Recovering bypass/key codes 848/1098/1198 dash

I am slowly moving away from the forum and posting useful info as I find it.

The attached pdf relates to the 848/1098/1198 - I2K immo system. The immo chip recovery in the pdf can also be applied to other bikes with the 24C family of immo chips. Some are easier than others due to speed and tacho needles having to be removed.

This relates to the red key bike dash immo chip. IRC immo system.

The recovered data for the key transponders needs to be prefixed
BE FA ** ** ** ** ** **
and then converted to
7D 5F ** ** ** ** ** **

I have a device that does the conversion so can help out if necessary.

For example
Key code identified as 00 00 01 42 F7 7F from dash

This is BE FA 00 00 01 42 F7 7F

The data required to program a T5 Transponder is

7D 5F 00 00 80 42 EF FE

This data can be inputted manually using the likes of a Zedbull Mini

AliExpress is a good source for the Zedbull, key blanks and T5 Transponders

If you have an Android device there is an app called Transponder Tiris Converter. Costs £1.18. This will convert the data from the immo chip (BE FA) to the format for use with the key programmer (7D 5F)

If you like a challenge, then do it manually https://www.mri-auto-diagnostics.com/wp-content/uploads/2020/11/4C_INFO.pdf

To convert the transponder info you do the following
The BE FA needs to be converted from Hex to Binary.
The bit that needs converting is 01 42 F7 7F.
The zero of 01 will always be 0000 in binary and will be ignored using an online converter.
So 01 = 00000001 (where 0001=1), 42=01000010, F7=11110111, 7F=01111111

To convert to Tiris the binary needs to be reversed and converted back to hex.
So 10000000=80, 01000010=42, 11101111= EF, 11111110=FE.
That will give you the 80 42 EF FE required to add to 7D 5F 00 00 to program a T5 transponder.

This process also applies to other dashes that use the 24C16 eeprom. However, to access the chip requires the removal of tacho and speedo needles, so care is required. The dash also needs to be powered up before the needles are refitted so they align correctly.

Ducati will tell you that if you lose the code card it cannot be replaced. There is a solution.

On the earlier dash using the red programming key then the bypass code can be calculated from the recovered hex code. The first code is always the red key.

The bypass code card is calculated from the last five digits, where 1 to 9 remain the same andA=1,B=2,C=3,D=4,E=5,F=6 and 0=7

In the above if 00 00 01 42 F7 7F was the first code listed then 2F77F will give the bypass code. This would give 2=2, F=6, 7=7, 7=7, F=6.
The bypass code is therefore 26776.

If you have a Zedbull then the red key transponder code can be read from the key (this process in bikes using the separate immo box like the ST4S). The Zedbull will display it in the format 5F 00 00 ** ** ** ** 7D. It just moves the first digits to last, ignore the 7D. Using the info from the first post 80 42 EF FE thisneeds converting from Tiris (hex) to binary, thebinary reversed, and then converted back to hex. The reverse of the instruction in the first post.That will give 01 42 F7 7F, just use the last fivedigits to calculate the code

For the data from the likes of the 848/1098/1198 things differ. Reading the immo chip recovers the full 8 bytes of the transponder code in the format E6 00 00 00 00 xx xx xx.
This data needs converting for key programming and will give a format of 67 00 00 00 00 xx xx xx. To get this you convert bytes 1, 6, 7 & 8 to binary, reverse the binary and then exchange the positions of each digit. The 67 00 00 00 00 xx xx xx detail can then be programmed to a T5 transponder.

Code from key *****Update - process works*******
The process for the I2K immo system bikes like the 848/1098/1198 (2 black keys/code card) is slightly different. When the key is read by the likes of a Zedbull then the code differs to the above format for the earlier bikes. The code is displayed in the format C0 xx xx xx 06 00 00 00 not the 67 00 00 etc as would be expected. However, by using software tools I am able to calculate the hex code held in the immo chip for the key or keys. Using the above calculation information the bypass code can be calculated from the last 5 digits. This means that if you have 1 or 2 black keys but no code card then the bypass code can be back calculated from the key (a less intrusive route to taking the dash apart).
 

Attachments

  • retrieve immobilzer code.pdf
    541.9 KB · Views: 262
Last edited:
@chrisw, thank you 👍
It’s been pinned to the top of the Workshop section and I’ve also made it an Article as opposed to a discussion thread. If you wish to add more just edit and add it to your original post👍, this way all the info is in the one post/article.

ps. I put your 2 recent subsequent posts into the original article already.
 
