8 charac- ing fora Green Zero Comparison Ertors Mes: ter fle names. Example: LASTBVIN.BIN at sage in the bottom right of the window. the end should be habit with all eadiwriters. (Key ProUSA LLC20.Back at the AR32, option 1 21. Arrow over to the Tan- a go file, then F3 to Program. «@ = 22.Then withthe) 2. Proasammina Completa in Grain the hardware and settings still intact. peje” yo asc ona teat your Return te Mode and est your raneponder fesieed 2010 Buick f LaCrosse My oy enssdssdsdaddadddd |2013 Chevy Malibu (Drivers Left Knee) 2010-2013 [| P24 EN | 2013 Malibu Circuit Board, Note Chevy Camaro] © EEPROM is on reverse from pro- cessor side vs Cruze example 2012 Chevy Equinox ‘Key Pro USALLC om 2Node action se ofl ain panel [keto Ov nh [Dab Tampunder oF TS TKS [Gee Osx Conr BING out Ifyou use a reflash technique to program these it requires a Red Key 4 and Black Key and additional programming though the OBD Il With gy EEPROM work, merely pull the data offthe device and you are done. jt |-Tre Tage Moa fhe wnt st nee 6h 2. Remove te sae pillps ling Tis Pan met dct inne wi ie seesrgclura. Yow gn then gt hase. You should nowbe able to SH Ivete pln wer pane! ana you mi 90 onthe (Key Pro USALLC assdAAAAdAdadaddadad3. Here is the immo box underneath itis held. 4 Once you remove the two plugs. wih box in ‘onto the column with two 10mm head bolts. hand, you can pop it open. At his point you can Release the box then disconnect the two locate your tagel device. a 3045 or equivalent ‘5. Youcan ays rend is 84 3CA0 seve ube ‘ves tacky havea irr eniteron Asin” fouthedevea, Looking she Agee IUIMTUP ute oeicely sonesesce oust be temo heed ied cqer wh sstraceabsr- Uae pe naa boton sm oss bush 7, The device options sereen shouldbe sia to 8. Very thatthe seres of thi, with LABR ithe top et and your hardware Det aetna seting deplayed along the botiom bar tow toe a a DVVPPVEPVE TTT TTSTOSS SDDS DSSS SESS SEE EEE EOOES9 The ra2iarow at. Fumi 'sngee Bust terhsl coc megelmensn ference mahi on ap he ee 1. once yout" he proses knee Soeur appear chage Lets sae fw gt aoud ‘hough Opto ure er sous dep stan ine Dis eels at sO ecbck you comers Sra sstnge Con jaune ky sone 12 Once we have a vertied Read, Save the fein mediately. Opfon A” ard that can be easy lest later Customer names are net my fiat ene fora fle name but wil work a pinch Now tom (10 Thea Ino screen "Do you want to sat reading a the foecinning ofthe fle” For us alvays yes. For loner industries hi i 9 use! ably ofthe AR. 42, We must verify the read before saving Hit ESC to return to the AR32 home: ‘sereen and then Option 8 Compare Device with Buffer, aka "Reread the device and make sure what you just read matches What you curently have inthe buffer.” “4 Hook up the Tango> Region Asia> Honda> CGars> Give» 1985(83C48) Note the discrepancy in Year and Models because of regional fer. {ences inthe Tango's Customers. UK vs USA ete Key Pro USALLC PAPMAAdAsAeseeeenanane 22222000088~ [ese raneponder 86 [risecin ae No ond igh Sect Took ‘This is an excellent beginner job. The Target Module is simple fo pull and service. The device is a standard 8 Leg 24C03 that is easy to desolder etc. The ‘mechanical key code is accessible and a common inexpensive blank is used. 1. This she dash area view. yourvehicles 2. Qur Target Module isthe antenna around. steering wheel or cluster design are different, the ignition. Stat be removing the three youmay not be dealing with tie exsctsystem. screws holding the lower shroud on. cutsnentnsappineteaemhingpesion ples andes «24604 on te antenna, Uobtccncion)uowererstnce demottn: hese steps itlappiyteyou.Macingam SEAIPSTANTR Serpeccetany sate ttenttying programmer te FPres SERUTUDEL NS swat gron wim Srminctone, comes very help when TMA ane Mttcsay netityes eaump win smedale thet yowremet rare SRST Ta atewyoam ofthese enum tesepperted. ee Honda key Pro USA LLC3.Shvoud set aside, you can access the fest 4To access the final pips, uncle 2 small Philips that secures the tamet tothe uss going tothe aeril and tne key chime lock Redsing, One right inthe font, poled at_Then positon your sight otha you can ook up from the oor area tos the final see SYou os ssethesrszgong!trv psc G.The module should be free to screwisverydthettacces,neete roses '@ke Out of the vehicle, And back Vise grips and patence are your best frends. to the service area “eho is close p ofthe otie's a, Youmaran ves sideways because the witing goes both ai. minal tba canna co 9 tectons The label ison the cove, use a fat hea to remove that cover Set aside. (key Pro USALLC . ® ® ® . 