- Make keys to BMW, Land Rover, Porsche.
- Supports ECU IMMO, key Programming via EEPROM data.
- Supports data read/write for BMW mileage correction and immobilizer reset, Mercedes-Benz automatically.
CG Pro 9S12 Programmer Full Version with All Adapters incl. CAS4 DB25 Adapter
CG Pro 9S12 Highlights:
- Crack a variety of strong encryption chips Stably and fast.
- Real-time monitoring, anti-loss system with high-end technology
- Complementary to the CG-100
- Software frequently update online
- Free Gift :CAS4 & BD25 Adapter
- Support 80% of the 35160WT, 35080, 35128 in the market
- Multi-language: English, Chinese, French, Spanish, Turkish
- Read and write any BMW CAS 1-4, Porsche BCM, Mercedes-Benz EIS, Audi BCM2 Etc anti-theft computer
Operating HC705/908 Series Chip for repairing old anti-theft computer read write function and ELS lock of Mercedes-Benz,etc
Operating AM29F200/AM29F400/AM29F800 series chips for automotive computer repair, anti-theft computer repair,etc
Operating AM29BL802 series chip etc used in automotive computer repair anti-theft computer repair or Wei Zhi anti-theft cancellation
New CAS4 DB25 Adapter Functions:
Reading CAS4 without demoulding (No Need to Remove Chip)
Free-to-Remove Operation Motorola, (Freescale) Series Chip
Such as BMW CAS4-5M48H (Convenience)
35160WT Adapter (Partly) works for the 35160WT (Partly) and 35128WT chip design that cannot be erased, it can directly repair the original vehicle red dot and directly use the original car chip.
With the CG Pro and 35160WT (Partly) adapter, you can fix the mileage without emulator.
CGPRO CAN V2.1 Adapter for CG Pro 9S12 Key Programmer support the following engine computer repair BMW E Series 3 Series or 5 Series, BMW F Series, BMW R Series (Mini), Bentley, Volkswagen MT60 MT80.
CG Pro 9S12 Features:
Support Freescale 705 series
Support Freescale 908 series
Support Freescale 711 series
Support Freescale 912 series
Support Freescale 9S12 series
Support NEC V850 series
Support engine computer changing and ISN reading
Support BMW, Mercedes-Benz automatic kilometer correcting
Support BMW, Land Rover, Porsche key programming
Support remote key renew
CG Pro 9S12 Supported ECU IMMO List:
CAS4+ 5M48H/1N35H (9S12XEP100)
CAS4 1L15Y (9S12XDP512)
CAS3 0L15Y/0M23S (9S12XDP512 including CAS3+ series）
CAS3 0L01Y (9S12DG256)
CAS2 0L01Y/2K79X (9S12DG256)
CAS2/E66 0L01Y/2K79X (9S12DG256)
CAS1 0K50E (912DT128A Write FLASH data online）
EWS4 0L86D/1L86D/2L86D (9S12DJ64)
EWS3 0D46J/2D47J (MC68HC711EA9)
EWS2 1D47J (MC68HC711EA9)
( Support read/write data above for mileage correction and immobilizer reset )
EIS 211 ST12 3L40K/ 1L59W/ 4L40K/ 1L85D/ 0L85D/ 2L85D/
EIS 211 HC12 0K50E/ 3K91D
EIS 209 ST12 3L40K/ 1L59W/ 4L40K/ 1L85D/ 0L85D/ 2L85D/
EIS 209 HC12 0K50E/ 3K91D
EIS 215 ST12 3L40K/ 1L59W/ 4L40K/ 1L85D/ 0L85D/ 2L85D/
EIS 215 HC08 2J74Y/ 4J74Y/ 1J35D (Can directly reset EIS data with 08 adapter;and read write EEPROM without extra adapter）
EIS 220 HC05
0D53J/ 0D59J/ 0D62J/ 0D69J/ 0F62J/ 0F82B/ 0G47G/
0H51A/ 1D59J/ 1D69J/ 1H52A/ 2D20J/ 2D59J
