CAL High-Security Automotive Keys 3 — Questions and Answers
Question 1: Which Honda/Acura transponder system introduced the 46 chip (PCF7936) and requires an OBD bypass or EEPROM dump to clone because it is crypto-protected?
- MICU immobilizer
- Honda G-type transponder system
- Honda Ignition Security System (HISS) (Correct answer)
- Honda SmartEntry system
Correct answer: Honda Ignition Security System (HISS)
Honda's HISS (Honda Ignition Security System) on motorcycles and the similar system on cars uses crypto-locked transponders that typically require OBD tools or EEPROM work to add new keys.
Question 2: A locksmith needs to program a new key to a 2015 Toyota Camry with no working keys present. Which approach is most likely required?
- Standard on-board programming using the door lock sequence
- Replacing the smart key ECU and re-pairing
- Using a professional key programmer with OBD PIN extraction or smart EEPROM bypass (Correct answer)
- Inserting the key 8 times with the door open
Correct answer: Using a professional key programmer with OBD PIN extraction or smart EEPROM bypass
Toyota's 'all keys lost' scenario requires a professional device to extract the immobilizer PIN from the ECU via OBD or EEPROM, then program new keys into the system.
Question 3: What is the function of the 'dealer seed key' in some BMW EWS systems?
- A mechanical master key that overrides the ignition
- A special service key used to authorize new key programming sessions (Correct answer)
- A key that starts the vehicle without the transponder
- An encrypted USB key stored at BMW AG headquarters
Correct answer: A special service key used to authorize new key programming sessions
In BMW EWS systems, a dealer seed key (or ISN code derivation) is used to authenticate the programming session before new keys can be registered to the EWS module.
Question 4: When using an automotive key programmer to perform an EEPROM read, the technician must physically access which component?
- The key fob battery compartment
- The BCM, ECM, or immobilizer control module's memory chip (Correct answer)
- The OBD-II diagnostic port only
- The vehicle's VIN plate
Correct answer: The BCM, ECM, or immobilizer control module's memory chip
EEPROM reading requires direct access to the memory chip inside the immobilizer or ECU module, typically involving removal of the module and soldering or clip-on probes.
Question 5: Which frequency do most North American automotive remote key fobs operate on?
- 315 MHz (Correct answer)
- 433.92 MHz
- 868 MHz
- 902 MHz
Correct answer: 315 MHz
Most North American vehicles use 315 MHz for their remote keyless entry (RKE) systems, while European vehicles typically use 433.92 MHz.
Question 6: A locksmith encounters a Subaru with an immobilizer that uses a 4D60 transponder. What generation of Subaru immobilizer is this associated with?
- First generation using a fixed-code transponder
- Second generation using a crypto-locked ID60 transponder (Correct answer)
- Third generation using a 128-bit DST chip
- A Subaru-specific Bluetooth module
Correct answer: Second generation using a crypto-locked ID60 transponder
The 4D60 (also known as ID60) is a second-generation crypto transponder used by Subaru, which is more secure than the earlier fixed-code 4D chips.
Question 7: What is 'key relearning' (also called 'key registration') in the context of high-security automotive systems?
- Teaching a locksmith the steps to cut a key from code
- The process by which the vehicle's immobilizer stores a new transponder's credentials (Correct answer)
- Re-cutting a worn key to restore its original bitting
- Programming a remote's buttons to new functions
Correct answer: The process by which the vehicle's immobilizer stores a new transponder's credentials
Key relearning/registration is the procedure where the vehicle's immobilizer ECU is instructed to recognize and save the cryptographic identity of a new transponder.
CAL High-Security Automotive Keys 3
Which Honda/Acura transponder system introduced the 46 chip (PCF7936) and requires an OBD bypass or EEPROM dump to clone because it is crypto-protected?