This article shares the tutorial explaining how to find pin codes for some older cars.
1. Alfa Romeo /Fiat /Honda
With the Alfa Romeo, Fiat & Honda Delphi immobiliser it is possible to add slave keys directly to the eeprom without affecting the tally to the engine ECU.
See below for key code location.
By replacing the original code with the code for a known key there is no need for any key programming.
Simply edit the buffer, reprogram the eeprom and solder it back on the immobilizer board.
Then program the new key to the relevant code. See below for the codes to enter into the eeprom, and the corresponding codes to program the key.
Key type = Megamos 13
Key code =
RED. 69 40 37 91 76 FC FE 03
BLUE R 69 30 BB F8 F6 61 FE03
BLUE 69 30 BB 34 16 FC FE 03
Immo code =
06 6D 41 8
86 7C 78 3D
86 7C 14 85
Note
It is not possible to add a red key in this way as it affects the tally to the engine ECU.
Red code applies only to matched eeprom files with 3 keys already programmed (e.g IAW 49F etc.)
2. Fiat / Alfa Files
ALFCO4RN.ECU = ALFA BOSCH ENGINE ECU. 24C04 IN RUN (REMOVE IMMO OR PROG KEYS)
ALFEARLY.IMM = ALFA EARLY YELLOW IMMO VIRGIN. 93C46 DIL THROUGH THE BOARD.
ALFDELPH.IMM = ALFA DELPHI IMMO VIRGIN. 93C46 SOIC (SURFACE MOUNT)
ALF22718.IMM = ALFA 60622718 YELLOW IMMO VIRGIN. 93C46 SOIC.
ALFGTVRN.ECU = ALFA GTV MC68HC11E1 52 PIN IN RUN FILE.
FIABOSMK.ECU = FIAT BOSCH ECU. 24C04 3 MASTER KEYS PROGRAMMED
FIABOSRN.ECU = FIAT BOSCH ECU. 24C04 IN-RUN (REMOVE IMMO OR PROG KEYS)
FIABRAVO.ROF = FIAT BRAVA / BRAVO 93C46 VIRGIN ROOF REMOTE REMOTE
FIADELMK.IMM = FIAT DELPHI IMMO. 93C46 3 MASTER KEYS PROGRAMMED.
FIADELVG.IMM = FIAT DELPHI IMMO. 93C46 VIRGIN FILE (PROG KEYS)
FIA4EFVG.IMM = FIAT IAW 4EF ECU. 25080 VIRGIN FILE. (PROG 3 KEYS)
FIA49FMK.ECU = FIAT IAW 49F ECU. 95040 3 MASTER KEYS PROGRAMMED.
FIA49FVG.ECU = FIAT IAW 49F ECU. 95040 VIRGIN FILE (PROG 3 KEYS)
FIACPERN.ECU = FIAT COUPE IAW 4WF. 68HC11E1 52 PIN IN RUN FILE. (REMOVE IMMO)
FIAULYRN.ECU = FIAT ULYSSE IAW 8P22 68HC11A1 52 PIN IN RUN FILE.
FIAYELVG.IMM = FIAT BOSCH YELLOW IMMO 93C46 VIRGIN FILE. (PROG KEYS)
FIA11111.BSI = FIAT PUNTO BODY CONTROL UNIT. 93C66 FILE PIN 11111.
3. FIAT Immobiliser. (Marelli)
Temic 11 key.
The 28 pin device is read as an MC68HC05E6.
The key location varies from unit to unit. As a guide the key data consists of 3 bytes of information, repeated 2, 3, 4 or even 5 times.
Usually on line 010 and 040 towards the end (i.e. address 01E or 01F, 04E or 04F) you will find key data which is only repeated twice.
CHECK AND DOUBLE CHECK THAT THE KEY DATA IS NOT REPEATED ANYWHERE ELSE !!
And the replace the original data with :-
F0 A5 71
Use the Temic 11 T5 masterchip or enter the following code with RW2,3 or 4 :-
A5 8E 7D 5F 00 00 00 0F
A5 8E 7D 5F 00 00 00 0F
4. FIAT IAW 16F xx type ECU’s
The 68 pin PLCC Device is read as an MC68HC11F1
Read the device and then edit line 120 with the following :-
FF FF FF FF FF FF 00 00 FF FF FF FF
leave the rest of the line as it is.
