Mechanic Wiki: Read Anti-Theft Passwords & Replace Immobilizer Components with LAUNCH X431 XPROG3

Step-by-step guide to reading immobilizer passwords and replacing components using the LAUNCH X431 XPROG3. Covers eeprom reading, wiring, soldering, and troubleshooting.

Published: May 24, 2026

Quick Answer

The LAUNCH X431 XPROG3 is a specialized ECU programmer that reads anti-theft passwords from vehicle immobilizer modules and replaces components like eeproms, transponder keys, or immobilizer control units. The process involves connecting the XPROG3 to the target module via bench mode, reading the eeprom dump, locating the password in the binary data, and then writing the necessary information to a new component. Success depends on correct wiring, firmware updates, and careful soldering.

Understanding Anti-Theft Passwords and Immobilizer Systems

An anti-theft password (often called an immobilizer code or SKC) is a secret value stored in the vehicle’s immobilizer system. This password must match between the key transponder, the immobilizer control unit (ICU), and the engine control unit (ECU) for the vehicle to start. Without the correct password, the engine will crank but not fire.

Typical locations for the password:

Eeprom chip inside the ICU, ECU, BCM (body control module), or key transponder
Microcontroller memory in newer modules (e.g., Motorola MCU)
Flashed eeprom on dedicated immobilizer units like the VW Golf 5 or BMW CAS

Password formats vary by manufacturer. Common formats include 4-digit numeric codes (e.g., 1234), 5-digit codes (e.g., 19283), or hexadecimal values (e.g., 1A3F). Some modern vehicles use rolling codes or encrypted data stored in the microcontroller’s secure area.

You interact with these components using the LAUNCH X431 XPROG3 in two primary ways:

Bench mode: The module is removed from the vehicle and connected directly to the XPROG3 via adapter cables. This gives full access to the eeprom for reading and writing.
On-board diagnostics (OBDII): Some vehicles allow password reading through the diagnostic port without disassembly, but this is limited to certain models and protocols.

Overview of the LAUNCH X431 XPROG3 for Immobilizer Work

The LAUNCH X431 XPROG3 is a stand-alone ECU programmer designed for reading, writing, and cloning eeproms, MCUs, and immobilizer data. Unlike basic OBD scanners, the XPROG3 works directly with the memory chips on the circuit board.

Key features that make it suitable for immobilizer work:

Supports MCU and eeprom read/write operations (e.g., 93C, 24C, 95P, ST, NEC, Renesas families)
Touchscreen interface with built-in pinout diagrams and wiring guides
Pre-loaded vehicle database covering major brands (VW, BMW, Mercedes, Toyota, Nissan, Honda, Ford, and many more)
3.3V and 5V power settings to match chip voltage requirements

Required accessories you will need:

XPROG3 main unit (the handheld programmer)
Adapter cables – typically an 8-pin or 16-pin harness that connects the XPROG3 to the vehicle module
Clip-on probes – for reading eeproms without desoldering (e.g., SOP8 clip)
Soldering station – a fine-tip iron for desoldering and soldering surface-mount chips
Fine tweezers and magnifier – for handling small components

Preparing the device for first use:

Charge the XPROG3 fully before starting.
Update the firmware via the LAUNCH website or through the X431 tablet (if you have the combination package). Without the latest database, you may miss support for newer vehicles.
Install the vehicle-specific software for the brand you are working on (e.g., “LAUNCH Immobilizer” or “XPROG3 EEPROM Programmer”).
Verify voltage settings – most eeproms operate at 5V, but newer ones (like 24C32) use 3.3V. Using the wrong voltage can damage the chip.

Important safety precautions: Disconnect the vehicle battery before removing any module. Avoid static discharge – use an anti-static wrist strap when handling circuit boards. Always verify voltage levels with a multimeter before connecting the XPROG3.

Step-by-Step: Reading Anti-Theft Passwords with the XPROG3

1. Identify the Immobilizer Module and ECU Type

First, locate the immobilizer module in your vehicle. Common modules come from:

Bosch (e.g., Motronic ME7, EDC16)
Siemens (e.g., SIMOS, SID)
Delphi (e.g., DCM, MPS)
Continental (e.g., VDO, IPC)

Once you have the module in hand, open its housing and find the eeprom chip. Look for markings like 93C56, 24C32, 95P08, etc. These are the chips that hold the immobilizer data, including the password.

Common eeprom types found in immobilizer modules:

Chip Type	Common Size	Voltage	Typical Application
93C56	2Kbit	5V	VW Golf 4, Audi A4
24C32	32Kbit	5V	Toyota, Honda BCM
95P08	8Kbit	3.3V	BMW CAS3, Mercedes EZS
ST95160	16Kbit	3.3V	PSA (Peugeot/Citroen)

Take a photo of the board connections – you will thank yourself when reassembling.

2. Disassemble and Access the Module (Bench Mode)

For most vehicles, you must remove the module from the car. This means unbolting the ECU or ICU and bringing it to your workbench. On-board reading via OBDII works only for a limited set of vehicles (e.g., some Toyota models). Bench mode is the reliable method.

Steps:

Disconnect all connectors from the module.
Use a small flathead screwdriver or plastic pry tool to open the casing.
Locate the eeprom chip on the PCB.
If the chip is soldered directly, you have two options:
- Desolder the chip using a heat gun (280-350°C) or a soldering iron with a wide tip. This gives a clean read but requires soldering it back.
- Use a clip-on adapter like an SOP8 clip. Clip the probe onto the chip pins while it is still on the board. This avoids desoldering but is less reliable if pins are dirty.

3. Connect the XPROG3 to the EEPROM

Now connect the XPROG3 to the eeprom via the adapter cable. The XPROG3 comes with a 16-pin connector that maps to various chip pinouts.

Matching pinouts (example for 24C32):

VCC: Connect to chip pin 8 (power)
GND: Connect to chip pin 4 (ground)
SCL: Connect to chip pin 6 (clock)
SDA: Connect to chip pin 5 (data)
WP: Connect to GND (write protection disabled)

Refer to the XPROG3 built-in pinout guide – tap the “Pinout” button on the touchscreen to see a diagram for your selected chip.

Power the module: Set the XPROG3 voltage to match the chip (3.3V or 5V). Never exceed the chip’s rated voltage.

4. Read the EEPROM Data

Turn on the XPROG3 and launch the “XPROG3 EEPROM Programmer” application.
Select “Immobilizer” from the main menu, then choose the vehicle brand and model.
From the list of supported ECUs, select the one you have. If not listed, go to “Manual Chip” and choose the eeprom type and size.
Click “Read”. The device will read the entire memory of the chip and display the dump in hexadecimal format.
Save the dump to an SD card or internal memory. Always back up the original data before making any changes.

5. Locate the Anti-Theft Password in the Dump

The password is often hidden in a specific memory address. The XPROG3 may have a built-in decoder that highlights the password for common modules. For example:

VW Golf 4 (93C56): Password is at offsets 0x0A0 to 0x0A3 (4 bytes, often in ASCII like "1234").
Toyota Corolla (24C32): Password at offsets 0x1F0 to 0x1F3 (4-digit hex).
BMW E46 (93C86): Password at offsets 0x020 to 0x023 (reversed hex).

If the decoder does not automatically show the password, use a third-party tool like Tango or AVDI to analyze the dump, or look for patterns: a 4-digit ASCII code (e.g., "4B 4C 4D 4E" equals "KLMN") or a repeating hex value.

Extract the password and write it down. This is the secret code you will need for replacing components.

6. Verify the Password (Optional)

If the vehicle is still drivable and the module is intact, try entering the password using a diagnostic tool (e.g., LAUNCH X431 tablet) to confirm it works. Alternatively, cross-check with stored key data – if the dump shows two keys and you know one works, compare the values.

Step-by-Step: Replacing Immobilizer Components

1. Prepare the Replacement Component

You may need to replace an eeprom (if damaged), a transponder key (if lost), or the entire ICU (if faulty). The XPROG3 helps you program the correct data into the new part.

For eeprom: Source a new chip of the same type (e.g., 24C32). Ensure it is blank or from a known good donor.
For key transponder: Use a transponder (e.g., T5, T6, or silicon chip) and program it with the vehicle’s key ID using a dedicated key programmer (the XPROG3 alone does not program keys directly, but you can write the key data into the ICU eeprom).
For ICU: Buy a new or used ICU (same part number). You will write the immobilizer password and key data to it.

2. Write the Correct Data to the New Component

For eeprom replacement:

Open the saved original dump in the XPROG3.
If necessary, edit the data (e.g., change VIN, add or delete keys). This is done in the hex viewer.
Select the new blank chip, connect it to the XPROG3, and click “Write”. The device will flash the data onto the chip.

For ICU replacement:

Connect the new ICU to the XPROG3 via bench mode.
If the ICU is brand new, it has no immobilizer data. You need to write the original password and key information. Use the “Immobilizer” function to enter the password manually (if the tool supports it) or write a full dump from a known good ICU.
For some cars (e.g., VW), you can perform a “Synch” or “Learn” procedure through the XPROG3 after writing – follow the on-screen prompts.

