Vida CEM swapping

[stevedi]

Read UEM with im608 and program remote

Only new with codes label.

Someone have any clue how to program used fobs? I know its possible if you have the old UEM with keyfob to move fobinfo from UEM to another used UEM. But thinking of keyfob without known UEM? Theres a encryptioncode i think is needed for it to work afaik?

there is a paper published called 'Dismantling Megamos Crypto', that will be your starting point

[scaro]

Only new with codes label.

Someone have any clue how to program used fobs? I know its possible if you have the old UEM with keyfob to move fobinfo from UEM to another used UEM. But thinking of keyfob without known UEM? Theres a encryptioncode i think is needed for it to work afaik?

there is a paper published called 'Dismantling Megamos Crypto', that will be your starting point

Yes i know, but this is not transponder to start car that i was thinking of. Its about the HCS412i inside fob. They work a bit similiar. If it possible to read it or write known info to it, or different method to make it work in different UEM?

[Treur]

Someone have any clue how to program used fobs? I know its possible if you have the old UEM with keyfob to move fobinfo from UEM to another used UEM. But thinking of keyfob without known UEM? Theres a encryptioncode i think is needed for it to work afaik?

there is a paper published called 'Dismantling Megamos Crypto', that will be your starting point

Yes i know, but this is not transponder to start car that i was thinking of. Its about the HCS412i inside fob. They work a bit similiar. If it possible to read it or write known info to it, or different method to make it work in different UEM?

Read datasheet. You can’t read/write/erase without code.

[scaro]

Yes i know that i need that code. (the one on tag when buying) thats why i ask if someone have made it work. But seems no one have or want to talk about it.
Its on the HCS412i and its not possible to retrive then. I thought maybee it was possible to erase it and make a new code and info without that but seems not doable.
Its possible on megamoscrypto to "renew" but not on this thats why i asked.

[KaoReal]

In terms of actually adding these fobs, I have new fob with the two codes, but IM608 doesn't seem to be able to add remotes. 2004 XC90. IM608 only goes to 2005 for support, and while it does seem similar, it requests both CEM and UEM data, and the pinouts shown do not match for either. Is it possible through OBD with VDASH?

[scaro]

I have only moved/added info from used UEM to other UEM. Never used new fobs. But have alot of used keys and fobs but not all of them have UEM/fobs that match.

[stevedi]

If you have the UEM pin (i dont know what it is, would love to know, someone DM me) you can read and write the fob list manually, otherwise you have to use the official method with the 2 serials on a new fob only

[bosse]

U guys know by now its keeloq system.
There is a way to get the codes.
Im quality sure its possible with a flipper or similar.
There is a lot of information about this.
But im not the man with skills or patients.

[scaro]

U guys know by now its keeloq system.
There is a way to get the codes.
Im quality sure its possible with a flipper or similar.
There is a lot of information about this.
But im not the man with skills or patients.

Yes it is, thats why i said "similiar" megamos crypt. I have thougt about this, but its alot of other things to do. Dont have any Flipper either, not yet anyway. Dont seems like i need it for more than this right now and its a bit much for only this. I dont own any P2 at the time but fun to read and learn how it works.

[stevedi]

Don't need a flipper, just use an SDR dongle and SDR#. record the audio from the frequency that matches the remote, open it in audacity, zoom all the way in, and decode your 1s and 0s manually.

Thats how I broke direktstart FM remotes 15 years ago.