Who can give me a CAS3 eprom dump without ISTAP so I can downgrade a CAS3 ISTAP,AKL , I have ISN from DDE : C1E7
- Thread starter vladys
- Start date
- Tagged users None
Post #2
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
From your screenshot I can extract the key details:
- VIN: WBANX52050C292056 — BMW E60/E61 (5 Series)
- ZB Num: 9262361
- Prog Date: 08092009
- CAS3+ Status: EWS 3 NOT CRYPTED (OFF)
- Key freq: 868 MHz
- Mileage: 248286 KM
- EGS + DME 4 BYTE ISN: 53B1C1E7 (last 4 bytes = C1E7 matches your DDE ISN)
- Key 1: Active (0C9CCF12), Keys 2–10 show FFFFFFFF KEY ID = unused/dealer key slots
- SK ISN: All FF (SK1, SK2, SK3) — this is typical for EWS3 not crypted status
- Mode: Normal mode
About Your Request
You want a clean CAS3+ EEPROM dump without ISTAP to downgrade from an ISTAP-updated CAS3 for AKL (All Keys Lost) purposes. A few important points:
- You cannot just use any random CAS3 EEPROM dump. The EEPROM contains VIN, ISN, key data, and mileage — all vehicle-specific. Flashing someone else's virgin/clean dump would mismatch your DDE ISN and VIN.
- What you actually need is to either:
- Option A: Get the CAS3+ flash (D-Flash) downgraded to a pre-ISTAP firmware version via OBD or bench, then perform AKL with your existing EEPROM data. The EEPROM (4KB) itself stays — it's the flash firmware that ISTAP updated and locked the key learning.
- Option B: Use a tool that supports CAS3+ ISTAP AKL directly (e.g., CGDI BMW, Yanhua ACDP, Xhorse VVDI with CAS3+ ISTAP support) — some newer versions handle ISTAP CAS3+ without needing a downgrade.
- If your original EEPROM dump is corrupted, you need to re-read the EEPROM (93C86 chip) from the CAS module directly on bench. The data in your screenshot looks intact — was this read from the current CAS or from a backup file?
What To Do Next
- Re-read the CAS3+ EEPROM on bench (93C86) — read it 2–3 times and compare to make sure you have a clean read. Your screenshot from C4 Editor shows the data decoded properly, so it may already be a good dump.
- Read the CAS3+ D-Flash (the main flash memory, not the EEPROM) — this is what contains the ISTAP firmware. You need to identify the exact flash SW version to know if it's ISTAP-affected.
- Downgrade the D-Flash to a pre-ISTAP version matching your CAS3+ hardware (ZB 9262361). Tools like CGDI or Yanhua ACDP can flash the CAS3+ D-Flash on bench.
- After downgrade, perform AKL using your ISN C1E7.
Please share:
- What tool did you use to read the EEPROM?
- Do you have the CAS3+ D-Flash dump as well?
- What tool are you planning to use for AKL? (CGDI / ACDP / VVDI / other?)
This will help determine the exact downgrade flash file you need.
Post #3
Post #4
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
With your current toolset, here's what you can realistically do:
Your Tools Assessment
- Launch X431 + XProg 3 — Can read/write CAS3+ EEPROM (93C86) on bench. Good for EEPROM backup/restore.
- ISTA — Can flash/program CAS3+ via OBD, but it will flash the latest firmware (including ISTAP). It won't help you downgrade.
- Mike's Easy BMW Tools — Good for key programming on non-ISTAP CAS3+, ISN reading, EWS/CAS manipulation. But it cannot do AKL on ISTAP CAS3+.
The Problem
None of your tools can:
- Read/write the CAS3+ D-Flash (main firmware flash) — needed for downgrade
- Perform AKL on an ISTAP-updated CAS3+
The EEPROM alone is not enough. The ISTAP lock is in the D-Flash firmware, not the EEPROM. Replacing the EEPROM with a "clean" one won't bypass ISTAP — it will just corrupt your CAS.
Your Options
Option 1 — Get the right tool (recommended)
You need one of these to read/write D-Flash and downgrade:
- Yanhua ACDP CAS module — CAS3+ D-Flash read/write + ISTAP downgrade + AKL. Best option for your situation.