This will put the ECU into a condition where it will run the car without the immobiliser connected, or, if you prefer, you can virginise the immobiliser and cycle 3 keys as per factory.
If you choose to not use the immobiliser make sure that it cannot be re-connected, as this will re-immobilise the ECU.
2 Key Fiat System
Keys can now be added to the Fiat Punto body control unit in the same way as the earlier Fiat immobilisers.
The device is a 93LC66 and should be programmed as a 93C66x16.
The 1st key is located at address :- 0001-0004 repeated at 01A5—01A8
2nd key 0005-0008 repeated at 01A9—01AC
A genuine Fiat crypto 48 chip is needed (from scrap yard key etc.).
Read the key with T-Prog or RW4 and type the first 4 bytes in reverse order over one of the existing keys in both locations.
i.e. CA 42 D6 06 Will become 06 D6 42 CA in UPA USB
Citroen Relay / Peugeot Boxer
Works in a similar way to the 2 key Fiat system.
Device is a 93C56
1st key is located at :- 0000—0003 repeated at 0080—0083
2nd key 0004—0007 repeated at 0084—0087
Reverse the bytes in the same way as the Fiat.
Alfa Romeo. Immobiliser 606 22718
Adding keys.
93C46 device located next to the relay.
Typical Screen Dump.
0000 0405 0704 2C21 2200 A4E2 0001 0804 0462
0010 6208 FFFF 6706 47F1 EF11 00D7 8FF6 0A05
0020 00B5 ???? ???? 00?? 7A0F 699F 000A 0000
0030 0000 0000 0000 0000 0000 0000 0000 0000
0040 0000 0000 0000 FFFF FFFF FFFF FFFF FFFF
0050 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
0060 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
0070 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
The question marks represent the key code.
Replace your original code with :-
1E 21 AA 65 42
Then program key chip to match :-
Philips 33
0F 80 21 2C 42 AA 65 1E
21 BF 40 00 00 00 00 00
BMW EWS Reader
This adapter is the single 52 pin socket with the BROWN device socket.
Device is = MC68HC11EA9
Oscillator Khz speed needs to be set to 8000
Works on 046J and 047J devices. (EWS 2 and 3, 3+)
The unused keys have the 12 bytes of revolving code still set as FF, whereas on the used keys the revolving code is in use and contains hex information. Locate the first unused key by looking for the first 12 bytes of FF , the 10 bytes preceding the 12 bytes of revolving code are the fixed code for the key.
This should be programmed to a new blank transponder chip, which should then start the car.
Ford Coded access
It is now possible to turn many Ford ECU’s from coded access back to timed access to eliminate the need for “In codes”.
This works successfully on all late vehicles using the DPC or LP range of ECUs. Which includes Focus, Transit, Transit Connect etc. etc.
You have the option of virginising the ECU, or editing the original file to retain the pump tally on diesel vehicles. This means that you only have to program the keys to get the vehicle running.
Device is a 95040
Modify the File in the following way :-
Address 000C to 0057 should be all 00 00 00 etc.
Line 0060. 00 02 D3 E9 F4 FA FD 00 00 00 00 00 00 00 00 00
Line 0070. 00 01 22 20 F1 F8 00 0A 00 00 00 01 22 20 F1 F8
Line 0080. 00 01 22 20 F1 F8
Leave the rest of the file as it is.
Re-program the device and re solder it. You should now be able to program keys by the
Jaguar XJ 6
1994—1997 with LNA type security module mounted in the boot, n/s near fuel filler cap Device is a 93C46. Re-program with the file below, program a Megamos 13 transponder chip with the key data below, and the vehicle will start.
File is JAGLNAMK.IMM
Key Data = FF 81 34 58 62 6C C6 65 Read with Genie, AD 90 etc.
89 B1 19 97 FD 07 D2 60 Read with RW 2 etc.
VW Audi Skoda Seat Instruments
Most of the VAG Instrument clusters on later cars contain the 4 digit PIN required for programming keys. This information is usually stored in an 8 pin SOIC eeprom mounted on the circuit board. The devices are usually clearly labelled (i.e. 93c66, 93c86, 24c02 etc.) so identifying the correct device is not difficult.
