background image

Touchclone™ EEPROM Reader 

 

28 

Touch

clone

™ Version 1.5 – Manufactured & Developed by 1

st

 Call Lockouts Limited. All rights reserved 2012. 

 

Let’s analyse the results further... 

 

 

 

 

 

 

 

 

 

 

 

Let us now create  your own custom read method 

Consecutive byte read 

Up to address 40 hex data is visibly changing but after that we are getting “FF” bytes. We now need to 
determine whether the “FF” bytes are valid or if they are produced by interference due to reading in circuit. 
As a safe measure the consecutive byte read is now set to 32. This will allow TouchClone to read up to the end 
of line “0010” before powering off the Eeprom ready to read the next 32 bytes up to the end of line “0030,” 
this will then repeat until all data for that Eeprom has been read. 
 

Power off delay 

 
This parameter can be used to make sure that the board fully powers down between reads, therefore we are 
going to allow a power off delay of 500ms (milliseconds).  
 
The main reason for the delay is because the board which we are reading from has a capacitor which stores 
charge (picture shown below), after so long the board is powered up long enough to ‘wake up’ the 
microcontroller on the PCB which then starts communicating with the Eeprom (which is its correct function). 
We must therefore allow the capacitor to discharge and the microcontroller to go back to sleep before 
restarting the read again. 
 
This delay will occur each time 32 bytes have been read (set in 

consecutive byte read

 parameter). 

 

Summary of Contents for TouchClone version 1.5

Page 1: ...the latest in automotive technology Touchclone is the first all in one cloner of car keys with the extra function to create programmed transponders via communication with a cars immobiliser Touchclone keys cloned at a touch ...

Page 2: ...uction 9 Touchclone Transponder Production Continued 10 Touchclone Immobiliser Transponder Production Modules 11 Touchclone Feature Lookup 13 Touchclone Database Lookup 14 Touchclone ID46 Diagnostics 15 Touchclone ID48 Unlock 16 Touchclone Mercedes Master Key 16 Touchclone Settings 17 Touchclone Website 19 Touchclone VAG Group ID48 Pre Coding 20 Touchclone EEPROM Reader 23 Touchclone Deactivation ...

Page 3: ...ed by 1st Call Lockouts Limited All rights reserved 2012 Getting Started In The Box TouchClone USB Drive Installer and Digital information Box of clip on probes box of 10 2x D Sub 9 way looms 12v Power adapter High speed USB cable Installation and activation card ...

Page 4: ...o TPX2 No external hardware required or internet connectivity Clone Crypto ID 46 or TPX4 release version November 2012 Touchclone Lock Status display ID 46 ID 48 4D TPX2 Touchclone Special Features Hitag 2 remote diagnosis test button battery and LED test Create Zedbull and AD900 precoded transponders Unlocking ID48 transponders using factory pin configuration Produce Mercedes transponders for C c...

Page 5: ...CU inline reading Motorola mask look up Customer information database Touchclone Interface Functions Intuitive Application Software Touch screen for standard functionality USB connectivity with serial connection for immobiliser probe connectivity PREVIEW A quick look at the software interface Touchclone has an extremely intuitive interface which allows the user to read clone and program keys quick...

Page 6: ...PCs at any one time Each time TouchClone is connected to a PC and the software is running the pairing will occur Users can determine if TouchClone is paired by checking if the connected symbol is illuminated in the TouchClone software as shown below For information on how to deactivate TouchClone refer to the deactivation section of this guide The device pairing system is put in place as a securit...

Page 7: ...ponder Touchclone has been designed to read a vast range of RFID transponders on the market place today from the first fixed code transponder T5 through to the latest Hitag and 4D 80 bit transponders To read and ID the transponder simply place it into the Touchclone holder next to the key holder and then click the read icon with your mouse The Touchclone software wizard will do the rest for you ...

Page 8: ...ouchclone also clones all the 4D prefixed transponders onto a TPX2 Step 1 Preparation Ensure you have the correct transponder ready to clone to before you start the procedure Step 2 INSERT key transponder Touchclone will automatically read the transponder following a mouse click of the clone transponder icon follow the on screen prompts to then put the clone transponder in after the original has b...

