Login Register

Reusing Old Remote, How I do it.

Post Reply
mikeak2001
Posts: 38
Joined: 30 Mar 2021, 15:45
Year and Model: S70 1998 T5
Location: Wales
Has thanked: 4 times
Been thanked: 37 times

Post by mikeak2001 »

Hi everyone.
Had a little search but couldn't see anyting about reusing old remotes so I though I'd post my routine to help people out.

In order to use remotes that have not come with packaging, we will need both the UEM and the current remotes that are linked to it.
Once the data has been read from the used UEM, you can either dispose of it or keep it as a spare.

We start off with reading the data from the used UEM, this can be done several ways. Either by stripping the mirror down and directly connecting a programmer to the circuit board, or, in my case, I use IOterminal for this particular part.

When we have the EEprom read and the data saved we need to perform the same routine on the vehicle the remotes will be programmed to.

Once the data reading is complete, we need to boot up this software (or it can be done manually, this will be shown later).


Image

We load up our doner EEprom file and we can see the remote data that is needed in order to make the remotes work with our vehicle.

Image

I note down all data, then close the program.
I open the EEprom file from the vehicle that the remotes are being programmed to and add the data we just wrote down from the last file.
As you can see here, the vehicle I was programming the remotes to already had position 1, 2 and 3 used, so i added them to position 4 and 5.
This way if the customer finds any of their old remotes then they can still be used.

Image

All that is left to do now is save the file, then which ever method you used to read the UEM, perform this in reverse to flash the NEW EEprom file back to it.
All it took then was a couple of presses on the lock/unlock of the remote and they work with the vehicle.


There is a way to do this manually, however i have Various programmers that don't require dismantling the UEM.
Once you have the EEprom bin file, the remote data is stored in the following location for remote No 4. just work backward in the file for remote 3 then 2 then 1 or the other way etc..

Hope this helps some people.


Image

For those who want to look at the files I have attached them here:
Attachments
S60 UEM REMOTES MAT.rar
(1.48 KiB) Downloaded 24 times

scot850  
Posts: 15483
Joined: 05 Apr 2010, 14:46
Year and Model: 2000 V70 R
Location: Calgary, Alberta, Canada
Has thanked: 2197 times
Been thanked: 1850 times

Post by scot850 »

This is above my head, but to try to see if I understand this at all let me ask this question.

So to re-use an old key, this is only possible if you have the UEM (part of the rearview mirror assembly) with the used keys that came from that car? I see loads of keys being sold for P2's which is mostly pointless unless you have the UEM and buy aftermarket cases with key blanks to have cut to your car. You then have to break open the old fob to salvage the transponder without breaking that and then refit everything into the new case to make an old key internals useable?

With the price of key fobs and programming these days this process makes more sense as time has gone on.

Neil.
2006 V70 2.5T AWD Polestar tune
2000 V70 R - still being an endless PITA
2006 XC70 - Our son now has this and still parked in our garage
2003 Toyota 4Runner V8 Limited
2015 Kia Sportage EX-L - Sold
1993 850 GLT -Sold
1998 V70 XC - Sold
1997 Volvo 850 SE NA - Went to niece in California - Sold
2000 V70 SE NA - Sold

mikeak2001
Posts: 38
Joined: 30 Mar 2021, 15:45
Year and Model: S70 1998 T5
Location: Wales
Has thanked: 4 times
Been thanked: 37 times

Post by mikeak2001 »

Yes, you will need the data from the original UEM.
up to around 2003/2004 there was a separate remote and key. After this Volvo started producing the flick out key top and remote, both were sold separately, and each is programmed in, key is programmed to the CEM, remote is programmed to the UEM.

You can programme the flick out key type to the earlier vehicles, when I worked for Volvo we performed this action a few times. essentially all types are the same but in a different form factor.

Keys are a different procedure, but the remotes are supplied with hex data printed on the packaging. once the remove is programmed, we used to destroy the packaging for security.

The only way to recover that data is to read out the eeprom data of the UEM.

scot850  
Posts: 15483
Joined: 05 Apr 2010, 14:46
Year and Model: 2000 V70 R
Location: Calgary, Alberta, Canada
Has thanked: 2197 times
Been thanked: 1850 times

Post by scot850 »

Thanks for confirming what I already thought I knew about this. I see several people selling use fobs. Can the fob portion without the flip key be reprogrammed without the code from the original packaging? As the main 'security function' is the key/antenna function is it the CEM that needs the security code from the packaging or do both need it?

I know people are able to read the CEM PIN# and program some functions on their cars. I was recently PM'ing with a guy who suggested I could do that so I can install and program electrically folding mirrors which he had done. As our recent purchase of an 06 V70 AWD showed it has a fairly basic spec, not even a central kid door lock option button on the central stack. It only had one button on the center stack under the climate system, where our son's 06 XC70 has about 6 button functions. I don't need them all, but it would be nice to be able to program those functions without dealer support.

