User Manual: Penloader Tool

PENLOADER TOOL
UserManual
For Software Version: 2.10
The use of this apparatus is limited to legitimate and legal purposes for vehicle
maintenance, in compliance with federal and state laws and regulations.
Thumbwheel Setting Penloader Operation
Write from Memory Block 0 to 93C series
00
device
01
device
02
device
03
device
04 Display keys for 3key 16 bit
05 Prog file: 3key16bit
06 Prog file: 16bit
07 Prog file: 32bit
08 Prog file: 47010
09 Prog file: 34010
10 Prog file: 50020
11 Prog file: 60330
12 Prog file: 60230
13 Prog file: 33110
14 Prog file: Aa010
15 Prog file: 35090
16 Prog file: 60220
17 Prog file: 08010
18 Prog file: 50050
19 Prog file: 48020
20 Prog file: 0e010
21 Prog file: 47020
22 Prog file: 50030
23 Prog file: 50031
24 Prog file: 24020
25 Prog file: nontrans
26 Prog file: Red_Black
27 Display Red and Black keys
28 Erase device to all FF
29 Erase device to all 00
30 Prog file: EarlyToyota
31 Prog file: FJ_S93C66
32 Prog file: SaabCIM03_09
ii
33 Not in use
34 Prog file:id box 93C86b virgin
35 Prog file: 2010Camry
36 Prog file: iSmart_Key_proxy_IDbox
37 to 83 Not in use
84 Chevrolet Cruze PIN read
85 Fiat PIN read
86 Saab PIN read
87 Toyota/Lexus 3 key read
88 Dodge Caravan PIN read
89 Jeep Liberty 95080 PIN read
90 Nissan 05 PIN read
92 VW Beetle PIN read
93 Isuzu PIN read
94 Chrysler PIN read
95 Restore original contents
98 Switch to THUMB 1 settings
Display serial number and power supply
99
voltage
THUMB 1 settings:
Thumbwheel Setting Penloader Operation

00 Send Memory Block 0 to computer
Receive data from computer and save in
04
Memory Block 0
05
Memory Block 1
06
Memory Block 2
07
Memory Block 3
iii
08 Copy from Restore Memory to Memory Block 0
12 Copy from Memory Block 0 to Restore Memory
16 Read and save 25LC010 to Restore Memory
21 Write from Restore Memory to 25LC010
26 Read and save 24C01 to Restore Memory
31 Write from Restore Memory to 24C01
Read and save 93C series device to Restore
36
Memory
37 to 98 Not in use
Display serial number and power supply
99
voltage
iv
1 INTRODUCTION 6
2 PRODUCT FEATURES 7
3 PENLOADER OPERATION 9
3.1 General Operation 9
3.2 Visual and Audible Cues 13
3.3 Memory Blocks 15
3.4 Restore Original Contents 15
3.5 THUMB 1 Settings 16
4 THUMBWHEEL SELECTIONS IN DETAIL 20
4.1 General Operation 20
4.2 THUMB 1 Settings 51
5 UPLOADING/DOWNLOADING SERIAL DATA 56
5.1 Introduction 56
5.2 General Setup 57
5.3 Transferring Memory Blocks Between The

Penloader and the Computer 65
5.4 Troubleshooting 74
5.5 Data File 77
v
1 Introduction
The Penloader was designed to provide a tool that can be
used to program memory devices installed on circuit boards,
as well as read existing PINs. The tool is simple to use and
requires no external computers, keypad entry devices, adaptor
boards or cables.
Features of the tool are:
 Small sized unit for hand held use

 4 digit alpha-numeric display
 Simple to use
 Programming options selected through a 2 digit thumbwheel
switch
 Onboard probes with spring loaded protective cover, for
programming 8 pin SOIC packages
 Supports Microwire, I2C and SPI devices
 Powered by rechargeable batteries or external 12V dc
supply
 Provides measurement of power supply voltage (battery and
external supply)
 Includes dual LED lamps to illuminate area around device to
be programmed
 Audio feedback to user
 Capability to read and display PIN numbers
 60 second auto power off when not in use
 Software is field updateable using a Windows PC and a
serial cable
 4 on board Memory Blocks that can be used to save 4
unique user files.
 Restore operation that can be used to restore contents of
last device programmed.
6
2 Product Features
Figure 1 – Penloader Unit
7
Item Description
1 Thumbwheel selector
2 On/Off button
3 START buttons
4 4 character display
5 Neoprene grip
6 Spring probes
7 12V dc input connector
8
3 Penloader Operation
This tool provides a set of programming and PIN read
functions to help the locksmith when programming new
transponder keys and proxy.
3.1 General Operation

