307 - BSI and key adaptation question

[longgo]

Hi fellas!

I have found quite a lot useful information in the topics of that forum, that helped me a lot.
Unfortunately for me, I found similar topics but with different content in it and not a lot data close to what actually search for..

The case is: Friend bought one Peugeot 305 1.6 petrol (manual transm.) produced 2003. It arrived with only single key (not foldable) without remote. Also I doubt it was the original one.., but still I promise to help with making second one.


What I have done:

- bought two keys from "Jackie Chan(AliEx)" just to be sure at least one will work. One is foldable , the second look like the current one but with remote in it. Both have same chip and induction coil, and look as that:

- using the pin code via PP2000 accessed the BSI (here is the unit number in case is needed)

During the procedure manage to program all 3 keys successfully and car start absolute fine with all of them! Then inside the settings I saw it was stated that the BSI recognize two radio remotes and 3 keys.
Then I try the following procedure:

and with the small (unfoldable) key I managed to lock and unlock the car remotely , but the foldable one no!

The questions:
- despite the peugeot planet showed that two radio remotes are accepted , can it be that only one remote can be used?
- After the last key was programmed via the software, I turn off and take the key out as the program stated that was ready and process finished. Then I wait a bit (about 30-40sec) , and start that remote sync process with the foldless key. When it finally lock and unlock the car, then start with the second key by follow the same steps as the picture above.
That been done, I took it out and waited about 30 sec and try both of them as remotes.
The small one worked, the foldable - no! By "not working" I mean to lock and unlock remotely. Otherwise all keys start the car without any issue what so ever..
- I`m missing something in the loop or can be partially faulty keyfob? Both have new battery if that matter, and as I said have same hardware as chip and coil. Do not poses any key remote reader to see if at least it broadcast anything. Have though one RTL chip based TV USB tuner that can connect to my Android phone and scan 433Mhz frequency and maybe see if it send something or no.

Any tip will be great, because probably I have not done all correctly..

Thank you!

[wheeler]

You can have up to 5 remote keys in the system.
It will just be that the other remote is the wrong one, Even though they will both be 434 MHz, there are different frequency types.
Stand alone transponder chips & the ones built onto the PCB have different ID types so the BSI knows this is a remote key hence the reason its saying there are 2 remotes in the system, its just that it wont recognise the RF signal from it.
Just order another one of the same type that worked if you want 2 working remotes.

[ozvtr]

There are 3 parts to the key.
The blade, the transponder and the remote transmitter.
The blade physically allows the ignition switch to rotate (simples, we all know that).
The transponder is interrogated by the car and allows/disallows the the engine to run.
The remote transmitter locks/unlocks the doors.
Don't get "transmitter" and "transponder" mixed up! They are two totally different things!

A 2003 307 should be a CAN-VAN architecture (Wheeler is that true?).
If this is the case a "virgin" PCF7936 transponder (or chips "known" to the engine ECU) will work, no problems and you will be able to get the engine to run.

However, the remote transmitter is is a different issue!!
Again, IF this is a CAN-VAN car, it is possible to get "old" keys to work...but it's a lot of trouble!! Apparently brand new keys from PSA are expensive AND hard to find.
The Chinese keys (Aliexpress) will never work!
Apparently there is a company called XHorse that produce keys that will work, but you will need to see a locksmith to get one.

IF the car is an "all CAN" network architecture, the Chinese keys should work. But you need to determine if your receiver is running ASK (Amplitude Shift Keying) or FSK (Frequency Shift Keying).

[wheeler]

I would expect that a 2003 model would still be VAN/CAN.

Yes full CAN ones are easy, XHorse remotes on the older VAN/CAN systems i have found personally to be hit and miss.

In any case the OP has managed to get one to work so best bet would be to just re order the same type again.

OEM remotes be it the old VAN/CAN or the newer full CAN are very poor quality in my opinion & i would never dream of paying the prices they ask for them (unless all else has failed), The XHorse type universal remotes in my opinion are way superior to the OEM keys & are a fraction of the price. Most have the plastic type buttons that dont distort & wear away like the OEM rubber buttons.