For bikes with 2 x black keys and Code Card
Transponder code read by Zedbull Mini
A bit of an update. I have created an excel tool that will calculate both the 67 00 00 00 00 xx xx xx and E6 00 00 00 00 xx xx xx codes.
The one starting 67 is used to program keys to a T5 transponder using the like of a Zedbull Mini. The one starting E6 is stored in the dash. The bypass code can be calculated from the E6 data (both keys have bypass codes stored in the dash). The bypass code will also allow the programming of keys.
When the transponder is read from the key it will be in the format
xx(1) xx(2) xx(3) xx(4) 06 00 00 00
To use the tool you need to realign the data to 06 00 00 00 xx(1) xx(2) xx(3) xx(4)
Use 06 00 00 00 C0 B5 D0 7D to play with it

Change the file name from pdf to xlsx
 

Attachments

  • Calculator_MK5.pdf
    23.6 KB · Views: 135
An even newer version. Just enter the Transponder Code
Again, use 06 00 00 00 C0 B5 D0 7D to test
Also try 03 00 00 00 60 D8 E8 38 (this was an anomaly found reading one key, it takes an additional 1 bit left to convert)
 

Attachments

  • Calculator_MK6.pdf
    24.2 KB · Views: 138
Last edited:
I have refined the excel tool (probably to the extent of my excel skills).
Enter the transponder code as read by the Zedbull Mini
Check the results for "Dash Code"
Enter the last five digits of that code to replace the XXXXX, press enter
Code should be generated
Again use 06 00 00 00 C0 B5 D0 7D and 03 00 00 00 60 D8 E8 38 to test
Change file from pdf to xlsx
 

Attachments

  • MK10.pdf
    38.4 KB · Views: 112
Thought I would add a calculator for the earlier Red Key, 2 black keys and code card bikes
Use 7D 5F 00 00 80 42 EF FE to test
Should convert to BE FA 00 00 01 42 F7 7F (code 26776)
Change file from pdf to xlsx
 

Attachments

  • Calculator_Red_Key.pdf
    30.8 KB · Views: 107
Just a little update on this for bikes using the I2K immo (2 keys, code card).
A recent assist I did, identified there is another anomaly with how the transponder is sometimes read by the likes of a Zedbull Mini. This results in the realigned transponder code being
01 00 00 00 xx xx xx xx
Or
19 00 00 00 xx xx xx xx
For the one starting 01 00 00 00 then enter that in the calculator and generate the results. Look down the left hand column of the results for the one starting 06 (06 00 00 00 xx xx xx xx). Make a note of this.
Then use the calculator again with the 06 data and that should produce the required result.
For the one starting 19 00 00 00 then enter that in the calculator and generate the results. Look down the left hand column of the results for the one starting 33 (33 00 00 00 00 xx xx xx, note there are 4 sets of 00). Make a note of this.
Then use the calculator again with the 33 data and that should produce the results at Shift 1.
 
Last edited:
Hi Chrisw,

Sorry to be bothering you. I saw all your posts on the subject of the Ducati 848 immo. I managed to take my red key to a key duplication house and they gave me the codes that appeared on the machine. I've read and reread all your posts, opened the files in xlsx and tested, but I couldn't reach a 5-digit immo code. Can you help me?

Attached you can see the pic of the machine with the red key info.
Its a DUCATI 848 2008 (First ones).

Thank you very much in advance.
Best Regards

Bruno Nunes
 
Further update
A recent assist has identified that the I2K immo systems used across the Ducati range are not the same. My process does not work on Streetfighters using the MAE Electronics dash. The immo chip in this dash is PIC and not the 24C16 on which my research was based.
For I2K bikes the process only works if you have the below key type
IMG_1274.jpeg
 
Last edited:
Hi Chris,

Have you done any Scrambler I2K immo? all keys lost, cant seem to figure out the transponder in the dash bin file.

any direction would be much appreciated.
 
You need to change your file view options in Windows. You can then change the file extension.

PM me the .bin file. To do this change it to .pdf
eg dash.bin becomes dash.pdf
 
You need to change your file view options in Windows. You can then change the file extension.

PM me the .bin file. To do this change it to .pdf
eg dash.bin becomes dash.pdf
 

Attachments

  • Scrambler dash original.pdf
    2 KB · Views: 26
This is not a bike or dash I have worked on previously. I have looked at the bin and the transponder codes are not obvious like on other bikes. I would suggest you register at the Digital Kaos forum and post a request for help on there. Someone may even be able to identify the dash pin code for you. Sorry I could not help.
 
You could also talk to Mark at Scorpio Electronics. He may be able to put your dash to virgin. You could then obtain a new lockset with new transponder keys. Then program them to the dash.
 
This is not a bike or dash I have worked on previously. I have looked at the bin and the transponder codes are not obvious like on other bikes. I would suggest you register at the Digital Kaos forum and post a request for help on there. Someone may even be able to identify the dash pin code for you. Sorry I could not help.
No probs, I appreciate your help and direction. Thanks very much mate.
 
Some digging has identified that the scrambler uses DST40 40 bit cryptography for the immo system. I do not think the 24C16 chip dump is going to help identify the key. It may be worth talking to a Ducati dealer as the PIN code and new keys may be programmable by their diagnostic kit. @Nelly can you assist?

 
Last edited:
The Scrambler uses the I2K-2 immo system. Officially, if both keys are lost then a lock set and dash is required. It's necessary to have at least one key present that the dash recognises to be able to enter the programming. Our diagnostics don't allow for anything else I'm afraid. If nothing else, without the key we can't turn the bike on..
 
Last edited:
Back
Top