Page 9: ...all range of low cost blank transponders This benefits the auto locksmith or heel bar as their stock holding of transponders can be greatly minimised Why Transponders can be made to suit each vehicle you are working on without having any dead stock Step 1 Transponder Production Click the transponder production icon This will take you through to a list of transponder Ids which can be produced using...

Page 10: ... Transponder Production Continued Step 3 Select From the list select the ID you wish to produce The transponder in the brackets denotes the blank transponder that will be used in the ID production Step 4 Insert blank transponder Touchclone will prompt you once you have made your selection to insert the correct blank transponder That ID will then be produced ...

Page 11: ...array of vehicles which Touchclone supports by reading the vehicles immobiliser unit The immobilisers PCB security device eeprom or MCU is read in or out of circuit The first column choice depicted below is a list of vehicle manufacturers which once selected will bring up the middle column of all the supported models for that manufacturer Finally once the make and model is selected the Touchclone ...

Page 12: ...D Identify the ECU Immobiliser you have removed from the vehicle matches exactly the UNIT ID for the Touchclone module If they do NOT match we strongly recommend you do not continue unless otherwise advised Step 2 PCB ID Before working with any device on the board ensure that the PCB components and their layout match the PCB ID picture exactly Remember there can be several module options for the s...

Page 13: ...anufacturer Model and Year summary fields Key blank and remote key reference SILCA ILCO reference Picture Image of the key blank Transponder Type ID of the transponder Touchclone module number Module reference How to ignition or door lock A first for those who need to strip down an ignition or door lock these guides show you how based on Ron Wakleys publication Immobiliser Location Where you will ...

Page 14: ...ersion 1 5 Manufactured Developed by 1st Call Lockouts Limited All rights reserved 2012 Touchclone Database Lookup Database Lookup This feature conveniently allows you to store customer data car information etc which can be recalled at any time ...

Page 15: ...e Type Once you have put the Hitag remote into the key holder or rested it across the top if it is a key card Touchclone will verify which Philips device is driving the remote and display it e g PCF7946 Battery Good OK Change Soon Change Now Critical These are the flags which will define the state of the battery life within the remote LED Remotes which have status LEDs will also be tested using th...

Page 16: ...nless on the same vehicle this function will UNLOCK the transponder This allows your cost of inventory to be protected NB This function relies on a default pin code being used by the Megamos transponder Touchclone Mercedes Master Key Mercedes Master Key Mercedes transponder production for C class E class and G class up to 2002 This function produces a coded transponder which will be programmed sim...

Page 17: ...the user to determine which version of TouchClone they are running an indication of whether an update is due The information in Device is a specific serial number assigned to that device registered to each user License states the expiration of the user paid subscription An expired license will maintain full functionality but will not be able to receive any future updates Updates Hit the check butt...

Page 18: ... the updates field will change to available and the check button will change to apply Click apply and you will see the following window Follow the on screen instruction by powering the TouchClone device off and then back on using the power switch All available updates will be applied and once completed your TouchClone device have all the latest exciting feature releases ...

Page 19: ...t Call Lockouts Limited All rights reserved 2012 Touchclone Website Website This simple function is a shortcut to the Touchclone website allowing you fast access to the technical support forum and videos as well as seeing what new software is contained on the latest updates ...

Page 20: ...en vehicles In order to get the data to write to the transponder we recommend you use OBD equipment at present we support datasets from units manufactured by both Advanced Diagnostics and Abrites The OBD equipment will present the component security data you need on screen On some of the newest vehicles the OBD equipment can only pull 6 of the 7 bytes needed to write to the key In order to get rou...

Page 21: ...he Advanced Diagnostics OBD equipment then check the option if not leave unchecked Once all steps have been completed click next to proceed to write to the transponder Finding the 7th byte NB This section describes the process when used with Advanced Diagnostics OBD equipment For other equipment please refer to the manufacturer s instructions If you managed to extract all 7 bytes then you are able...

Page 22: ...ovided transponder bucket and press next so Touchclone can then write out the extracted data and the 7 th byte as 00 The above window shows the successful write Now take the transponder back to the vehicle and wait for the AD OBD equipment screen to update When the pre code value is correct the screen will update to say Correct Transponder Yes If not then take the transponder back to Touchclone an...

