OVER CRANKING

[Fx323i]

nice one.... let us know how you get on...

my further research has me seeing that one of the problems with the earlier ews 2 systems is that the mcu ( microprocessor contol unit) has an otprom ( one time program read only memory) and the problem with the ak 90+ programmer and some of the earlier programmers I think !!!!!!.. is that the mask ( or otherwise the chip pinout).... can be altered by the ak 90 programmer by choosing the wrong microcontroller and blowing ( resetting all the memory cells ) and making the ews useless... i have some further reseach to do in the next few days, and it looks as though by cutting some of the pins on the ews pcb that this can be avoided...

It looks as though by reading the ews 2 unit with the wrong settings on the ak90+ the data on the ews can be erased...

heres the datasheet from motorola for the mcu used in ews2

https://www.nxp.com/docs/en/data-sheet/MC68HC11EA9TS.pdf

maybe someone else that has read an ews2 can confirm this ?

consequently later ews units.. have a different mcu that has an eeprom ( electrically erasable program read only memory) and not an otprom and this issue has been fixed so a later ews would seem the way to go if you need to get extra keys programmed... things have moved on a lot since 1995 - 1998 in the world of microcontrollers...

or just get a ews delete or do as others have done the old trick...!!!!!!

Otprom? Not true. The first EWS2 units had 1D47J or 2D47J mask and this one has a read protection in their bootloader. In case of reading, there is a risk of deleting all the data in the EWS unit (if you go with the datasheet from the MCU manufacturer and read it their way) and you lose the original data stored in it. In case you are able to program new transponders and have a working INPA ADS/OBD depending on the car model (or are able to pull the full data from the ECU and are able to find the ISN there), these are quite easy to recover as you can "make up" the data for EWS, make new transponders, write the ISN in the EWS and recode the EWS. This way you lose the ability to order a fully functional working transponder key at the dealership, though. EWS modules fitted with 0D46J do not have this protection.

EDIT: EWS3 can also have 2D47J mask and in this case the situation varies by if the unit is EWS3.2 or EWS3.3. In case of EWS3.2 it is the same like EWS2 (as EWS3.2 means EWS3 in EWS2 mode). With EWS3 recovery in most cases requires reading a full memory from DME/DDE and find the ISN manually. The ISN is stored in some cases in flash memory (29F200, 29F400 or C167 in most cases), or in EEPROM (most DDEs).

AK90 has an ability to overcome the read protection, but the chinese clones are quite risky to use as you never know if it will or won't work and after it goes in the wrong direction, you can not revert. The same is valid in case you try to recode EWS3 in EWS2 mode (valid only for models E38/39 though as only here this combination is fitted) as EWS3 - there is no way back other than reprogramming the data from the EWS manually in the bin file read from EWS unit.