Can I read specific data from the CAS module with INPA

pinky_and_me · 01-23-2012, 11:01 PM

I need to program a new key ( I got an empty emergency key ) and I need to get the ISK keys from the CAS module so the new key would recognize the car.
From what I have read those keys are stored in the CAS module and a EEPROM dump of the CAS module contains that info but I was wondering if there is a way to just read the values through INPA or maybe some other BMW tool?
I have not gone over coding tutorial yet but if someone can confirm this data is available I would definitely do the rest.

Thanks!

Sensible_ · 02-03-2012, 08:01 AM

I looked into this. The easiest way will be to get a dump from the EEPROM, I know of no way to actually read the keys you are after.

By the way where did you get a blank key from? I am in the process of resoldering a new transponder chip onto a used key.

pinky_and_me · 02-03-2012, 12:49 PM

I got the key from ebay: http://www.ebay.com/itm/280764807715

It's only the plastic emergency key and it has a transponder chip in the head, I did try to read the chip and it seems to be empty so I just need the data to program it with.
I don't need the whole key, just the transponder so I don't know if that would work for you.

Any idea if the dump can be done via NCSExpert? I know that it reads the modules but I don't know if it can do a binary dump rather than interpreted data.

I would of thought INPA would have the capability to program a new key

Sensible_ · 02-03-2012, 03:44 PM

I see. I thought you were talking about the smart key 868mhz.

Anyway the technical side will be the same. I only achieved a Dump in older cars using such device as AK-90 tools which really do simplify things. However I don't see why ncs or progman couldn't read a binary dump, I dont have much experience in ncs though.

What format is the cas module in when you read it out at the moment?

pinky_and_me · 02-03-2012, 06:06 PM

The DIYs for NCSExpert suggest the TRC dump files are text format with keywords but I am still waiting for my cable so I can check it out.
I'm also waiting for another device called bmw scanner 2.01 that supposedly can do a CAS EEPROM dump for my 2007 e90 but I'm a bit skeptical.

Also my keyfob is the 315Mhz but it should matter for the transponder as long as you can replace it. When I tried opening one of those things I had to break the shell and then I did not see the transponder on the board, or at least nothing that had markings for the transponder model that I expected to be there.

Sensible_ · 02-03-2012, 06:38 PM

The e90 smart keys in europe use Philips surface mounted soldered chip transponders such a PCF7945 chip. It's a tiny flash chip, not like the older transponders.

I'm also waiting for my cable, I have an early 08 e90. If you have any luck / ideas in the mean time let me know.

pinky_and_me · 02-03-2012, 07:30 PM

Will do, mine uses the PCF7945 as well (mid 07 e90) and the blank key I got has the same chip so the chance of success increases

Since there's no board in the emergency key I'm guessing you don't need to soldier the transponder on the board, you can probably just glue it to the fob somewhere and it should work if programmed correctly.

Sensible_ · 02-04-2012, 08:50 AM

Yeah that idea just occurred to me aswell. Do you have any links to a PCF7945 non soldered transponder? I'm not too bad at soldering but I would struggle with something that small. I can't seen to find any, although those blank emergency keys are dirt cheap. I guess I could just take one from there and as you say, glue it into a smart key casing and bingo, one functional blank immobiliser (once coded from a cas dump and the dump written back to the cas.) Obviously It wouldn't have the remote unlocking but luckily my car still has old fashioned lock on the drivers door.

pinky_and_me · 02-04-2012, 10:18 AM

I don't have links but I've found blank transponders online before - mostly from chinese sellers around $5-6 a piece.
I'm also hoping I don't have to write the CAS dump back since this is a blank transponder and as long as the ISN key is written on the transponder the car should be able to program it. From what I've read when you get a new key from the dealer they don't program the car in any way, just plug the new key in and wait a bit.
As for the remote unlocking, my local BMW indie shop told me that they can actually program that to work with my car but they can't do anything about the transponder so I won't be surprised if it's some setting somewhere in INPA.

Sensible_ · 02-04-2012, 05:43 PM

Aha, yeas there is an option in the ecu menu to SET a key using the stalk on the left han side of the wheel.

So as long as the transponder was blank and has the 'secret code' from the CAS dump the car will acknowledge it and the. It can be activated in the car itself.

