Key Fob programming?

[amagalla]

Hello all,

I see all over the place Porsche owners with key fobs that they can't use because they don't have the program code for the fob. Because of this, they have to throw away a perfectly good, working fob, then buy a new one for $200, then have it reprogrammed. There are 2 eprom chips on the fob. Is there anyone out there with a universal eprom reader/programmer and a spare throwaway key fob that is willing to see if the program code is saved on one of the eproms, and if it can be rewritten?

Here are a couple of images of the fob board. The chip with the most promise is on the top right side.





Tony

[amagalla]

Bump on this. Any adventurous soul looking for a challenge?

[JFP in PA]

The Porsche key fobs are not programmed in the field, they come with codes already burned onto them; the cars are programmed to accept the key fob and its codes, not the other way around. As there is no way to change the key codes in the field, without the proper key information to feed to the car, the key becomes a paper weight.

[amagalla]

I know that the code is in the fob. The problem that I see is that there are TONS of fobs out there that can't be used because the owner didn't retain the programing tag with the code on it (who does). What I'm asking is; "Is there the possibility that the code is stored on one of the chips on the fob? And if so, is it recoverable if it can be read with an eprom reader?" If the programing code that is normally on the tag is stored in one of the eproms, and it's readable, that means all those paperweights are now useful fobs.

[JFP in PA]

Originally Posted by amagalla

I know that the code is in the fob. The problem that I see is that there are TONS of fobs out there that can't be used because the owner didn't retain the programing tag with the code on it (who does). What I'm asking is; "Is there the possibility that the code is stored on one of the chips on the fob? And if so, is it recoverable if it can be read with an eprom reader?" If the programing code that is normally on the tag is stored in one of the eproms, and it's readable, that means all those paperweights are now useful fobs.

I do not think what is on the key is everything you would need. The keys came with IPAS code tags, some forty or so digits in length, which are fed into the PIWIS system where an algorithm creates a separate code in the car's security system, which will recognize the key code when it receives it. From what I have seen is stored on the car's security system, it is not simply the code in the key, it is more complicated than that, so I think you are still in the paperweight mode.

[Qmulus]

The chips are not readable. It is a very common practice in microprocessors to lock the code, with no way to read the contents. You _might_ be able to erase and reprogram it, but even that is not guaranteed. These are not just EEPROMs, but ICs dedicated to function in key fobs where security is part of the design.

The only way that I can see to reuse a fob is to find the alarm/immo module that the fob was originally used in, find the code for that fob (the data stored is NOT that 16 or however many character long string), and program it into another alarm module. I don't even think locksmith tools have the ability to decrypt these codes. I THINK PST2s will show you the code of the fob currently being used from data received by the alarm module, but I don't know if it will show the code of a fob that is not matched to the module.

The actual key programming (immobilizer) is pretty straight forward. In fact, I have an Audi switch blade key for one of my spares, but I do not have a spare remote/fob for unlocking the car.

[sjg1138]

Does anyone know where I can get the data sheets for the chips that are in the Fobs? I agree with Amagalla in that maybe we can get the code out of a Key Fob. If that can be done, the Fobs will no longer be paperweights. We would still need to goto the dealer with the Fob to have the code programmed into the car's computer, but at least we won't have to purchase new (expensive) key Fobs from the dealer.

I have searched on the Microchip website but can not identify the large chip in the Fob.
It seems like the part number is something like: 025O1Y9 but I am having issues reading it off of the pictures Amagalla took. Can anyone identify the chip and point me to the Data Sheet? With this info I think we can determine whether or not we can get the Code out of the chip.

I have an extra Fob but don't really want to de-solder the battery holder (to see the chip) unless I have a method lined up to try to read the chip.

[sjg1138]

I'm betting it is something like this:
MCS3142 - Security- KEELOQ® Encoder Devices

What model year car is this remote for? Part of the code on the chip could be the year (02) followed by the month (50).

The first

[iklimeno]

The smaller one (SOP-16 package) is 315MHz ASK/FSK transmitter TDA5101 by Infineon.

[Qmulus]

Originally Posted by amagalla

I know that the code is in the fob. The problem that I see is that there are TONS of fobs out there that can't be used because the owner didn't retain the programing tag with the code on it (who does). What I'm asking is; "Is there the possibility that the code is stored on one of the chips on the fob? And if so, is it recoverable if it can be read with an eprom reader?" If the programing code that is normally on the tag is stored in one of the eproms, and it's readable, that means all those paperweights are now useful fobs.

After looking into this, I am convinced that yes, a random key fob is and always will be a paperweight. The ICs used are designed so that the programming data cannot be read. You may be able to re-write them, but without knowing what data to put into them, and how to sync that data with the alarm/immobilizer module, that ability is useless as well. From what I can tell, even if you do retain the programming tag, after a certain number of key presses that data may no longer be valid. The way Porsche implemented the remote access security is very good. We should be happy about that.

Bottom line, don't lose your keys. The fobs can be repaired with new switches and cases, but you can't just pick up a random fob and program it to work in your car.

[RichRobby]

What about a cheap way to get an original key for a particular car working again? Tried all the suggestions I've found in various threads

Sent from my ONE A2003 using Tapatalk

[particlewave]

Originally Posted by RichRobby

What about a cheap way to get an original key for a particular car working again? Tried all the suggestions I've found in various threads

Sent from my ONE A2003 using Tapatalk

What's the problem and what have you tried?

