E90Post
 


TireRack
 
BMW 3-Series (E90 E92) Forum > E90 / E92 / E93 3-series Technical Forums > BMW Coding > Can I read specific data from the CAS module with INPA



Reply
 
Thread Tools Search this Thread
      01-23-2012, 11:01 PM   #1
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

Can I read specific data from the CAS module with INPA

I need to program a new key ( I got an empty emergency key ) and I need to get the ISK keys from the CAS module so the new key would recognize the car.
From what I have read those keys are stored in the CAS module and a EEPROM dump of the CAS module contains that info but I was wondering if there is a way to just read the values through INPA or maybe some other BMW tool?
I have not gone over coding tutorial yet but if someone can confirm this data is available I would definitely do the rest.

Thanks!
pinky_and_me is offline  
0
Reply With Quote
      02-03-2012, 08:01 AM   #2
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

I looked into this. The easiest way will be to get a dump from the EEPROM, I know of no way to actually read the keys you are after.

By the way where did you get a blank key from? I am in the process of resoldering a new transponder chip onto a used key.
Sensible_ is offline  
0
Reply With Quote
      02-03-2012, 12:49 PM   #3
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

I got the key from ebay: http://www.ebay.com/itm/280764807715

It's only the plastic emergency key and it has a transponder chip in the head, I did try to read the chip and it seems to be empty so I just need the data to program it with.
I don't need the whole key, just the transponder so I don't know if that would work for you.

Any idea if the dump can be done via NCSExpert? I know that it reads the modules but I don't know if it can do a binary dump rather than interpreted data.

I would of thought INPA would have the capability to program a new key
pinky_and_me is offline  
0
Reply With Quote
      02-03-2012, 03:44 PM   #4
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

I see. I thought you were talking about the smart key 868mhz.

Anyway the technical side will be the same. I only achieved a Dump in older cars using such device as AK-90 tools which really do simplify things. However I don't see why ncs or progman couldn't read a binary dump, I dont have much experience in ncs though.

What format is the cas module in when you read it out at the moment?

Last edited by Sensible_; 02-03-2012 at 04:45 PM.
Sensible_ is offline  
0
Reply With Quote
      02-03-2012, 06:06 PM   #5
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

The DIYs for NCSExpert suggest the TRC dump files are text format with keywords but I am still waiting for my cable so I can check it out.
I'm also waiting for another device called bmw scanner 2.01 that supposedly can do a CAS EEPROM dump for my 2007 e90 but I'm a bit skeptical.

Also my keyfob is the 315Mhz but it should matter for the transponder as long as you can replace it. When I tried opening one of those things I had to break the shell and then I did not see the transponder on the board, or at least nothing that had markings for the transponder model that I expected to be there.
pinky_and_me is offline  
0
Reply With Quote
      02-03-2012, 06:38 PM   #6
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

The e90 smart keys in europe use Philips surface mounted soldered chip transponders such a PCF7945 chip. It's a tiny flash chip, not like the older transponders.

I'm also waiting for my cable, I have an early 08 e90. If you have any luck / ideas in the mean time let me know.
Sensible_ is offline  
0
Reply With Quote
      02-03-2012, 07:30 PM   #7
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

Will do, mine uses the PCF7945 as well (mid 07 e90) and the blank key I got has the same chip so the chance of success increases
Since there's no board in the emergency key I'm guessing you don't need to soldier the transponder on the board, you can probably just glue it to the fob somewhere and it should work if programmed correctly.
pinky_and_me is offline  
0
Reply With Quote
      02-04-2012, 08:50 AM   #8
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

Yeah that idea just occurred to me aswell. Do you have any links to a PCF7945 non soldered transponder? I'm not too bad at soldering but I would struggle with something that small. I can't seen to find any, although those blank emergency keys are dirt cheap. I guess I could just take one from there and as you say, glue it into a smart key casing and bingo, one functional blank immobiliser (once coded from a cas dump and the dump written back to the cas.) Obviously It wouldn't have the remote unlocking but luckily my car still has old fashioned lock on the drivers door.
Sensible_ is offline  
0
Reply With Quote
      02-04-2012, 10:18 AM   #9
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

I don't have links but I've found blank transponders online before - mostly from chinese sellers around $5-6 a piece.
I'm also hoping I don't have to write the CAS dump back since this is a blank transponder and as long as the ISN key is written on the transponder the car should be able to program it. From what I've read when you get a new key from the dealer they don't program the car in any way, just plug the new key in and wait a bit.
As for the remote unlocking, my local BMW indie shop told me that they can actually program that to work with my car but they can't do anything about the transponder so I won't be surprised if it's some setting somewhere in INPA.
pinky_and_me is offline  
0
Reply With Quote
      02-04-2012, 05:43 PM   #10
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

Aha, yeas there is an option in the ecu menu to SET a key using the stalk on the left han side of the wheel.

So as long as the transponder was blank and has the 'secret code' from the CAS dump the car will acknowledge it and the. It can be activated in the car itself.