With regards to keyless entry I was meaning remote unlocking, I.e. pushing the unlock button. If the new transponder isn't soldered on the buttons won't communicate with our new transponder if that makes sense.

Sensible_ · 02-04-2012, 06:05 PM

Just regarding the transponders. The PCF7936 seems a good option. It's hitag2 like the 42 and 45 but doesn't require soldering. I think the valet key you linked to uses this sort of chip.

Sensible_ · 02-05-2012, 04:34 PM

This is worth looking at.

http://www.autokeyprog.com/cat_doc/BMW_KeyCoder.pdf

It seems I was wrong, ISN can be read via ODB without EEPROM dump. Shame all the program's that do it are well out of my price range

pinky_and_me · 02-05-2012, 05:02 PM

I've seen this too but I suspect they are doing a dump over the OBDII port and extracting the ISN from it.
I hope that the hitag2 software is extracting the keys from the CAS dump as well so if we can get the dump via NCSExpert I hope we can program a blank key and let the car add it automatically. And if not if NCSExpert can read a EEPROM dump it should be able to write a modified version as well.

Sensible_ · 03-11-2012, 03:37 AM

Any updates regarding this? I haven't had much time recently to play

pinky_and_me · 03-11-2012, 02:29 PM

Nope, it seems that it's near impossible to get the CAS EEPROM area that we need from the module. Apparently BMW had an update early 2011 that completely disabled the download via the OBDII port and, although there is some crazy expensive hardware that can supposedly do it, I don't think it can be done. INPA, NCSExpert and even WinKpf do not seem to touch that area of the CAS ever. On top of that I did get some software updates in early 2011 from the dealership so it seems cheaper to spend the $200 on a new key from the dealer and be done with it.

Ndx · 03-11-2012, 11:05 PM

Hello,

It is possible to get CAS up to CAS3 ...
Its not easy and not something that I recommend doing unless you are doing it for leaving because it can cost more money if something goes wrong ..

Easy but expensive solution is tool from Simon ...

Google "BMW Simon Touch"

Sensible_ · 03-12-2012, 01:02 PM

that's a shame. Oh well, I'll continue a bit of research. To be honest I'm working on my own service app although it's taking ages sniffing the data transfer.

Ndx · 03-12-2012, 06:35 PM

Those chips are encrypted and most likely if you will try on to boot and use wrong pass. It will erase so be careful ..

Sensible_ · 03-21-2012, 11:38 AM

@ndx,

I think we have established the chip specs. We just need a viable way of reading a CAS data dump, ideally through ODB.

JimVR4 · 03-21-2012, 01:58 PM

Have you looked into Revtor's NCS_Dummy? It is supposed to be able to anaylze trace dumps and dissassemble modules. I am totally new with it myself but there is a great deal of information on Bimmerforums for it.

pinky_and_me · 03-21-2012, 02:53 PM

I've looked into that, the trace files part is for regular coding, the disassemble part is the ability to deduce all the options a module supports from the DATEN files for the module. It doesn't actually do anything with the car directly.
From what I have read none of those touch the secure part of the CAS that contains the data I need.

Sensible_ · 04-14-2012, 07:46 AM

Ok,

Plenty of tools which, are astronomically over priced, and have the ability to read a CAS DUMP through the ODB port, so it is possible.

Is there anyone out there with one of these tools that would be willing to assist in helping us create a free solution, through understanding the communication through the virtual comport?

If so, please send me a PM.

01-23-2012, 11:01 PM	#1
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	Can I read specific data from the CAS module with INPA I need to program a new key ( I got an empty emergency key ) and I need to get the ISK keys from the CAS module so the new key would recognize the car. From what I have read those keys are stored in the CAS module and a EEPROM dump of the CAS module contains that info but I was wondering if there is a way to just read the values through INPA or maybe some other BMW tool? I have not gone over coding tutorial yet but if someone can confirm this data is available I would definitely do the rest. Thanks!
	Appreciate 0 Tweet Quote

02-03-2012, 08:01 AM	#2
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	I looked into this. The easiest way will be to get a dump from the EEPROM, I know of no way to actually read the keys you are after. By the way where did you get a blank key from? I am in the process of resoldering a new transponder chip onto a used key.
	Appreciate 0 Quote