2 ° ° » 2 2 e 2 2 2 2 2 2 2 2 2 = = 2 = 2 2 2 o a a , e ,Stench oo oma cs cont ee ee laden Coa cs comme. cocoa anton cut, | suggest insortng Kino the adaptorfor_ for the TMPro, We have a 24C family the programmer you willbe using fst prio ty. You don't want o dp this tiny memory devs 14. With the device installed, connect the adaptor to the TMPro hardware. Set Dale ah TMPro usb to PC. Start the SW. ‘connector like this. PIN 1 to PIN 1 orienta: tion throughout Make sure S (key Pre USALLC15.With all the connections estab- lished, and the sw running, ek the Read. re, lace the cur- “7-Once he TMPrO reads the deve, tw ao ‘ently the BN and depny he optons seen fr that syst. You can eet reagnars he Hons DEREERERERESELSEULEEE 419,From the IKeyClone home screen we go Usiities> Key Gonerator> Key By ‘Dump> Honda> ‘ekey Pro USALLC device button, 16.The device selection pop- Uup should appear. Scroll down Sand select the device type, 24C04, Then OK on the next pop -up to proceed, 18.As usual, select a searcha- ble and/or organized file [Eee name. Date or Invoice number may work if your volume Sisn't too = high, 20.The options screen for tis vehicle should ‘come up. A few more details and models listed, but most important theTaree Module 10 Marg Device aL Cush SOI) [inal Tanponde Meee 8 iN Enea No {olls, Lets have a look a hs prety si 1. Tho presnce oo backing, vale round De metal faceoff ion, is the eatin a he p- {onal memobize sytem. Mave te custo ook beleive ot 2c il be enaros key Pro USA LLC Proereer eda plas EEPROM Appling ble Tampons Mega Isuzu was in wouble in ts ial years but she went out witha bang. They added an op lalimmmobilizr systems tomo oft vehicies right atthe end, Is 6 PIN, At this time, acquiring that number i geting dificult Buti isnt a proces. 2. Just above the perce! is na bracket. One 10MM bot secure onthe top edge. Two smal pigs need sieconneon 8, A o ODD. rfind itjust as easy to do them via EEPROM and more successful on the first attempt. Good Luck. oI3. Horeisthe mo box onthe Banch. The is you do et pct yuo met fipeup and open. Removalathe Boar tom Sarna rata sa i ewe as a box's ecu and unnecessary. (e122 cane anon comarca BN 5 Solder abridge between either PINK point 6. chose my points and applied a small bead of and anather point, PINK or “Ths solderbotween hem You should fee safe us thors the oscilaor which stops the MCU fram ng this technique, however desoler he sal sending aut destructive commands, ‘at should you fel nervous outta in crc 7 Now we are prepared toread the target de- 8. Vey all switches, including vice Open the ARS2 sofware, PgDn and arfow geting, and the Pamonabbon cable Is [Ser overtoou device ype then Ince. You plunged ino the Left postion and the Brown {an also type “DOLCABB and poss ene ain a RAAAAAAAAAAAAAAAA AAA AAAA AAA A AACA A MARS9.ARS2 is set ips i place and he ator isa to felt From the AR home seen select fetion o ar 7 11 Once you hit"Y" the process s so quick the screen doesnit appear to change. Let's see if we got a read though Option 5 Butter Editar, should diepiay a screen tke ths. 13. Once we have averied Read, Save the fle immediatly ‘and Can be easly lead ate, | dont suggest Cus- tomer last name fr security reasons. (comms) ‘key Pro USALLC Fd" The queslon that appears alto baton of line screen is ‘Do you want to sta reading at the loeinning of he fle” For us always yes. For leterinaustes this is 2 useul abi ofthe AR 12, Return to the AR home and option to verify the BIN. Always “Y” Read from the start. The is 14. Lets take a moment and return tothe bur that the only EEPROM equipment you have isa reader AR22, Orange 5, Miniro, Welln, you this sytem the pn is plan language and ina ‘at location. sways at 75 and 76. Program via the OBD withthe found PIN, 385121, The nal step betore the ZedBull does its 22. Final ZB step. Verty your produced tran- ‘magic, fs naming te ie tis about to create, AS. sponder (Precaded) isin the Zedbull antenna, always | suggest adding the Convertors name And then lick OK. We wl to the ongina fle name fe 44601317Bullbin return othe ARQ2 for the final steps of tis vehicle. 23: Now retunothe ARS2 sofware we reed. 24 ere rewbys soul eet eB ce pyogtam te BUI IN othe devin hopeuly st tespin nae Ao. Bilal conneciea.Opton 1 Proyam Deven tm aes Ne ey rn ‘Disk File,, then ALT “D" to view the files. ene 25. From the fle selon screen, MtFF3'Fo pro- 25. Assuming you get the Green Prearamming ftums tothe home serean Complete mossage at the bttom, you ae done Any Messages means revit all setings and connocs an ty again Return everthing ti ight locaton and test transponder funtion, These veh are becom ing cxeasingly rae butityou are the toch that's prepare, you arete tech fo got pa. (Key Pro USA LLC Isuzu » . . . 2 = = = = 2 2 = 2 2 2 = = = 2 = 2 = = = = = = = = = = = = = 2 2 - 2 » 2 e -[FeeaNoisie Omer Module tains truest ane Frat Device 7508 ZORA [rn ‘rn Tampon DO ‘ae Tn the part and foc unknown reasons, personaly ave hed sues programming this ster ths the O20, Fortunately programming «hey tra EEPROM wotk creatively easy and gives the ‘svantage of ot hang erase he existing key. required by ihe OBD programming. Oe (hart worked on recently, could not be powered up with junipers or battery bores owere is ‘rer 0 an seve when prog following these steps. 4.Here is an interior view from the pas- 2. Start by unsnapping the trim around the ssenger side. Weneed to remo the instrument cluster. Shouldn't need more ‘gauges to access the Tara: es = ‘The tmmo system on this ve- takon into account. This is a hiicle is relativelyeasyto -‘Tibbe key,sobe prepared to workon,howeverthome- cut the key before taking the chanicalkey mustalsobe job. They impression eas Tagua ‘Key Pro USALLC anne mAAaAnansanaaaaeaie3. Set this layer of the trim tothe 4.Remove the 4 Philipps that side, itis thin and you could also secure the next layer of the trim. damage the vent pretty easily. 