Chip-Tools

ITDEEN

Preparing a HITAG2 dealer key for the Cayenne (up to 2010) and finding the 7th byte

This prepares a virgin HITAG2 key/transponder for use as a dealer key on the Cayenne up to 2010, getting the component security bytes from the ECU over OBDII or from a Kessy/ECU dump. You need it when you don't have a key ordered from the dealer.

Procedure

1. On 2004-2007 models with a HITAG2 key/transponder use a virgin PCF7936 transponder or a virgin key. The transponder must be in encrypted ("Crypto"/Cipher) mode: with your HiTag2 programmer replace 0x06 with 0x0E in the first byte of the configuration page (page 3; page 0 is the transponder ID, pages 1 and 2 are the secret key). If the value is already 0x0E, the transponder is already in cipher mode.
2. On 2007-onwards models prepare the HITAG2 key/transponder with the "Program dealer key" function: connect the AVDI to the OBDII, open the "Special Functions", select "Key learning", model "Cayenne (-2010)", function "Program dealer key" and press "Next".
3. Method A - nothing removed, all over OBDII: press "Autodetect from ECU". The software tries to read the component security bytes from the ECU automatically and decides for itself whether the 7th byte needs to be searched for. If you don't have a working key for the car, first bridge the fuses as described in the appendix to get communication with the ECU.
4. If after the read you have all 7 bytes, you can program the key directly: press "Program".
5. If you only have 6 bytes and you do have a working key for the car: put it in the programmer and press "Find 7th byte from working key"; the 7th byte is found in a few seconds (doesn't work with Tango, you need a Hitag2 or an Abrites programmer).
6. If you only have 6 bytes and do NOT have a working key: search for the 7th byte manually. Connect the interface to the OBDII and connect the programmer as well, then press "Program": the software tells you when to put the key in the ignition lock and when to put it back in the programmer. Only insert the key, do NOT turn it. The search takes about 20-25 minutes, worst case up to 45 minutes.
7. To work faster you can keep the programmer near the ignition lock, but at least 15 cm away, otherwise the car reading the key will be disturbed.
8. Tip: for the 7th byte search use a plastic key or a blank transponder, at least the first few times. If the key locks up (flat battery, PC hangs, etc.) you can recover the encryption key with "Find 7th byte from working key" and restore the key with the Hitag2 key tool.
9. Method B - removing the Kessy or the ECU: select the "Load component protection from Kessy/ECU dump" radio button, press "Load dump", pick the dump file; the "Program" button then becomes active. Note: the ECU dump sometimes contains only 6 of the component security bytes and you still have to find the 7th. With the Kessy dump you get all 7 bytes, but there are many Kessy software versions: if the configuration data is decrypted incorrectly the bytes come out wrong, the key won't work and has to be restored with the Hitag2 programmer.
10. Method C - if "Autodetect" doesn't work (missing licence, fuse bridge not done properly, ECU missing or faulty): if you have previously read the component security bytes, for example by desoldering the ECU EEPROM and decoding it with the Dump Tool, enter them manually and carry on as in step 4.
11. With the key/transponder ready for learning, in the "Key learning Porsche Cayenne" window enter how many keys you want to learn and the security access code of the Kessy module, then press "Learn" to start the learning.

Reference screenshots