[joekitch]

so, our keyfobs are basically $10 in cheap chinese parts sold at a 3000% markup.
using a used key is notan option since the keys come flashed from the factory specific to your car.....
but the only thing that gets flashed is some cheap generic eeprom chip...

think its possible to just get a used key for $20, desolder the flashable eeprom chip, find the exact same chip online from china for $5 per 500, then just go to a dealer or friendly indie shop and ask them to flash it to your car?

would this work?

[Sensible_]

Originally Posted by joekitch

so, our keyfobs are basically $10 in cheap chinese parts sold at a 3000% markup.
using a used key is notan option since the keys come flashed from the factory specific to your car.....
but the only thing that gets flashed is some cheap generic eeprom chip...

think its possible to just get a used key for $20, desolder the flashable eeprom chip, find the exact same chip online from china for $5 per 500, then just go to a dealer or friendly indie shop and ask them to flash it to your car?

would this work?

What is your aim? Creating virgin keys, I take it for a decent price?

You can buy the hitag chips for very cheap, and yes, they can be easily soldered...

It's a simple process.

The hard part is programming them.

[joekitch]

Originally Posted by Sensible_

What is your aim? Creating virgin keys, I take it for a decent price?

You can buy the hitag chips for very cheap, and yes, they can be easily soldered...

It's a simple process.

The hard part is programming them.

i wouldn't mind paying a dealer to program, honestly, it if the keyfob itself is cheap as beans (a comfort access keyfob from a wrecked e90 goes for like $50 on ebay, if even that)

[snaimpally]

There is a company that will do it for you for $50:

http://www.keylessentryremotefob.com...p/bmwflash.htm

[joekitch]

Originally Posted by snaimpally

There is a company that will do it for you for $50:

http://www.keylessentryremotefob.com...p/bmwflash.htm

i guess the question is, if they wipe the eeprom chip, is it then totally indistinguishable from a "virgin" keyfob? will dealer programming successfully activate it?

[Sensible_]

By the way, just so you know. EEPROM is not a chip. It is a type of memory in the HITAG2 Chip used in these types of fob.

The EEPROM area of the chip can probably be erased by some sort of BDM tool. They are fairly cheap. I wouldn't even take it to a dealer. Good Indy should have the correct tools, they are $500 upwards.

[joekitch]

Originally Posted by Sensible_

By the way, just so you know. EEPROM is not a chip. It is a type of memory in the HITAG2 Chip used in these types of fob.

The EEPROM area of the chip can probably be erased by some sort of BDM tool. They are fairly cheap. I wouldn't even take it to a dealer. Good Indy should have the correct tools, they are $500 upwards.

i was under the impression the whole point of that particular chip in the keyfob is that it has a non-writeable first sector that is specific to the car it's programmed to, and cant really be erased. As in, it can only be written to ONCE and its stuck there until the chip is destroyed

i called the people that offer that flash service at keylessentryremotekeyfob.com and asked how it works.....they themselves dont actually know, they send it to some guy to do it.
i wonder if it needs to be formatted beforehand in some BMW specific way?
or if he literally just goes "BALEET ALL" on his little tool and its good to go?


ON THE UPSIDE; my nearby dealer will code a keyfob (even a CA keyfob bought online) for only $75, not bad at all

[Sensible_]

Yes it does have a one time programable area but often the chip can be erased by 'reballing' the IC. Or as I suggested reading the EEPROM directly from the chip and, modifying it then writing it back.

The bit of protected information is known as the ISN or ISK. It's a secret key which is used in a handshake between CAS unit and key.

[joekitch]

Originally Posted by Sensible_

Yes it does have a one time programable area but often the chip can be erased by 'reballing' the IC. Or as I suggested reading the EEPROM directly from the chip and, modifying it then writing it back.

The bit of protected information is known as the ISN or ISK. It's a secret key which is used in a handshake between CAS unit and key.

waaaaaitminute, reballing as in baking it to release the solder, replacing the solder balls and baking it again to set? i'm used to reballing in the video game console sense of the word (literally adding solder balls to the CPU or GPU chip).

and this ISN/ISK, is it a value specific to your bmw or is it just a generic "this chip is supposed to be in a bmw keyfob yo" type thing?

if it is as you say and all the eeprom stuff you care about for reprogramming a key is that flexible, that's great.

[335NJ]

If you guys can figure this thing out, as far as enrolling keys into these cars with ANY keyfob, virgin, etc. You'd also be a HUGE help to the automotive locksmithing industry.

Since our only option is to directly write keys into the CAS manually.

[Sensible_]

Originally Posted by joekitch

waaaaaitminute, reballing as in baking it to release the solder, replacing the solder balls and baking it again to set? i'm used to reballing in the video game console sense of the word (literally adding solder balls to the CPU or GPU chip).

and this ISN/ISK, is it a value specific to your bmw or is it just a generic "this chip is supposed to be in a bmw keyfob yo" type thing?

if it is as you say and all the eeprom stuff you care about for reprogramming a key is that flexible, that's great.

The ISN is used in a calculation between fob and CAS module in car. The ISN is unique to the particular CAS module, it is not generic.

ISN is stored in CAS EEPROM. Most 3rd party key programmers will read a section of CAS EEPROM and extract ISN.

It is not a simple process. Like I said before, creating a Virgin fob is easy. The hard part is programming it.

[snaimpally]

Originally Posted by Sensible_

By the way, just so you know. EEPROM is not a chip. It is a type of memory in the HITAG2 Chip used in these types of fob.

The EEPROM area of the chip can probably be erased by some sort of BDM tool. They are fairly cheap. I wouldn't even take it to a dealer. Good Indy should have the correct tools, they are $500 upwards.

Exactly! EPROM = Eraseable Programmable Read Only Memory. It is normally read only but it can be erased and it can be re-programmed using special equipment. For older EPROMs, I think UV light was used to erase. Then they came up with electrically eraseable PROMs (EEPROMs). Special control signals are used to reprogram the chip, but otherwise it behaves like a ROM.

[diezzler]

Old thread, but same question in the area. I just retrofitted comfort access into my car. Since it's practically impossible to get a CA key from the dealer, and my only option is to send someone my CAS to sync virgin made keys, could a swap work? If I take one of my good keys and desolder the hitag key and transplant it into a used CA key, would this work. Technically it would have my vin and ISN number now. Not so sure if the transponder codes are stored in this chip..?
Thanks

[matteblue3er]

Look up AK90.

It's a setup (software and interface) that is used for programming key fobs.

They sell clones for pretty cheap.

[335NJ]

Originally Posted by matteblue3er

Look up AK90.

It's a setup (software and interface) that is used for programming key fobs.

They sell clones for pretty cheap.

Won't do CAS. It might do early model CAS types, but E9x start at CAS2 and go up to CAS3+ depending on MY.

[Levanime]

what is done is, you read they keyfob,

then you read CAS, decrypt, add readed Keyfob info to it, crypt, flash to CAS,

sync cas and dme,

thats it.

[Sensible_]

Just google BMW Multi Tool. It's expensive but it's the best way to keep program without bricking your CAS. Buy, use, sell on eBay to recoup some costs...easy.