5.Again set it aside for %,7etna\srniee remove seoue ‘Target Module in place. Be gentle as the safe keeping. lear fronts tend to get brite over the ye: 7. Tilt the cluster outward ®.And you should be able to ac- cess the two plugs that must be as much as possible. gicconnected — i (okey Pro USALLCjg, 10. Remove the Torx screws 9. Front and back Views. na the perimeter ofthe cluster 11. The back haif of the cluster should now: ieee) separate fen be cla on. Sat tas 8 of the cluster to re- Secs Gn conetconarmnateitbady,” _ move. Careful not to move the needles, 13.Now the back ofthe target. 14. Our target device is module should separate from the ee almost dead center on Sy the module. (key Pro USA LLC i AAA AAAAAAAA AAA AAAAA AMAA AMAA AAASWYVVVVDEDEDEEEED {5 Fom scone ven can sa he te.keeping in mind that we have a prt on he Sampatenen mics owt Tnktien oar lok othe SMOK help les and Suan saeghtim ciccmmcacrmemsnse,” Talc tis dagram tout device using the aire torts Mask nis case, OL26M equals. J MCEBHC- 912060, win nis romiedge Ohm Metro tack down our solcer points on me por 17. | start with one end of the meter on the leg identified in the diagram, then probe each one of the points in the port. There should be zero resistance be- tween the leg ® and the point © © In this case the probing result- fed in these points here. 18, Here is one final view wit the leads sol- 10. From the SMOK se ered tothe circuit. Connect he other end of 44Cl)> Motorola» MC> HC12> UNSECURED> the adapior fo the SMOK hardware then the EEPROM> MCSSHC912 EE UNSEC usb tothe pe okey Pro USALLC28 elect a hy sl sopoprte omy custorers sie 27 Next pop-up, after clicking save, is the ove aammgaartcer O80) he Toes, standard reminder fom the Tango tat the ‘See spullapear requesting ourame me teen at device must be written with this new bin fie 28, Return tothe SMOK. 29. The bar along the bot- land select the Tango produced ie tor wil take approximately 15 seconds Minoan “mowime Progressinthebotlom le. scroll and fhould verify its success | i Date: Notes! key Pro USALLC guar 61. The presence the nro eauped vehicle canbe. 2 The mn bon aad one ack ie oe owe determined fom te posengerwndon “OFF ACC” sch pana en fess car Una te bx ean be i of Sno inbearpasemeimeesiios! toca bea amy srt Wont ae or Be vay ; Mazaa ‘key ro USA LLC i MTT OTter and use sofware to arslte and hen follow On 586 No funy be desire ea wh he O29 1: tuee postr tack as an solo andlor tt ender be coer De Imyetarat aon pesaie setng ard appx S200. dv iota From stout ch amay ere Seve Yo 31 Sige that bows ontalege 2 secs persis‘9. Now thatthe devices paced noi adeptor. wo 10 We ot elinders rpm comet ic Me Si sect) owt nr WebeOrmges atin ington aee eteenotcscad Se ae ae Sn mecuetaa URE no ANCES Pert : ee Sane soso” ease iene San eae 11 Excellent work, Notee the word code in pain language in the BIN? IT) Fle> Save> Las IN. Or the Diss Image. ors er T3Now tse to opanthe Tango sotwcre Moke 14. Hara i the daa seen forthe Mazda ‘hese hariar a emce, es os2- 20> ode, gles some quck deta, Click {reterencs back othe abe onthe nn Bom Seed te oy us Maza key Pro USALLC PPAR A AAA A Of a“eter tat acnci seyag tage. cttequremttetbe sinh sacs ceaininea fete a espe epop wp Then OK nape youwl ters BI {tye une sans, wn ws Sarayes stare be ow tear ot we must the memory te cevce win avec we we pong, ne nyu Beret ee eee ee ne tote Tango pernad compl evar Yoveuvattaumiotesae tyne me crqra” SPENT aking proens Nove back the O05 18 An ofcourse, he reminder pep tling us ‘rp acne | oa | 418. fhe Org5 i sll open and connected as sms aa itwas atthe beginning ofthis exercise, thon "nes phonies mies, anes click the Lup top. And Select, the Tengogetortes le Doub Chex | Oe “Okey Pro USALLC Mazda ‘Uae Trnopond 55900 8 ern E Mazda Koy Pro USA LLC AAAAAALAAAAEEIAAAANA3. The nema ute wou be oat the Sel Nar ber and use sofware to varlte tr hen allow On Board Procedures prem on soporte anapond © Bt sometimes things 99 bad Maybe we have a 5. start my hot ar at alow pressure seting ‘and approx. 300C. From about 1 inch away 1 Circe the device from atop angle that blows fon the legs. 2 second per side circles. 77 Hook up your ORGS and start the software Click the then Configura- tion 44MTRK> Group MC5SHCOS> Chip> McesHCos86 “Pkey Pro USALLC WUEBVEBEYYY FRemowed fot bx, secu the boat for desaidering boards akendy marked for device ointaton on. oir cone DertKEYPRO@ Wlercedes © . ) reeds a sar mda rb nein, Tey orients icy ond ore seiner. Ts {Stine cntpan, Yuku pal one nodes ver tisor tte uge mde: Ten one You ave ‘pwede te Fret Mle conten yo il econ’ 64 QF ate be reno feet Tl 67 ‘py ne conponiebeafaa aseeon rt re ivf oth i oe ro wan 8 LAs | stated, you fist need to pull the en- 2.The Target is located inside and under gine control fromunder the hood. This the fuse panel. Start by removing the cov- Target Module is called an “AAM Ad you will need 3 720 diver key Pro USA.LLC. =a <= <« <« = = = = = = = = a a a2 Bumovo aprox seven-20 screws tom he Remove the back section ofthe fuse ‘pein cline cse Sore oftesces are panel cover. Set aside but be aware a Hestvertymeyate there may stil be screws hanging on to it. = 5 that contains 6, Disconnect all the plugs along the bottom the fuses and relays, staight upward Once sage, Then you wl need to release lited past he bottom, sot the bo holding the Target Mocule, aka AM comer on the ed the fuse block ‘and one, Ton the outsise ofthe "L."This oneisypicaly 8 There are no extemal cues a5 1 Try towork the module off whether this module contains the immo da- equally on the top comers, Ihave also seen the tg or not. Open the module now to find out if bs break due to cooked removal r J — (Okey Pro USALLC Mercedes BonzSime board ots ihe his, youateingsedthace. 