The following pages contain a number of screen shots showing the location of the PIN, and how it is calculated.
Early A3, A4, Skoda etc.
PIN of this vehicle is 0471. Take the 2 pairs of highlighted numbers above (71 04 ) and swap the pairs around.
Note the address label at the left hand side ( 000001F0 ) To arrive at the screen above you will need to scroll to the bottem of the screen dump.
Late Audi A3, A4 A6 etc
The PIN is repeated 3 time on most VAG immobilisers. With the screen dump above the number is FE 25. To arrive at the correct PIN you must swap the pairs around i.e. 25 FE and then convert from hexadecimal. The calculator included in Microsoft Windows is ideal for this. Simply start the calculator program, from the VIEW button select scientific, then highlight the HEX button, type in 25FE and highlight the DEC button. The converted PIN is 9726
Late Golf, Bora etc
With 93C86 eeprom carries the PIN at the end of the 14 digit immobiliser number. Again repeated 3 times but this time not a hex conversion. Simply read as is i.e. 84 94
VW Passat, Audi A4 A6 etc
Another variation on the 93C86 program. This time the PIN is repeated 3 times at the end of the third 14 digit number. Once again reverse the pairs i.e. D2 1F becomes 1F D2 and the convert to decimal with the calculator. PIN = 8146
Late Golf etc. 24C08
PIN not repeated 3 times. Swap the pairs i.e. 75 06 becomes 06 75, Then use calculator to convert from hex. PIN = 1653
VW Golf etc. 24C02
The PIN is repeated 3 times. Swap the 2 pairs i.e. 57 73 becomes 7357 and read as is, no conversion.
Seat Ibeza etc. 93C66
Repeated 3 times. Swap the pairs and read as is. i.e. 76 72 becomes 7276
VW / AUDI FILES
VWTDIVG.ECU = VW TDI ECU 24C04 VIRGIN FILE
All other files are for reference, and or recovery of corrupt program.
EARLY VW Immobiliser box.
Device = MC68HC05B6
PIN Number is located at address 091 & 092 (191 & 192, 193 &194 if using the developer board) then repeated at 093 & 094 i.e.
09 BD 09 BD
hex convert. = 2493
VW Valeo immobiliser.
Device = 24C04
PIN is located at :
66 & 67
112 & 113
1BE & 1BF
Reverse the pairs and hex convert.
Engine ECU 2001+ Audi,VW, etc. 24C04 device
Diesel engines from 2001 on with 24C04 device.
Read the chip and check for the 14 digit security number and VIN. If these are located in the right hand (ASCII) display, then the PIN will be located at 12E-12F and then repeated at 160-161. Reverse the pairs and hex convert.
Engine ECU 2001+ Audi, VW etc. 95040 device
Diesel engines from 2000 with 95040 device.
PIN is located at 32-33 and repeated below at 42-43. Reverse the pairs and hex convert
PEUGEOT CPH IMMOBILISER PIN NUMBERS.
DEVICE IS AN ST95040 or 93C66
THE PART NUMBER (PRINTED ON THE CPH LABEL) IS LOCATED AT ADDRESS 023. IF IT READS CORRECTLY THEN READ THE NUMBER AS IS.
i.e 1B 0E 06 22 = RE6Y
IF THE PART NUMBER DOES NOT READ CORRECTLY, THEN THE HEX DUMP NEEDS TO SWAP BYTE. THIS MEANS THAT EACH 2 PAIRS OF NUMBERS NEED TO BE SWAPPED AROUND.
E.G.
01 41 03 02 C1 04 22 1D BECOMES:-
41 01 02 03 04 C1 1D 22
READ PIN NUMBER AFTER BYTE SWAP – NOT BEFORE !!!!
THE PIN NUMBER IS LOCATED 3 TIMES AT ADDRESS :-
0DD – 0E0
15D – 160
1DD – 1E0
AFTER READING THE 4 BYTES FOR THE PIN CODE, USE THE TABLE BELOW TO DECODE THE PIN.