EIS 210 HC05
0D53J/ 0D59J/ 0D62J/ 0D69J/ 0F62J/ 0F82B/ 0G47G/
0H51A/ 1D59J/ 1D69J/ 1H52A/ 2D20J/ 2D59J
EIS 203 HC08 1J35D/ 2J74Y/ 4J74Y
EIS 164 ST12 3L40K/ 4L40K/ 1L59W/ 0L85D/ 1L85D/ 2L85D
EIS 169 ST12 3L40K/ 4L40K/ 1L59W/ 0L85D/ 1L85D/ 2L85D
EIS 639 ST12 0L01Y
EIS 639 HC08 0L02M/ 1L02M/ 4J74Y/ 1J35D/ 2J74Y
EIS 199 ST12 3L40K/ 4L40K/ 1L59W/ 0L85D/ 1L85D/ 2L85D
EIS 230 ST12 3L40K/ 4L40K/ 1L59W/ 0L85D/ 1L85D/ 2L85D
(Support all above data read / write for mileage correction and immobilizer reset)
Roewe 750 IMMO 0M89C (Read/Write)
EWS ST12 3L40K/ 4L40K/ 5L40K
RFA 9S12XEQ384 (1M12S 2M12S 1M53J 2M53J ) 9S12XET512 ( 3M53J 2M53J 1M53J)
Support Dash Type:
Domestic cars 9S12 dash
Audi A4/A5/Q5-BCM NEC D70F3634/D70F3380
Audi ELV HC08GR 4L35K
BMW CAS3 YES
BMW CAS3+ YES
BMW CAS4 YES
BMW CAS4+ YES
(Program key via eeprom data）
Support Chip List:
8T0959754J_2 smart card
Generic type smart card
PCB2 8T0959754 433 remote control
PCB2 8T0959754D 868 remote control
PCB2 8T0959754F 433 smart card
PCB2 8T0959754G 315 smart card
PCB2 4H0959754DA 433 smart card
PCB2 4H0959754DB 315 smart card
PCB2 4H0959754DD 868 smart card
5WK49125 868MHz remote
5WK49127 315MHz remote
5WK49145 868MHz smart remote
5WK49147 315MHz smart remote
HUF5661 868Mhz Huf
HUF5662 315Mhz Huf
HUF5663 434Mhz Huf
HUF5667 434Mhz Huf
HUF5661 868Mhz Huf
Huf 434 frequency
Huf 868 frequency
K2TA3-74B smart card black
2TA3-76E smart card
K2TA3-H7J smart card white oval
K2TA4-30A smart card
4-button smart key 315MHz F7952B
4-button smart key 433MHz F7952B
5-button smart key 315MHz F7952B
5-button smart key 433MHz F7952B
M3M chip screen printing:F7953
H2 smart 434MHz PCB: CU1897L
YWX000061 (434MHz) Visteon
YWX000071 (315MHz) Visteon
AES smart card- A232800800 5 key
AES smart card- A2C32801600
AES smart card- A232801600
Hitag2 smart FCCID-CWTWB1U82
285971998R smart card Hitag
285974100 remote control Hitag
285975779R smart card 433mhz
285979045R smart card 433mhz
5WK49266 (900MHz) smart card
5WK49269 (433MHz) smart card
Packing List :
1pc x CG PRO host
1pc x M35080/35160 Adapter
1pc x EEPROM&V850 Adapter
1pc x HC705/908, AM29FXXX, AM29BLXXX Adapter 3-in-1
1pc x 35160WT adapter
1pc x CGPRO CAN V2.1 Adapter
1pc x CGPROG CAS4 Adapter New DB25 Adapter
1pc x 711 Adapter
1pc x DB25 Adapter
1pc x 12p Welding Line
1pc x USB cable
1pc x Packing box
1. How to install the cgpro new device?
Download the latest software from the official website, then connect the device, and plug 12v power cable, the device will automatically be activated.
2. CG pro 35160WT adapter can not erase the chip.
About this may erase 90%, other 10% chip can not be erased. Our development team is improving this adapter. We can send you the new one once we solve this issue.
3. Can CGPRO program car keys?
Yes, You can program keys for BMW, por-sche, land rover and jaguar, find the corresponding anti-theft and then match the keys according to the software tips, if the customer offer us the model which we do not indicate, then cgpro does not support this model.
