Open Source Hitag Programmer

**Faraday** · 9th August, 2022, 07:49 PM

Originally Posted by XProfig

In the last months I did some improvementsw to AESHitager. Furthermore, I reworked some parts of the arduino code. Arduino part of the project will be called "hitaguino", this makes it easier to distinguish between GUI and arduino.

AESHitager v1.3.1, hitaguino v2.1.1
You find the most recent version in the GitHub page: https://github.com/kivijakola/hitager/releases

Below an overview of the new features:
- Writing remote data to BMW PCF7945 (and others) now working stable
- Support BMW remote programming from CAS3 dump (mask 0L01Y, 0L15Y)
- PCF7991 ABIC configuration can be changed by GUI
- Documentation added to GitHub https://github.com/kivijakola/hitager

General:
- Improve stability of RFID communication (especially china keys)

Testers welcome!

Looks like typo:

**XProfig** · 10th August, 2022, 12:02 AM

You are right, I just copy&pasted the comment from arduino nano to arduino mega. Will correct that soon. Thanks for reviewing!

**mbi** · 10th August, 2022, 07:12 PM

Thank you rellullapaasee and XProfig for this project.

I downloaded new version v1.3.1 and hitaguinov211, I programmed arduino and after a few test with BMW key, I think I found issue. Remote key data is read wrong while on old version v1.3.0 everything is OK. See video.

https://drive.google.com/file/d/1ofw...ew?usp=sharing

**Faraday** · 10th August, 2022, 09:32 PM

'General:
- Improve stability of RFID communication (especially china keys)'

It works very stable now THX.

**XProfig** · 11th August, 2022, 09:52 AM

Thanks a lot mbi and Faraday for testing. You are a big help!

@mbi: I assume that you tested with a BMW PCF7945 (5WK49125) key, which has a not-yet locked remote page. Correct?

With help of the logs I'm understanding the problem:
PCF7944 and china key requires a special read-out strategy in order to enable reading of the locked remote page (Pg15). But this strategy does not work for not-locked PCF7945. This seems to be a new behavior with version v1.3.1.
I will analyze that in detail in the next days and try to find a read-out procedure which works for all keys (PCF7944, china key and PCF7945).

**mbi** · 11th August, 2022, 10:13 AM

Yes, this key has not-yet locked remote page. I don't know if it is 5WK49125 because there is no any marks on it. I bought it as new (cheapest one). Based on ID AESHiteger detects as pcf7945/53 and I didn't open its cover.

**XProfig** · 11th August, 2022, 11:17 PM

I just added some "intelligence" to the BMW remote reading code. Now it reads all my BMW keys I have for testing just stable. I tried each one 10 times successfully.
Following remotes are supported now
- PCF7945 (5WK49125) with Pg15 not locked
- PCF7944 (old version CAS key) with Pg15 locked
- 26A0700 (china key) with Pg15 locked

Please find the new AESHitager v1.3.2 under the known location (https://github.com/kivijakola/hitage...ses/tag/v1.3.2)

@Faraday: The typo in hitaguino code is fixed as well

**mbi** · 12th August, 2022, 11:07 AM

Thank you Xprofig! It works well now.

Could you confirm one thing for me.
You wrote on github:

With c70e02a I was now able to write the remote data many times without any error.

Does it mean that I can write diffrent remote data many times until remote page is locked in TMCF?

**Faraday** · 12th August, 2022, 01:14 PM

He meant write consistency IMHO

**XProfig** · 12th August, 2022, 01:48 PM

Originally Posted by mbi

Thank you Xprofig! It works well now.

Could you confirm one thing for me.
You wrote on github:

Does it mean that I can write diffrent remote data many times until remote page is locked in TMCF?

Yes, that was my experience if I remember correctly. You can rewrite the remote data of 5WK49125 multiple times as long as you did not set the lock bit in TMCF byte.

**hoangtu** · 8th October, 2022, 12:07 AM

Originally Posted by GlennGlenn

Coil that works perfectly
Attachment 893201 Attachment 893202 Attachment 893203 Attachment 893204

hi! Can anyone reupload this image? thank you very much

**XProfig** · 13th October, 2022, 05:35 PM

Unfortunately I did not save the pics. I don't understand why they are not available anymore, althought they were uploaded to the forum.

**jl01152** · 18th November, 2022, 07:53 PM

Originally Posted by XProfig

Can you describe which key you are trying to read?

I guess an E39 key. According to my google research, this key uses PCF7935 chip. I do not know if it can be used with standard Hitag2 commands. If not, this might be the reason why it's not working for you.
Could you try with a Hitag2 key (e.g. PCF7936 / 45/ 52 / 53 ...)?

Sorry Xprofig, I thought I responded to this months ago. Unfortunately I only have PCF7930 and PCF7935 I think. Thank you for clarifying this though because I spent countless hours trying to figure out if there was an issue with my hardware configuration. so I can keep the arduino setup and have both the ak90 and hitager in one. Even though I haven't had a use for it, its good to have and I appreciate your development on this. I've been reading up and seeing lots of improvements since I was last on this forum. Thanks

**atsankov** · 15th December, 2022, 05:53 PM

Hi
It is possible to use this tool for reseting used VVDI XT27 chip and use it again?

**GlennGlenn** · 25th December, 2022, 01:00 AM

Hi
Yes you can re-use XT27A transponders using the Hitager system.
VVDI Superchip tab, Freeze Chip, Enable Mem Access, Read Chip to make sure, Set Type to ID7936(ID46) and press Set Type.
XT27A is now in default mode as supplied from manufacturer.
You don't have to use Freeze Chip in this default mode, it will Enable Mem Access without freezing the chip.
Reprogram as usual to any other type and data.