The basic operating procedure for using the Penloader is
as follows:
(i) Remove module containing memory device to

be programmed, from the vehicle, and
disassemble to provide access to the memory
device to be programmed or read.
(ii) Set thumbwheel to the required number (refer to
Table 3.1 below).
(iii) Power up the Penloader (thumbwheel must not
be set to 98 before power up).
(iv) Position the Penloader over the 8 pin memory
device ensuring that the spring probes are
making good contact with the legs on the
memory device. Where possible, a “Flash device
identifier” is specified to help locate the correct 8
pin device on the circuit board. Figure 2 below
shows how to locate pin 1 on the 8 pin memory
device. It is important that the spring probe
identified as “1”, is in contact with Pin 1 on the 8
pin memory device.
(v) Push the START button.
(vi) The 4 character display will show status as the
programming/read operation proceeds. The
Penloader unit will also provide audio cues
during the operation (ref section 3.2 below).
(vii) On completion the display will identify whether
the programming operation was successful or
not. In the case of PIN reads, the display will
show the 4 digit PIN (and hold it for 5 seconds) if
the operation was successful.
9
Figure 2 – Locator for Pin 1
The following table shows the options that are selectable using
the thumbwheel.
10
Thumbwheel
Penloader Function
Setting
00 Write using data from Memory Block 0
04 Displays 2 keys for use with thumbwheel setting

05
05 Lexus or Toyota 3 key file program
06 Lexus or Toyota - 16bit file program
07 Lexus or Toyota - 32bit file program
08 Toyota Prius - 47010 file program
09 Toyota Sequoia - 34010 file program
10 Lexus LS400 - 50020 file program
11 Lexus GX470 - 60330 file program
12 Lexus LX470 - 60230 file program
13 Lexus ES330 - 33110 file program
14 Toyota Camry – aa010 file program
15 Toyota 4runner - 35090 file program
16 Toyota Landcruiser - 60220 file program
17 Toyota Sienna - 08010 file program
11
19 Lexus RX330 - 48020 file program
20 Lexus RX330 - 0e010 file program
21 Toyota Prius - 47020 file program
24 Lexus SC430 - 24020 file program
25 Lexus or Toyota - nontrans file program
26 Honda Red/Black keys program
27 Displays 2 keys for use with thumbwheel setting

26
28 Erase device to all FF
29 Erase device to all 00
30 Toyota – EarlyToyota file program
31 Toyota FJ Cruiser - FJ_S93C66 file program
32 Saab CIM- SaabCIM03_09 file program
33 Not used
34 Toyota - id box 93C86b virgin file program
35 Toyota Camry - 2010Camry file program
36 Toyota - iSmart_Key_proxy_IDbox file

program
37 - 83 Not used
84 Chevrolet Cruze PIN read
85 Fiat Punto/500 PIN read
12
86 Saab PIN read
87 Toyota/Lexus 3 key read
88 Dodge Caravan PIN read
89 Jeep Liberty 95080 PIN read
91 Nissan 2009 and up PIN read
92 VW Beetle 2000 PIN read
93 Isuzu 2003-2005 PIN read
94 Chrysler PIN read
95 Restore original contents
98 Switch to THUMB 1 settings
99 Displays unit serial number and power supply

voltage
Table 4.1 – Thumbwheel selection options
3.2 Visual and Audible Cues

When the Penloader is used to program an update into a
memory device it will provide both visual and audio cues to
the user. The following table defines these cues and their
definition. Note that all visual cues are displayed on the 4
character display.
13
Visual
Audio Cue Definition
Cue
The Penloader is
Faint ticking sound,
determining what type
with ticks
IDNT and size device it is
approximately 1
currently positioned
second apart
over.
The Penloader is
Machine gun type programming the
PROG
sound external memory
device.
The Penloader is
comparing the data in
Same sound as used the programmed part,
VRFY
for PROG. with the data used to
perform the program
function.
The VRFY operation
was successful, and
the data in the
Pseudo “charge”
OK programmed part
tune.
matches the data used
in the program
operation.
An error occurred, or
Low tone held for 2 the Penloader could
FAIL
seconds. not determine the type
of device.
The Penloader unit is
reading data from an
READ None
external memory
device.
The Penloader unit is
SAVE None saving data into a
memory block.
Table 4.2 – Visual and audible cues
14
3.3 Memory Blocks
The Penloader contains four onboard Memory Blocks,
which can be used for the purpose of saving and retrieving
custom data files. Each Memory Block can hold up to 2K
Bytes (2048 Bytes) of data. To identify the Memory Blocks,
they are numbered as 0, 1, 2 and 3.
Data can be read from an external memory device and

saved to any of the four Memory Blocks (THUMB 1
thumbwheel options 08 to 11 – refer to section 3.5).
External memory devices can also be programmed using
data sourced from any of the four Memory Blocks
(thumbwheel options 00 through 03).
In addition, the Penloader contains the capability to send

the contents of any of the Memory Blocks to an external
computer (via RS-232) for viewing and editing purposes
(THUMB 1 thumbwheel options 00 to 03); and also to
receive, and save to a Memory Block, data files from an
external computer (THUMB 1 thumbwheel options 04 to
07).
Each memory block has an associated comment field,

which can be used to name or add a note for a particular
Memory Block. The comment field may not exceed 58
characters in length (including spaces). To add a comment
field, an external computer must be used. This procedure is
described in a separate document called “Penloader Tool –
Data Send and Receive Manual”.
3.4 Restore Original Contents

