Chip-Tools

ITDEENBGES

Mercedes: reading hashes from the EZS over infrared and reading the password from version 57 NECs

This procedure reads the hashes straight out of the EZS over infrared without knowing the password, and recovers the password from version 57 NEC microcontrollers taken out of the key. With the full dump, hashes and password you then generate the dumps in the Abrites diagnostic software for Mercedes.

Procedure

1. For the hashes: connect the ZN036 adapter to the vehicle's EZS, the adapter to the ABPROG and the ABPROG to the AVDI.
2. In the software's drop-down menu select "MB_EZS_IR" and then the vehicle model, for example W204.
3. Press the read button and place the IR adapter in the key slot (fob).
4. Wait for the read: when it finishes the hashes are displayed on screen. On some models you have to insert and remove the key from the slot several times for the read to complete.
5. For the password: place the NEC processor taken from the key onto the adapter board supplied with the ZN036.
6. Press "READ NEC KEY PASSWORD" and wait for the read to finish: it can take from a few seconds up to a few minutes.
7. Once the read succeeds the SSID and password fields appear along with the other chip data.
8. When you have the full dump, the hash files and the password, save the file and use it afterwards to generate the dumps with the Abrites diagnostics for Mercedes.

Reference screenshots