As I only have the one thing to get programmed I will just get the dealer to do it for me. I know the guys there including the service manager and they have given me a good price to do it.

Thanks for sharing all this info, much appreciated!

Neil.
2006 V70 2.5T AWD Polestar tune
2000 V70 R - still being an endless PITA
2006 XC70 - Our son now has this and still parked in our garage
2003 Toyota 4Runner V8 Limited
2015 Kia Sportage EX-L - Sold
1993 850 GLT -Sold
1998 V70 XC - Sold
1997 Volvo 850 SE NA - Went to niece in California - Sold
2000 V70 SE NA - Sold

mikeak2001
Posts: 38
Joined: 30 Mar 2021, 15:45
Year and Model: S70 1998 T5
Location: Wales
Has thanked: 4 times
Been thanked: 37 times

Post by mikeak2001 »

scot850 wrote: 01 Apr 2026, 19:10 Thanks for confirming what I already thought I knew about this. I see several people selling use fobs. Can the fob portion without the flip key be reprogrammed without the code from the original packaging? As the main 'security function' is the key/antenna function is it the CEM that needs the security code from the packaging or do both need it?
Yes the details off the packaging is required if you were to use official methods of programming such as Vida.
The only alternative is something as per my original post, so to answer the question of ebay remotes, they will be no good unless you have the details.
In regard to the key/antenna, this is for the actual flip key itself, there is a chip inside the top of the key and this is programmed to the CEM, the remote however is programmed to the UEM (Rear View Mirror)
scot850 wrote: 01 Apr 2026, 19:10 I know people are able to read the CEM PIN# and program some functions on their cars. I was recently PM'ing with a guy who suggested I could do that so I can install and program electrically folding mirrors which he had done. As our recent purchase of an 06 V70 AWD showed it has a fairly basic spec, not even a central kid door lock option button on the central stack. It only had one button on the center stack under the climate system, where our son's 06 XC70 has about 6 button functions. I don't need them all, but it would be nice to be able to program those functions without dealer support.
By cracking and reading the CEM pin, this enables you to change the config of the car. as you stated.... adding things like power fold mirrors. Some options like this are available from the dealership, however, some options are not, for example heated seats.
By acquiring the CEM pin and some software you have the availability to perform more advanced option changes, most only require adding some parts like the seat heat pads and the switches. Then adjust the vehicle config.

A recent project car of a friend saw me install quite a few things such as:
power fold mirros with BLIS and home lighting
compass mirror
heated seats
rain sensor for automated wipers
fog lights
trip computer.

Just to name a few....
scot850 wrote: 01 Apr 2026, 19:10 As I only have the one thing to get programmed I will just get the dealer to do it for me. I know the guys there including the service manager and they have given me a good price to do it.
If you have access to a good service and only want the one option added. it's probably the right way to go.

vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

If only we knew Volvo's security key to program HCS412... Because upon entering program mode it self-erases.

transponder.png
transponder.png (855.7 KiB) Viewed 383 times
Screenshot at 2026-04-03 11-29-53.png
Screenshot at 2026-04-03 11-29-53.png (88.29 KiB) Viewed 383 times
hcs412.png
hcs412.png (60.27 KiB) Viewed 383 times

vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

https://handwiki.org/wiki/Engineering:KeeLoq

Ah, a side-channel attack, my favorite :)

vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »


mikeak2001
Posts: 38
Joined: 30 Mar 2021, 15:45
Year and Model: S70 1998 T5
Location: Wales
Has thanked: 4 times
Been thanked: 37 times

Post by mikeak2001 »

vtl wrote: 03 Apr 2026, 09:46 https://handwiki.org/wiki/Engineering:KeeLoq

Ah, a side-channel attack, my favorite :)
Thank you, I will take a read of all this, I feel a project coming on.
Managed to find the unlock code the for Volvo ID48 chips when I sorted a non start S60 for a Volvo dealer.

It would be nice if we can reset or use the remotes without knowing the original packaging data or reading it from the old UEM.

vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

mikeak2001 wrote: 05 Apr 2026, 05:02 Managed to find the unlock code the for Volvo ID48 chips when I sorted a non start S60 for a Volvo dealer.
I read that most of manufacturers cheapen out and didn't use a full range in Megamos Crypto (ID48) or were using an example key from howto, or something along these lines. Volvo, however, did everything right.
mikeak2001 wrote: 05 Apr 2026, 05:02 It would be nice if we can reset or use the remotes without knowing the original packaging data or reading it from the old UEM.
I usually don't lock my cars unless I'm obliged to do so by law (beer or guns/ammo inside) ;)

Post Reply
  • Similar Topics
    Replies
    Views
    Last post