In the past, I have compared transponder key cloning to an “arms race” between vehicle manufacturers and aftermarket manufacturers. Some vehicle manufacturers feel that since they manufactured the vehicle, all service after the sale should be done by their dealer network. And now that transponder key origination and duplication has become a high profit margin business, they are doing everything that they can to drive that business back to their dealer network. On the other hand, the aftermarket providers feel that they are offering a valid public service by providing replacement keys and fobs at competitive prices.
In an effort to drive sales back to the dealers, under the guise of added “security,” manufacturers are making their systems more and more complex. Every time they come out with a new system, cloning equipment manufacturers have to devise new ways of producing a clonable key or fob that not only works, but also does not infringe on any patents or copyrights.
This vicious cycle has been repeating over and over for almost two decades, and locksmiths are the ones caught in the middle. As the two sides practice their game of one-upmanship, locksmiths who have bought into a particular cloning system find themselves on the horns of a dilemma. Do you buy a new machine? Upgrade your old machine? Trade in your machine for a new machine? Alternatively, do you just wait to see what happens next? And of course, there is always the issue of whether your existing stock of clonable keys will work with another manufacturer’s equipment. Only you can decide what works best for you, but hopefully the information in this article will help you make a more informed decision.
Cloning Basics
If you are already familiar with cloning technology, feel free to skip this part of the article. But if you are new to the concept of cloning, or want to understand the process better, here is some information that I hope will make the rest of the article more understandable.
When we talk about cloning a transponder key or a fob, we are talking about making a new key or fob that is electronically identical to the original. That means the vehicle in question cannot tell the difference between the original key or fob and the clone. Before you can do this, three conditions must be met. You must have:
- An original key or fob that operates the vehicle, and is of a type that can be cloned
- A blank key or fob that the appropriate information can be recorded onto that does not infringe on existing patents and/or copyrights
- A machine capable of recording the information from the original key, and then writing that information to the clone key in such a way that the vehicle will not be able to distinguish the clone from the original.
A common abbreviations in use with transponder systems is RFID, an acronym for Radio Frequency Identification. The first generation of transponder keys used a very simple system by today’s standards for identification. Essentially, the transponders in those early keys each had a unique serial number, and when the transponder was energized by the transceiver ring in the vehicle, the transponder broadcast its single serial number. When the serial number was received by the vehicle, it was checked against the list of authorized transponders and if there was a match, then the ignition system in the vehicle was energized. If the serial number did not match, then the vehicle remained immobilized*.
Those first generation transponder keys were easy to clone. All you had to do was energize the transponder, record the data that was transmitted, and then program that data onto a blank transponder in an appropriate key blank.
The primary reason that some of the first generation keys couldn’t be cloned was more of a legal problem than a mechanical problem. For instance, the original Ford transponder was manufactured by Texas Instruments (TI) and the patents and/or copyrights were owned by TI or Ford. They would not license anyone else to use their information. For that reason, no clonable keys were available for that system until a work-around was developed that used a battery powered circuit board inside the key to emulate the TI transponder. Keys of this type have become known and “Electronic Keys” or “EK-Keys.”
As soon as clonable keys came out for the first generation Ford transponder system, Ford upped the ante by going to an encrypted transponder system. Shortly after the 40-bit encrypted system became clonable, the 80-bit system was introduced, and there is no end in sight.
Cloning an encrypted key is much more difficult than cloning those first generation systems. In an encrypted system, each key uses a unique “algorithm” to process a random number transmitted to the key by the vehicle computer. The result from the algorithm is then transmitted back to the vehicle, which knows the algorithms of all the registered keys. This allows the vehicle to recognize a valid key. The information exchanged between the vehicle and the key changes every time the key is used.
While working on this article, I searched the Internet to find a simple definition for the word “algorithm.” The easiest definition that I could come up with was the “informal definition” listed on Wikipedia, which is: "A set of rules that precisely defines a sequence of operations, which would include all computer programs, including programs that do not perform numeric calculations. Generally, a program is only an algorithm if it stops eventually.”