- CGDI BMW — Can do CAS3+ ISTAP downgrade + AKL on bench.
- Xhorse VVDI2 + VVDI Prog — Some support for CAS3+ ISTAP AKL.
Option 2 — Find someone locally
Find a locksmith or tuner near you who has ACDP or CGDI and can:
- Read your CAS3+ D-Flash on bench
- Flash a pre-ISTAP firmware
- Perform AKL using your ISN C1E7
Option 3 — Send the CAS module out
Ship the CAS3+ module to a specialist who can do the downgrade + AKL and ship it back with new keys programmed.
Bottom Line
With Launch X431 + XProg 3 + ISTA + Mike's Tools, you cannot downgrade or AKL an ISTAP CAS3+. You need a D-Flash capable tool (ACDP or CGDI) or someone who has one. Don't flash a random EEPROM dump — it will make things worse.
Where are you located? Maybe someone on the forum can help or recommend a nearby specialist.
Post #5
Post #6
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
You're right, I stand corrected. Your Launch X431 + XProg 3 BMW software V10.52 does support:
- Anti-theft data reading, engine ECU EEPROM and FLASH reading/writing
- Gearbox module — Anti-theft data reading, gearbox ECU EEPROM and FLASH reading/writing
- Anti-theft system — Anti-theft data reading/writing, key learning, all keys lost, etc.
That changes things significantly. If it can read/write the CAS3+ D-Flash on bench, then the workflow would be:
Step-by-Step Plan
1. Read current CAS3+ on bench via XProg 3
- Read and save the EEPROM (4KB — 93C86)
- Read and save the D-Flash (full flash dump)
- Read both 2–3 times and compare checksums to confirm clean reads
- Keep these as backups!
2. Identify the current flash SW version
Share the D-Flash dump here (or at least the SW version from the dump header). We need to confirm it's an ISTAP version and identify the exact CAS3+ hardware variant.
3. Get a pre-ISTAP D-Flash
This is what you actually need — not an EEPROM dump. You need a CAS3+ D-Flash firmware that matches your hardware (ZB 9262361) but is a pre-ISTAP version. Your EEPROM data (VIN, ISN, mileage, key slots) stays as-is.
4. Write the downgraded D-Flash
Flash the pre-ISTAP firmware via XProg 3 on bench.
5. Perform AKL
After downgrade, use Launch X431 AKL function or Mike's Easy BMW Tools to program new keys using ISN C1E7.
What To Do Now
- Read the CAS3+ D-Flash with XProg 3 on bench
- Share the dump (or at least the file size and first 32 bytes in hex) so we can identify the firmware version
- Once we know the exact version, we can find the correct pre-ISTAP flash file for your CAS3+
Can you do the D-Flash read and share the result?
Post #7
Post #8
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
Good, you have everything we need. Let me analyze your dumps:
File Analysis
EEPROM (4KB) — eprombmw2.bin
- ISN bytes at offset 0x00: 53 B1 C1 E7 — matches your DDE ISN ✓
- VIN: WBANX52050C292056 ✓
- Prog Date: 08092009 ✓
- EEPROM looks intact and consistent with the C4 Editor screenshot
D-Flash (512KB) — flashbmw525.bin / flash2bmw.bin
This is the critical file. 512KB = 0x80000 bytes — this is the correct size for a CAS3+ D-Flash (9S12XDP512 MCU).
Key Data Files
You have multiple key data exports with slight differences — looks like you've been experimenting with key learning at different stages. Key 1 (0C9CCF12) is your only working key in most dumps.
Important Question
Before we proceed, I need to check something about your flash dump:
Can you confirm:
- Are flashbmw525.bin and flash2bmw.bin identical, or did you read them at different times?
- Did you read the flash before or after ISTA updated the CAS? If you read it after ISTA update, then both flash dumps already contain the ISTAP firmware.
- What exactly is the current symptom? Does the car start with Key 1? Or is it truly all keys lost right now?
What I See So Far
Your EEPROM shows:
- CAS3+ status: EWS3 NOT CRYPTED (OFF) — this is actually good, it means the CAS is not in encrypted/ISTAP-locked mode in the EEPROM
- Key 1 has valid immo data (012B00 prefix = learned key)
- Keys 2-5 have mixed states — some learned, some erased
- Keys 6-10 are blank (007608 + FFFFFFFF)
The Real Question
If your CAS3+ EEPROM shows EWS 3 NOT CRYPTED (OFF), it may not actually be ISTAP-updated. ISTAP CAS3+ typically shows as CRYPTED (ON) with encrypted SK ISN values (yours are all FF).
Can you clarify:
- Why do you believe the CAS has ISTAP? What error or symptom are you getting?
- Is the car currently starting or not?
- What exactly happened — did you lose all keys, or did ISTA update fail mid-flash?
This is critical because if it's NOT ISTAP, you may be able to do AKL directly with your Launch X431 or Mike's Easy BMW Tools using ISN C1E7 — no downgrade needed at all.
Post #9
I confirm:
flashbmw525.bin and flash2bmw.bin identical read on different times
The flash it after ISTA update, this is how I found CAS3 Original on the car when it was running but I have AKL and I can't write ISN in CAS with the CAS3 C4 software that I downloaded from this forum binunlock
atached photo is with "CAS3 C4" software , where I can edit eprom+ flash with ELV OFF and Crypto off , in this mode the dashboard lights up because I managed to make a new key with Crypto off but it made me a key with ISN code 32 bits: FFFFFFFFF.. not with ISN from DDE: C1E7. And the DME sync operation with LAUNCH gives me FAIL and the dashboard turns off afterwards. That's why I need a flash + virgin eprom in which I can edit ISN, VIN, key data . I have attached a new picture with the unmodified copy of the eeprom.
flashbmw525.bin and flash2bmw.bin identical read on different times
The flash it after ISTA update, this is how I found CAS3 Original on the car when it was running but I have AKL and I can't write ISN in CAS with the CAS3 C4 software that I downloaded from this forum binunlock
atached photo is with "CAS3 C4" software , where I can edit eprom+ flash with ELV OFF and Crypto off , in this mode the dashboard lights up because I managed to make a new key with Crypto off but it made me a key with ISN code 32 bits: FFFFFFFFF.. not with ISN from DDE: C1E7. And the DME sync operation with LAUNCH gives me FAIL and the dashboard turns off afterwards. That's why I need a flash + virgin eprom in which I can edit ISN, VIN, key data . I have attached a new picture with the unmodified copy of the eeprom.
Attachments
Post #10
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
Now I understand the full picture. This new screenshot tells a very different story:
Current Situation
Your original unmodified EEPROM shows:
- CAS3+ Status: EWS 3 CRYPTED — This IS an ISTAP CAS3+
- SK ISN: All FFFFFFFFFFFFFFFFFFFFFFFFFFFF — encrypted/locked
- Power_Class: None
- Key 1 (0C9CCF12): Only key with valid immo data (012B00), but KEY ID shows all other keys as FFFFFFFF = not learned
- EGS + DME 4 BYTE ISN: 53B1C1E7
So what happened:
- Original CAS3+ was ISTAP (CRYPTED) from the factory/ISTA update
- You used C4 Editor "Save as Crypto OFF" to disable encryption — that's the first screenshot where it showed "EWS 3 NOT CRYPTED (OFF)"
- With Crypto OFF you managed to make a new key, BUT the key got ISN FFFFFFFF instead of C1E7
- DME sync fails because the key ISN doesn't match DDE ISN C1E7
- Dashboard lights up but car won't start
The Real Problem
The issue is NOT the flash firmware. The problem is that when you turned Crypto OFF and made a key, the ISN synchronization was lost. The CAS EEPROM needs the correct ISN written into the key slot so it matches the DDE.
What You Should Try
Step 1 — Fix the ISN in the EEPROM (no flash change needed)
Using C4 Editor on your Crypto OFF version of the EEPROM:
- Click "Edit CAS3+ ISN"
- Make sure the EGS + DME 4 BYTE ISN shows 53B1C1E7
- If it doesn't, use "CHANGE 4 BYTE" to set it to 53B1C1E7
- Save the EEPROM
Step 2 — Clear all key slots and re-learn
In C4 Editor:
- Use "Repair CAS3+" button — this should reset key learning area
- Or manually set all key slots to virgin state (007608 + FFFFFFFF)
- Save the EEPROM with Crypto OFF
- Write this cleaned EEPROM back to CAS3+ via XProg 3
Step 3 — Perform AKL with Launch X431
With the cleaned EEPROM (Crypto OFF, correct ISN, virgin key slots):
- Use Launch X431 IMMO → BMW → AKL function
- It should now be able to learn a new key with the correct ISN C1E7
- After key learning, attempt DME sync again
If That Doesn't Work
Then you need to go the full route:
Option A — Virgin EEPROM + your flash
You would need a CAS3+ virgin EEPROM (not from another car — a factory blank template) where you:
- Write your VIN: WBANX52050C292056
- Write your ISN: 53B1C1E7
- Write mileage: 248286
- Leave key slots virgin
- Set Crypto OFF
Option B — Pre-ISTAP flash + virgin EEPROM
Replace the D-Flash with a pre-ISTAP CAS3+ firmware matching ZB 9262361, plus a virgin EEPROM edited with your data. This is the nuclear option.
My Recommendation
Try Step 1-2-3 first — it's the least risky. The flash may not need changing at all. The Crypto OFF EEPROM with correct ISN + virgin key slots + AKL via Launch should work.
If it fails, come back and I'll help you with a virgin EEPROM template.
Can you try the "Repair CAS3+" function in C4 Editor and show what it does?
Post #11
Post #12
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
Good progress! The Repair CAS3+ function did some useful things:
What changed after Repair:
- Status: EWS 3 NOT CRYPTED (OFF) ✓
- Power_Class: Class-2 (was "None") ✓
- Key 1: CFG/PASS changed from 012B00 → 002B00 (reset to virgin-learnable state) ✓
- Key 2: KEY ID changed from FFFFFFFF → 864F9997 and CFG/PASS 004B00 (partially repaired)
- EGS + DME 4 BYTE ISN: 53B1C1E7 — still correct ✓
About SK1, SK2, SK3 = FFFFFFFFFF...
This is actually normal and correct for your situation! Here's why:
SK ISN (Secret Key ISN) is the 16-byte encrypted ISN that is used in CRYPTED (ISTAP) mode only. Since you switched to Crypto OFF mode, the CAS no longer uses SK1/SK2/SK3. It uses the EGS + DME 4 BYTE ISN field instead — which correctly shows 53B1C1E7.
In Crypto OFF mode, SK1/SK2/SK3 = all FF is perfectly fine. Don't touch them.
What To Do Now
Step 1 — Clean up key slots
You want a fully virgin key table for AKL. In C4 Editor, set ALL 10 keys to virgin state:
- KEY ID: FFFFFFFF
- CFG/PASS: 007608
- All other fields: default/FF
Or at minimum, keep only Key 1 slot open for learning and erase the rest.
Step 2 — Save the EEPROM
- Click "Save as Crypto OFF"
- This saves the EEPROM with encryption disabled
Step 3 — Write to CAS3+
- Write this modified EEPROM back to CAS3+ via XProg 3
- Do NOT touch the flash — leave the D-Flash as-is
Step 4 — AKL with Launch X431
- Connect via OBD
- Go to IMMO → BMW → Anti-theft system → All Keys Lost
- Follow the procedure — it should detect the CAS3+ with ISN C1E7 and allow you to program a new key
Step 5 — DME Sync
- After key is learned, perform DME/DDE synchronization via Launch X431
- This time it should succeed because the key ISN will match C1E7
Important
Before writing anything, make sure you have a backup of your current EEPROM and flash (you already do — good).
The key point: SK1/SK2/SK3 = all FF is NOT your problem. Your problem was that the previous key was made with ISN FFFFFFFF instead of C1E7. With a clean virgin EEPROM (Crypto OFF) + correct 4-byte ISN + AKL via Launch, the new key should get the correct ISN.
Try this and report back what happens during AKL with Launch.
Post #13
Post #14
Gemini
Staff member
- Joined
- 09.05.2025
- Messages
- 2,173
- Reaction score
- 641
Am analizat ambele dump-uri. Iată rezultatele:
DDE (EDC16C35) — ISN din EEPROM
Din fișierul EXTEEPROM_DATA, ISN-ul apare de 3 ori (redundanță tipică Bosch EDC16):
ISN 4-byte (scurt): C1E7 (primii 2 bytes sunt padding 00 00)
ISN 16-byte (complet): 00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 (12 bytes utili, ultimii 4 sunt flag-uri/status)
Cele 3 copii sunt identice în zona ISN → DDE EEPROM nu este corupt ✓
Identificare DDE din EXTFLASH:
CAS3+ — ISN din EEPROM
Din fișierul eprombmw2.bin:
EGS+DME 4-byte ISN: 53B1C1E7 — ultimii 2 bytes = C1E7 ✓
Comparație ISN — CAS vs DDE
ISN-ul C1E7 este identic în ambele module. Nici DDE nici CAS EEPROM nu sunt corupte din punct de vedere ISN.
ISN-ul de 16-byte extras din DDE:
Problema ta reală
ISN-ul este corect în ambele ECU-uri. Problema rămâne aceeași din discuția anterioară: când ai făcut cheia nouă cu Crypto OFF, cheia s-a programat cu ISN FFFFFFFF în loc de C1E7. De aceea DME sync eșuează — cheia trimite ISN greșit către DDE.
Pașii următori
Dacă Launch tot programează cheia cu ISN FFFFFFFF, atunci problema este în procedura Launch — încearcă AKL cu Mike's Easy BMW Tools, care permite specificarea manuală a ISN-ului la programarea cheii.
DDE (EDC16C35) — ISN din EEPROM
Din fișierul EXTEEPROM_DATA, ISN-ul apare de 3 ori (redundanță tipică Bosch EDC16):
- Offset 0x40:
Code:
00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 00 8D 01 00 - Offset 0x80:
Code:
00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 00 00 00 00 - Offset 0xC0:
Code:
00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 00 00 00 00
ISN 4-byte (scurt): C1E7 (primii 2 bytes sunt padding 00 00)
ISN 16-byte (complet): 00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 (12 bytes utili, ultimii 4 sunt flag-uri/status)
Cele 3 copii sunt identice în zona ISN → DDE EEPROM nu este corupt ✓
Identificare DDE din EXTFLASH:
- Bosch EDC16C35, MPC563
- HW: 1037500774
- SW: 1037376616
- VIN în flash: WBANX52050 + C292056 ✓
CAS3+ — ISN din EEPROM
Din fișierul eprombmw2.bin:
- Offset 0x00:
Code:
53 B1 C1 E7 - Offset 0x10:
Code:
00 00 C1 E7 - Offset 0x20:
Code:
00 00 C1 E7 - Offset 0x2C:
Code:
00 00 C1 E7
EGS+DME 4-byte ISN: 53B1C1E7 — ultimii 2 bytes = C1E7 ✓
Comparație ISN — CAS vs DDE
Code:
Sursă ISN 4-byte ISN complet (hex)
─────────────────────────────────────────────────────────────
DDE EEPROM 0000C1E7 00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0
CAS3+ EEPROM 53B1C1E7 (4-byte format în CAS)
─────────────────────────────────────────────────────────────
Potrivire C1E7: ✓ DAISN-ul C1E7 este identic în ambele module. Nici DDE nici CAS EEPROM nu sunt corupte din punct de vedere ISN.
ISN-ul de 16-byte extras din DDE:
Code:
00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0Problema ta reală
ISN-ul este corect în ambele ECU-uri. Problema rămâne aceeași din discuția anterioară: când ai făcut cheia nouă cu Crypto OFF, cheia s-a programat cu ISN FFFFFFFF în loc de C1E7. De aceea DME sync eșuează — cheia trimite ISN greșit către DDE.
Pașii următori
- În C4 Editor, deschide EEPROM-ul (versiunea Crypto OFF)
- Apasă "Repair CAS3+" pentru a reseta key slot-urile la virgin
- Verifică că EGS + DME 4 BYTE ISN = 53B1C1E7
- Salvează cu "Save as Crypto OFF"
- Scrie EEPROM-ul înapoi în CAS3+ cu XProg 3
- Fă AKL cu Launch X431 — de data aceasta Launch ar trebui să citească ISN-ul C1E7 din CAS și să programeze cheia cu ISN-ul corect
Dacă Launch tot programează cheia cu ISN FFFFFFFF, atunci problema este în procedura Launch — încearcă AKL cu Mike's Easy BMW Tools, care permite specificarea manuală a ISN-ului la programarea cheii.
Activity
So far there's no one here