10. No red connectors, No Immo iat THIs module contains gurTane data here, Return this module to ar todesolderandstipfosteo1 the car and move to the next step. 11.Once the false module has 12.Remove the kick panel above the been returned, move to the interi- pedals. Couple plastic retainers and or of the vehicle. ‘a couple Philips screws and it drops. Wis 43,Directly above the gap between the 14 You do not need to remove the entre mod brake and parking brake is th Ue. Locate a ‘and slide it out, leaving the rest hanging, Mercedes Benz ‘Okey ProUSA LLC15\Here you can see the EAM Target 16. On the bench, open the Target Module out ofits socket. Andits Module box and turn the board over. 17. Our true Target Device is. 18. Now whether dealing with the here. is the Mask. Mark EAM or AM, you should be pre~ the board with P pared to desolder the 64 QFP. 19 Locate the O5B/X GFPS4 acapterforthe ORGS. 20 re a “There aeresisors one suc hi ata | arte ever A en ag ele a Mercedes Bonz 2 a 2 a a 2 ° , ° , ,24 .Locate HCOSB/ Zine s#OrP aaptormo me 1c05B ‘plug. Remember tha all the writing on HC705B adaptor. oe mates 23.Now 24.From the ORGS sw, you can in- ji | 4-MTRK> stall the SAMAR Vicssticos> nicestic70sKs2 adaptors 5 into the top of the OR- G5 hard- ware. And start the 25, With hardware and sofware sot. Cick the 26 Assuming the BIN appears in the win- e you get any boot dow, before anything else, ferore oF rea errors, chock the salering and to verify the read cee cmmeadosos 5 Mrcedes| ey Pro USALLC83. Of course you have sighed relief when the ORGS read and then the Tango recognized it, but the most challenging portion of this job is returning the QFP 64 Device to the circuit. Remember the ba- sics. 1) Clean the board of old solder, flux and lacquer. 2) Verify the device lays flat and square and Pin 4 oriented on the board before fluxing. 3) Use plenty of flux. 4) Solder a couple opposite corner legs down to establish the flat and squareness. 5) Solder the re- mainder of the legs with your chosen method, 6) Return the mod- ules and parts. 7) Check function. Immo issues on these are indi- cated with “No Start” in the odometer display. 8) GET PAID. The bottom ask if you Inoperabio key "oe Koy Pro USA LLC AANA TATA 0 0008[AtaGies Daren Dat Deve Render Grange — ‘eae Fanponde9 15,181 {his isa great introduction toa slighty more involved "EEPROM" jab uses it uilioes a 64 (quad fat peck MCU. But fortunately it can be road in circa withthe ORCS. These can use ‘multiple types of MCUs however they are allroad tho same, Maybe your or el locks Use one ofthese vans fora service vehicle. This would be a great epportniy fo practice 1-The Target Module is an ICU behind the 2. Start by removing the two screws instrument cluster, This is an easy module in the top of the cluster bezel toremove.3.Once the screws are removed, 4.The removed bezel, exposes the bezel can be unsnapped and two more T20 screws holding set aside the top cover for the cluster. ae a S 6, Unscrew he nal wo T20 that secure 5. Unsnap and set frei cur tine a Tote aside the top cover. — mcomnecton‘orthe custeris hinge ~S 7.Pull the top of the cluster rear-_ 8.Remove the target module, and ward and downward. The ICU is unplug it to take back to the easily seen and accessible. bench: « « « oi Mercedes Benz CkeyProusauc9.The label of the Target Module _10.Remove the back cover and on the bench. Visually verify yours then is similar before proceeding. securing the board into the bo: I 411 The circuit board removed from the box. 12.We need to check the ORGS before we (Our Target Device is easily seen now. Re- proceed. Connect the hardware and start the ‘member they can be sifferent device types. SW. Select Type Button 3-05 Immo> Mer- This particular one is 1L02M, ‘codes> SprintorVito 08AZ32A (L52H) 13.In the ORGS sw Click Help> Chip Info. This will display the solder points for the adaptor. FO AsiKEYPRE@ Device Render SMOK [Mrocammes Teo “Tape Modal Mole Loco gion Module “age Deve MCSI20 128 Read nor Ot nC rina Transponder 6 Gable Trane 96 IN treo PINeecin INN ey ‘This version ofthe Sprinter sa bit more involved than its previous incarnation. The Target _Modile is mare complicated to remove, The solder poins forthe SMOK are sigh smaller. So once you have conquered the Teme version, ive is E2S based system an attompt Ths isan ‘actuated ignition system, se donot attempt te fun the ignition lock prior fe programming. lied * 2.Remove two T20 screws ‘aka EZS, And its surrounded bya bunch of screws and plastic. from the lower dash panel. oe ‘these vehlotos using his Immo nystom when you are dene, The only adaitional Nave hmewsfaure rate tor tne lgmie lon media Wis Gre techniques you ‘cTivore you willbe capabie ofvopine- [pWTigliden mosaiandnavelthe, echieveshlawhenwe getetozerto that Fipummecrenayteriantavan sep. a oo — = = 3 Mercedes Benz (key Pro USALLC3.Remove the Small 4.Thenthe Larger 5. Now you can ac- Panelbelow the Panel under the cess headlight switch, steering column, to remove. 