Who can give me a CAS3 eprom dump without ISTAP so I can downgrade a CAS3 ISTAP,AKL , I have ISN from DDE : C1E7

vladys said:

Who can give me a CAS3 eprom dump without ISTAP so I can downgrade a CAS3 ISTAP,AKL , I have ISN fro...

Click to expand...

From your screenshot I can extract the key details:

• VIN: WBANX52050C292056 — BMW E60/E61 (5 Series)
• ZB Num: 9262361
• Prog Date: 08092009
• CAS3+ Status: EWS 3 NOT CRYPTED (OFF)
• Key freq: 868 MHz
• Mileage: 248286 KM
• EGS + DME 4 BYTE ISN: 53B1C1E7 (last 4 bytes = C1E7 matches your DDE ISN)
• Key 1: Active (0C9CCF12), Keys 2–10 show FFFFFFFF KEY ID = unused/dealer key slots
• SK ISN: All FF (SK1, SK2, SK3) — this is typical for EWS3 not crypted status
• Mode: Normal mode

About Your Request

You want a clean CAS3+ EEPROM dump without ISTAP to downgrade from an ISTAP-updated CAS3 for AKL (All Keys Lost) purposes. A few important points:

1. You cannot just use any random CAS3 EEPROM dump. The EEPROM contains VIN, ISN, key data, and mileage — all vehicle-specific. Flashing someone else's virgin/clean dump would mismatch your DDE ISN and VIN.
2. What you actually need is to either:
   • Option A: Get the CAS3+ flash (D-Flash) downgraded to a pre-ISTAP firmware version via OBD or bench, then perform AKL with your existing EEPROM data. The EEPROM (4KB) itself stays — it's the flash firmware that ISTAP updated and locked the key learning.
   • Option B: Use a tool that supports CAS3+ ISTAP AKL directly (e.g., CGDI BMW, Yanhua ACDP, Xhorse VVDI with CAS3+ ISTAP support) — some newer versions handle ISTAP CAS3+ without needing a downgrade.
3. If your original EEPROM dump is corrupted, you need to re-read the EEPROM (93C86 chip) from the CAS module directly on bench. The data in your screenshot looks intact — was this read from the current CAS or from a backup file?

What To Do Next

1. Re-read the CAS3+ EEPROM on bench (93C86) — read it 2–3 times and compare to make sure you have a clean read. Your screenshot from C4 Editor shows the data decoded properly, so it may already be a good dump.
2. Read the CAS3+ D-Flash (the main flash memory, not the EEPROM) — this is what contains the ISTAP firmware. You need to identify the exact flash SW version to know if it's ISTAP-affected.
3. Downgrade the D-Flash to a pre-ISTAP version matching your CAS3+ hardware (ZB 9262361). Tools like CGDI or Yanhua ACDP can flash the CAS3+ D-Flash on bench.
4. After downgrade, perform AKL using your ISN C1E7.

Please share:

• What tool did you use to read the EEPROM?
• Do you have the CAS3+ D-Flash dump as well?
• What tool are you planning to use for AKL? (CGDI / ACDP / VVDI / other?)

This will help determine the exact downgrade flash file you need.

I have only Launch x431 + xprog 3 , ISTA standalone, mike easy bmw tools

vladys said:

I have only Launch x431 + xprog 3 , ISTA standalone, mike easy bmw tools

Click to expand...

With your current toolset, here's what you can realistically do:

Your Tools Assessment

• Launch X431 + XProg 3 — Can read/write CAS3+ EEPROM (93C86) on bench. Good for EEPROM backup/restore.
• ISTA — Can flash/program CAS3+ via OBD, but it will flash the latest firmware (including ISTAP). It won't help you downgrade.
• Mike's Easy BMW Tools — Good for key programming on non-ISTAP CAS3+, ISN reading, EWS/CAS manipulation. But it cannot do AKL on ISTAP CAS3+.

The Problem

None of your tools can:

• Read/write the CAS3+ D-Flash (main firmware flash) — needed for downgrade
• Perform AKL on an ISTAP-updated CAS3+

The EEPROM alone is not enough. The ISTAP lock is in the D-Flash firmware, not the EEPROM. Replacing the EEPROM with a "clean" one won't bypass ISTAP — it will just corrupt your CAS.

