As an automotive locksmith, my “meat and potatoes” jobs are things like generating new keys for vehicles made by Ford, GM, Chrysler, Toyota, and Nissan. Occasionally, I’ll get a Mitsubishi or a Subaru, but my daily routine is pretty much what you see on the road the most. But, in addition to those, I try to do the jobs that the other locksmiths in the area don’t want to do or can’t do. Unfortunately, because I’ve been in the business so long, that also includes the older stuff like beat-up old VATS vehicles, Ford 10-cuts, and the assorted genuine antique. (Recently, I had an extremely rare 1956 Ford Fairlane with a glass roof at my shop to replace the trunk lock.)
Occasionally, a transponder job pops up that the other guys don’t want, and I look forward to those as a change of pace. When I do some of these jobs, my profit margin can be a lot greater than usual. Generally, since these jobs either take more of my time or required a larger investment in equipment, they are not huge money-makers. But they really do boost my “word of mouth” reputation in the local community. When I quickly and easily solve a problem that three or four other guys in the area turned down, people tell their friends.
I have chosen not to go into genuine EEPROM work mostly due to my age. It’s not that you can’t teach this old dog new tricks – it’s because I don’t think that in my area, I will be able to recoup the investment in equipment in the few years that I have left before I retire. But that doesn’t mean that I don’t do any direct programming of chips. I just don’t do jobs that would require removing the chip from the board.
The most common job of this nature that I get is “Re-Flashing” old Lexus and Toyota vehicles. Even though there are fewer of these on the road every day, I still see enough of them that I recently invested in some new equipment. Let’s begin by looking at some of these vehicles and how I deal with them.
Re-Flashing Lexus and Toyota Vehicles
When Toyota first implemented transponder technology in the 90s, they simply did not plan for “All Keys Lost” situations. At that time, all programming was done with on-board procedures, but all those procedures required a working “Master Key.” If no working keys were available, or if only a “Valet Key” was available, you simply could not program a new key.
Some clarification is in order at this point. In the language of Toyota and Lexus, the difference between a “Master Key” and a “Valet Key” is somewhat different from most applications. The main point is that the chips used in the valet keys cannot be recognized by the transponder system for programming purposes. This was intended to keep people who had temporary custody of the key, like valet drivers, from being able to quickly make a duplicate key without the knowledge of the owner.
The usage of the valet keys was spelled out clearly in the owner’s manual, but unfortunately very few people read those instructions. The original valet key had a grey rubber head while the master key had a black rubber head. The rubber that was used in the valet key was a dark charcoal grey originally, but with usage and age, the rubber turns to a darker color, making the keys hard to tell apart. In addition, aftermarket keys can be programmed as master keys or as valet keys, depending on the programming procedure. This results in a lot of aftermarket valet keys with black rubber heads.
Fortunately, there is an easy and accurate way to tell the difference between the keys by way of the behavior of the “Security Light.” When there is no working key in the ignition lock, the security light will normally be blinking. When a recognized master key is inserted into the ignition lock, the security light will stop blinking instantly. If a recognized valet key is inserted into the ignition lock, the security light will blink one additional time after the key has been inserted, and then go out. The key does not have to be turned to the “ON” position to run this test. (Current production Toyota and Lexus vehicles, as well as all Scion vehicles, still use this system to identify a master key versus a valet key.)
Naturally, shortly after this system was introduced, people started losing all of their keys. Since there was no provision for programming a new key without a working key, the only way for the dealership to return the car to service was to replace the vehicle computer, known as the Engine Control Unit (ECU). To make matters worse, the Toyota or Lexus dealerships were also instructed to replace all of the locks on the vehicle in an all keys lost situation. In 2000, the average price for this job at the dealerships was around $2500.
Some tech-savvy locksmiths figured that there had to be a better way. The original work-around for this situation was to remove the chip from the board that contained the transponder information. Once the chip had been removed, it could be re-written to the original factory data and then replaced on the circuit board. (If this sounds familiar, that is because it very much like many current EEPROM procedures.) This would re-set the security system to the original condition and the vehicle would accept the first three keys that were inserted into the ignition. The first two keys would become Master Keys, and the third would become a Valet Key.
Tools of the Trade
Soon, people discovered that the data could be re-written while the chip was still installed on the board with the right equipment. This led to the development of the current crop of re-flashing tools such as the EZ-Flasher (Photo 1) manufactured by Blue Strike Digital, LLC (www.BlueStrikeDigital.com) and available from many automotive locksmith distributors.
I have made a lot of money re-flashing Lexus and Toyota ECUs through the years, but that business has declined sharply because there are just not that many still on the road. I’ve also had to drop my price for re-flashing them as well since very few people with a 1998 Lexus ES are willing or able to pay $500 - $800 in a lost key situation. But that is exactly what I was charging back in 2002. Now, I’m lucky if I can get $350 for re-flashing a Lexus.