6.Unsnap and remove the Bez- 7, el around the radio and AC controls. Lots of plastic told ya This will give you access to yet an- other 120 screw in the gap between the AC vent and the cluster bezel trim and.set law : » aside. It 8 would be » easy to break if you lean on it. okey Pro USALLC Mercoen Gene10. Back on the left side of the column, 11.Thalsrightfoks, Remove the clustor. ft remove the T20 screw below the light | "SNPS straight towards the rear ofthe van suitch tached tothetoptrim. Sion Cle mesh wetness with this process. 12, Disconnect the single pug to the cluster in Fe ads a eo uong a small Orhan cgi ave", unscrew the ignition bezel. located in the top of the cluster “cave.” es Faroe ove, £23, 5 ac Suan av oTeT eT eres isoed ond © aPMar Tate Gelert oreo moved to your soldering station. Note It says EZS on the labelVecknaflthecasetoninetortiae 17-Remove the back ‘care ofthe plug pins that come thru the case. half and set aside. 18.Remove the two small Torx 19.Here isa front and back view of screws from the front of the ig- the circuit board nition module. Then the board Verily yours is similar. ‘and what tne amounts to the ig- nition lock wil slide out \ the back, 20 you open the SMOK help doc and goto 24, his is what SMOK provides He cr eevee 10 determine where to solder the adaptor leads to. arcades Benz (Key Pro USALLC22. Here is a blown up version, for our sight challenged readers. Fire uy the solder iron. llow is ingide rrreleles? 24.Now connect the solder adaptor to the SMOX hardware and the SMOK Usb to the pe. Start the software. 25 Heres even a closer view of my adaptor soldered tothe points, use a small section of speaker wie fo ease the coax connection as it seems slightly more dffeuitto solder. 25.Mei MCU> Motorola> MC> HC12> Te ‘ppeors tobe puzel Rs Bolfile. Even though it gives a warni ‘never had an issue adding33.You will be prompted to save the new bin file containing the new transponder in the Tango. Sa hare rate fr Rl ores « a a sume you have the common sense to re- tum to the SMOK and Open this new Tan {0 converted file. Write the fil to the de- Vice, assuring itis sil soldered up. Then. esolder and return tothe Sprinter Re- ‘member the ignition wll not tur il a pro= {grammed transponder is nionuved tot | ‘stronaly recommend chock tiple times as you start puting the back together, You don want to che ‘once and get dane to find out connection Is loose, Eventing the same for reading n= JEEPROM, but you must gon exa step and read the Fah daa by eelecing vom he |SMOK options. Mercedes Bone 34,And reminded that the device must be rewritten to complete the transponder adding process. ———_———r you ever need to replace an ignition module, yu wil ned o alo copy ove the Fash data rem the orginal device tote donc. fvc= HoTa> Secura> Fne> NOBST2> acs 2aseFLS SEC Wn bot saves soerup | ano ard wea fs of Ofer another bay | Key POUSALLG, aannananaaaaaaaaaaaididdDevice Reader Orange ‘Programmer: KeyClone [Fewenoiic cu Nols nai Bl iret her feztboen teen c Read In or Out: Out of Circuit [Oven Tmpmnen90 =~ Tampude 8.T ee inne Bt Stand lor Ot Convert 1 Gone Oot ey on Tames ‘his module Int erbly cet o remove, however when youd gt the mode i ate ‘you mil ave to desolder a 64 QFP. I may have been the condition of my part ‘r maybe not, but in removing the target module, mir damage occured. the section so that you might 20! make the same mistakes. A.The Target Module is located behind the 2. Stat the process by removing the fuse Instrument cluster. A few layers are be- panel cover on the driver's end ofthe snd the module currently. dash. ‘okey Pro USALLE4, Now the lower dash should drop down. Disconnecting all the wires is unnecessary. 3.Three Philips head screws secure the lower dash in place. ij Bieri the damage | montioned ear. IAs carefully a= poor ‘This thin piece of trim broke on both sides. My ‘snap the cluster trim from the ‘example was an early year, $0 maybe this is less front of the cluster. Iealy on ltr years, but bo careful ether way. bo 7.There are 4 Philips head 8. The cluster should be free now screws to remove that secure _ to pull outward. Disconnect 2 lev- the cluster in er type plugs from i's back. Mercedes Henz ‘©key Pro USA LLC. aannAAAA AMADA HNH10110000400400 AAA AEN9. With the cluster out of the 11.Remove the board from thé box. Make your pin 1 mark on the 10. The module is only held in with way, you can see the target ICU, Sal Plastic clips and there are two plugs to release. e board before proceeding too far. touse ther- mal tape to protect the surrounding compo- be shy with the tape, it isn't expen sive and ‘can save you tons of trouble. (key Pro USA LLC 44, Use your practiced techniques and gently lft the device out of circuit Carefully let it coo! in a safe location Mercedes Benz 12. Here is a slightly closer view. 1D69J equals MC68HCO5X32‘Locate the 086% OF adaperfortne ORGS. 18 stomevoas corey Ace us ‘There ae restos ontnesrtaca athe prt hat | Suse cave up heathen eter e as ce ha ‘We cred eda cir ye fo 17.Locate HCOSB/ ‘monte ht le ng ont ep tng HC705B adaptor. 