Freelander 1 Anyone sorted key chip cloning??

This site contains affiliate links for which LandyZone may be compensated if you make a purchase.
andyfreelandy

andyfreelandy

Well-Known Member
Posts
5,118
Location
Devon
As the F1 gest older, more and more come with one key.
Fobs is straightforward. Key blank supply and ID46 blank chips are readily available but hs anyone found a cloning device to make a new key chip from a working key please?!

Seems a huge market.
 
I have never opened an FL1 key fob before, but on the Rover 75 when you open the key there is a PCB board, which incorporates the battery, then inside the rear of the key is a transponder.
aWtH28ul.jpg
1

It is this transponder that needs to be re-wrote,
5eJGrNbl.jpg
2

Also if you pop out the PCB along with the battery.
RzbmtEll.jpg
3

On the reverse of the board is a sticker with a code on it, these can be used from any car and re-wrote to match your car, there are a few members on the R40 club whom have the equipment to do this, all that is needed is a new transponder and the code is taken i think from the EWS on the car.
PV9yzW1l.jpg
4

you would then have to remove you key blade from you original fob and add it to the new fob, or you can purchase a new fob and have it cut.

I will ask one of the members if they can do FL1 fobs
 
Looks the same transponder chip.
If you can find a way of copying to a used or new blank chip then that would be great.

The Freelander 1 has just the chip in the key head. The remote and electronics are all in the 2 button fob.
Early cars had a transponder in the fob I believe. My MGF did, the fob had to be on the key ring for the car to start.
 
Terminology needs clarifying to prevent misunderstanding.

The transponder is in the key head.
The fob is usually used to describe the 2 button remote to access the vehicle.

Just so that we don't go off on a blind alley!!!!

Thanks.
 
Read this on a BMW site, looks like the same system as the F1.
The transponder has an EEPROM in it and stores:

  • The vin number
  • Mileage at last use
  • Fixed password
  • Rolling code (random password)
  • Key number


New (programmed) keys come with the vin and fixed password programmed. The ews assigns the first rolling code at first use and marks that key slot in it brain as used. The EWS will only provide that key with the next rolling code next time if the KEY supplies the correct rolling code. The ews also updates the mileage in the key. The EWS provides updated mileage and rolling code each time the key is validated (put ion and turned on and passwords are correct.

If one were to duplicate the data in the transponder (have a locksmith make a duplicate of the key) the next time either key was used he key used would get a new rolling code and the other key would cease to work. If you want 2 working keys the duplicate must be coded as a different key in an unused slot and contain the fixed password unique to that slot in that cars ews. Which one can get from reading the ews or having bmw make you a key.

Looks like a rolling code system with password is used. I also read that chip cloning results in a failed key after the codes roll. Timpsons have apparently had this problem.
Looks like we need a software geek input!!
 
andyfreelandy said:
As the F1 gest older, more and more come with one key.
Fobs is straightforward. Key blank supply and ID46 blank chips are readily available but hs anyone found a cloning device to make a new key chip from a working key please?!

Seems a huge market.
Click to expand...
Timpsons cloned the one key that came with my car years ago. I supplied a blank and they provided the chip (which was a sort of lozenge shaped thing - presumably the ID46 chip you're referring to). Both keys have worked fine since. I don't know if that helps? You could call into your local store and ask what kit they use
 
I wasn't aware of two way coms between the transponder (in the 2001 onwards FL1 key) and the alarm ECM, but that would make sense as the code is rolling, and it has to get in the key somehow.
It'd be interesting to see if the transponder data stream can be recorded and broke down to display what is being transmitted and received.

This is way beyond my ability, but I'm sure someone on here has the ability to do it.
 
Classic Rides North Wales does keys & fobs. They send a small dongle you plug into the diagnostic port, and it automatically programs the key & ECU into a spare slot in the ECU. Call Les and he will explain the process in detail. I spoke with him yesterday about it.

Very similar process on Son's girlfriends Corsa, except I did that myself. Replacement button key with circuitry & blank ID chip from eBay. Then used Op-Com software to erase ECU slots, and then program new key plus Immobiliser & Engine ECU's. In this case you definitely cannot program used keys into the ECU's because it's a one-time process.
 
There are three different Freelander immobiliser systems:-
1. upto about 1999 there is no separate immo and it's all in the 27VT. These just have the remote central locking fob and that's all.
2. about 2000 to 2003 you have the fob for the remote central locking, and a chip in the key which links to the EWS3D immo. This is essentially the same system as the Rover 75 and is BMW based.
3. about 2003 to 2006 you have the fob for the remote central locking, and a chip in the key with links to the SAWDOC immo which I think is a JLR based ECU.