4. Can cgpro read CAS data?
Yes. But Some BMW CAS anti-theft devices cannot be directly made with obd by CGDI BMW devices. CAS should be removed and then read out with CGPRO, and then loaded into BMW devices. (i.e, CSA3+ CAS4+)
5. Can CGPRO read Mercedes lock data?
Yes. Just like the BMW equipment, CGDI MB cannot be completely lost by obd directly. We also need to remove EIS. CGPRO reads the EIS data and then loads it into the Mercedes equipment.(i.e. W220)
For example many customers will ask how to do W220 all key lost: first with a programmer(our CGPRO 9S12) will lock chip data read out, and then load the data into the CGDI MB, and then do according to the software prompts.
6.Brief description of 35160WT operation:
The erasure of 35160WT consists of two stages. The first stage is to initialize the device (prompt: it takes 5-20 minutes to initialize the device, please wait patiently). The second stage is to erase (prompt: erase time is about 5-40 minutes, please wait a moment.../Erase time of about 5-40 minutes, wait please...). If the device has been initialized, it will go directly to the second stage. Note that the second stage is really the stage of erasing the chip, the first stage is only the adaptation between the host and the chip.
35160WT erase heating method description (if the chip can not be erased can try):
Before operation, adjust the air gun to 100 degrees Celsius and heat the chip for 20-30s (the chip is welded on the board). After that, stop heating and install it immediately to try the operation. If the chip is not erased in the second stage after the chip is completely cooled, it can be reheated by air gun for 20 to 30 seconds and then stopped heating. Chips may be erased during cooling.
7. Cgpro can not erase it if it is more than 800000km.
8. Why does the car diagnose a fault when some modules have gone through an ICP operation?
Some of the modules on cars are very smart, especially newer cars.When the module is powered up, the program in the module will check whether the voltage and other working conditions at each point are normal.If it is not in the normal state, an error code is written to the EEPROM. However, ICP operation is to remove the module from the car and only power the microcontroller. The level of other ports must be abnormal, so this problem will occur.
So using ICP mode is risky, especially for operating smart module.
9. Why is it that some modules can be read and some modules cannot be read but the microcontroller is the same?
The operating mode out of reset is determined by the states of the MODC, MODB, MODA pins during reset. The MODC, MODB, MODA bits in the MODE register show the current operating mode.
1). Normal modes: Some registers and bits are protected against accident changes.
2).Special modes: Allow greater to protected control registers and bits for special purposes such as testing.
Therefore, please measure the MODE pin before operation to ensure that the chip is in normal MODE!
10. Why is the module function still abnormal after writing EEPROM and FLASH data when the master is HC912 series module?
The EEPROM module contains an extra word called SHADOW word which is loaded
at reset into the EEMCR, EEDIVH and EEDIVL registers.
EEMCR—EEPROM Module Configuration $00F0
NOBDML—Background Debug Mode Lockout Disable
0 = The BDM lockout is enabled.
1 = The BDM lockout is disabled.
Loaded from SHADOW word at reset. Read anytime.
Write anytime in special modes (SMODN=0).
To unlock BDM with storage rest data contents of register please do next:
1) Read register data at address $000F0
2) Set MOST significant bit to ??!!!
For example: If data at address $000F0 contain $79 make logical OR with $80
$79 OR $80 = $F9;
3) Next write this value to EEPROM
4)BDM will be enable after next reset ONLY !!!
NOTE: MC68HC912 without post fix has EEPROM shadow byte only.But it located at the same address $000F0.
11. Why does the chip encrypt after the FLASH data is written and reset?
This FSEC register holds all bits associated with the device security. This register is unbanked.
KEYEN—Enable backdoor key to security.
1 = backdoor to Flash is enabled.
0 = backdoor to Flash is disabled.
NV[6:2]-Non Volatile Flag Bits.
These 5 bits are available to the user as non-volatile flags.
SEC[1:0]-Memory Security Bits.
The SEC[1:0] bits define the security state of the device as shown
in Security states table:
Security states table
The Flash security state is defined by the SEC bits of the FSEC register.During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x7F_FF0F.
Flash and security byte address
If the byte you want to write FLASH data in the above table for the address is XXXXXX00/ XXXXXX01/ XXXXXX11,then after you have written this data and reset , the microcontroller will encrypt.