19.Now = = 20.From the ORGS sw, you can in- [i 4-MTRK> stall the pial s: MC68HC05> MC68HC705X32. adaptors + =e = into the top of the OR- G6 hard- ware. And start the software. 2 Mercedes Bera Key Pro USA LLCBUEVVUVESVSSTIESUTSD DRED DDSESEeTTSTTCUEETES “Target Modale BOM “Tonge Devi Lk SOIC) Orginal Transponder Filips BIN Ene No pepe KeyClone penser 6 When the BCH number will ot erat va the O5D, you ook ai the sicher on the module. What happens if that sticker missing or damaged? Hore’ azoluton tht doesnt require either num: ‘ber beceuse BIN conversion results in « progranned transponder. Thi is an excellent beginner ‘example, no desoldering, simple device and easy reroval 4. Heres interior view ofthe dash area. Note the unmarked immo ight at approximatoly 2 o ‘dock in reference tothe anaiog clock A 2. The targt module leated behing a smal pan ‘tonto diver sie A pila, behind thee fot {eat The cover easy removes fora beter ew ‘This section would be con- BCM conversion system. See sidered a general guideline the end of the section | = ab- for any Nissan orInfinitiin breviated descriptions of the carly yearranges ofthe BCM Modules that apply. ‘okey Pro USALLE eee Nissan 14 dule) is 4. Remove the FIM along the door fame and 3 The the black box wih the wht label Remove he cet aside, Then remove the 1°! covering the a above the fot rest {CA andthe surrounding electronics. pp eer) 5. Unplug the tives plugs going nto he BCM. 6. ee thoso iarbanas Andityou choose to remove te ent bracket §e-7 yen an meteaicuny wort he BOM to securing he BCM. tar be removing the Soci nachos oe at tine OF 10MM bolt atthe base. OF the plas tabe by wedging the diver between simlartos wih your module. Note the part hum the bor and the metal racket, Do what werks brs et, and most portant ou usualy the8. Using a smalfat head you can work around the perimeter of the box and release the plastic ‘abs holding the back of the box on, s 11. Now that we have located our target device, we can connect our AR32 tis computer and star the ARS2 software by double clicking th, EPROM icon onthe desktor, 13, The device options screen should be similar to hia, with LOBR inthe top let and your hard ware settings deployed along the botom 10. Hore isthe BGM circuit boar roe of ts box From the help les of programmers tke the Tan {908 TMP, | know to ook for an SOR device 42. withthe ARS? sofware up and running, ther type your device ino using the PGON anc cursor arrows sro to the device type and it INSERT to select fom screen 14, erty that the series of wer connected to thei pos 8 ‘Nissan15. Once altho sotings are correct onthe AR. hardware attach the Pomona (Blue ip) tothe device, The brown wire on the ibbon cable ‘oud goto pin one. 17, Option 5 (uter Eder) shows us what was justread out ofthe device. Cick it and the ‘s2f66n should go from hs 19. Locate the C thats de ‘ated tothe same NICU that our You ‘can determine this because a 2 wil proxy Nissan 16. Option 3 onthe ARS2 software, READ DE- VICE INTO BUFFER, isthe command we use to extract a copy ofthe BIN inside the device. Press "Yt read frm beginning of the BIN 18, Tothis. However you can see there appears tobe no information here. Increase the voltage and tr to Read again, which Idi, to zero re- sults, Se deselder or try ths 20. Fux tho exposed legs on each ide ofthe nd solder a jumper from one othe oth the erystal rom allowing the MCU to interfere with our device reads, a a a a « « « « « s se s os = = e e se « s =e = « = a a « a «a «a «a «a «a « « « a key Pro USA Lic20, Reconnect the Pomona ip, and return to 21. We haven vee this BIN but do youre ‘step 18: Read the device again. Hopefuly the member the 1 to PN conversion? Look ‘esis of option 5 (Butler Ector wil lok similar closely, use your magination to see they re to this. here inthe fe 21. From the main AR eeoen, Lets select option 22. fall's well you wil ecele a GREEN Zero '8-Compate Device to Buffer Selt-explanatory Errors Found message inte bottom ght you tite, the AR2 wil reread the vee and com- receive a RED enor count message, acjust he are the orginal reat foow up read, pete and ty again. Green is Good 22. Upon receiving the Green Zero Erors Mes- 23. Now attach your KeyClone to the PC and 296, prion one is saving the BIN fl Start he supporting sofware you haven used will save tothe the programmer ia wile, dont be surprised computes dive afer you prove a fle name. there aro updates nooded. Aways improving ‘Key Pro USA LLC » » » > > » » » » e . . 