[longgo]

The car is type ASK @ 433MHZ with CAN/VAN. Transponder: ID46 PCF7961 . At least that is exactly what I have inside the small key with buttons (the picture above) that work.
Just checked my order`s invoice - the second one (plip) is exactly the same specs as that mentioned just now.
The "original" one is simple key without any remote, so that`s why I was not able to pull any number of it as it exist on original plip type.

You can have up to 5 remote keys in the system.

That`s what I was looking for! My thoughts where that can be up to 5 keys but not up to 5 remotes..
Will order again similar with same specs as the work one. What can be the reason, now when I think about it, perhaps the inner of the key was made for FSK and they sent it as ASK.

The Chinese keys (Aliexpress) will never work!

If that is the case, why then the first one from Ali-exp is working just fine? The actual trouble is only the remote on the second key who is misbehaving. Probably due the chance the PCB is dedicated for different type of modulation.

Thank you again!

[ozvtr]

If that is the case, why then the first one from Ali-exp is working just fine? The actual trouble is only the remote on the second key who is misbehaving. Probably due the chance the PCB is dedicated for different type of modulation.

The transmitter and transponder are paired (for the CAN-VAN network). The transmitter has a code buried in the transmitted signal. That code is also in the transponder memory. They must match, or the transmitter will not be accepted during the initialization phase.
The only thing I can assume is that the Chinese have twigged to this and are now producing transmitters with paired transponders. It would be easy to copy the transmitter and transponder from a genuine "virgin" key (if you had the capacity to program the the transmitter chip). They would all be the same, but that doesn't really matter. However, there is a catch!
There is a prefix code for each car type. An example of the code is: 01A0 for a Citroen C3, 0960 for a Peugeot 307, 0CA0 for a Citroen C2 and so on. These are NOT the ACTUAL codes BTW, just off the top of my head but you get the idea.
So did the Aliexpress listing specify the vehicle type for individual keys? Or did you just jag the correct one for your car??
Could you give us a link to the listing please?
The "old" transmitter/transponder keys the Chinese made did not work, because of the above. If the Chinese have cracked this, I will be P1$$ed!! I have spent a lot of time and effort to make "new" keys for my cars! D'oh!

As far as the "flip-key" goes, they are for the "all CAN" networks. So I am not surprised that it doesn't work. I don't know much about the all CAN security system, but I do know that it is MUCH simpler than the CAN-VAN system!!

[ozvtr]

You can have up to 5 remote keys in the system.

My thoughts where that can be up to 5 keys but not up to 5 remotes..

LOL! Wheeler will argue as to how many remotes you can have. (I say the BSI will only accept 2).

I have programed 2 remotes and one "valet" key (no remote) for my Citroen C3. And changed the prefix code in another C3 so that I can swap keys around (it's along story. Actually...see below).
But I have not tried to program in more than 2 remotes. So far even getting 2 remotes with the same prefix code has been difficult. So I had to steal one from my other C3.

[longgo]

Here is the link for the working key: https://www.aliexpress.com/item/1005006913195348.html - HU83 Blade
As for the remote function, maybe I should of order simple (no remote) key as spare and build some ESP32 wifi receiver with custom code protocol and simple Android app with two buttons so he can open and lock the car

[wheeler]

LOL! Wheeler will argue as to how many remotes you can have. (I say the BSI will only accept 2).

I cant think if i have ever tried more than 2 remotes on a VAN/CAN system but i can say 100% that the full CAN ones will definitely take more than 2.
I have had multiple remotes programmed along with the originals when experimenting with new kit & universal (re writable) keys on my last C4 & X7 C5.
I’ve never seen any documentation anywhere to say that a VAN/CAN will only accept 2 remotes.

[ozvtr]

I’ve never seen any documentation anywhere to say that a VAN/CAN will only accept 2 remotes.

If I ever dig up another key with a C3 prefix code...I'll let you know. BTW there are 10 prefix codes, so I would need to buy at LEAST 10 to (statistically) get one C3 prefix code. I could use 3 of any prefix code as the Prefix code for the car can be changed in LEXIA.