The Penloader also contains a reserved “Restore” Memory
Block which is used by the Penloader to save the contents
of an external memory device before it overwrites it with
new data.
When programming an external memory device, and after
the START button is pressed, and the Penloader has
15
identified the external device to be programmed, the
Penloader reads the contents of the external memory
device, and saves it to the “Restore” Memory Block.
Should the user desire to restore the original contents of
the external memory device after programming, this is
made possible through the use of the thumbwheel 95
setting.
It is important to note that the “Restore” Memory Block is
overwritten by each subsequent programming of an
external device. As a consequence, it is only possible to
restore the last contents of the last external memory device
programmed.
It is possible to permanently save the contents of the
“Restore” Memory Block, as described in section 4.2.6.
3.5 THUMB 1 Settings

The Penloader contains a second bank of thumbwheel
settings, referred to as the THUMB 1 settings. These
settings are invoked by setting the thumbwheel to 98 prior
to powering on the Penloader. When this is done, the
display will indicate “THUMB 1 active”, and the thumbwheel
selections will switch over to the THUMB 1 settings table,
as follows:
Thumbwheel Setting Operation

Send Memory Block 0 to an
00
external computer
01
external computer
02
external computer
03
external computer
16
Receive data from computer and
04
save in Memory Block 0
05
06
07
Copy from Restore Memory to
08
Memory block 0
09
memory block 1
10
memory block 2
11
memory block 3
Copy from memory block 0 to
12
Restore Memory
13
Restore Memory
14
Restore Memory
15
Restore Memory
Read and save 25LC010 to
16
Restore Memory
17
Restore Memory
18
Restore Memory
19
Restore Memory
20
Restore Memory
21 Write from Restore Memory to
17
25LC010
Write from Restore Memory to
22
25LC020
23
25LC040
24
25LC080
25
25LC160
Read and save 24C01 to Restore
26
Memory
27
Memory
28
Memory
29
Memory
30
Memory
31
24C01
32
24C02
33
24C04
34
24C08
35
24C16
Read and save 93C series device
36
to Restore Memory
37 to 98 Unused
Display serial number and power
99
supply voltage
18
These thumbwheel settings will remain in place until the
power is cycled, with the thumbwheel set to some setting
other than 98.
19
4 Thumbwheel Selections In Detail
4.1 General Operation
The following sections describe the operation of the
Penloader under the general thumbwheel settings.
4.1.1 Thumbwheel Settings 00 through 03

File: Sourced from Memory Block (0,1,2 or 3)
Flash device identifier: Depends on manufacturer
Device type: 93C series (93C01, 93C02, etc…)
Type of operation: Programming
Manufacturer(s): Any
These thumbwheel setting are used to program a 93C

series [microwire] memory device using the contents of one
of the four memory blocks provided. Set thumbwheel to 00,
01, 02, or 03 depending on which memory block (1, 2, 3, or
4) should source the data to be programmed into to the
external device. Note that the contents of the comment field
will scroll on the display when the thumbwheel is set to one
of these selections.
To perform the programming function use the procedure

described in section 3.1. Display must display “OK” at the
end of the procedure, else the programming operation
failed.
20
4.1.2 Thumbwheel Setting 04
This thumbwheel setting is used to display the 2 keys
programmed into a memory device using Thumbwheel
setting 05. The keys are displayed in 4 character
increments, as follows:
(i) Before starting, perform the programming

procedure as described in section 4.1.3 below.
(ii) Set thumbwheel to 28.
(iii) Press the START button. The display will scroll
until “KEY1” is displayed, then the scroll
operation will pause. KEY1 is the first Key, and
KEY2 is the second Key.
(iv) Press the START button again to continue the
display scroll to the next 4 digits of the key
value.
(v) Continue step (iv) until all 28 digits of both keys
have been displayed. Pressing START again will
scroll the data from the beginning again.
21
File: 3 key16bit
Flash device identifier: IC900
Manufacturer(s): Toyota, Lexus – Type 1 ECU (models
specified in the following table).
Model Year ECU Location

4Runner 1998-2001 Behind glove box
Avalon 1998-2003 Behind glove box
Camry 1998-2000 Behind glove box
Solara 1998-2000 Behind glove box
Highlander 2001-2003 Behind glove box
Landcruiser 1998-2000 Behind glove box
MR2 2001-2003 Behind driver seat
Rav 4 2002-2003 Behind glove box
Sienna 1998-2003 Behind glove box
ES 300 1998-2001 Behind glove box
GS 300 1998-2000 Under hood, driver’s side
LS 400 1998-2000 Behind glove box
LX 470 1998-2000 Under hood
RX 300 1999-2003 Under hood
Below glove box, under
SC 300 1998-2000
carpet
SC 400 1998-2000
carpet
Note: Use this option if the immobilizer will not enter “Learn”
mode after re-programming using Thumbwheel selection
30.
22
failed.
After the programming procedure successfully completes,

set Thumbwheel to 04 to display the two Key values
programmed.
23
File: 16bit

Avalon 1998-2003 Behind glove box
Highlander 2001-2003 Behind glove box
Landcruiser 1998-2000 Behind glove box
MR2 2001-2003 Behind driver seat
RAV 4 2002-2003 Behind glove box
Sienna 1998-2003 Behind glove box
LS 400 1998-2000 Behind glove box
LX 470 1998-2000 Under hood
RX 300 1999-2003 Under hood
SC 300 1998-2000
carpet
SC 400 1998-2000
carpet

24
failed.
After programming is successfully completed, follow the

procedure described in Appendix A, section A.1.1 to
register keys into the ECU.
If the immobilizer will not enter “Learn” mode after re-

programming, reprogram using Thumbwheel setting 29.
Note: If vehicle will only register 1 key after programming -

this is an indication that it probably uses a Type 2 ECU, and
was programmed with the wrong file. Reflash with the
correct file.

