Car On-board diagnostic system

Program Nissan Rogue 2010 Key without PIN code

Publié le 9/02/2018 à 09:16, Marne-la-Vallée
Mots clefs : Lonsdor K518Londsor K518ISELonsdor K518 key programmer
Lonsdor K518ISE key programmer was used to program immobilizer key for a Nissan Rogue year 2010, I found extra menu and a few new options, BCM to pin was done automatically.  No need to pic converter, no token, easy instructions. More options for smart key then other programmers.
Connect K518ISE host with vehicle via OBD diagnostic socket
Select Immobilizer->Nissan->Select from type->Immobilizer->Electronic Key (E0)->Add key
Insert working key to turn ignition on
Lonsdor K518ISE automatically read BCM code and PIN
Insert new key and turn ignition on
Turn ignition off
Repeat IGN ON/OFF for twice
Program success.
Follow Lonsdor K518 prompt to program next key. Very easy.
I also added smart key on an imported Nissan and other models, no need for hazard light to be on.. Over all experience with Nissan was good.

How to repair BMW E90 series FRM3 with xprog

Publié le 8/02/2018 à 05:54, Aéroport de Paris - Roissy Charles-de-Gaulle
Mots clefs : XprogXprog-mxprog boxxprog m

There is a problem that many people have heard about (and many have also met with it). Your BMW completely refuses outdoor lighting (more precisely, the passing beam and dimensions with the ignition on, but we can not control it), front windows do not work, central locking, interior light either. When diagnosed, the FRM does not communicate. In the mean time, a lot of errors are associated with the connection to this ecu.

The fact is that the failure of the FRM3 module is due to the failure of the eeprom area in the microcontroller (MC9S12XEQ364) controlling this unit. And eeprom dies gradually, until the changes in it reach a critical mass. And then the module works until it needs data from the machine … reboot, whether it’s connecting a diagnosis or removing the battery terminal (trying to start on a weak battery is equivalent to removing it).

Everything can be done much easier! Coding and programming is NOT NECESSARY. The internal memory of the microcontroller MC9S12XEQ364 stores its native eeprom! It is encrypted in the memory area called D-flash, counting which it is possible to completely restore the FRM3 unit’s performance by retaining all ecu coding changes (for example, turning off errors on fog lights when installing Chinese xenon). This saves time, money and time.

The main thing is to correctly consider D-flash, so as not to destroy it. Here’s to you a small step-by-step guide, how to do it with xprog m box ecu programmer:

We remove the ecu from the car and put it on the table. Here it is:


look inside:


The connection points have long been known to all …

connected to xprog


Run xprog software, select the mcu “MC9S12XEQ364”. We will read d-flash.


Press the “new” button, then “read”. The partition error will pop out, do not get scared, just ignore it.


click “ok”. the following window pops up:


Do not change anything! (“number of sectors for eeprom” = 0; d-flash = 32768; eeprom = 0) click “ok”. Go to the process of reading d-flash.

Then restore eeprom from d-flash. Open the resulting file in xprog. for checking, scroll to the very end of the file, there should be in the open form the number of the car to which the unit belongs.

click “devices” select “MC9S12XEQ364_EEE”.
Before writing the resulting file, MANDATE EEPROM AREA! MANDATORY!
for this we press the button “erase”. again an error on partition. Only this time you need to specify the size of eeprom
number of sectors for eeprom = 16
d-flash = 0
eeprom = 4096.
click “ok”. the eeprom area is erased. then “write”. wait for the end, put the ecu on the car, enjoy the work done.


The tutorial here is translated from Russian and just for education purpose. Credit to evg3n175. You are at your risk.

BMW E90 Airbag ECU Repairing with Xprog

Publié le 6/02/2018 à 09:41, Paris - Charles-de-Gaulle
Mots clefs : xprogxprog mxprog v5.0

Here’s the methods of removing the crash from the airbag units. Crash is a record appearing in the airbag blocks after an accident that caused the firecrackers to fire.


(Note. The tutorial is just for education purpose. You are at your risk. Credit to Russian expert evg3n175)


It’s a BMW 3 series E90. The previous owner was in an accident, the current owner does not know the details. The airbag light is on. He didn’t know what to do.  Diagnostics for all known “ECU error”.

Let’s get down to practice …

We remove the airbag module on the table. It is necessary to make a reservation. In the unit there is a shock sensor. If you are too lazy to remove the acb terminal, you must remove the chip from the unit, and then unscrew the module! when installing the opposite, first screw the unit and then connect the connector!
No pillow will work when the AIRBAG light is on! The cushion unit is in emergency mode when the light is on.