2 > e 2 e » s » > . s » » » » . ® ® » » » » » , ,‘ight File ‘okey Pro USA.LLC28, With the appropiate transponder on the hardware, and the ‘Cick the Gen te New Key button, The TP Generated. OF ‘message in the daleg box means sucess, = (=) 31, Now retum to the AR32 software, we need to rogram the"IKC" BIN tothe devie, hopefully stil all connected. Option 1 Program Devic rom Disk Fila, then ALT “D"to view the es 138, From the fe selecton screen, it"F3" fo x0 are returns to the home scree ‘gram. The Benet {-P"}o proceed programming. 'S Ski nt me screen (Key Pro USA LLC, 30, Now Clik the “+= A" button, ep right and Select afl name for future searchabity |just 9 he programmers name to the lst fle ee area 32, Use the arow keys, lt he fe thatthe IKC created, Koep in mind tat he ARS2 only splays 8 character fio names. New fle may 3p ears as “4m 185-1 bin’ ve 4mB1BS08IKC: in 23, Assuming you gt the Groen Programming Someta mestage atthe bottom, yu are Sere. Ray Messages means revit ‘eto rermove the soldered on grounding mper rom sop 20. Return everyting os ght Caton and test ransponder function. Probably rot an everyday station But probably ig bucks Important the knowesoePARAARAAAAPAAAAAAAANAAAAAAAR EERE ERE REEEEEES 8 Nesan key ProUSA LLC |BIN Enc No PIN tin 6 No ‘his particular unt was sen by 3Jockzmiths balore Irecered te call. They had al wed various 02D ‘Programmers, bot legit and ler !atemptod witha oy ORD options. Everything fae wt Performed te folowing procedure. Iwas paid wel a 08 Should you succeed where many have aed. Hope this belps 1.0ur 2. Remove around the ignition lock. Itis easy remove, he column shroud. And the single bot tat se the lock housing See the next mage lar system is that many ODE programmers cannot com- fmunicate with this antique ‘@key Pro USALLC Nissan 93. Here is another angle with the 4nd there isthe bott. tis a Philips and serewdriver inplacetohsip 3 rue mataatona socket be vod reference th It's location. 5.Other than the single bolt. nothing 6 ,Pop the cover off and our Tar- else holds the module in and the ign get Device is immediately visible, tion lock doesn’ interfere with removal. is in the form of a 44 Leg PLCC. So this is one of the easiest ‘of the mod: les to get in hand. Great | to snag at the pick-your- own-parts ¥ FE lets .With some research, you can de- 81s your racteedecniquestodesolir the 44 Leq device, Remember to insulate the termine that this is a Texas InStru- ssrrounding components. Mark Pin 1 or take ments TMS370CO02. But by look- spite ing this sys- tem up in the Tango soft- ware prior to the work, I knew what to expect aeee sannaadssaasassdannaaaqnngqnn ae8.0nce The device is ree moved, lo- catethe TMS adap tor for the Org5. t should look similar to this one. 11.Load the adaptor withthe device mounted init into the Org5 hardware. | do not recom mend in staling the adaptor then the device Be- cause of the extra stain tis would cause to the hacd- 13.1f everything is set up, Click t Green “Read Button and hope- fully a BIN appears in the window. damaging the adap- tor. 412.Now open the Org5 software and Click the Select Type Button. Then MCU> TI(TX Instru.)> TMS370C002. 14.Just to be sure, before saving, Click the Yellow “C”ompare Button, to verify the accuracy,21 Back at the Org5, Open the Tango File with the ‘and double cl utton, “a 23.With the BIN fle correctly rewritten to the device, you have to cross the most ait- ficult bridge to complete the job. Remem- ber the basics when soldering the device SITE FOR PROFESSIONAL LOCKSMITHS, back, remove the excess solder, clean lacquer away, square the device on the pads, Pin 1 orient- ed, see the appen- Date: (Key Pro USA LLC Nissan 0iar Dre ees ——=oe “Target Device: 93LC66A (SOIC) . Read In or Out: Out of Circuit = rn ra racine _— Not Olam ne Os Cor BN Gv err ge a] ‘his is another example ofa high end vehicle tha is classified at tho easiest level of EEPROM work, The Target Module removes without any tools, The Target Device isa standard sized 8 leg. And if you can make a mechanical key fora VW, you can do this one using the same methods and tools. ‘These vehicles ulize an electonicaly acu 2.The PAS unit, our {ated ignition. Wait until ater the programming |s complete o attempt tuning the ignition lock 1 Porsche ©key Pro USA LLC TAATAAAT TATE AEEEEE3.This is the view ofthe ook- 4. But you do remove the seat hiss the view ing from the brake pedal towards the back The solo tem securing the PAS tothe vehicle i seat. dont remove the seat to remove the pls scrowat te base of the front edge, ‘And disconnect tvee plugs. 5:Here is the label on top of the PAS 6 Plastic tabs secure the lid on module, tomake sure you didn't around the thin edge. Our target manage to pull the wrong module. device is almost dead center. 7.Thsdovice's a gStCGEA, which ndicatosa 8. or take a Megamos 48 aysiam. i you encounter a 93LC55, CUE Ws hat my exami an exact mac to ‘move tobe 1907 Boxter section, as you are Yous, Insult, Isoe ard Ds ean wih TS system wih sight derences, _lape hee. Note hv close hose c Key Pro USALLC : = = = = = = = = = = = = = = = 2 Lal wo Lal | ll Lal e al 2 ° e " e e z e e Z Z ia8.You can solder the now desoldered 10.Connect device to the TMPro adaptor einsa vom board, or Iload thedeviceintoa us" clam shell type adaptor and then in-Tatpro hard. srt that into the d ware. And the [ill TMP;ro tothe PC via usb. went ahead and loaded » usable tran- ‘sponder into the aerial 11. With the Software up —_12. Then from the pop up window, seeand run- “ay Select the ap- as w= _ propriate de- ning, Click vice. In tis the Select case, 93066, and Raa ‘as TMPro ab- breviates the Memory device type ul vice : down to its a petee most simple —— 2 identi. 