File: 32bit

4Runner 2002 Behind glove box
LandCruiser 2001-2002 Behind glove box
Sequoia 2001-2002 Behind glove box
IS 300 2001-2003 Under hood, driver’s side
LX 470 2001-2002 Behind glove box
25
failed.

Note: If vehicle will only register 1 key after programming -

this is an indication that it probably uses a Type 1 ECU, and
was programmed with the wrong file. Reprogram with the
correct file.

File: 47010
Flash device identifier: IC
Manufacturer(s): Toyota (models specified in the following
table).
Model Year Immo Location

Under dash board, above
steering column. Must drop
the column – 10mm bolt to
Prius 2001-2003
release the bracket located
in left corner behind roll
bar.

failed.

register keys into the Immobilizer.
26
After programming all modules must be resynchronized by
performing the following procedure:

File: 34010
table).

2003 and Behind cluster. Must be a
Sequoia
newer 4D-67 transponder.

failed.
Important: One of the pins of the blue colored component in

the corner of the board next to IC1, must be connected to
GND before trying to program IC2 (refer to photo in
Appendix B).

27
File: 50020
Manufacturer(s): Lexus (models specified in the following
table).

LS 400 1997 Behind glove box

failed.


File: 60330
Flash device identifier:
table).

GX 470 2003-2004 Behind instrument cluster

failed.
28

File: 60230
table).

LX 470 2003-2004 Behind glove box

failed.


File: 33110
table).

ES 330 2004 Behind glove box
29
failed.


File: aa010
table).


failed.


File: 35090
table).
30

failed.


File: 60220
table).

LandCruiser 2003-2004 Behind glove box

failed.

31
File: 08010
table).

Sienna 2004 Above center dash

failed.


File: 50050
table).

LS 430 2004 Above navigation system

failed.
32

File: 48020
table).

2004 (VIN
RX 330 Above center dash
starts with “J”)

failed.


File: 0e010
table).

2004 (VIN
RX 330 starts with Above center dash
“2”)
33
failed.


File: 47020
table).

Under dash board, above
Prius 2004
steering column.

failed.

34
File: 50030
table).

LS 430 2001-2002 Above navigation system

failed.


File: 50031
table).

LS 430 2003 Above navigation system

failed.
35

File: 24020
table).

SC 430 2002-2003 Behind instrument cluster

failed.


File: nontrans
Manufacturer(s): Toyota, Lexus (models specified in the
following table).
36
Model Year VIN
All models not equipped with a separate
transponder/immobilizer unit. Must use a Type 1 ECU.
Camry Sept 2002 - Jan 2003 1 or 4 (4 or 6 cyl)
Camry Sept 2002 - 2005 1 or 4 (4 cyl only)
Camry Sept 2002 - Jan 2003 1 or 4 (6 cyl only)
Camry Sept 2002 - 2005 J (4 cyl only)
Camry Sept 2002 - Jan 2003 J (6 cyl only)
Camry Sept 2002 - July 2003 J (4 cyl only)
Camry Sept 2002 - Jan 2003 J (6 cyl only)
Normally, Type 1 ECU vehicles would be programmed

using the “16bit” file (ref sections 4.1.3 and 4.1.4), however
if no transponder keys are available, the ECU unit can be
programmed using the ”nontrans” file. In this case a
standard metal key should be used after programming.

failed.
After performing the programming operation, do not install

the center plug when reinstalling the ECU.
37
File: Red/Black Keys
Manufacturer(s): Honda (models specified in the following
table).

NSX 1997 - 2004
Attached to steering
Prelude 1997 - 2002
column.
RL 1996 - 2004

failed.
The Red Key, and one Black Key, for use with this
programming operation is displayed using thumbwheel
setting 27. Use a T Code Pro, SDD or CodeSeeker
programmer to initialize a Black Key.

This thumbwheel setting is used to display the Red Key and
one Black Key programmed into a memory device using
Thumbwheel setting 26. The keys are displayed in 4
character increments, as follows:
(i) Before starting, perform the programming
procedure as described in section 4.1.24 above.
(ii) Set thumbwheel to 27.
(iii) Press the START button. The display will scroll
until “Red” is displayed, then the scroll operation
will pause. “Red” identifies the start of the Red
Key, and “Blck” identifies the start of the Black
Key.
38
(iv) Press the START button again to continue the
display scroll to the next 4 digits of the key
value.
(v) Continue step (iv) until all 16 digits of each key
has been displayed. Pressing START again will
scroll the data from the beginning again.