[RichRobby]

Originally Posted by particlewave

What's the problem and what have you tried?

The key works manually, starts the car etc but the remote buttons don't work. Sent it away to be physically refurbished so pretty sure the hardware is OK. Forget exactly what I have tried, it was a while ago but suggestions such as putting it in the lock and turning it whilst holding various buttons etc has not 'reprogrammed' it.

Sent from my ONE A2003 using Tapatalk

[particlewave]

Ah. Does the light come in when the button is pressed? Aside from replacing the buttons, I'd also reflow all solder joints. The boards can flex a bit from harder button presses and after 12-20 years, the boards can get fragile and even crack (so fine that it's hard to see with the naked eye).
If you've tried the proper procedures, I'd guess a physical problem.

[RichRobby]

Yes, the lights come on. Thing is I sent to a company to refurbish it so I have to assume that it is OK physically etc.

Sent from my ONE A2003 using Tapatalk

[RichRobby]

To clarify a little better, the working key light flashes quick, many times a second whereas the non working one flashes maybe twice a second at best. It has a new battery.
Also the circuit boards are slightly different between the two. Only had the car about 8 months so maybe it's not an original key and never has worked remotely.

Sent from my ONE A2003 using Tapatalk

[WorkInProgressK]

Worst case. Probably isn't the right FOB.

I have the same issue. From what I read on the WWW, they have a life span. Over a certain number of uses they lock themselves or stop working(not sure which is true). Just like butt dialing, you can ?key dial?. That is the most compelling reason I have seen.

You can purchase a new one for around 125$. But to have it programmed by an Indy-tech, you need the immobilizer codes. Allegedly you can get them at the dealership. This is where I stopped. I haven't gotten around showing up at a dealer yet.

I believe the Pro version of the durametric can program also, which is what most indy- techs have I presume.

Originally Posted by RichRobby

The key works manually, starts the car etc but the remote buttons don't work. Sent it away to be physically refurbished so pretty sure the hardware is OK. Forget exactly what I have tried, it was a while ago but suggestions such as putting it in the lock and turning it whilst holding various buttons etc has not 'reprogrammed' it.

Sent from my ONE A2003 using Tapatalk

I just wanted to add. The key has an RFID for the mechanical side. That should be very easy to duplicate because of the nature of the function. To be honest tapping into the RFID system & tumbler with aftermarket FOB would be more cost effective in the long term. A screwdriver with the proper RFID would start the car.

[JayG]

Originally Posted by WorkInProgressK

Worst case. Probably isn't the right FOB.

I have the same issue. From what I read on the WWW, they have a life span. Over a certain number of uses they lock themselves or stop working(not sure which is true). Just like butt dialing, you can ?key dial?. That is the most compelling reason I have seen.

You can purchase a new one for around 125$. But to have it programmed by an Indy-tech, you need the immobilizer codes. Allegedly you can get them at the dealership. This is where I stopped. I haven't gotten around showing up at a dealer yet.

I believe the Pro version of the durametric can program also, which is what most indy- techs have I presume.



I just wanted to add. The key has an RFID for the mechanical side. That should be very easy to duplicate because of the nature of the function. To be honest tapping into the RFID system & tumbler with aftermarket FOB would be more cost effective in the long term. A screwdriver with the proper RFID would start the car.

For starters, a Durametric WILL NOT program the immobilizer for a key. It can ONLY be done with PWIS or PST2 and even if you have one of those, you need the special security codes that only a dealer can get

If you can find a fob with barcode for $125, that is a great deal. The best $ I have found is $137. Without bar code, its useless

I have never heard that a fob just stops working after a certain number of uses. Switches may wear out and boards start to fail, but not at a certain number of uses

As far as the RFID, its a little "pill" in the key fob and easily moved from one to another
If you want to mess with this on your car, be my guess. Its not worth it

There are many threads here and other forums about key fob programming and replacememnt

[WorkInProgressK]

Originally Posted by JayG

For starters, a Durametric WILL NOT program the immobilizer for a key. It can ONLY be done with PWIS or PST2 and even if you have one of those, you need the special security codes that only a dealer can get

If you can find a fob with barcode for $125, that is a great deal. The best $ I have found is $137. Without bar code, its useless

I have never heard that a fob just stops working after a certain number of uses. Switches may wear out and boards start to fail, but not at a certain number of uses

As far as the RFID, its a little "pill" in the key fob and easily moved from one to another
If you want to mess with this on your car, be my guess. Its not worth it

There are many threads here and other forums about key fob programming and replacememnt

sunset porsche parts
************************************************** **********************
http://www.********************************************** **************************.com/porsche/boxster/98663724418/2001-year/roadster-s-trim/3-2l-h6-gas-engine/electrical-cat/keyless-entry-components-scat/?part_name=transmitter

Sorry I may have been wrong with the durametric. But new head for 130$ is a really good price.

Newport beach Porsche did program it for free. Still trying to revive my old key fobs. They even provided the immobilizer codes when I asked!

[JayG]

Next time I need one, Ill drive to Newport Beach Porsche!