12th he TMPro here are minimal steps. 14 Now that we have already load- arta eden aa selact 92086, : eee & ceptable tran feadeandaus. | sponder into ‘denies the BIN | the hardware, fle to capi waiaralreacHil yeeros 3 3 Poche fay Pro USA LL‘Model Deve Renda ARE eee rag Tat Male PAS Medan: Uae Dive Se age Dee 3.64 6 9010 Read ner Out Ou of Get Sa ale Tampondagy TS TR IN Frere No PINatcin BIN: Ne i ‘hiss another example ofa high end vehicle that i classifi atthe easiest lovel of EEPROM work. The Target Module removes without any tls, The Target Device isa Standard sized 8 leg. And ifyou can make a mechanical key fora VW, you can do this one sing the same methods and tool. ‘These vehices vize an aectronically actu: 2-The PAS unit, our stedigntion. Wat unl after he programming |s complet to atterpt turning the igrton lock 5 Porsene DKey Pro USA Lic3.This is the view of the © look= 4. Buf you do remove the seat this s the view ing from the brake pedal towards the back The sole tem securing the PAS tothe verics f= Seat. don't remove the seat to remave the _@ plastic screw at tho baso of th front ego, 2 ‘And disconnect thre plugs 5.Here is the label on top of the PAS_6. Plastic tabs secure the lid on around module, to make sure you didn't the thin edge. Our target device is manage to pull the wrong module. near the large MCU on the board 7.This whchindicatesa 8M Megamos 13 system. tyou encounter a 93086, pote + move tothe 2003 Porsche 911 secton as you a. YOU, sus ate a8 De ‘dealing wih a 48 system wih sight diferences,'ekhee And nt (ere) POUSALLE Ponte .10. Wh he ARB2setnre up and uring, 2.bad thaldevice iio aeaee: ther type your device in or using the PGDN and. tor as quickly as possible 0 YOU cursor rows scolltothe device type and ht lessen the chance of dropping it_ !NSERT to select fom screen 11. The device options screen should be sim- 12 Very thatthe series of lar otis, with 93C56 inthe top left and yaur ARS2 ae set corectly, and aso the hardware settings cispayed along the bot- fo start and the de vice conecod tothe let postion, Option 3.on the ARS2 software, READ DE- 14, Option 6 (utr Edy) shows us what was VICEINTO BUFFER. isthe command weuse just readout of the deve Chek tand the Yoeetact a copy ofthe BIN inside he device, screen should go frm ths, Press“ trea fom begining ofthe BIN @ dl e oe e eo oe os oe oe oe es = = e- = = -« =- «= = = <= = <= 715 Tots lfyouset some dla, that's good you do. 16, From the main AR22 screen Let's se 15 Tome rom the main ARS2 screen Lats select op ‘ten inrose he votage check a setogs rd ton 8 Compare Device to Buffer. The AR32, a ee ee rand men Weave yl eread the device and compare he rial econ ok 6% fead to teflon up read. ‘7-Malliswellyou wil recive a GREEN Zero 18, Upon een the Green Zero Erors Message, Errors Found message inthe botom gh Ifyou prety eneis sar he SIN ie receive a RED error count message, adust the il ave fo amore secu lip, ee. and ty again ation of your enoosng ater you pos ae noe 48, Moving over'o the Tango, remember the 20. The Tango Info screen fr this systom. should appear. telus that we winged a TS region is where the car company is based, |E (OF TKSSS! to complete this process Porsche ie German so select Europo> Por. ‘sche> Boxter> 1996 (93058) ‘key Pro USA LLCROVER ® & Make Model Years 4 Fang = = = = : = = = = = = = 4Thisigntion wi ot un unt programmed van- 2 Our ponder nrodueed tothe ack. you make the inthe top, center of the upper dash ‘mechanical key fest. dont attempt totum sock Just below the can--—— er othe winds3 Pop the speaker cover saighiup Asmat! 4. Three torx serews hold the speak- fathead wilhep to unsnapit The cover would 6” in ‘be easy to break if you lean on or drop @ tool thr it 50 | would set tina safe pace 5 tubby OF 6 Disconnect and remove the speaker. Again W@8 it 8_how much would it suck e drop acriver close towhere the windshield meets the dash. through the font of hi speaker laying onthe Careful not io swing the wrench into the glass. drivers side oor? Probably $800 atthe dealer. ze ee 7 ifyou can lok straight down, from inside or Atp that got tom a great fckerith was to ‘outside he vehicle through the windshield, leave the box mounted, pig the module, and YoU can see the Target Module mounted to open the back of th box. Then you can slide Srewall, behind the radio, the ch tke an EWS un — —9:Here's the board coming out of 10, Overalll view to make sure the dash, We can take ito the sta- your board is very similar. tion for the simple soldering job. 11,And this is our c 12 you hook up the Org5 to the PC and 16381206128, Fortunately we Under the following do nothave to desolder this 80 Leg GFP. Rover> 14-This wil display the O195 ‘pinout forth 13.Now EM EREMISHCAIEIY Mosatar. Bosicaty wet vies toe te Oro ‘eed ogo to what points onthe board. For Help then Chip Info. iss wornin need te 4 wre adaptor ‘Okey ProUSALL Rover 3