Automotive electronics


Let's talk about some unexplained functions of BMWscanner140.

EWS. What we can do here?

Under EWS there is a programming menu.

OK, take some old EWS without keys, connect it on the bench, attach transponder coil, 12v DC,BMWscanner itself and... explore it, explore BMW.

1st screen - EWS programming:

here at first we save EWS backup. Hmm... EWS locked? Very interesting...

let's try to unlock:

we are asked to bridge some pins. Ok, no problems!

We do what is requested and press "YES!":

wow... unlocked and... seems that absolutely erased!

we maked a backup some steps ago, let's try to restore everything.

We are going back to programming menu  and pressing "load EWS backup"...

what we can't restore from backup is ISN and KEY data... but we are ready for this!

ISN we write here is our favourite, 0x0579:

and a small play with KEY codes:

WOW! Seems that we can write empty/blank/known PCF directly through EWS:

some knowledge of transponder internal structure is necessary here.

Now all marks are green, EWS is configured. We must lock it now:

starter relay clicks, everything is well done:

Really this works on all known EWS2 EWS3 units, without any problems. We didn't test EWS4, but most likely will work because principles are the same.


1. everything described here is most likely impossible to do with a lot of clones due to a different hardware and incomplete reverse engineering. All passwords to access EWS special functions are inside adapter itself and it doesn't matter which software version it use.

2. don't play with EWS if you are not sure what you are doing. Without some knowledge most likely you will loose all existing keys if they are. If not - no problems, nothing important to loose if you make all possible backups.

3. about transponders: best manual for newbies ever seen is written by authors of GAMBIT and is supplied with GAMBIT software. Don't miss to read it!