With regards to keyless entry I was meaning remote unlocking, I.e. pushing the unlock button. If the new transponder isn't soldered on the buttons won't communicate with our new transponder if that makes sense.
Sensible_ is offline  
0
Reply With Quote
      02-04-2012, 06:05 PM   #11
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

Just regarding the transponders. The PCF7936 seems a good option. It's hitag2 like the 42 and 45 but doesn't require soldering. I think the valet key you linked to uses this sort of chip.
Sensible_ is offline  
0
Reply With Quote
      02-05-2012, 04:34 PM   #12
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

This is worth looking at.

http://www.autokeyprog.com/cat_doc/BMW_KeyCoder.pdf

It seems I was wrong, ISN can be read via ODB without EEPROM dump. Shame all the program's that do it are well out of my price range
Sensible_ is offline  
0
Reply With Quote
      02-05-2012, 05:02 PM   #13
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

I've seen this too but I suspect they are doing a dump over the OBDII port and extracting the ISN from it.
I hope that the hitag2 software is extracting the keys from the CAS dump as well so if we can get the dump via NCSExpert I hope we can program a blank key and let the car add it automatically. And if not if NCSExpert can read a EEPROM dump it should be able to write a modified version as well.
pinky_and_me is offline  
0
Reply With Quote
      03-11-2012, 02:37 AM   #14
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

Any updates regarding this? I haven't had much time recently to play
Sensible_ is offline  
0
Reply With Quote
      03-11-2012, 01:29 PM   #15
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

Nope, it seems that it's near impossible to get the CAS EEPROM area that we need from the module. Apparently BMW had an update early 2011 that completely disabled the download via the OBDII port and, although there is some crazy expensive hardware that can supposedly do it, I don't think it can be done. INPA, NCSExpert and even WinKpf do not seem to touch that area of the CAS ever. On top of that I did get some software updates in early 2011 from the dealership so it seems cheaper to spend the $200 on a new key from the dealer and be done with it.
pinky_and_me is offline  
0
Reply With Quote
      03-11-2012, 10:05 PM   #16
Ndx
Second Lieutenant
 
Drives: 2011 328i Xdrive
Join Date: May 2011
Location: Canada, Ontario

Posts: 266
iTrader: (1)

Hello,

It is possible to get CAS up to CAS3 ...
Its not easy and not something that I recommend doing unless you are doing it for leaving because it can cost more money if something goes wrong ..

Easy but expensive solution is tool from Simon ...

Google "BMW Simon Touch"
Ndx is offline   Canada
0
Reply With Quote
      03-12-2012, 12:02 PM   #17
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

that's a shame. Oh well, I'll continue a bit of research. To be honest I'm working on my own service app although it's taking ages sniffing the data transfer.
Sensible_ is offline  
0
Reply With Quote
      03-12-2012, 05:35 PM   #18
Ndx
Second Lieutenant
 
Drives: 2011 328i Xdrive
Join Date: May 2011
Location: Canada, Ontario

Posts: 266
iTrader: (1)

Those chips are encrypted and most likely if you will try on to boot and use wrong pass. It will erase so be careful ..
Ndx is offline   Canada
0
Reply With Quote
      03-21-2012, 10:38 AM   #19
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

ndx,

I think we have established the chip specs. We just need a viable way of reading a CAS data dump, ideally through ODB.
Sensible_ is offline  
0
Reply With Quote
      03-21-2012, 12:58 PM   #20
JimVR4
Second Lieutenant
 
JimVR4's Avatar
 
Drives: 09 328i M-Sport 6MT
Join Date: Nov 2011
Location: San Jose, CA

Posts: 289
iTrader: (0)

Have you looked into Revtor's NCS_Dummy? It is supposed to be able to anaylze trace dumps and dissassemble modules. I am totally new with it myself but there is a great deal of information on Bimmerforums for it.
__________________
2009 E90 328i ///M-Sport / Blue Water Metallic / Oyster/Black Dakota / PP / 6MT / 194M / Comfort / iPod+USB w/ProClip charging dash mount / $494 /
1995 3000GT Spyder VR4
JimVR4 is offline   United_States
0
Reply With Quote
      03-21-2012, 01:53 PM   #21
pinky_and_me
Second Lieutenant
 
pinky_and_me's Avatar
 
Drives: N54 335xi
Join Date: Feb 2011
Location: Cleveland, OH

Posts: 275
iTrader: (0)

I've looked into that, the trace files part is for regular coding, the disassemble part is the ability to deduce all the options a module supports from the DATEN files for the module. It doesn't actually do anything with the car directly.
From what I have read none of those touch the secure part of the CAS that contains the data I need.
pinky_and_me is offline  
0
Reply With Quote
      04-14-2012, 06:46 AM   #22
Sensible_
Lieutenant
 
Drives: 2008 E90
Join Date: Feb 2012
Location: London

Posts: 412
iTrader: (0)

Ok,

Plenty of tools which, are astronomically over priced, and have the ability to read a CAS DUMP through the ODB port, so it is possible.

Is there anyone out there with one of these tools that would be willing to assist in helping us create a free solution, through understanding the communication through the virtual comport?

If so, please send me a PM.
Sensible_ is offline  
0
Reply With Quote
Reply

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -5. The time now is 04:07 AM.




e90post
Powered by vBulletin® Version 3.7.0
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
1Addicts.com, BIMMERPOST.com, E90Post.com, F30Post.com, M3Post.com, ZPost.com, 5Post.com, 6Post.com, 7Post.com, XBimmers.com logo and trademark are properties of BIMMERPOST