Page 23: ... in circuit for several reasons We will now explain each reason and how it affects successful reading Ultimately we will give you some ideas of how to create custom solutions to enable a higher success rate with incircuit Eeprom reading We are using Touchclone to demonstrate how custom read methods work as it gives us the flexibility to change otherwise fixed parameters To put you in the right min...

Page 24: ...parameters the boxes highlighted from Yellow through to Orange that we can change to allow for a successful read We will break down what each parameter means and then give you a real life example so that you can try it for yourself This knowledge will allow you to experiment on Eeproms in circuit with the goal of obtaining all the data off the device without having to desolder Clip on Instructions...

Page 25: ...ve discharged before reading the next section of data This function only becomes active when a value other than 0 is set in the Consecutive byte read field Increase this if after a consecutive byte read restart the data remains incorrect 3 Byte Delay The delay between reading bytes measured in microseconds 0 is in most cases the best value as you want to extract the most data in the shortest time ...

Page 26: ...essful custom method you can make a note of how it was read and you have gained a competitive advantage against all those that continue to desolder Custom Read Function Example The vehicle we are working on is a 53 Plate Citroën Relay van we know which Eeprom to read on the immobiliser and we have found that it is a 93C56 Eeprom please see selected screenshot above Default Read Method If you have ...

Page 27: ...vehicle would highlight this problem or comparison against a known successful read on a similar vehicle immobiliser box We can now assume that all the data could be retrieved from the Eeprom by changing the read method parameters as the Eeprom does respond with data albeit irregularly and corrupt We will now show you how we tune each parameter to ensure the data we get is valid Verify Your Data us...

Page 28: ... next 32 bytes up to the end of line 0030 this will then repeat until all data for that Eeprom has been read Power off delay This parameter can be used to make sure that the board fully powers down between reads therefore we are going to allow a power off delay of 500ms milliseconds The main reason for the delay is because the board which we are reading from has a capacitor which stores charge pic...

Page 29: ...use the read commands for 8bit and 16bit organisations are different The eeprom organisation is set by the circuit itself and if the option here is incorrect each two consecutive bytes in the data will duplicate Above is the method that we have assumed by doing some simple investigation into the data collected using the default read method Below are the results of the custom read method ...

Page 30: ...ions and we have eradicated the large amount of FF bytes Now click the next button on the Touchclone application to see if it can be recognised as a supported vehicle module by TouchClone Yes the data has been read from the Eeprom successfully and recognised by Touchclone successfully As labelled DEE57 is a supported module by TouchClone Select that module and click next to go on to create a key ...

Page 31: ...of a PC that you were using being no longer available or another PC is preferred you may deactivate a slot by doing the following Note Either of the PCs Touchclone is activated on may access this function Ensure that Touchclone is connected to the PC has power and the software is running and connected to device Above Red circle indicates that the device is connected to software and we can deactiva...

Page 32: ...ow select which PC you would like to de activate from the system and then click deactivate If you have Touchclone activated on multiple PCs and wish to deactivate all slots you must make sure that you deactivate other installation first this is because when you deactivate this installation the unit is no longer connected to this PC and will not allow any further deactivations Once you have complet...

Page 33: ...vation functions that will be explained Possible reasons why you might use this application Problem during install meaning you could not activate TouchClone e g Internet Issues when trying to activate online Previous install still on a PC and wish to reactivate TouchClone without doing a full re install The application is located on your installation USB drive Open the USB drive root and enter the...

Page 34: ...ne activation has occurred or if there was an Internet connection problem when installing Touchclone software Ensure that you fill in your activation code that is on your activation slip inside your Touchclone carry case Also make sure that the email address used is the correct one as it is where notifications of future updates will be sent to Once both fields are completed check you have full acc...

Page 35: ...dates Press the Start button In the following window open the folder highlighted below Copy all Touchclone update tc files into the above updates folder Next go to the Touchclone program files folder below And run this file inside that folder TouchClone will now apply the TouchClone files that were moved to the updates folder in previous steps Follow the on screen instructions to complete updates ...

Reviews: