How to Find and Write VAG 7th Byte CS with Tango Key Programmer

Posted 2020-11-20 cnautotool

Find out and write VAG 7th Byte CS requires Tango software version 1.112 or above.  Tango Key Programmer software updated to V1.112 on May 9th, 2018.

Tango transponder programmer software added (online update)

1-Added new transponder MEGAMOS AES
2-Toyota key maker: new menu item AUTODETECT
3-Key maker Kia Sportage 2008- (MPC5xx,HITAG)
4-Key maker Hyundai Sorento 2008- (MPC5xx,HITAG)
5-Key maker Renault Fluence III 2012- (NEC850,HITAG)*
6-Key maker Renault Megane III 2012- (NEC850,HITAG)*
7-Fixed some bugs, incl. PCF7930-35 recognition

How to find VAG CS 7th Byte in Tango?

requires Tango software version 1.112

Component Security in keys of the Megamos48 type
The modern immobilizers of the VAG-group vehicles have such conception as “Component
Security” (CS). The CS is an array of 7 bytes length. Its role in a vehicle is to forbid a mixing of
electronic units from different cars. In terms of the immobilizer the CS is a “password” that used
in couple of the Motor Unit (ECU) and the immobilizer.
The protection scheme includes 3 components that share the CS, they are:
ECU
IMMO
KEY
The protection scheme allows the engine to start only in case when the CS is identical in all the
three components.
Key and CS
The CS is a part of the Crypto Key and fills its upper area Word9-Word6.

Usage
In common practice it is possible to get the first 6 bytes of CS. The last, 7th byte is unknown.
There are many ways how to find out the 7th byte. One of them is to pull out it from an existing
key. Thus, to use this tool, it is needed to have at least one valid key.
1. Running of the “Search Component Tool”
Click the appropriate button in the MEGAMOS-48 mode as shown on the picture:

2. In the new window:
Type the 6 bytes of CS that are known
Select Brand
Select method

At this example the CS assumed as A8CE3566AEBC and a car is Seat.
3. Now all is ready to start searching.
Put the valid existing key into the programmer coil.
Click the “Start Searching” button:

During operation the 7th Byte value will change sequently from 0x00 to 0xFF. When the value is
valid, the process will be stopped. Operation takes up to 1 min of time.

How to Write CS 7 Bytes with Key Programmer Tango?

Key and CS
The CS is a part of the Crypto Key and fills its upper area Word9-Word6.
ECU and CS
ECU uses the CS as a password. More modern ECUs contain only 6 bytes of the CS. In this case
the CS should be extracted from another devices, for example it may be a dashboard.
IMMO and CS
The vehicle dashboard usually has a role of an immobilizer. The IMMO always contains all the 7
bytes of the CS.

Introduction
The tool “Write Component Security 7 Bytes” (Megamos 48 window) helps you to put the CS
manually into a transponder. Let’s see an example of ECU BOSCH Motronic M7.

The CS has been marked in the blue color.
To write the CS, invoke the tool and type the CS in the window:

Select the vehicle brand and press the Write button. Temporary the Seat brand is unavailable