Porsche 911UK Forum

Welcome to the @Porsche911UK website. Register a free account today to become a member! Sign up is quick and easy, then you can view, participate in topics and posts across the site that covers all things Porsche.

Already registered and looking to recovery your account, select 'login in' and then the 'forget your password' option.

Fobs, blades and pills

eabeukes

Well-known member
Joined
30 Jan 2018
Messages
194
While it sounds like something from a 90's rave, I'm after some help of a non-chemical nature!
:dance: :lock:

I currently have 3 keyfobs:
#1 - Remote light works and locks/unlocks, blade present and locks/unlocks door, pill present. This key can start the ignition.
#2 - Remote light works but no remote lock/unlock, blade present and locks/unlocks door, pill present. This key doesnt work in the ignition
#3 - No lights, no blade. Pill present in key head.

I have tried to swap the pill from #3 into #2 but it still doesnt let me start the car.

Any idea's?
 
Ok .. so if i get this right key numbers 2 and 3 dont start the car ? so swopping the Pill will not start the car as its the same problem which ever key its in ?

Just for info .. a tester can program the key to start the car .. so you could have them coded on ... talk to your indy perhaps :)

The blip cant be made to work but to start the car then as long as the pill is intact then it should be able to be coded to the car .

Edit ..

I suspect that neither key 2 or 3 is actually coded to the car .. hence they wont work .
 
Thanks Demort, I've actually ordered a programmer from AliExpress so will see how that turns out! If not, I know roughly what Indy you're at :thumb:
 
Easy I'll let you know when it arrives if it works, if you want to borrow it after.
 
eabeukes said:
Easy I'll let you know when it arrives if it works, if you want to borrow it after.

Brill thanks!

I think my car is megamos id48 pill, but this apparently changed some time in 1999 from id13

http://transpondery.com/transponder_catalog/porsche_transponder_catalog.html

i'm not sure how reliable this page is.

But our cars have been hacked.... so there must be a cheap solution out there for duplicating pills... some light reading: https://www.usenix.org/sites/default/files/conference/protected-files/sec15_slides_verdult.pdf

They mention they "hacked" the tango programmer, which can be got from aliexpress for £140. But I think you need an immobilizer dump from the immobilizer ecu to program a pill, not just a working key.
 
The one I have on the way apparently does both id13 and id48 programming and cloning. Will have updates after Easter weekend (if it arrives as scheduled!)
 
wasz said:
... I think you need an immobilizer dump from the immobilizer ecu to program a pill, not just a working key.

The mobile key guy who looked at my key a few months back said this too.
 
asterix_the_gaul said:
wasz said:
... I think you need an immobilizer dump from the immobilizer ecu to program a pill, not just a working key.

The mobile key guy who looked at my key a few months back said this too.

This can't be that hard to do.... a serial adapter soldered up to the right pins... hard to get info on how to do it for obvious reasons.
 
Id like a little info if possible on this ..

The fob transponder is a glass tube with .. Magnets or temp magnets in it ?

Id love to know how this actually works if anyone could explain or pm me a link so i can read up on it .

i know its a coil of wire that picks up the signal from the transponder so i assume its magnet based .. but the details .. :dont know:

Its also a rolling code so how do you alter the transponder ?
 
From what I remember the key man said he gets the immobiliser code from the car transponder when key is in the ignition, the car transmits the code not the pill, hence needing the car. The code is then cracked by an online pragram that spits out the data that you program the pill with so it works with your car. At least that was my understanding..
 
Cheers young man .. my confusion is how the pil actually works ..

Ive broken them appart trying to figure out how they actually work .. its bits of metal in a glass tube basically with some sort of insulation between them and what looks like small copper windings .

The reader of the pil is a copper coil .. so my guess is magnetic but i dont understand how you can change the pil .. hence temp magnets :dont know:

Not the sort of thing Porsche will tell us about on any training cource .
 
Demort said:
Cheers young man .. my confusion is how the pil actually works ..

Ive broken them appart trying to figure out how they actually work .. its bits of metal in a glass tube basically with some sort of insulation between them and what looks like small copper windings .

The reader of the pil is a copper coil .. so my guess is magnetic but i dont understand how you can change the pil .. hence temp magnets :dont know:

Not the sort of thing Porsche will tell us about on any training cource .

OK these work in the same way as your contactless bank card, and the "microchip" ID tag in your pet dog.

There is a coil of wire around the ignition key slot.

As we know, pass a current through a coil and it induces a magnetic field. A current is applied to the wire around the key slot.

Put a coil inside that coil, and a current is induced in the second coil. In this case the "pill" or "transponder" in the key head, which is a chip with a coil of wire as you have found.

This induces current powers the chip inside the pill up.

Then the car sends a message to the chip in the pill. If it likes the response, it fires the car up.

The systems run a variety of encryption techniques to stop you just copying the pills, with various rolling codes and things too complex to describe here, but if you google "megamos encryption" theres some detail.....
 
:thumb:

Excellent .. cheers young man .. i would guess that theres more than one coil in the transponder and strength of return signal and the amount of coils would give a combination that could be used as a code .

I think perhaps the rolling code is only for the fob and the transponder is fixed , it wouldn,t really need to alter logically .

Ill do some googleing :)
 
I've got a few transponder cloning tools but nothing that works cloning the 996 id48 pill. I can do 996s by coding the module to a pill, and can do this without the IPAS codes. Think this is a better approach than cloning pills anyway as uses a different 'slot' (996 accepts 5 keys) rather than being a duplicate key.
 

New Threads

Forum statistics

Threads
124,354
Messages
1,439,451
Members
48,709
Latest member
Silage
Back
Top