Beginning with the 2003 model year, almost all the Toyota and Lexus vehicles that used the original system switched to the new system which could be programmed through the OBD II port in an all keys lost situation. The biggest exception to that was the Toyota Sequoia, which used a system that had to be re-flashed up through the 2007 model year.
Last summer, I did battle with a 2005 Toyota Sequoia after the owner lost his keys during the Blue Angels Show on the Pensacola Beach. I’m still not sure if the module in that truck had issues, or if my elderly 1st generation flashing tool had issues, but I simply could not get it to work properly. I was eventually forced to enlist the help of a friend who introduced me to the Andromeda tool from Andromeda Research Labs (www.arlabs.com). I also had to buy a steering column and a used ECU from a local scrap yard for $40. (They wouldn’t sell the ECU without the steering column.) It took four trips to the beach and a LOT of time, but I finally got the thing running again, and decided that I needed the Andromeda tool!
With the Andromeda tool, I have much greater capabilities than I ever had with my old flashing device and because it it’s a modular tool system, I can upgrade it as needed. Andromeda Research Labs offers all of the tools and components individually or in two different “Locksmith Kits.” One of the optional adapters will let you do “off the board” programming of EEPROMs if you want to do that type of work.
The heart of the system is the Andromeda Programming Unit (P/N AR-32A) which allows you to download and upload data to essentially any of the standard 8-pin EEPROMs that are used in most automotive immobilizer systems (Photo 2). With this capability, you can handle problems that require more than simple re-flashing. The process that most automotive locksmiths refer to as “re-flashing” Is also known as “Re-Virginizing,” because it erases all the vehicle specific information from the EEPROM and returns it to its original factory values. Once this is done, the EEPROM is in the same condition as in a new immobilizer. When the device is returned to the vehicle, it will be in the “learn mode” and can accept new keys in the same way that the original keys were programmed into the vehicle at the factory. This means that all the existing keys will no longer operate the vehicle if they turn up later.
With the AR-32A and the appropriate software, I now have many more options. I can essentially recreate the missing key by downloading the data from the immobilizer and then loading that information into a new key by way of the “Tango” tool -- a specialized cloning device that I’ll discuss later. I can also delete individual keys or program the immobilizer to accept specific “off the shelf” keys that I already have. By doing that, those keys will automatically work, once I have re-installed the immobilizer. (Some vehicles, such as the Sequoia, will also require a re-synchronization of the ECU with the immobilizer for the modified immobilizer to work properly.)
The AR-32A programming unit can be controlled by virtually any computer using an “X86” processor, and a 9-pin serial port or a USB 9-pin Serial Port adapter. (This includes computers running any version of Windows.) When I bought my unit, I also purchased a refurbished Panasonic “Toughbook” laptop computer from Andromeda Research Labs as well. When the system arrived, it came with the software already installed and was essentially “plug and play.” If you already have a computer that you want to use with that AR-32A, the software required is the EEPROM+ programming system, which is supplied with the programming unit. Because this software works with the underlying machine language, the version of Windows is immaterial. In fact, if you don’t want to permanently install the software, you can create a USB thumb drive that will allow you to use almost any computer simply by inserting the thumb drive and rebooting the computer.
The EEPROM+ software that is provided with the “locksmith kits” also includes a tutorial and the “Librarian Application.” These features allow you to quickly learn how to use the system and provides a wealth of vehicle specific information and help, as well as the files that you will need for most re-flashing operations. The kit also includes a practice EEPROM chip so you can practice using the system before you ever tackle your first job. In addition to that, the good folks at Andromeda Research Labs provide some of the best tech support that I have ever dealt with.
Several optional tools are available from Andromeda Research Labs to compliment the system. The basic programming unit and a selection of these optional tools have been assembled into two different “Locksmith Kits,” or the components can be ordered individually. In my case, I purchased the #1 locksmith kit plus the “AccuTouch Probe” (P/N ATPB1) shown in Photo 3. This tool greatly simplifies the process of connecting the tool to the EEPROM chip on the board and is provided with two different optional connectors. I purchased the unit with the DMAX connector (P/N ATPB1/DM) so that I could also use it with my DMAX machine.
When working on an EEPROM while it is still attached to the circuit board, one of the big issues is making and maintaining a good connection to all eight pins simultaneously. The chip and the circuit board are coated with a sealant that is similar to varnish, which can make that task difficult. In the past, I’ve used a spray solvent and a stiff brush to remove the sealant but even then, making a good connection with the traditional “Blue Clip” was a tedious trial and error procedure. The AccuTouch Probe uses eight needle-pointed and spring-loaded probes to punch through the sealant and make a solid connection, simply by pushing down on the top of the tool, once it is in the proper position. There are two different adapters available for the AccuTouch Probe, one for the DMAX tool, that I mentioned earlier, and another for the EZ-Flasher (P/N ATPB1/EZ).