02-03-2012, 12:49 PM	#3
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	I got the key from ebay: http://www.ebay.com/itm/280764807715 It's only the plastic emergency key and it has a transponder chip in the head, I did try to read the chip and it seems to be empty so I just need the data to program it with. I don't need the whole key, just the transponder so I don't know if that would work for you. Any idea if the dump can be done via NCSExpert? I know that it reads the modules but I don't know if it can do a binary dump rather than interpreted data. I would of thought INPA would have the capability to program a new key
	Appreciate 0 Quote

02-03-2012, 03:44 PM	#4
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	I see. I thought you were talking about the smart key 868mhz. Anyway the technical side will be the same. I only achieved a Dump in older cars using such device as AK-90 tools which really do simplify things. However I don't see why ncs or progman couldn't read a binary dump, I dont have much experience in ncs though. What format is the cas module in when you read it out at the moment? Last edited by Sensible_; 02-03-2012 at 04:45 PM..
	Appreciate 0 Quote

02-03-2012, 06:06 PM	#5
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	The DIYs for NCSExpert suggest the TRC dump files are text format with keywords but I am still waiting for my cable so I can check it out. I'm also waiting for another device called bmw scanner 2.01 that supposedly can do a CAS EEPROM dump for my 2007 e90 but I'm a bit skeptical. Also my keyfob is the 315Mhz but it should matter for the transponder as long as you can replace it. When I tried opening one of those things I had to break the shell and then I did not see the transponder on the board, or at least nothing that had markings for the transponder model that I expected to be there.
	Appreciate 0 Quote

02-03-2012, 06:38 PM	#6
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	The e90 smart keys in europe use Philips surface mounted soldered chip transponders such a PCF7945 chip. It's a tiny flash chip, not like the older transponders. I'm also waiting for my cable, I have an early 08 e90. If you have any luck / ideas in the mean time let me know.
	Appreciate 0 Quote

02-03-2012, 07:30 PM	#7
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	Will do, mine uses the PCF7945 as well (mid 07 e90) and the blank key I got has the same chip so the chance of success increases Since there's no board in the emergency key I'm guessing you don't need to soldier the transponder on the board, you can probably just glue it to the fob somewhere and it should work if programmed correctly.
	Appreciate 0 Quote

02-04-2012, 08:50 AM	#8
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	Yeah that idea just occurred to me aswell. Do you have any links to a PCF7945 non soldered transponder? I'm not too bad at soldering but I would struggle with something that small. I can't seen to find any, although those blank emergency keys are dirt cheap. I guess I could just take one from there and as you say, glue it into a smart key casing and bingo, one functional blank immobiliser (once coded from a cas dump and the dump written back to the cas.) Obviously It wouldn't have the remote unlocking but luckily my car still has old fashioned lock on the drivers door.
	Appreciate 0 Quote

02-04-2012, 10:18 AM	#9
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	I don't have links but I've found blank transponders online before - mostly from chinese sellers around $5-6 a piece. I'm also hoping I don't have to write the CAS dump back since this is a blank transponder and as long as the ISN key is written on the transponder the car should be able to program it. From what I've read when you get a new key from the dealer they don't program the car in any way, just plug the new key in and wait a bit. As for the remote unlocking, my local BMW indie shop told me that they can actually program that to work with my car but they can't do anything about the transponder so I won't be surprised if it's some setting somewhere in INPA.
	Appreciate 0 Quote

02-04-2012, 05:43 PM	#10
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	Aha, yeas there is an option in the ecu menu to SET a key using the stalk on the left han side of the wheel. So as long as the transponder was blank and has the 'secret code' from the CAS dump the car will acknowledge it and the. It can be activated in the car itself. With regards to keyless entry I was meaning remote unlocking, I.e. pushing the unlock button. If the new transponder isn't soldered on the buttons won't communicate with our new transponder if that makes sense.
	Appreciate 0 Quote

02-04-2012, 06:05 PM	#11
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	Just regarding the transponders. The PCF7936 seems a good option. It's hitag2 like the 42 and 45 but doesn't require soldering. I think the valet key you linked to uses this sort of chip.
	Appreciate 0 Quote