0=00 I=12
1=01 J=13
2=02 K=14
3=03 L=15
4=04 M=16
5=05 N=17
6=06 O=18
7=07 P=19
8=08 Q=1A
9=09 R=1B
A=0A S=1C
B=0B T=1D
C=0C U=1E
D=0D V=1F
E=0E W=20
F=0F X=21
G=10 Y=22
H=11 Z=23
ROVER FILES
ROV25RN.ECU = ROVER 25 ECU 93C66 IN RUN FILE
ROVMEM19.ECU = ROVER MEMS 1.9 93C46 IN RUN FILE (CUT PIN 13)
ROV220TD.ECU = ROVER 220 TDI FBW 93C46 EDGE OF BOARD IN RUN FILE
ROV220TE.ECU = ROVER 220 TDI FBW 93C46 MIDDLE OF BOARD IN RUN
ROV400RN.ECU = ROVER 400 DIESEL ECU 93C46 IN RUN FILE
ROV825RN.ECU = ROVER 825 V6 MEMS 2J 93C66 IN RUN FILE
ROVMEM16.ECU = ROVER MEMS 1.6 PT No MNE10127 93C46 IN RUN CUT13 ROV
ROVMETRN.ECU = ROVER METRO MNE101270BA 93C46 IN RUN FILE
ROVMGFRN.ECU = MGF VVC ECU 93C66 IN RUN FILE
ROVMGZRN.ECU = MGZ ECU 93C66 IN RUN FILE
ROVMEM2J.ECU = ROVER MINI DUEL PORT 93C66 IN RUN FILE
ROVER 600/800 + Honda . Valeo box
Device is MC68HC05B6
Address line 10 (110 if using developer board). Should be 10 bytes of information. 1st 5 are key No.1. the 2nd 5 bytes are key No. 2.
i.e. If 10 bytes = 0A 01 02 03 04 — 05 06 07 08 09
To program the Phillips 33 key. Prefix the 1st 5 bytes with FF FF F5. i.e.
Key No 1 = FF FF F5 0A 01 02 03 04
FF FF F5 0A 01 02 03 04
To Add a key to a Toyota ECU or Immobiliser
Read the key to be added in a Genie, RW4 or similar. Note the first 5 bytes of the “TIRIS FORMAT” data.
Now place the bytes in the following order :- 3rd, 2nd, 5th, 4th.
E.g. 7E BC 42 35 08 will become 42 BC 08 35. This is the information that you will use to replace one of the existing keys with when you read the ECU or Immobiliser dump.
Toyota / Lexus 4C VVTI.
Some of the vvti ECU’s split the key data into 2 pairs of bytes. Read the transponder in TIRIS format as with the previous example. The bytes are swapped in the same way. i.e 3rd, 2nd, 5th, 4th.
So in the screen dump below the TIRIS read for the first master key (outlined in red) would be 7E 7A 79 63 01 xx xx xx xx .
The first 2 bytes to enter in the ECU would be the 3rd, and then second i.e. 79 7A. These would be entered over the top of the first 2 bytes of the first master key.
The second pair of bytes are entered in the same way, but over the top of the existing bytes in the lower red box.
It is essential that the new key information is entered in the correct place. If you put the first 2 bytes over the top of key 1, and the second pair of bytes over the top of key 2 or 3 IT WILL NOT WORK!!
VAUXHALL / OPEL FILES
VAU012VG.ECU = VAUXHALL 0281010012 ECU 24C04 VIRGIN FILE
VAUOMERN.ECU = VAUXHALL OMEGA 0261203272 ECU 24C02 IN RUN FILE
VAUVECDE.ALM = VAUXHALL VECTRA DELPHI ALARM 93C46 VIRGIN
VAUVECVG.GBX = VAUXHALL VECTRA B/BOX ECU 24C02 VIRGIN
Vauxhall early immobiliser ( up to 1999 ) PIN number follows chassis number in the text. It is always repeated twice.
VOLVO, Early models with Renix ECU These units can be put into a running condition without the immobiliser.
The 52 pin PLCC device should be read as an MC68HC11E9-old Files are in the relevant folders.
Hope it helps.
Leave a Reply