Hitag support pages
Covered transponder family: PCF7939PA and HitagPro compatible mcu based transponders - e.g. PCF7x45PTT and PCF7953PTT, used by BMW (F-series), Range Rover, Porsche.
Security is based on 128-bit security key (SK).
It is possible to prepare new key according to vehicle specific demands: key configuration, SK, VIN, key number, page locks etc. To explain all possible options is not out task - ask NXP for datasheets and car manufacturers for all necessary information. What to write into key to make it ready to start a car is up to you.
Some transponder basics - there are 1024 bytes of EEPROM memory available for user access. It is split into 8 individually configurable pages with individual access rights. According to configuration each page can be read in plain mode or crypto mode. Or read can be disabled at all. Same story with write options. 32 bytes are left for EEPROM configuration page.
Usually all page sizes are already preconfigured for specific use and locked against size change. If not, it is possible to configure them by yourself - use XMA config button or edit bytes manually.
Page0 contain transponder ID, SK and some important bytes essential for HitagPro operation. If key is blank or preconfigured, it is usually accessible for both read and write operations in plain mode. In this case stored SK is not important, you can replace it with your own one and lock page if you wish.
In case of used key, it is possible to read and write pages according to page configuration . By default programmer tries to read/write key in plain mode (if allowed). If crypto is allowed too, you can uncheck “read plain” check box to force operation in crypto mode.
It is possible to enter SK manually into 4 fields inside SK group box. Button “SK to buffer” updates memory buffer. Values not currently matching are displayed on yellow background on hex editor screen. You must use MODIFY or WRITE buttons to update/store them into transponder memory. Button VERIFY SK checks SK for validity, if success SK background becomes green.
Same principles are used when exploring and updating BMW key data - it is altered only in buffer, not a key itself. It is done to avoid mistakes and to allow user to check what happens. How to get BMW key screen: go to any page, press BMW icon.
What’s updated in HTplus2 software for HitagPro operation: