Test Driving The AD-900 Pro

Aug. 1, 2009
The AD-900 Pro successfully cloned clonable transponder-equipped keys and electronic keys from Bianchi, Ilco, JMA, Jet and STRATTEC.

Reading the GM T5 keys

More than 90 percent of new vehicles are being equipped with transponder-based engine immobilizers. There is even an increase in transponder based anti-theft systems for motorcycles/scooters, snowmobiles, four wheelers and larger vehicles.

Transponder technology has evolved from fixed to rolling code onto encrypted; making it much more difficult for the unauthorized to capture a signal. In addition, vehicle manufacturers have added their own unique programming, making it more difficult for others including aftermarket key blank manufacturers to supply their own versions. And finally, aftermarket key blank manufacturers appear to be personalizing their transponder/electronic key blanks, making it difficult or impossible for other manufacturers’ cloning equipment to clone their transponder/electronic keys.

New on the market is the Advanced Diagnostics AD-900 Pro, a transponder duplicating/copying (cloning) machine manufactured by a company that does not manufacture or sell transponder-equipped key blanks in North America.

Note: For the purpose of this article, transponder duplicating, copying and cloning are interchangeable terms.

“The goal of the AD-900 Pro is to be able to read and clone clonable transponder-based engine immobilizer system Original Equipment and aftermarket transponder and electronic keys using aftermarket manufacturers’ clonable key blanks. To that goal, at this time, a properly equipped AD-900 Pro can read and clone Bianchi, Ilco, Jet, JMA and STRATTEC clonable transponder-equipped key blanks and electronic keys,” says Tony Presido, national sales manager for Advanced Diagnostics.

The AD 900 Pro has the ability to clone Silca/Ilco EH2 and EH3 keys, JMA TPX1 and TPX2 and TK40 keys, explains Presido. “This means that a locksmith using the AD900 does not need to stock only one manufacturer’s clonable keys. The locksmith can be free to pick which clonable keys he wants to use according to price, appearance and functionality.”

For the purpose of this article, I will include example part numbers from aftermarket transponder and electronic key blank manufacturers.

I was provided an Advanced Diagnostic AD-900 Pro to test using OEM and aftermarket clonable transponder keys and electronic keys. Electronic keys are equipped with a circuit board that is designed to communicate with the vehicles’ on-board electronics that control their engine immobilizer systems. Unlike transponders, electronic keys emanate the appropriate signal on a predetermined basis.

The technology required to clone an electronic key is different than cloning a transponder. Cloning machines must have additional resources to read and duplicate some of the electronic key’s values.

Transponder-based anti-theft systems were first introduced to North America in the mid-1990s. Fixed code (value) transponders are the Temic 11 and 12, the Megamos 13, and the Philips 33 and 40 White. The early clonable transponders are the “T5.” These include the Buick (Ilco B97PT5), Cadillac (Bianchi B99PT5), Honda (Jet HD106-N-PHT) and Saturn (JMA TP05GM-37.P).

In the recent past, Silca (Kaba Ilco) introduced their version of the clonable Texas Instruments (TI) 4C using the Silca EH1 and EH2 electronic keys, Ilco EK-3 electronic keys and the TK40 electronic keys. Electronic keys that can clone Texas Instruments 4C transponders are available from Bianchi, Jet and STRATTEC. Cloning the above fixed value transponders using the Silca, Ilco and TK40 electronic keys is a standard feature of the AD-900 Pro.

Specific functions of the AD-900 Pro require additional software. This software is sold separately from the unit. The most popular software upgrades for the U.S. market are:

ADS-905: Enables cloning JMA TPX1 (4C) transponder-equipped key blanks

ADS-906: Enables cloning Ilco EK-3 (Silca EH1/EH2) 4C and 4D transponder-equipped key blanks

ADS-907: Enables cloning JMA TPX2 (4D) transponder-equipped key blanks

ADS-916: Enables cloning TK40 (4C and 4D) transponder-equipped key blanks

The method of installing a software upgrade is similar to upgrading T-Code/MVP software.

To clone the Texas Instruments 4C onto a JMA TPX1 transponder using the AD-900 Pro requires the ADS905 software module. JMA developed their TPX1 clonable fixed code transponder for specific model years of Ford, Lincoln, Mercury, Nissan, Infiniti, Mazda (B4000 Series pickup), Toyota and Lexus.

At this time, specific versions of the Texas Instruments Crypto 4D transponder are the only clonable encrypted transponders used in the North American market. The TI 4D transponders are used by Chrysler (Ilco Y160), Ford (STRATTEC 599114), Hyundai, Infiniti, Jaguar, Kia, Lexus (JMA TP29TOYO36.P), Mazda, Mitsubishi, Nissan, Scion, Subaru and Toyota transponder keys where the original key has a dimple stamped into the blade. To clone the TI 4D transponder using the AD-900 Pro requires a personal computer and Internet connection at the time of writing this article.

Two options are available to clone the Texas Crypto 4D transponder. The ADS906 option enables cloning Texas Instruments 4D transponders onto an Ilco EK3 Electronic Key. The ADS907 option enables cloning the Texas Instruments 4D transponders onto a JMA TPX2 transponder-equipped key. The ADS-916 is needed to do the 4D to the TK40.

Functions of the AD-900 Pro include Reading, Copying, Unlocking, Generating, PIN code calculating and EEProm reading of transponders. Unlocking permits reprogramming of most Megamos 48 Crypto VAG (T6 Audi and Volkswagen) transponders. Not all transponders or electronic keys can be read completely. The details of reading a specific transponder can include determining the transponder type, transponder codes, whether the transponder is locked or not and car brand.

Since the AD-900 Pro is designed for ”World” as well as North American vehicles, some features are applicable for specific regions and not for others.