Concerning number 1, the upto 1999 you can mechanically cut a new key and program in a spare fob using a tool like pscan. These vehicles also have an emergency override EKA system like an MG Rover. If you don't know your EKA then it's worth finding it out and writing it down somewhere safe but not in the vehicle. On these early systems you can also rematch engine ECU to 27VT yourself with the right tools.

Concerning number 2 and 3 you can program in a fob as per 1 but it won't start the vehicle, because the chip in the key has to match what's in the separate immo. The chip in the key is activated and transmitted with via a coil in the ignition barrel. This works with no key/fob battery so in theory it's more reliable and more secure, but also more difficult to solve if you loose your key.

I know that if you have one working immo chip in the key that there are places that can clone them. So basically now I suppose that you would have two identically coded key chips. If you only have one then it's probably a wise thing to do now.

What if you loose the last one?

Three options that I know of:-
A. Landrover can supply (using the VIN) a brand new key with a chip that matches one of the codes that is already in your EWS3D or SAWDOC ECU. When these ECUs were produced the manufacturer put multiple codes in the ECUs and made careful records. So if you can get a JLR parts dept to supply one based on your VIN, then it should "just work".
B. There are tools that can "hack" the immo. Basically they can supply a key with a chip with a known code, and they they modify the immo ECU to put that code into the ECU so that the chip works. My understanding is that you can't do this through the diagnostic socket and the immo ECU has to be physically removed to access the right spot in the circuit board to hack it. This means getting the dashboard top off to get to the ECU. Less money to JLR but more money in labour to get to the immo ECU. If you can get the dash top off yourself then a good auto locksmith guy can do the rest quite easily.
C. Change the key chips, immo ECU and engine ECU for a working set from a scrap Freelander. Note that the engine ECU and immo are irreversibly linked so you have to change both. It's a complete three part "security chain" from the key chip to the immo to the engine ECU.

If anyone knows of more options then please let me know.

To be very clear about pscan and it's capabilities with EWS3D and SAWDOC: it can enable or disable key chips that are already linked to the immo, so when the codes already match. The usefulness of this probably limited to disabling a lost or stolen key, so if someone finds that lost key, or stole it, then you can make that lost/stolen key useless and therefore protect the vehicle. Basically if you loose a key and get a replacement from JRL then ideally you should do this. Secondly, if you then find that missing key you can re-enable it with pscan.
However, what it cannot do is create the link between a key chip and the immo that are not previously linked. So if you loose your last key chip then pscan won't help you.
The same rules apply to the JLR factory diagnostic tool.

I hope all that helps. Unfortunately it is quite complex.
 
pscan.eu said:
There are three different Freelander immobiliser systems:-
1. upto about 1999 there is no separate immo and it's all in the 27VT. These just have the remote central locking fob and that's all.
2. about 2000 to 2003 you have the fob for the remote central locking, and a chip in the key which links to the EWS3D immo. This is essentially the same system as the Rover 75 and is BMW based.
3. about 2003 to 2006 you have the fob for the remote central locking, and a chip in the key with links to the SAWDOC immo which I think is a JLR based ECU.

Concerning number 1, the upto 1999 you can mechanically cut a new key and program in a spare fob using a tool like pscan. These vehicles also have an emergency override EKA system like an MG Rover. If you don't know your EKA then it's worth finding it out and writing it down somewhere safe but not in the vehicle. On these early systems you can also rematch engine ECU to 27VT yourself with the right tools.

Concerning number 2 and 3 you can program in a fob as per 1 but it won't start the vehicle, because the chip in the key has to match what's in the separate immo. The chip in the key is activated and transmitted with via a coil in the ignition barrel. This works with no key/fob battery so in theory it's more reliable and more secure, but also more difficult to solve if you loose your key.

I know that if you have one working immo chip in the key that there are places that can clone them. So basically now I suppose that you would have two identically coded key chips. If you only have one then it's probably a wise thing to do now.

What if you loose the last one?

Three options that I know of:-
A. Landrover can supply (using the VIN) a brand new key with a chip that matches one of the codes that is already in your EWS3D or SAWDOC ECU. When these ECUs were produced the manufacturer put multiple codes in the ECUs and made careful records. So if you can get a JLR parts dept to supply one based on your VIN, then it should "just work".
B. There are tools that can "hack" the immo. Basically they can supply a key with a chip with a known code, and they they modify the immo ECU to put that code into the ECU so that the chip works. My understanding is that you can't do this through the diagnostic socket and the immo ECU has to be physically removed to access the right spot in the circuit board to hack it. This means getting the dashboard top off to get to the ECU. Less money to JLR but more money in labour to get to the immo ECU. If you can get the dash top off yourself then a good auto locksmith guy can do the rest quite easily.
C. Change the key chips, immo ECU and engine ECU for a working set from a scrap Freelander. Note that the engine ECU and immo are irreversibly linked so you have to change both. It's a complete three part "security chain" from the key chip to the immo to the engine ECU.