3. Solder or Install the New Component

For eeprom:

Apply flux to the pads on the PCB.
Position the new chip with correct orientation (pin 1 marked by a dot).
Solder each pin carefully – a fine-tip iron at 300°C works well. Avoid bridging adjacent pins.
Use a magnifier to inspect connections.

For ICU/BCM:

Plug the module back into its connectors inside the vehicle.
Secure the housing and mounting bolts.

4. Test the Replacement

Reinstall the module in the vehicle and reconnect the battery. Try to start the engine. The immobilizer warning light should turn off after a few seconds, and the engine should crank and start.

If the engine still does not start, use the XPROG3 to perform a “Synch” or “Learn” function. Some vehicles require a 30-minute ignition-on cycle (with the immobilizer light flashing) to synchronize the new component with the ECU. Consult the LAUNCH software for specific procedures.

Troubleshooting Common Issues

XPROG3 does not detect the eeprom: Double-check wiring – a loose connection is the most common culprit. Verify voltage setting and ensure the chip is properly powered. Try a different adapter cable.
Password read as all zeros or invalid: You may have selected the wrong chip type or size. Re-read the dump with a known good configuration. If the chip is physically damaged, the data may be corrupted.
Vehicle still doesn’t start after replacement: Perform an immobilizer reset – many cars (especially VW/Audi) require a 30-minute ignition-on cycle with the key in the “on” position and the immobilizer light flashing. Re-sync keys using a diagnostic tool.
“Communication error” on XPROG3: Update the firmware to the latest version. Change the USB port (if connected to a PC) or restart the device. Ensure no other programs are using the USB port.
New eeprom fails to program: Verify the chip is blank (unused chips are blank by default). Try a slower write speed in the XPROG3 settings. Use a stable power source – low batteries on the XPROG3 can cause write failures.

Frequently Asked Questions (FAQ)

Q1: Can I read the anti-theft password without removing the ECU?
A: Some vehicles allow on-board reading via OBDII, but most require bench mode for full eeprom access. You must open the module and connect directly to the chip.

Q2: Does the LAUNCH X431 XPROG3 work on all car brands?
A: It supports a wide range (VW, BMW, Mercedes, Toyota, Nissan, etc.) but not all. Check the vehicle database on the LAUNCH website before purchasing to confirm compatibility with your specific model.

Q3: What do I do if the eeprom chip is glued or potted?
A: Carefully chip away the compound with a sharp tool or use a heat gun to soften it, then desolder. Work slowly – damaging the chip or board traces can ruin the module.

Q4: Can I use the XPROG3 to program a key fob?
A: Not directly; the XPROG3 handles eeprom and immobilizer data. For key fob programming, you need a dedicated key programmer or combine with the X431 tablet (which can program keys via OBDII for supported vehicles).

Q5: The password I read doesn’t work. What could be wrong?
A: Possible causes include wrong offset in the dump, the vehicle uses a rolling code, or the ECU was swapped without matching. Recheck by reading a known good dump from a working module of the same type.

Q6: Is it safe to write a reprogrammed eeprom back to the ECU?
A: Yes, if the data is correctly prepared. Always back up the original dump first. A single mistake in the hex file can cause the ECU to fail – double-check values before writing.

Q7: Can I reuse the same eeprom after rewriting?
A: Most eeproms can be written thousands of times, but if the chip is damaged from heat during desoldering, replace it. Repeated heating can degrade performance.

Conclusion

The LAUNCH X431 XPROG3 is a powerful tool for reading immobilizer passwords and replacing components – when used correctly. The key to success lies in careful preparation: identify the correct chip, use the right wiring, back up the original dump, and follow manufacturer pinout diagrams precisely. If you hit a wall, update the firmware or check community forums for known working dumps.

Practice on scrap modules before working on a customer’s vehicle. The more you familiarize yourself with the XPROG3 interface and common eeprom layouts, the faster and more confident you will become. Keep your tool updated, and always verify voltage levels – a simple mistake can cost you a module.

For a deeper dive into specific vehicle procedures, check out our guide on VW Immobilizer Reset Using XPROG3 or Common Eeprom Pinouts for Bosch ECUs.

About the Author: Erwin Salarda is an Automotive Service Equipment Technician based in the Philippines, specializing in computerized automotive diagnostic equipment such as OBD scanners and wheel alignment systems.