The simplest way that I have found to describe the process when applied to transponder keys is to say that every time the key is used, the transponder takes a math test and then sends the result to the vehicle. Since the vehicle set up the “math test,” it also knows the answers that every registered key would come up with. If the response that is sent to the vehicle, by the transponder in the key, matches an expected response, the vehicle will then be allowed to start.
Once encrypted keys became common, cloning equipment had to be adapted to work with the new transponders, and new clonable keys had to be devised. We are now in the fourth or fifth generation of cloning technology. The cloning equipment of today is dealing with encryption systems that would have baffled the code-breakers of World War II and the Vietnam war. And now, we are contending with transponder keys with integrated remotes and/or proximity features. Cloning equipment that clones the remote functions as well as the transponder have been available in Europe for some time now, but are just now becoming available here in the United States.
Pre-Cloning
The term “pre-cloning” is often used to describe the process of writing a code to a blank clonable key that will allow that key to be used just like an OEM key for onboard programming or programming with a diagnostic device. In order to pre-clone a key, the cloning tool must know the basic parameters of the system that is being used, so that it can generate a valid code or algorithm that will be acceptable to the vehicle.
This ability allows the locksmith to stock fewer types of transponder keys. In addition, an aftermarket clonable key may be drastically less expensive than an OEM “dealer only” key. An example of this would be the Cadillac Catera. OEM keys are only available through GM dealers and they generally run about $70 each. Aftermarket clonable keys are available from most locksmith distributors for around $12.
If you have a cloning device that supports pre-cloning, then you only have to stock the aftermarket key in order to be able to both duplicate the customer’s key, and to originate a new key if all the keys have been lost. Since most GM vehicles have onboard programming, the ability to pre-clone GM keys also allow you to stock fewer keys, since you can use a pre-cloned key for onboard programming as well as for over the counter duplication without having to have the vehicle present. The price difference on the GM PK3 keys is not as drastic as it is with the Catera, but every little bit helps.
EPROM & EEPROM Programming
EEPROM service has become the latest craze in advanced automotive locksmith service. The ability to read data from, and write data to an EEPROM is now something that is supported by some cloning devices. The term EEPROM stands for Electrically Erasable Programmable Read-Only Memory and is a type of non-volatile memory used in computers and other electronic devices to store small amounts of data that must be saved when the power is removed. One of the primary differences between an EPROM and an EEPROM is that EPROMs generally have to be removed from the device in order to be erased or re-written, while an EEPROM can usually be erased or re-written in place by way of software. The amount of data that can be stored on an EPROM or EEPROM is somewhat limited and so is their lifespan, but that makes them perfect for storing the type of data that is used in some of the more advanced encrypted security systems. Because the data stored on either type of chip is non-volatile, it remains unchanged when the device is powered down. In some ways, these chips are similar to “Flash Memory” that is used in memory cards and thumb-drives.
Transponder Equipment Options
Advanced Diagnostics 900 Pro Transponder Duplicating System (AD900 Pro). Advanced Diagnostics (AD) has been producing transponder equipment for locksmiths from the very beginning. While they do not manufacture any key blanks, they do work closely with the major key blank manufacturers. Unlike some other cloners, the AD900 Pro is designed to support clonable keys from all major manufacturers including Silca, Ilco, Keyline, Jet Hardware, and JMA. With the use of optional software, the AD900 Pro can also handle reading and writing of most automotive EEPROM devices that advanced locksmiths deal with.
Designed to be a standalone machine, the AD900 Pro can be used in the field for many jobs without an Internet connection. The AD 900 features a full keyboard as well as dedicated read / write controls. It can be used for simple cloning, but also supports manual data input for “pre-cloning” operations. With the proper software, it can clone all fixed code systems as well as many encrypted systems such as the Crypto 42 transponder and the Texas Instruments 4C and 4D transponders.