Generating is creating a code for a clonable transponder that does not have one. The AD-900 Pro can be used to write code onto a blank transponder-equipped key. No compatible fixed or encrypted transponder-equipped key is required. If a comparable transponder-equipped key is available, the clonable transponder can be cloned.

The reason is most clonable transponders (T5, 4C and 4D) are sold with no code. This is why key blank manufacturers warn locksmiths not to on-board or device program using a clonable transponder-equipped key with no value assigned. This can result in a catastrophic fault that requires the vehicle towed to the appropriate dealership in order to remove the fault.

An available option is Hyundai and Kia pin code calculating. The option, ADS911, is similar to the option for the T-Code. It will calculate the PIN Code from the Vehicle Identification Number of pre-CAN United States Hyundai and Kia vehicles.

The actual reading and cloning operation of the AD-900 Pro is straight forward. The device is equipped with a 20-character keypad, that includes 1-10, A-F, up and down arrows, “X” (back) and the enter sign.

There is a USB port, on/off switch, receptacle for the power supply and an EEProm Reader. The USB port is used to update the software for the device and the internet connection. The AD-900 Pro operates on 110VAC using a plug-in transformer.

When powered, the AD-900 Pro presents the Main Menu that contains six choices: Identification, Copy, Write Code, Special Func, Test and Settings. Use the up and down arrows to indicate the operation.

To read a transponder, insert the key into the opening located forward of the keypad. High security key blades may not slide into the slot. From my experience, the device can still read and copy a transponder that is not completely within the opening.

Insert the key and press Enter when the indicator is on the number 1 line. For this portion of the article, I inserted an early General Motors small head 75 groove fixed (Megamos 13) transponder key and pressed the Enter key. After a few seconds, the key ID came up on the display as:

FFC10340D10E8A1A

ID: 13 MGMS FX

Can be copied!

To copy the fixed value onto a clonable “T5” transponder, press “X” to return to the main menu. Highlight Copy. Press Enter for the device to read the key. The screen for the key identification will appear with the code and the ID. Press Enter. The display instructs: “Please put T5 Transponder to the Antenna.”

Remove the key and insert the clonable T5 key into the slot. Press Enter. The device is writing the value onto the transponder. When finished, “Successful” will appear on the display. To be certain both transponders have the same code, check the identification of the cloned transponder with the original.

Note: The Advanced Diagnostics AD-900 Pro will clone a “T5” transponder to another “T5” transponder.

The same basic operation is used to clone a Texas Instruments 4C fixed code transponder onto a electronic key or a JMA TPX1 transponder, an electronic key onto a JMA TPX1 transponder or a JMA TPX1 transponder onto an electronic key with the appropriate software module. The 4C fixed code transponders can be cloned to the Silca EH1 and EH2, Ilco EK-3 and the KeyLine electronic keys without an optional software module. To clone the 4C transponder, a PC and internet connection are not required.

Cloning a Texas Instruments 4D transponder requires a PC and internet connection with the appropriate AD-900 Pro software module(s) for electronic keys or a JMA TPX2 transponder.

IMPORTANT: The JMA TPX2 transponder is a one time only write transponder. Once the TPX2 transponder has been cloned, it cannot be cloned again.

A window opens on the computer display and all cloning operations use the PC. Only a portion of the TI 4D transponder can be read.

To copy a 4D encrypted transponder for the first time, download the software program from www.advanced-diagnostics.co.uk. To ensure the download is proper, use Internet Explorer. I have had problems when downloading using Mozilla.

On the bar, click DOWNLOADS. Then go down to AD-900 Pro and select the “Loader Program.” Download and run the program. When the software programs have been downloaded, two icons will appear on you screen: AD900Pro.exe and USB Driver.exe.

To clone a 4D transponder, connect the device to the PC using the USB cable. Once connected and powered, click the AD900Pro icon.

Important: Check for updates every few weeks for both the device and the software. The device provided had software 1.14 as did the program.

The AD900 window will appear. Click “SETTINGS” and in the new window, and then press the “CONNECT” button. If the COM setting is correct, “Successful” will appear near the bottom of the window. If not, change the COM setting. I needed to change the COM setting to COM 4. We successful appears, press the “MAIN MENU” button.

Insert the 4D transponder or electronic key. For this part of the article, I used a Chrysler gray plastic head key. Press the “READ” button. The window should indicate the Transponder Type as a 64 Texas Crypto. “It can be copied…!” appears beneath two buttons if you have both software modules. They are the TPX2/EH2 Supercomputer and the KEYLINE Supercomputer.

If an electronic key is inserted, the Transponder Type Texas Crypto appears. The number may be different. “It can be copied…!” appears beneath two buttons if you have both software modules.

For this part of the article, I used a JMA TPX2CHR-15.P clonable transponder-equipped key blank.

To clone this transponder, insert the key into the AD-900 Pro slot. Press the TPX2/EH2 Supercomputer button. Press OK when the calculation window appears. Press “WRITE” when the button is activated. When the transponder or the electronic key has been programmed, “Successful” will appear in the window. Time required can be up to six minutes.

The AD-900 Pro operated as described. It was able to clone clonable transponder-equipped keys and electronic keys from Bianchi, Ilco, JMA, Jet and STRATTEC. The types cloned included the fixed code (value) transponders are the Temic 11 and 12, the Megamos 13, and the Philips 33 and 40 White using the “T5” and similar transponders. The Texas Instruments 4C clonable transponders can be cloned using the EH1/2, EK-3 and the TK40 electronic keys and the JMA TPX1 transponders. The Texas Instruments 4D clonable transponders can be cloned using the EH2, EK-3 and the TK40 electronic keys and the JMA TPX2 transponders.

For more information, contact your local locksmith distributor or www.adusa.us