HITAG2

HITAG2 is very popular immo transponder， it is compatible with PHILIPS
PCF7936 transponders.  It support following types：
PCF7936
PCF7941
PCF7942/44
PCF7943
PCF7945
PCF7946
PCF7947
PCF7952
PCF7953
PCF7961

Access method：
 PCF7936 support Password mode and Cipher mode
 Other’s don’t have Password mode itself, only have Cipher mode

 For Password mode: Only SK low was used for login，
Default key：4D494B52

 For Cipher mode: It use SK low and SK high for login，
Default key： SK low：4D494B52;
                     SK high: 4F4E

Read Transponder

It will read all readable page and shown in window (Transponder information,
Transponder data, Remote control
(not all transponder have this area))，it will try password mode and cipher mode automatically, also Manchester and Biphase automatically.

For the transponder with default key we can read all readable pages.

If the transponder was changed SK value, we can only read ID before you input correct
SK value in Parameter. Every page in HITAG2 has 4 bytes. The type is detect with
identifier, so it will not strictly for many OEM keys

About the transponder manufacture configuration(TMCF)

TMCF byte is very important; usually it is the first byte in Config page.

Example:
Config page is “XXYYZZWW” (4 bytes). The first byte “XX” is TMCF，write error
TMCF value can lock the transponder or damage it. The specify explanation for TMC
following: Convert XX(hex) to binary, it have 8 bits,  every bit can be 0 or 1, we set as: X1 X2 X3 X4 X5 X6 X7 X8

 X1: If set to 1, the SK low and SK high was unable to read and write
 X2: If set to 1, the Config page was unable to write, but read is always available
 X3: If set to 1, Remote control area was unable to read and write(Note: PCF7936 have none about this bit)
 X4: If set to 1, transponder data was unable to write, but read is always available

X5: If set to 1, transponder is use transponder data area. If set to 0, mean use remote control area (Attention: For PCF7936, if set to 1, transponder use Cipher mode, if set to 1, transponder use Password mode)

 X6: Always 0, reserve bit (Attention: PCF7936 must set to 1, set to 0 will damage transponder)
 X7: Always 0, reserve bit (Attention: PCF7936 must set to 1, set to 0 will damage transponder)
 X8: If set to 0, transponder use Manchester coding, if set to 1, use Biphase coding (CDP)

How to change a byte to binary:
With PC system Calculator ->Select Scientific->Select Hex ->input TMCF value ->Select Bin,

you can see the binary values. If binary not have total 8 bits, means the front have several 0

Example:

TMCF value is C8, so X1-X8 have value: 11001000
The transponder use Manchester coding
The transponder use transponder data area
The SK low and SK high was unable to read and write
The Config page was unable to write, but support read

MAIN MENU