If anyone knows of more options then please let me know.

To be very clear about pscan and it's capabilities with EWS3D and SAWDOC: it can enable or disable key chips that are already linked to the immo, so when the codes already match. The usefulness of this probably limited to disabling a lost or stolen key, so if someone finds that lost key, or stole it, then you can make that lost/stolen key useless and therefore protect the vehicle. Basically if you loose a key and get a replacement from JRL then ideally you should do this. Secondly, if you then find that missing key you can re-enable it with pscan.
However, what it cannot do is create the link between a key chip and the immo that are not previously linked. So if you loose your last key chip then pscan won't help you.
The same rules apply to the JLR factory diagnostic tool.

I hope all that helps. Unfortunately it is quite complex.
Click to expand...
Hi, thanks that's interesting. If I remember rightly JLR need the cars VIN & then have to order a new key from Germany (about £150) then they told me it needs programming to the car (another £75) that was about 2 yrs ago.:eek:
Timpsons key cutting & 'cloning was about £80 or £90 about 6 months quite reasonable. I might just get a key cut & hide current one on board somewhere.
 
Andy Warren said:
Hi, thanks that's interesting. If I remember rightly JLR need the cars VIN & then have to order a new key from Germany (about £150) then they told me it needs programming to the car (another £75) that was about 2 yrs ago.:eek:
Timpsons key cutting & 'cloning was about £80 or £90 about 6 months quite reasonable. I might just get a key cut & hide current one on board somewhere.
Click to expand...

In my opinion "programming to the car" is a bit disingenuous from JLR dealers, and in fact, most of the dealers around here no longer have a T4 system and so couldn't do this if they wanted. Probably what they are doing is disabling all of the other keys so that the vehicle can't be stolen with an existing key. That would be the right thing to do and I suppose worth the forty minutes of labour or whatever £75 buys you these days.
To the best of my knowledge the new key will come from Germany already preprogrammed to the car, as I stated.
The only disadvantage of the Timpsons route is that it gives you multiple keys with the same code. If you loose one of those keys then you can't disable it because that would also disable its clone (the other one). At least that's my conclusion based on my understanding of how it works and what I think Timpsons are doing, but I could be wrong.
 
Thanks Andy & Philip.
My logic, based on the age of the vehicles, is that keys get broken or lost. The chances of anyone matching a found key to a vehicle is very small. Generating a new key chip code seems beyond the diyer.
So, cloning the existing key where only one exists or where one is bent or broken would seem a sensible way forward.
The Pscan is great for removing any key slots not in use or where keys are not in your possession.
The programmer I have will generate a cloned chip from a working key. Why the key must be swapped between the programmer and the vehicle I am not sure?

Going to get a few blanks cut and then try to clone the chips. They work out at £8 for the key blank and about £0.80p for the chip plus what the key cutting costs.
Have also found a source of flip key blank and case which houses the remote and looks to have the right key blank. We will see!!
 
Quick update. Not going so well!

Bought cloning machine.
Got software.
Set up and got the thing working.
Got a blank key cut to fit car.
Inserted original and the reading went on for hours. It identified the chip as a Philips and the key type as 'BMW rolling'.

Eventually, after 2 hours, I contacted tech support for the machine and was told that it didn't and no machine on the market would clone BMW rolling code key chips!!

So bit stuffed. Will be back to supplier who reckons it has done a Freelander 1 key. Also mystified as to how some report Timpsons managed it. I asked in Timpsons, a big store, and was told they couldn't do Land Rover but he cut the key blank OK for a few quid.

Bit stuck now!!!
 
I have a bunch of ECUs that I got from a crashed car, with keys, and one of the keys is clearly a clone, so it is possible.
However this is 2004-2006 car which had the SAWDOC immo rather than the BMW one.

If you are doing a slightly earlier car then it will be BMW EWS3D which is the same system as fitting to Rover 75.

I have a feeling that this is actually based on the BMW EWS2 as fitted in BMWs but I'm no expert.
 
You must log in or register to reply here.

Similar threads

T
Replacing chip in Freelander 1 key
Replies
13
Views
2K
pscan.eu
P
T
Full EV Landy.... Its the future!
3 4 5
Replies
96
Views
8K
RapidBlue
RapidBlue
DocMason94
Hello from Birmingham!
Replies
3
Views
598
Hippo
Hippo
J
Freelander 1 Immobiliser
Replies
13
Views
5K
Hippo
Hippo
P
My Td4 modifications... all done... at last.
Replies
3
Views
2K
PopRivet
P
Back
Top