AD900 Pro software is sold separately so you can buy only the software that you need. The design of the AD900 Pro is intended to make it compatible with future systems simply by adding new software. New software is constantly being introduced, and one of the most recent additions allows the user to clone some Volvo CAN vehicle keys. Some of the more advanced encrypted systems do require an Internet connection, however. The Internet connection allows the AD900 Pro to connect to a computer system with much greater power, which allows you to clone these encrypted keys much more efficiently than a standalone unit could.
The AD900 Pro also offers a complete listing of the applications for the AD900 Pro can be downloaded for free from the Advanced Diagnostics website, www.adusa.us.
Ilco RW4 Plus Transponder Duplicator, with SNOOP This is another stand-lone machine that does not need a computer for day to day use, but can be easily updated via the Internet. Ilco provides free software updates for one year from the date of purchase. After that, updates are available for a nominal charge.
The RW4 Plus is a fifth generation tool with the ability to clone all fixed code keys, Texas Instruments encrypted keys, as well as Philips encrypted keys. Ilco also produces a full line of modular electronic keys that are all compatible with the RW4 Plus. The RW4 Plus can also clone most one-piece and two-piece clonable keys from other manufacturers.
The RW4 Plus features a keyboard for manual data entry when needed as well as for archiving. A 12VDC power supply is included for use in vehicles. The RW4 Plus is also equipped with software for automatic code generation for pre-cloning operations.
One of the unique features of the RW4 Plus is the SNOOP module. This innovative device can be attached to a key and then used in a customer’s vehicle to help decode systems like the GM Circle Plus system (Philips encrypted). An easy-to-read LED indicator tells the user when enough information has been obtained to clone the key. This device can save you multiple trips to the vehicle or having to hook up a machine in the customer’s car. After the SNOOP has been used in the vehicle, it is inserted into the RW4 Plus and the information needed to clone the key is downloaded to the RW4 Plus. That information is then used to clone the key in a single pass, where some other machines may require multiple trips to the car.
In 2013, Kaba Ilco introduced the EH3LB multi-system electronic head that is compatible with all existing Ilco modular blades. This electronic head does not require a battery and can mimic the functions of both the Texas Instruments and Phillips encrypted transponders.
In 2014, Kaba Ilco introduced the GTH Multi Transponder Head, which can emulate the functions of 14 different transponders. This new multi-function head is smaller than the older EK heads and does not require a battery. It also fits all existing Kaba / Ilco modular system key blades. It uses a special glass encapsulated transponder device so the key is effectively waterproof and more damage resistant than earlier EK heads. Owners of RW4 Plus devices made before 2014 will require a software update in order to use the GTH Multi Transponder heads. However, that update is available online at no charge for all registered RW4 Plus owners.
For more information on the RW4 Plus go to: http://www.kaba-ilco.com/key
Jet iClone (Intelli-Clone) The iClone machine is essentially a rebadged version of the AD900 Pro discussed above. But because the software is sold separately for this machine, the iClone and the AD900 Pro have different capabilities. Jet also offers additional product support, specialty keys, and a full line of modular clonable keys including heads for all Texas Instruments and Philips encrypted applications. Jet also offers a trade-in program and incentive pricing.
For more information on the iClone machine go to: http://www.jetkeys.com.
JMA TRS-5000 EVO This standalone machine replaces the earlier TRS-5000 machine, and competitive trade-in programs are available. This machine features automatic updating whenever the machine is connected to the Internet, but no Internet connection is required for normal use. The TRS-5000 EVO uses a simplified two-button read/write control.
The TR-5000 EVO can clone all fixed code keys as well as Texas Instruments encrypted and Philips encrypted keys. In addition, the TRS-5000 EVO can clone the JMA TP05, TPX1, TPX2, and TPX4 transponders. These transponders allow the user to supply their customers with true transponder keys in place of larger modular electronic keys. These keys require no battery and the transponders themselves are waterproof.
JMA is the second largest key blank manufacturer in the world, offers a full line of domestic, and import keys. All JMA transponder keys feature easily removed transponders and empty “shell keys” are readily available. This allows a locksmith to easily recover the transponder from a damaged or miscut key for reuse. And now that some locksmiths are buying the chips without a key, this is a very efficient way to deal with the transponder inventory in some high-end markets.