02-05-2012, 04:34 PM	#12
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	This is worth looking at. http://www.autokeyprog.com/cat_doc/BMW_KeyCoder.pdf It seems I was wrong, ISN can be read via ODB without EEPROM dump. Shame all the program's that do it are well out of my price range
	Appreciate 0 Quote

02-05-2012, 05:02 PM	#13
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	I've seen this too but I suspect they are doing a dump over the OBDII port and extracting the ISN from it. I hope that the hitag2 software is extracting the keys from the CAS dump as well so if we can get the dump via NCSExpert I hope we can program a blank key and let the car add it automatically. And if not if NCSExpert can read a EEPROM dump it should be able to write a modified version as well.
	Appreciate 0 Quote

03-11-2012, 03:37 AM	#14
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	Any updates regarding this? I haven't had much time recently to play
	Appreciate 0 Quote

03-11-2012, 02:29 PM	#15
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	Nope, it seems that it's near impossible to get the CAS EEPROM area that we need from the module. Apparently BMW had an update early 2011 that completely disabled the download via the OBDII port and, although there is some crazy expensive hardware that can supposedly do it, I don't think it can be done. INPA, NCSExpert and even WinKpf do not seem to touch that area of the CAS ever. On top of that I did get some software updates in early 2011 from the dealership so it seems cheaper to spend the $200 on a new key from the dealer and be done with it.
	Appreciate 0 Quote

03-11-2012, 11:05 PM	#16
Ndx Second Lieutenant 27 Rep 289 Posts Drives: 335i Join Date: May 2011 Location: CA NY iTrader: (1)	Hello, It is possible to get CAS up to CAS3 ... Its not easy and not something that I recommend doing unless you are doing it for leaving because it can cost more money if something goes wrong .. Easy but expensive solution is tool from Simon ... Google "BMW Simon Touch"
	Appreciate 0 Quote

03-12-2012, 01:02 PM	#17
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	that's a shame. Oh well, I'll continue a bit of research. To be honest I'm working on my own service app although it's taking ages sniffing the data transfer.
	Appreciate 0 Quote

03-12-2012, 06:35 PM	#18
Ndx Second Lieutenant 27 Rep 289 Posts Drives: 335i Join Date: May 2011 Location: CA NY iTrader: (1)	Those chips are encrypted and most likely if you will try on to boot and use wrong pass. It will erase so be careful ..
	Appreciate 0 Quote

03-21-2012, 11:38 AM	#19
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	@ndx, I think we have established the chip specs. We just need a viable way of reading a CAS data dump, ideally through ODB.
	Appreciate 0 Quote

03-21-2012, 01:58 PM	#20
JimVR4 Captain 345 Rep 842 Posts Drives: 21 X5 M50i M-Sport Join Date: Nov 2011 Location: San Jose, CA iTrader: (0)	Have you looked into Revtor's NCS_Dummy? It is supposed to be able to anaylze trace dumps and dissassemble modules. I am totally new with it myself but there is a great deal of information on Bimmerforums for it. __________________ 2021 G05 X5 ///M50i / Phytonic Blue / Cognac Vernasca iStep 03/2023.50
	Appreciate 0 Quote

03-21-2012, 02:53 PM	#21
pinky_and_me Second Lieutenant 13 Rep 294 Posts Drives: N54 335xi Join Date: Feb 2011 Location: Cleveland, OH iTrader: (0)	I've looked into that, the trace files part is for regular coding, the disassemble part is the ability to deduce all the options a module supports from the DATEN files for the module. It doesn't actually do anything with the car directly. From what I have read none of those touch the secure part of the CAS that contains the data I need.
	Appreciate 0 Quote

04-14-2012, 07:46 AM	#22
Sensible_ Colonel 532 Rep 2,503 Posts Drives: 2008 E90 Join Date: Feb 2012 Location: London iTrader: (1)	Ok, Plenty of tools which, are astronomically over priced, and have the ability to read a CAS DUMP through the ODB port, so it is possible. Is there anyone out there with one of these tools that would be willing to assist in helping us create a free solution, through understanding the communication through the virtual comport? If so, please send me a PM.
	Appreciate 0 Quote