CAL - Certified Automotive Locksmith ECU and EEPROM Programming Questions and Answers

Question 1

What is the primary reason for a locksmith to perform an EEPROM dump from a vehicle's immobilizer module during an All Keys Lost (AKL) scenario?

Accepted Answer

To extract the security data required to generate a transponder chip the vehicle will accept.

Answer

EEPROM work is an advanced method used when standard OBD programming is not possible. The process involves reading the raw security data (such as PIN codes, component security, or key data) directly from the memory chip. This data file, or 'dump,' is then loaded into a specialized tool which uses it to write the correct information onto a new transponder, creating a key the vehicle will recognize without needing to communicate through the diagnostic port.

Question 2

A locksmith is working on an older Toyota where OBD programming has failed. They remove the immobilizer ECU and identify an 8-pin chip labeled '93C66'. Which is the most appropriate next step in the key generation process?

Accepted Answer

Use a hot air station to desolder the chip, then place it in a socketed EEPROM programmer to read the data.

Answer

The 93C66 is a common type of EEPROM chip used in automotive immobilizers. To generate a key from its data, the locksmith must first read the contents. This is typically done by either desoldering the chip and placing it in a dedicated EEPROM programmer or by reading it 'in-circuit' with a specialized clip. The other options are incorrect procedures that would either not work or risk damaging the module.

Question 3

When performing EEPROM work, which of the following best describes 'in-circuit' reading?

Accepted Answer

Reading the data from the memory chip while it is still soldered to the circuit board.

Answer

'In-circuit' reading refers to the technique of accessing the data on an EEPROM chip without removing it from the Printed Circuit Board (PCB). This is often accomplished using a special SOIC clip that attaches over the chip or by soldering very fine wires to the chip's legs, which then connect to the programmer. This method saves time and reduces the risk of damaging the board with heat.

Question 4

A locksmith needs to read the data from a secured Motorola (Freescale) MC9S12 processor in a BMW CAS module. Which connection method is typically required for this task?

Accepted Answer

Soldering wires to specific points on the circuit board or using a specialized BDM probe/jig.

Answer

Secured processors like the Motorola MC9S12 family cannot be read with simple clips. They require a more invasive method, such as soldering multiple wires to specific contact points on the board (like the background debug mode, or BDM, port) or using a specialized probe/jig that aligns with these points. This allows the programmer to bypass the processor's security and read its internal flash or EEPROM memory.

Question 5

After successfully 'dumping' an immobilizer data file and loading it into a programming tool like a VVDI2 or Tango, what is the primary function the tool performs with this file?

Accepted Answer

It interprets the security data in the file to prepare a new transponder with the correct values.

Answer

The raw data file, or 'dump,' contains the vehicle's unique key data in a binary or hex format. Specialized programmers have software modules (often called 'key makers' or 'producers') designed to read these specific file structures. The software identifies the key slots, PIN code, and/or crypto data, and then uses that information to write the correct code onto a new transponder, making it a valid key for the vehicle.

(CAL) Certified Automotive Locksmith Practice Test

(CAL) Certified Automotive Locksmith Practice Test

CAL - Certified Automotive Locksmith ECU and EEPROM Programming Questions and Answers