Here is the link for the working key: https://www.aliexpress.com/item/1005006913195348.html - HU83 Blade

I don't know how it worked. I can only assume you jagged the prefix code. The C1 isn't even a PSA product (it's a Toyota) and to my knowledge the C4 never had a CAN-VAN network! So I can't see how that 1 transmitter will work with all those different models.
If you buy another one, and it works...go and buy a lottery ticket!
I used to have one of these a while ago, and of course it didn't work. I think I threw it away. But now that I know more about the system I should have a closer look. If you got one to work I would like to know how. I must admit that I have heard of them working for random people but not everyone.
I could scan it with the SDR and RTL-433 and see what it's putting out.

[wheeler]

The C1 isn't even a PSA product (it's a Toyota) and to my knowledge the C4 never had a CAN-VAN network! So I can't see how that 1 transmitter will work.

Correct, the C4 was full CAN right from the start & the C1 although it looks like a PSA remote its completely different on the inside as like you say its a Toyota system. It doesn’t even use an ID46 chip.
I can only assume its blanket advertising.
I have never has any luck with Chinese remotes on the older systems either but maybe they have upped their game?

[ozvtr]

maybe they have upped their game?

Now I will definitely have to dig up my old one or buy a new one. Just to see what's going on.
RTL-433 will allow me to "see" the prefix code straight away. The ID46 chip and the transmitter will need to be paired, but that's not a big deal (for the Chinese). I can only postulate that the prefix code is for a 307, because that's hard coded into the transmitter firmware. That would also explain why the keys are hit and miss.

[ozvtr]

So I decided to see what the story was with these Chinese keys, and I was wrong.
I bought two different keys. Because I found two different looking keys on Aliexpress, but the advertisers said they both suited the C1, C2, C3, Peugeot, Citroen, BBC1, BBc2, BBC3 oops got carried away there. You get the picture.
One is the "old" classic knock off and the other is a bit different. ER, I have called them 'good' (the old one) and 'bad' (the new one). I've given the game away already haven't I?

While the shape is much the same you can see the layout of each is different.
the 'bad' one has a separate ID46 chip much like the original key did. The old board has an onboard chip.
First up I put the ID46 chips through their paces. Bad one first.

Nope this is just a virgin chip! Next the good chip.

Hello! We have some data! And it looks good too. I'm not sure yet, but it looks like good data. Stuff looks familiar. And the prefix code is for....a PEUGEOT 307. Well well.
Next up lets look at the transmitter data. First up the bad one.

Rubbish!
Guess who's turn it is now?

And there it is, the 307 prefix code!!! I won't send it off to be decoded, I'm convinced it will work.

That means if you are desperate, the old Chinese knock off keys will work, but, you will need to change you car's prefix code to 0A50.
The Keys were not that expensive and the quality didn't look too bad! Actually the rubber AND the plastic housing were crisply molded. The rubber in the originals were shi..bad. So how bad could these be in comparison?

The 'Good' key cost me about 5 pound.
The 'Bad' was about 7 pound.

I cant say the 'BAD' key wont work..in some application (maybe the C1 and Toyota Aygo) but it definitely doesn't work for this application.

[longgo]

@ozvtr - sorry to answer with such a long delay Somehow I missed that post..

From what you show, It seems that the key with 307 sign is exactly similar (or maybe same) of what I bought and work absolute fine. On the other hand, exactly the same chip and parts are set in the flip keys that I have ordered, but seems is programmed differently.
On each PCB board are seen four pins, which I suspect is for serial programming of that chip. Have no idea what tool must be used or is it possible to reprogram them once they are ready, but just as thought come to my mind - what if i can just clone that what works? Didn`t bother to try, just a thought..

Just for fun bought myself Xhorse Mini tool. The "original" hard key and the flip both has the similar frequency, but recognized codes from the device where not..
Anyway, the car still run perfect with both adapted keys, just with the flip one, the remote function is not working. Mt friend is happy and have a spare one if something happen.

[ozvtr]

On each PCB board are seen four pins, which I suspect is for serial programming of that chip. Have no idea what tool must be used or is it possible to reprogram them once they are ready, but just as thought come to my mind - what if i can just clone that what works? Didn`t bother to try, just a thought..

I have not looked at the specs for the chip but it will be an all-in-one code generator and transmitter. The guys on the Digital Kaos hacked the RF signal code, so it must be using a generic rolling code algorithm. And so I would assume it's an off-the-shelf item.
The chip could possibly be copied and written to the flip fob. The ID46 chip can definitely be copied and the new on board ID46 programmed.