File: Erase_to_FFs
Manufacturer(s): Any.
This programming operation will erase the flash device to

all FFs (which is the normal erased state for flash
memory).

File: Erase_to_00s
Manufacturer(s): Any.
This programming operation will erase the flash device to

all 00s and is included in case it is needed for
experimentation.

File: EarlyToyota
table).
39

failed.

File: FJ_S93C66
table).

FJ Cruiser Above glove box.

failed.
Use the procedure described in Appendix A, section A.8.1

to register keys in the immobilizer.

File: SaabCIM03_09
Manufacturer(s): Saab (models specified in the following
table).

93 2003-2009 Behind steering wheel.
40
failed.
After programming is successfully completed a GM tech2

dealer programmer with online subscription is required for
key registration. Therefore it is recommended that the car
be towed to a dealer, the CEM be reflashed at the dealer,
then the dealer perform the key registration.

Not in use at this time.

File: id box 93C86b virgin
table).

failed.

File: 2010Camry
table).
41
Camry 2010

failed.

File: Smart_Key_proxy_IDbox
Manufacturer(s): Toyota and Lexus.
File is used to update the smart key proxy id box when it is

locked up.
4.1.35 Thumbwheel Setting 37 through 83

These thumbwheel selection options are not in use at this
time.
42
File: N/A
Device type: 24C16
Type of operation: PIN read
Manufacturer(s): Chevrolet (models specified in the
following table).
Model Year BCM Location

Cruze
This thumbwheel selection can be used to read the 4 digit

PIN for the vehicle(s) specified. To perform the PIN read
function use the procedure described in section 3.1. At the
end of the operation the display will display the 4 digits of
the PIN.

File: N/A
Device type: 93C66
Manufacturer(s): Fiat (models specified in the following
table).

Punto 2009
500

end of the operation the display will display the PIN
(scrolling display).
43
File: N/A
Device type: 93C66
Manufacturer(s): Saab (models specified in the following
table).

All

the PIN.

File: N/A
Device type: 93C56
Type of operation: Key read
Manufacturer(s): Toyota and Lexus (models specified in the
following table).

Same as Thumbwheel setting 05
This thumbwheel selection can be used to read the 3 keys

from the vehicle. The display will pause for ease of viewing
– use the START button to continue scrolling through the
digits.
44
File: N/A
Device type: 95040
Manufacturer(s): Dodge (models specified in the following
table).

Caravan

the PIN.

File: N/A
Device type: 95080
Manufacturer(s): Jeep (models specified in the following
table).

Liberty 2006 Steering column

the PIN.
45
File: N/A
Device type: 93C56
Manufacturer(s): 2005 Nissan (models specified in the
following table).

All 2005 Consult Tcode manual.

the PIN.

File: N/A
Device type: 93C66
Manufacturer(s): 2009 Nissan (models specified in the
following table).
46
Driver’s side, under
Altima 2009 and up
instrument panel.
Pathfinder 2009 and up
Frontier 2009 and up Driver’s side, under
steering column. Remove
XTerra 2009 and up
lower knee protector to
Armada 2009 and up access.
Titan 2009 and up
Under dashboard,
Rogue 2009 and up passenger side, near glove
box.
Driver’s side, behind
Murano 2009 and up
combination meter.
Near parking brake pedal
Quest 2009 and up
assembly.
Versa 2009 and up Behind glove box.
Sentra 2009 and up Behind glove box.
Under instrument panel,
Maxima 2009 and up attached to steering
member.
Driver’s side, adjacent to
350Z 2009 and up
fuse block.
Under dashboard,
370Z 2009 and up
passenger side.
Left driver’s side, under
Z12 2009 and up
instrument lower panel.
Under dashboard,
GT-R 2009 and up
passenger side.

the PIN.
47
File: N/A
Device type: 93C76 ?
Manufacturer(s): Volkswagen (VW) (models specified in the
following table).

In cluster, under dash
Beetle 2000 and up
board

the PIN.

File: N/A
Device type: 93LC46
Manufacturer(s): Isuzu (models specified in the following
table).
Model Year Immo\ECU\BCM Location

Axiom 2003 - 2005 Below steering column
Rodeo 2003 - 2005 Below steering column

the PIN.
48
File: N/A
Device type: 24LC02
Manufacturer(s): Chrysler (models specified in the following
table).

All Type 1 On steering column at
1998 and up
Chryslers ignition switch.

the PIN.
Important: One of the pads on the board must be

connected to GND before trying to program the board (refer
to photo in Appendix B).

File: Data from “Restore” Memory Block.
Flash device identifier: Depends on manufacturer
Manufacturer(s): Any
This thumbwheel setting is used to restore the contents of a

memory device to it’s value prior to programming.
Anytime the Penloader is used to program a device, it

reads the device and saves the contents into a “Restore”
memory block (contained in the Penloader) prior to
overwriting the device with new data. If there is a desire to
restore the original contents of the device after
programming, this can be achieved using thumbwheel
setting 95.
49
It is important to note that the contents of the “Restore”
Memory Block are overwritten with each subsequent
programming operation. Thus a function is also provided to
save the contents of the “Restore” memory bank to one of
the other 4 Memory Blocks provided (ref section 4.2.6).
(i) Set thumbwheel to 95.

(ii) Position the Penloader over the 8 pin memory
device.
(iii) Press the START button.
(iv) If successful, the original contents of the
memory device will be restored and the display
will indicate “OK”.
4.1.48 Thumbwheel Setting 96 through 97

These thumbwheel selection options are not in use.

Switch to THUMB 1.

This thumbwheel selection will display the serial number of
the Penloader, plus the voltage of either rechargeable
batteries, if an external dc supply is not connected to the
unit; else the voltage of the external dc supply.
To display these 2 parameters the thumbwheel switch
should be set to 99, and the START button pressed. The
unit will display a WAIT message, then continually scroll
through a message that shows the serial number and the
supply voltage.
50
4.2 THUMB 1 Settings
The following sections describe the operation of the
Penloader under the THUMB1 thumbwheel settings. To
invoke these thumbwheel settings, set the thumbwheel to
98 before powering on the Penloader. These settings are
only valid until the Penloader is powered off.
Anytime the Penloader is used to program a device, it

reads the device and saves the contents into a “Restore”
memory block (contained in the Penloader) prior to
overwriting the device with new data. If there is a desire to
restore the original contents of the device after
programming, this can be achieved using thumbwheel
setting 95 (ref section 4.1.47). It is important to note that the
contents of the “Restore” memory block are overwritten with
each subsequent programming operation. Thus functions
are provided to save the contents of the “Restore” memory
Block to one of the other 4 Memory Blocks provided.
The THUMB 1 settings include all of the save operations to

the Restore Memory, and the copy of the Restore Memory
to and from one of the onboard 4 memory blocks (0, 1, 2, or
3). Note that the write function to these memory blocks can
take a while, depending on the amount of data to be
written. In some instances, this save operation may take 30
seconds or more. In all cases audio cues are used to define
the end of the operation, and status is shown on the
display.

These thumbwheel settings are used to transfer the
contents of a memory block up to a computer. This
procedure is described in section 5.
Set thumbwheel to 01, 02, 03, or 04 depending on which

memory block (0, 1, 2, or 3) should source the data to be
sent to the computer.
51
These thumbwheel settings are used to transfer the
contents of a data file from a computer to a Memory Block.
This procedure is described in section 5.

Memory Block (0, 1, 2, or 3) the data received should be
saved to.

These thumbwheel settings are used to copy the data
saved in the Restore Memory Block to one of the four
permanent storage Memory Blocks (0, 1, 2, or 3).

Memory Block (0, 1, 2, or 3) the data should be saved to.

These thumbwheel settings are used to copy the data
saved in one of the four permanent storage Memory Blocks
(0, 1, 2, or 3) to the Restore Memory Block .

memory block (0, 1, 2, or 3) the data should be copies from.

These thumbwheel settings are used to read the contents
of an external 25LC series [SPI] device, and save the
contents to the Restore Memory Block.
Set thumbwheel to 16, 17, 18, 19 or 20 depending on the

device type to be read. To perform the read and save
function use the procedure described in section 3.1.
Display must display “OK” at the end of the procedure, else
the operation failed.
Note that the “LC” in the device part number is not

significant – devices may have variations on parts numbers
such as 25AA040, or 95C020.
52
Thumbwheel Setting Device
16 25LC010 or 95010
17 25LC020 or 95020
18 25LC040 or 95040
19 25LC080 or 95080
20 25LC160 or 95160

These thumbwheel settings are used to write the contents
of the Restore Memory Block to an external 25LC series
[SPI] device.

Note that the “LC” in the device part number is not

significant – devices may have variations on parts numbers
such as 25AA040, or 95C020.

21 25LC010 or 95010
22 25LC020 or 95020
23 25LC040 or 95040
24 25LC080 or 95080
25 25LC160 or 95160

These thumbwheel settings are used to read the contents
of an external 24C series [I2C] device, and save the

53
Note that the “C” in the device part number is not

significant. Some parts may use the “LC” or “AA”
alternatives.

26 24C01
27 24C02
28 24C04
29 24C08
30 24C16
These thumbwheel settings are used to write the contents

of the Restore Memory Block to an external 24C series
[SPI] device.


significant. Some parts may use the “LC” or “AA”
alternatives.

31 24C01
32 24C02
33 24C04
34 24C08
35 24C16
54
This thumbwheel setting is used to read the contents of an
external 93C series [Microwire] device, and save the
It is not necessary to select the actual 93C series device

type as the Penloader will determine which type it is
reading from. To perform the read and save function use
the procedure described in section 3.1. Display must
display “OK” at the end of the procedure, else the operation
failed.

significant. Some parts may use the “LC” alternative.

This thumbwheel selection will display the serial number of
the Penloader, plus the voltage of either rechargeable
batteries, if an external dc supply is not connected to the
unit; else the voltage of the external dc supply.
To display these 2 parameters the thumbwheel switch
should be set to 99, and the START button pressed. The
unit will display a WAIT message, then continually scroll
through a message that shows the serial number and the
supply voltage.
55
5 Uploading/Downloading Serial Data
5.1 Introduction
The Penloader can save up to four data files, sourced from

external memory devices, in onboard flash memory, with a
maximum file size of 2048 bytes (corresponding to the
largest anticipated memory devices that it will be required
to function with – 93C86 microwire devices, and 24C16 I2C
devices). The data files are stored in one of 4 memory
blocks, numbered 0 through 3.
Included in the Penloader is the capability to both send any

of these 4 memory blocks up to an external computer; and
to receive a text file containing data and save it to one of
the 4 memory blocks (with some limitations).
The send/receive capability is designed to work with

standard off-the-shelf terminal emulator programs such as
Microsoft’s Hyper-Terminal (usually included with the
Windows operating system), and TeraTerm from Ayera
Technologies. Other terminal emulators may be used if they
contain the capability to send and receive files using the
Xmodem protocol.
Hyper Terminal can be found on a Windows computer

under:
Start-->All Programs-->Accessories-->Communications
TeraTerm ver 3.1.3 can be downloaded for free from:
http://www.ayera.com/teraterm/
Other versions have not been tested, but should function

correctly with the Penloader.
56
It is also important that the computer to be used to
communicate with the Penloader, has a working serial port.
Many laptops do not include serial ports any longer. In this
case the user will need to use a USB to serial adapter to
provide the serial interface function. These can be
purchased through a variety of vendors such as Office
Depot, Staples, Best Buy, Amazon.com, Frys, etc…
5.2 General Setup

5.2.1 Terminal Emulation Software
The following procedures can be used to setup the terminal
emulation programs the first time that they are used.
5.2.1.1 Hyper Terminal

Start Hyper Terminal by going to Start-->All Programs--
>Accessories-->Communications and selecting it with the
left mouse button. A window should appear that looks like:
57
Enter a name for the connection, and select an appropriate
icon, then click on the OK button. Another window will pop
up that looks like:
58
Select the COM port available on the computer, and click
on the OK button (Note: the area code and phone number
fields are not required once a COM port has been specified.
These fields should be ignored). A further window will pop
up, as shown below. Select the options a shown (38400, 8,
None, 1, None), click on the Apply button, then the OK
button.
59
The main Hyper Terminal screen should now appear. It is
recommended that the settings just entered be saved, so
that they may be used again without having to go through
the setup procedure. To save the settings, click on File
from the menu options along the top of the Hyper Terminal
window, then click on Save As from the drop down menu.
As this action will actually save a short cut to Hyper
Terminal, it is recommended that the user select the
Desktop and an appropriate name as shown in the
following screen shot.
60
Hyper Terminal is now ready to use. Before closing Hyper
Terminal it is recommend that the program be disconnected
from the COM port in use. To do this click on Call from the
menu options along the top of the Hyper Terminal window,
then click on Disconnect from the drop down menu.
Each time that Hyper Terminal is started by double clicking

on the saved short cut on the Desktop, it will automatically
connect to the COM port specified.
5.2.1.2 Tera Term
Once Tera Term has been downloaded and installed, it will

be necessary to setup the serial communications
parameters. Before working on this it is easiest if a short cut
to Tera Term is created on the computer’s Desktop. To do
this, locate the executable file (named something like
ttermpro.exe) in the installation folder (named something
like C:\TeraTermPro\ttpro313, but may be in a subfolder
61
under C: if one was selected during the unzip process),
right click on the executable file and drag it to the Desktop.
Once dragged to the desktop, release the right mouse
button and a drop down menu will appear. Select Create
Shortcuts Here from this menu and a shortcut will appear
on the Desktop.
Double click on the shortcut to start Tera Term. A popup

window will appear as shown below.
Select the Serial option as shown, then select the COM port
available on the computer, and click on the OK button. It is
now necessary to setup the COM ports parameters. Select
Setup from the menu options along the top of the Tera
Term window, then click on Serial Port from the drop down
menu. Another window will pop up as shown.
62
Select the options as shown (except for the COM port
which was selected in the last step, and should match what
is shown on this screen), and click on the OK button.
Tera Term is now setup for use with the Penloader. It is

recommended that the settings be saved for future use. To
save these settings select Setup from the menu options
along the top of the Tera Term window, then click on Save
Setup from the drop down menu. Name the setup file
Penloader.ini and select a folder that you will remember,
then click on the Save button. Tera Term does not
automatically restore the saved parameters.
To restore the saved setup next time Tera Term is started,

select Setup from the menu options along the top of the
Tera Term window, then click on Restore Setup from the
drop down menu. Navigate to the folder that the file
Penloader.ini was saved in, select the file and click on the
Open button.
63
5.2.2 Connecting the Serial Cable
Before any data can be moved between the Penloader and
a computer, a serial cable must be connected between the
2 devices.
To connect a serial cable to the Penloader, the

programming head must be removed and replaced with a
serial cable head. To remove the programming head gently
pull the head away from the end of the tube.
Once removed, the serial cable head can be installed. To