Writing Data to the Key
Regardless of what tool you use to read the data from the vehicle, you are also going to need a tool that can write that data directly to the transponder chip in the key. Most cloning tools do not offer this capability, and those that do often offer only rudimentary procedures. The tool that I chose to use is the Tango tool shown in Photo 4, from Scorpio-LK Ltd. (http://www.scorpio-lk.com) This tool is available from most locksmith distributors who deal in automotive tools. The same company produces the “Orange-5,” “Barracuda,” and the “Omega” Programmers. There are several other devices on the market that perform similar procedures, but the Tango seemed like the best choice for me. I urge you to do your own research and decide which tool will be the best for your situation.
The software for the Tango uses individual modules that they call “Keymakers” for the various applications. According to their website, over 1142 Different Keymakers are available, and 793 are included in the basic software. You can purchase and download individual Keymakers as needed. In the case of my Toyota Sequoia, I did have to buy a Keymaker, but it also does most of the Toyota, Lexus and Scion vehicles as well.
If you get into this type of work, you will quickly learn about “BIN Files.” A BIN file is a file that contains the binary information from either the immobilize or the transponder. Rather than being presented as a huge list of ones and zeros, it is presented in the “Hexadecimal” (HEX) format. Hexadecimal is “Base 16,” a numbering system that has sixteen digits instead of ten. The digits that correspond to 11 – 16 are represented by the letters A – F. It’s not necessary to learn HEX to do this type of work, but it helps. Once you understand HEX though, some things become obvious. Things like the 5-character Nissan BCM code, which you will suddenly realize is just a number presented in HEX format.
Once you have downloaded the BIN file, either from the immobilizer or from the key, either the EEPROM+ software or the Tango software can be used to edit the information. If you want to create a new key, without altering the data that is already programmed into the immobilizer, the key that you produce will essentially be a clone of one of the missing keys. I use this procedure when I re-flash a module for other locksmiths who may be hundreds of miles away from me, so that they can just reinstall the ECU and go on their way. A typical usage, such as with the Toyota Sequoia that I’ve been talking about, would require four steps:
- Download the BIN file from the immobilizer
- Copy the information for one of the existing keys
- Transfer that information to the Tango
- Use the Tango to produce a key that the immobilizer will recognize
Or, if you wanted to just produce a new key that the immobilizer will recognize and delete some or all of the existing keys in the immobilizer, the process is very similar.
- Use the Tango to download the data from a new key
- Read the BIN file from the ECU
- Identify and delete the information for any key that you wish to delete
- Edit the Bin file to add the information for the new key
- Upload the modified BIN file back into the ECU so that it will automatically recognize the new key
Pre-Coding Keys
In 2006, VW began encoding the VIN into the data on each key. This simple change has caused a lot of headaches for locksmiths. Programming new keys for VW vehicles now requires that you either use a special key ordered from the dealership that is already encoded with the VIN, or that you have the hardware and software required to encode the VIN into the new key. Other manufacturers such as Fiat have also adopted similar systems.
In most cases, this job can be done with a combination of tools like the ones that I have mentioned above, but there is a device called the “Smart Aerial” (Photo 5) that can provide a shortcut procedure for owners of the Smart Pro, T-Code Pro, or MVP Pro from Advanced Diagnostics. (http://www.adusa.us) (The T-Code Pro or the MVP Pro must also be equipped with the Smart-Dongle.)
The Smart Aerial (P/N ADC242) plugs directly into the Smart Pro, or into the port on the side of the Smart Dongle. The end of the Smart Aerial has an opening that can be placed over the ignition lock in the vehicle. The new key is then placed through the opening in the Smart Aerial and into the vehicle ignition lock. With the Smart Aerial in this position, it can both read data directly from the transceiver coil in the vehicle and write information into the key.
The use of the Smart Aerial also requires the “Pincode Reading Software” (P/N ADS185 and/or ADS219) to analyze the data from the vehicle and then “Pre-Code” the new key. The software is integrated into the programmer so that it can quickly pre-code the key and then program the new key into the vehicle in a streamlined procedure that would require multiple steps with other devices. Currently, Advanced Diagnostics offers software for both VAG vehicles (Volkswagen Audi Group) and Fiat. Use of the Smart Aerial provides a simple and cost-effective process for owners of the Smart Pro, T-Code Pro, or MVP Pro to program keys for VAG vehicles and Fiats without the necessity to purchase additional hardware.
.