For more information on the TRS-5000 EVO go to: www.jmausa.com.
Keyline USA 884 Decryptor Ultegra (Bianchi USA is now Keyline USA, a division of the Bianchi 1770 Group.) This standalone cloning device is the first cloning device to be marketed in the U.S. that can also clone remotes. In addition to remotes, it is designed to clone Philips Crypto (Second Generation) keys, Texas Instruments fixed code and encrypted keys, TK24, TK40, TK50, TK60 and TK100 electronic heads, and also works with the T2, T5, and TK1 single piece clonable keys from various manufacturers. The full-featured keyboard supports manual code entry when needed as well as simple read / write cloning.
The new TK40 / TK100 and the TK50 Electronic Universal Heads have several new features including a true transponder that does not require a battery and can mimic the functions of a wide variety of OEM transponders, both fixed code and encrypted. The TK40 / TK100 and the TK50 Electronic Heads can be mated with a variety of key blades that allow you to clone many different vehicle keys without having to tie up a lot of money in stocking a large assortment of transponders. The TK40 / TK100 head is even compatible with many motorcycles as well. A complete listing of the current applications for the TK100 Universal Electronic Head can be downloaded at www.keyline-usa.com
Keyline also offers several heads that allows the user to clone not only the transponder functions, but also the remote functions of many vehicles keys. When the 884 Ultegra was first introduced, remote cloning functions were basically limited to European vehicles with the RK60 head. However, that has now been expanded by way of software upgrades to include almost all U.S. Ford vehicles. The new RFD100 head offers the ability to clone both the transponder functions and the remote control functions on Ford vehicles using any types of fixed code transponders, Texas Crypto transponders and second generation Philips Crypto transponders. The RFD80 heads include an original Ford / Texas Instruments 80-bit transponder that can be programmed into the vehicle with a diagnostic device (or onboard if two working keys are available) along with a remote head that can be programmed into the vehicle with onboard programming.
Three different key blades are available for the RFD100 and RFD80 heads that allow the locksmith to duplicate all Ford 8-cut keys, the new HU101 style side-milled keys used on many new vehicles and the Tibbe keys used on the Transit Connect from 2010 -2013.
Software updates are available and the machine can be updated via a USB connection as needed, but no computer is required for normal operation. The 884 Decryptor Ultegra also features a 12VDC power option so that it can be operated from the cigarette lighter in your van or in a customer’s car.
The functionality of the 884 Decryptor Ultegra has recently been enhanced with the addition of new clonable fob kits for some BMW, Nissan / Infiniti, Toyota, Chrysler / Dodge / Jeep, and Volvo vehicles. Various “kits” are available for these different applications, and more are being added all the time. More information on these keyless system kits and the 884 Decryptor Ultegra go to: www.keyline-usa.com.
A final word of warning
Please be aware that many of the transponder tools and transponder keys offered for sale on the internet are illegal copies of legitimate products. Some of these knock-off tools even use the same part numbers and logos as the legitimate tools and will pop up in almost any internet search. As a general rule, these knock-off machines cannot be updated and have no warranty or support of any kind. The manufacturers listed above have all spent a great deal of time and money developing tools for our industry. As a security technician, I hope you realize that buying illegal tools and equipment hurts us all. If you find a price on a copy of one of the machines listed here that seems too good to be true, I can assure you that it is.
Misconceptions
One of the biggest misconceptions about electronic anti-theft systems is that an invalid starting attempt with a pre-programmed transponder equipped key or a key with no transponder will “shut the vehicle down.” The fact is, the vehicle was already shut down. Usually, an invalid starting attempt is simply ignored by the system. In some cases, an alarm may be triggered or a theft code may be entered into the computer that will require clearing before the vehicle can be started again, but normally an invalid starting attempt is simply ignored. When the correct key is detected, the systems that were shut down when the car was last turned off are then re-energized. If there is a theft code in the system, it is usually cleared automatically by using the correct key.