Your Options

Option 1 — Get the right tool (recommended)
You need one of these to read/write D-Flash and downgrade:

• Yanhua ACDP CAS module — CAS3+ D-Flash read/write + ISTAP downgrade + AKL. Best option for your situation.
• CGDI BMW — Can do CAS3+ ISTAP downgrade + AKL on bench.
• Xhorse VVDI2 + VVDI Prog — Some support for CAS3+ ISTAP AKL.

Option 2 — Find someone locally
Find a locksmith or tuner near you who has ACDP or CGDI and can:

• Read your CAS3+ D-Flash on bench
• Flash a pre-ISTAP firmware
• Perform AKL using your ISN C1E7

Option 3 — Send the CAS module out
Ship the CAS3+ module to a specialist who can do the downgrade + AKL and ship it back with new keys programmed.

Bottom Line

With Launch X431 + XProg 3 + ISTA + Mike's Tools, you cannot downgrade or AKL an ISTAP CAS3+. You need a D-Flash capable tool (ACDP or CGDI) or someone who has one. Don't flash a random EEPROM dump — it will make things worse.

Where are you located? Maybe someone on the forum can help or recommend a nearby specialist.

Launch x431 + xprog 3 can read\ write flash. I attached photo of software

vladys said:

Launch x431 + xprog 3 can read\ write flash. I attached photo of software

Click to expand...

You're right, I stand corrected. Your Launch X431 + XProg 3 BMW software V10.52 does support:

• Anti-theft data reading, engine ECU EEPROM and FLASH reading/writing
• Gearbox module — Anti-theft data reading, gearbox ECU EEPROM and FLASH reading/writing
• Anti-theft system — Anti-theft data reading/writing, key learning, all keys lost, etc.

That changes things significantly. If it can read/write the CAS3+ D-Flash on bench, then the workflow would be:

Step-by-Step Plan

1. Read current CAS3+ on bench via XProg 3

• Read and save the EEPROM (4KB — 93C86)
• Read and save the D-Flash (full flash dump)
• Read both 2–3 times and compare checksums to confirm clean reads
• Keep these as backups!

2. Identify the current flash SW version
Share the D-Flash dump here (or at least the SW version from the dump header). We need to confirm it's an ISTAP version and identify the exact CAS3+ hardware variant.

3. Get a pre-ISTAP D-Flash
This is what you actually need — not an EEPROM dump. You need a CAS3+ D-Flash firmware that matches your hardware (ZB 9262361) but is a pre-ISTAP version. Your EEPROM data (VIN, ISN, mileage, key slots) stays as-is.

4. Write the downgraded D-Flash
Flash the pre-ISTAP firmware via XProg 3 on bench.

5. Perform AKL
After downgrade, use Launch X431 AKL function or Mike's Easy BMW Tools to program new keys using ISN C1E7.

What To Do Now

• Read the CAS3+ D-Flash with XProg 3 on bench
• Share the dump (or at least the file size and first 32 bytes in hex) so we can identify the firmware version
• Once we know the exact version, we can find the correct pre-ISTAP flash file for your CAS3+

Can you do the D-Flash read and share the result?

I attached everything what I extracted from CAS3 .

vladys said:

I attached everything what I extracted from CAS3 .

Click to expand...

Good, you have everything we need. Let me analyze your dumps:

File Analysis

EEPROM (4KB) — eprombmw2.bin

• ISN bytes at offset 0x00: 53 B1 C1 E7 — matches your DDE ISN ✓
• VIN: WBANX52050C292056 ✓
• Prog Date: 08092009 ✓
• EEPROM looks intact and consistent with the C4 Editor screenshot

D-Flash (512KB) — flashbmw525.bin / flash2bmw.bin
This is the critical file. 512KB = 0x80000 bytes — this is the correct size for a CAS3+ D-Flash (9S12XDP512 MCU).

Key Data Files
You have multiple key data exports with slight differences — looks like you've been experimenting with key learning at different stages. Key 1 (0C9CCF12) is your only working key in most dumps.

Important Question

Before we proceed, I need to check something about your flash dump:

Can you confirm:

• Are flashbmw525.bin and flash2bmw.bin identical, or did you read them at different times?
• Did you read the flash before or after ISTA updated the CAS? If you read it after ISTA update, then both flash dumps already contain the ISTAP firmware.
• What exactly is the current symptom? Does the car start with Key 1? Or is it truly all keys lost right now?

What I See So Far

Your EEPROM shows:

• CAS3+ status: EWS3 NOT CRYPTED (OFF) — this is actually good, it means the CAS is not in encrypted/ISTAP-locked mode in the EEPROM
• Key 1 has valid immo data (012B00 prefix = learned key)
• Keys 2-5 have mixed states — some learned, some erased
• Keys 6-10 are blank (007608 + FFFFFFFF)

The Real Question

If your CAS3+ EEPROM shows EWS 3 NOT CRYPTED (OFF), it may not actually be ISTAP-updated. ISTAP CAS3+ typically shows as CRYPTED (ON) with encrypted SK ISN values (yours are all FF).

Can you clarify:

• Why do you believe the CAS has ISTAP? What error or symptom are you getting?
• Is the car currently starting or not?
• What exactly happened — did you lose all keys, or did ISTA update fail mid-flash?

This is critical because if it's NOT ISTAP, you may be able to do AKL directly with your Launch X431 or Mike's Easy BMW Tools using ISN C1E7 — no downgrade needed at all.

I confirm:
flashbmw525.bin and flash2bmw.bin identical read on different times
The flash it after ISTA update, this is how I found CAS3 Original on the car when it was running but I have AKL and I can't write ISN in CAS with the CAS3 C4 software that I downloaded from this forum binunlock
atached photo is with "CAS3 C4" software , where I can edit eprom+ flash with ELV OFF and Crypto off , in this mode the dashboard lights up because I managed to make a new key with Crypto off but it made me a key with ISN code 32 bits: FFFFFFFFF.. not with ISN from DDE: C1E7. And the DME sync operation with LAUNCH gives me FAIL and the dashboard turns off afterwards. That's why I need a flash + virgin eprom in which I can edit ISN, VIN, key data . I have attached a new picture with the unmodified copy of the eeprom.

vladys said:

I confirm:
flashbmw525.bin and flash2bmw.bin identical read on different times
The flash it after I...

Click to expand...

Now I understand the full picture. This new screenshot tells a very different story:

Current Situation

Your original unmodified EEPROM shows:

• CAS3+ Status: EWS 3 CRYPTED — This IS an ISTAP CAS3+
• SK ISN: All FFFFFFFFFFFFFFFFFFFFFFFFFFFF — encrypted/locked
• Power_Class: None
• Key 1 (0C9CCF12): Only key with valid immo data (012B00), but KEY ID shows all other keys as FFFFFFFF = not learned
• EGS + DME 4 BYTE ISN: 53B1C1E7

So what happened:

• Original CAS3+ was ISTAP (CRYPTED) from the factory/ISTA update
• You used C4 Editor "Save as Crypto OFF" to disable encryption — that's the first screenshot where it showed "EWS 3 NOT CRYPTED (OFF)"
• With Crypto OFF you managed to make a new key, BUT the key got ISN FFFFFFFF instead of C1E7
• DME sync fails because the key ISN doesn't match DDE ISN C1E7
• Dashboard lights up but car won't start

The Real Problem

The issue is NOT the flash firmware. The problem is that when you turned Crypto OFF and made a key, the ISN synchronization was lost. The CAS EEPROM needs the correct ISN written into the key slot so it matches the DDE.

What You Should Try

Step 1 — Fix the ISN in the EEPROM (no flash change needed)

Using C4 Editor on your Crypto OFF version of the EEPROM:

• Click "Edit CAS3+ ISN"
• Make sure the EGS + DME 4 BYTE ISN shows 53B1C1E7
• If it doesn't, use "CHANGE 4 BYTE" to set it to 53B1C1E7
• Save the EEPROM

Step 2 — Clear all key slots and re-learn

In C4 Editor:

• Use "Repair CAS3+" button — this should reset key learning area
• Or manually set all key slots to virgin state (007608 + FFFFFFFF)
• Save the EEPROM with Crypto OFF
• Write this cleaned EEPROM back to CAS3+ via XProg 3

Step 3 — Perform AKL with Launch X431

With the cleaned EEPROM (Crypto OFF, correct ISN, virgin key slots):

• Use Launch X431 IMMO → BMW → AKL function
• It should now be able to learn a new key with the correct ISN C1E7
• After key learning, attempt DME sync again

If That Doesn't Work

Then you need to go the full route:

Option A — Virgin EEPROM + your flash

You would need a CAS3+ virgin EEPROM (not from another car — a factory blank template) where you:

• Write your VIN: WBANX52050C292056
• Write your ISN: 53B1C1E7
• Write mileage: 248286
• Leave key slots virgin
• Set Crypto OFF

Then flash this EEPROM + keep your existing D-Flash, and do AKL.

Option B — Pre-ISTAP flash + virgin EEPROM

Replace the D-Flash with a pre-ISTAP CAS3+ firmware matching ZB 9262361, plus a virgin EEPROM edited with your data. This is the nuclear option.

My Recommendation

Try Step 1-2-3 first — it's the least risky. The flash may not need changing at all. The Crypto OFF EEPROM with correct ISN + virgin key slots + AKL via Launch should work.

If it fails, come back and I'll help you with a virgin EEPROM template.

Can you try the "Repair CAS3+" function in C4 Editor and show what it does?

I attached photo with repair eprom but but how do I stop it from being fffff at SK1,2,3?

vladys said:

I attached photo with repair eprom but but how do I stop it from being fffff at SK1,2,3?

Click to expand...

Good progress! The Repair CAS3+ function did some useful things:

What changed after Repair:

• Status: EWS 3 NOT CRYPTED (OFF) ✓
• Power_Class: Class-2 (was "None") ✓
• Key 1: CFG/PASS changed from 012B00 → 002B00 (reset to virgin-learnable state) ✓
• Key 2: KEY ID changed from FFFFFFFF → 864F9997 and CFG/PASS 004B00 (partially repaired)
• EGS + DME 4 BYTE ISN: 53B1C1E7 — still correct ✓

About SK1, SK2, SK3 = FFFFFFFFFF...

This is actually normal and correct for your situation! Here's why:

SK ISN (Secret Key ISN) is the 16-byte encrypted ISN that is used in CRYPTED (ISTAP) mode only. Since you switched to Crypto OFF mode, the CAS no longer uses SK1/SK2/SK3. It uses the EGS + DME 4 BYTE ISN field instead — which correctly shows 53B1C1E7.

In Crypto OFF mode, SK1/SK2/SK3 = all FF is perfectly fine. Don't touch them.

What To Do Now

Step 1 — Clean up key slots

You want a fully virgin key table for AKL. In C4 Editor, set ALL 10 keys to virgin state:

• KEY ID: FFFFFFFF
• CFG/PASS: 007608
• All other fields: default/FF

Or at minimum, keep only Key 1 slot open for learning and erase the rest.

Step 2 — Save the EEPROM

• Click "Save as Crypto OFF"
• This saves the EEPROM with encryption disabled

Step 3 — Write to CAS3+

• Write this modified EEPROM back to CAS3+ via XProg 3
• Do NOT touch the flash — leave the D-Flash as-is

Step 4 — AKL with Launch X431

• Connect via OBD
• Go to IMMO → BMW → Anti-theft system → All Keys Lost
• Follow the procedure — it should detect the CAS3+ with ISN C1E7 and allow you to program a new key

Step 5 — DME Sync

• After key is learned, perform DME/DDE synchronization via Launch X431
• This time it should succeed because the key ISN will match C1E7

Important

Before writing anything, make sure you have a backup of your current EEPROM and flash (you already do — good).

The key point: SK1/SK2/SK3 = all FF is NOT your problem. Your problem was that the previous key was made with ISN FFFFFFFF instead of C1E7. With a clean virgin EEPROM (Crypto OFF) + correct 4-byte ISN + AKL via Launch, the new key should get the correct ISN.

Try this and report back what happens during AKL with Launch.