How to Find and Write VAG 7th Byte CS with Tango Key Programmer

  • -

How to Find and Write VAG 7th Byte CS with Tango Key Programmer

Find out and write VAG 7th Byte CS requires Tango software version 1.112 or above.  Tango Key Programmer software updated to V1.112 on May 9th, 2018.

Tango transponder programmer software added (online update)

1-Added new transponder MEGAMOS AES
2-Toyota key maker: new menu item AUTODETECT
3-Key maker Kia Sportage 2008- (MPC5xx,HITAG)
4-Key maker Hyundai Sorento 2008- (MPC5xx,HITAG)
5-Key maker Renault Fluence III 2012- (NEC850,HITAG)*
6-Key maker Renault Megane III 2012- (NEC850,HITAG)*
7-Fixed some bugs, incl. PCF7930-35 recognition

How to find VAG CS 7th Byte in Tango?

requires Tango software version 1.112

Component Security in keys of the Megamos48 type
The modern immobilizers of the VAG-group vehicles have such conception as “Component
Security” (CS). The CS is an array of 7 bytes length. Its role in a vehicle is to forbid a mixing of
electronic units from different cars. In terms of the immobilizer the CS is a “password” that used
in couple of the Motor Unit (ECU) and the immobilizer.
The protection scheme includes 3 components that share the CS, they are:
ECU
IMMO
KEY
The protection scheme allows the engine to start only in case when the CS is identical in all the
three components.
Key and CS
The CS is a part of the Crypto Key and fills its upper area Word9-Word6.

Usage
In common practice it is possible to get the first 6 bytes of CS. The last, 7th byte is unknown.
There are many ways how to find out the 7th byte. One of them is to pull out it from an existing
key. Thus, to use this tool, it is needed to have at least one valid key.
1. Running of the “Search Component Tool”
Click the appropriate button in the MEGAMOS-48 mode as shown on the picture:

26-1

2. In the new window:
Type the 6 bytes of CS that are known
Select Brand
Select method

26-2

At this example the CS assumed as A8CE3566AEBC and a car is Seat.
3. Now all is ready to start searching.
Put the valid existing key into the programmer coil.
Click the “Start Searching” button:

26-3

During operation the 7th Byte value will change sequently from 0x00 to 0xFF. When the value is
valid, the process will be stopped. Operation takes up to 1 min of time.

How to Write CS 7 Bytes with Key Programmer Tango?

Key and CS
The CS is a part of the Crypto Key and fills its upper area Word9-Word6.
ECU and CS
ECU uses the CS as a password. More modern ECUs contain only 6 bytes of the CS. In this case
the CS should be extracted from another devices, for example it may be a dashboard.
IMMO and CS
The vehicle dashboard usually has a role of an immobilizer. The IMMO always contains all the 7
bytes of the CS.

Introduction
The tool “Write Component Security 7 Bytes” (Megamos 48 window) helps you to put the CS
manually into a transponder. Let’s see an example of ECU BOSCH Motronic M7.

26-4

The CS has been marked in the blue color.
To write the CS, invoke the tool and type the CS in the window:

26-5

Select the vehicle brand and press the Write button. Temporary the Seat brand is unavailable.


  • -

Tango Key Programmer 1.110.1 Adds SLK-05 Transponder

Original Tango Transponder Programmer new software 1.110.1 released at the end of Nov, 2017.

[+] SLK-05 Transponder launched! Supports Toyota’s Smart Key AES
(Page1 39)emulation.

This feature allows to start an engine, to
Learn new keys.
[+] TangoPlus for Toyota V6.5
True Emulation via OBD of all Smart Keys Page1 39*
The only right conception to solve the “All Keys Lost”problem.
[+] Image generator Toyota Page139 on SLK-05.

The generated
Transpinder is fully compatible to Toyota requirements that A
Customer is able to learn it vla OBD.*
[+] Cloning Toyota Smart Key 128BIT(Page1 39) to SLK-05*
[+] Key maker BCM2 Audi A4/A5/Q5(95320,PCF7945AC)*
[+] Key maker BCM2 Audi A4/A5/Q5(NEC,PCF7945AC)*
[+] Key maker Ford Transit 2017-(NEC,DST80)*
[.] Improved Toyota Certification ECU maker: compatibility for keys
Page139
[.] Improved operations with Auto Key Programming PCF7930,31,35. Now it is possible to make Individual settings to each type of transponders.

36-1

Emulator SLK-05 – Supports work with DSTAES smart keys [Page1 39 ]. SLK-05 supports emulation/cloning/image generation – functionality of the emulator requires activation of SLK-05 additional software.  Added in Tango update 1.110 (November 2017)

36-2