We unscrew the bolts and take out the board. In this ecu, the crash sits in the eeprom.


here it is our eeprom

As a rule, most eeprom look so as to find out that this is an eeprom, and not any other random detail that just looks like an eeprom. go to all the famous connoisseur Google for 95640 datasheet (documentation for the radio parts) and drive the inscription with eeprom. in our case this is “95640”

and click on the first link to the .pdf document (the datasheets are always in .pdf) We get the following:


We will open Xprog m ecu programmer software. press the “devices” button and look for our eeprom, EEPROM->ST->95640:


In the left column, the inscription “programming interface” tells us that we can read this eeprom using both an adapter (“On-board”) and an in-circuit (“In-circuit”)
connection scheme:


with the adapter I think everything is clear … and internally looks like this:


We call the connection points, solder. in xprog click the “new” button. after which the “read” button becomes active. we press it and if everything is done correctly we will see:


without fail we do verification! “verify” button. this function reads the eeprom once again and compares with the previously read.
Next, press the “save” button and save our original dump.
You can remove the crash from the dump using a special software. for example “Ultra Prog”. if there are no specialized programs, our software does not support the ecu, then you can search on the forums via google for a clean dump.
so, open the ultra prog. The “airbag” tab and look for our block number is 65.77 – 9134280. unfortunately ultraprog does not know this module. then you can try to choose another one similar to the number, or based on the same eeprom ecu:


further “file – load” select the read dump. press the “unlock airbag ECU” button. In the folder with our original dump, a dump file appears with the ending “_clear”.
Return to xprog. the “open” button selects the flashed dump. press the “erase” button to clear the eeprom. after which the button “blank” it will check whether the memory of the machine is clean. and if everything is ok click the “write” button.
we get discouraged, put a bump on the car and check … erase the errors, look what’s left. most likely there will be at least one error. Either we change them to integers, or solder the deceptions. once again erase the mistakes and success !;)

Make Peugeot partner 2017 Remote by Mini KD900 VVDI2

Publié le 1/02/2018 à 09:04, Paris - Charles-de-Gaulle
Mots clefs : Mini KDVVDI2Mini KD900Xhorse VVDI2

How to: Peugeot partner 2017 remote key programming with Mini KD and VVDI2 key programmer.


Tools used:

Mini KD (KD900) Keydiy Key Remote Maker Generator

Xhorse VVDI2 key programmer

Original key

Blank remote key


Main steps:

Step 1: Program remote with Mini KD

Step 2: Key Learn with VVDI2


Step 1: Program remote with Mini KD


Scan the Android or iOS QR code to download the Mobile KD App

Connect Android or iOS devices to Mini KD900


Connect VVDI2 with vehicle via OBD diagnostic socket


Connect to KD remote


Open Mobile KD App->Remote Function->Remote Generate->Select proper remote type->Generate remote





Generate remote with KD900 mini success.

Insert battery to the remote and install remote to key shell


Step 2: Learn key with VVDI2

Open VVDI2 Quick Loader->Select Peugeot->Read Pin Code

Read 4-digit pin code success



Press Get Immo data, enter key learn number and PIN code

Click on Key Learning


Inert original key and turn ignition on


Remove original key.

Insert new remote key and turn ignition on

Remove new key


Inert original key and turn ignition on again

The key is successfully programmed. Prepare the next key to program


Test both 2 keys

Original key, press Lock and Unlock button


Insert new remote key and turn ignition on

Remove key

Press Lock and Unlock button on the remote


New key programming success.

How to read BMW EWS3 2D47J key data with Xprog

Publié le 25/01/2018 à 08:37, MONTMARTE
Mots clefs : XprogXprog m

It is a BMW E38 year 1997 with EWS3 immobilizer. So, 1997, e38, as I understood there M52 with 1 VANOS.
We are going to read the great and terrible MC68HC11EA9 with a 2D47J mask.

bmw-EWS3-2D47J-1 bmw-EWS3-2D47J-2

The car does not start.

When connected to the immo, I immediately got a very fast heating of the ELMOS chip on the board, up to 60 degrees and above (as indicated by the laser thermometer), and naturally the unit does not react to the key with the key, just as the indicator LED does not indicate that the unit is connected , well, in short, a 100% corpse.

Since the processor is encrypted, and the machine is far away, and you can not dump the dump, so first I try to get by with small blood and reanimate the board, namely, to change the often failing, the aforementioned, microcircuit.


She did not give a substitute for the results. The same heat. Which means only one thing – the end card, and then we have two ways – either to transplant the processor to a live board, or to read the dump and fill it into the normal and secure EWS3 block with the 0D46J processor mask, which I did.



Read data with Xprog v5.55 box programmer


All successfully read


General view of the scope of work


On the BMW EWS3 EWS4 test platform, the unit was seen, the key was identified, the relay worked.

Today I was informed that after the EWS-DME synchronization the car successfully left the service station on its own.

Page précédente | Page 1 sur 22 | Page suivante

Mes albums

Où suis-je actuellement ?


Mes amis

Sites favoris