install the new head, align the 2 holes in the bottom of the
head with the 2 alignment pins on the bottom of the
Penloader. Note that the 2 alignment pins are not
symmetrically positioned with respect to the end of the
Penloader tube – ensure correct orientation of the new
head with respect to the Penloader tube.
A standard 9 pin “D” serial cable can now be plugged into

the end of the 9 pin female “D” connector on the end of the
Penloader, and the other end of the serial cable plugged
into the 9 pin male “D” connector in the computer (or USB
to serial adapter cable).
64
5.3 Transferring Memory Blocks Between
The Penloader and the Computer
All data transfers between the Penloader and a computer

use the standard Xmodem protocol. For this reason it is
necessary to sequence the transfer differently depending
on which direction data is to be transferred. The following
paragraphs describe the sequence to be followed to
perform the data transfer. Important: Penloader must be
connected to the computer (as described in section 5.2.2)
before sequencing through the following paragraphs.
5.3.1 Using Hyper Terminal to send Memory

Blocks from the Penloader to the
computer
Penloader: Set thumbwheel to 98, then power up

Penloader and wait for thumbwheel number to scroll by.
Penloader: Change thumbwheel to the correct setting for

sending the desired Memory Block, then press the Start
button. The following table specifies the thumbwheel
settings for each memory block:
Memory
Thumbwheel Penloader Display
Block
-00- Send Mem block 0 to
00 0
computer
01 1
computer
02 2
computer
03 3
computer
Hyper term: Select Transfer from the menu options along

the top of the Hyper Terminal window, then click on
65
Receive File from the drop down menu. The following
window will pop up:
Hyper term: Select the Xmodem protocol (important – do

not select the 1K Xmodem protocol option), and also a
folder where the file should be saved. Click on the Receive
button and another window will pop up, as shown below.
Hyper term: Enter a filename in the field provided and click

on the OK button. The following window appears.
66
If the file transfer is successful, the above window will
disappear, leaving only the original Hyper Terminal start up
window, and the Penloader will display OK along with
providing an audio cue. If the file transfer is not successful,
the Penloader will display FAIL.
5.3.2 Using Tera Term to send Memory Blocks

from the Penloader to the Computer


sending the desired Memory Block, then press the Start
button. The following table specifies the thumbwheel
settings for each Memory Block:
67
Memory
Block
00 0
computer
01 1
computer
02 2
computer
03 3
computer
Tera Term: Select File from the menu options along the
top of the Tera Term window, then click on Transfer from
the drop down menu, followed by clicking on the Xmodem
option, and finally select the Receive option. The following
window will pop up:
68
Tera Term: Enter the filename for the file to be used to
save the received Memory Block data, and verify that the
Binary option is not selected, and that the CRC option is
selected. Then click on the Open button. The following
window will pop up and the data transfer will start
immediately.
If the file transfer is successful, the above window will

disappear, leaving only the original Tera Term start up
window, and the Penloader will display OK along with
providing an audio cue. If the file transfer is not successful,
the Penloader will display FAIL.
5.3.3 Using Hyper Terminal to send Memory

Blocks from the computer to the
Penloader


receiving and saving the desired Memory Block. Do NOT
press the Start button yet. The following table specifies the
thumbwheel settings for each memory block:
69
Memory
Block
-04- Receive data from
04 0 computer and save in Mem
block 0
block 1
block 2
block 3
Hyper term: Select Transfer from the menu options along

the top of the Hyper Terminal window, then click on Send
File from the drop down menu. The following window will
pop up:
Hyper term: Select the Xmodem protocol (important – do

not select the 1K Xmodem protocol option), and also the
name of the file containing the Memory Block data (using
the Browse button). When done, click on the Send button.
The following window will appear:
70
Penloader: Press the Start button. The file transfer should
start and the Penloader should display “RCVE”, while also
making a ticking sound.
When the file transfer has completed, the above Hyper

Terminal window will disappear, leaving only the original
Hyper Terminal start up window.
The Penloader takes a little longer to complete the

operation as it must save the transferred data into the
onboard Memory Block. When the Penloader operation
completes, it will display OK if the operation was
successful, and also provide an audio cue. If the file
transfer is not successful, the Penloader will display FAIL.
71
5.3.4 Using Tera Term to send Memory Blocks
from the computer to the Penloader

receiving and saving the desired Memory Block. Do NOT
press the Start button yet. The following table specifies the
thumbwheel settings for each memory block:
Memory
Block
block 0
block 1
block 2
block 3
Tera Term: Select File from the menu options along the
top of the Tera Term window, then click on Transfer from
the drop down menu, followed by clicking on the Xmodem
option, and finally select the Send option. The following
window will pop up:
72
Tera Term: Select the file containing the Memory Block
data, and verify that the CRC option is selected. Then click
on the Open button. The following window will pop up and
the data transfer will start immediately.
Penloader: Press the Start button. The file transfer should

start and the Penloader should display “RCVE”, while also
making a ticking sound.
73
When the file transfer has completed. The above Tera
Term window will disappear, leaving only the original Tera
Term start up window.
The Penloader takes a little longer to complete the

operation as it must save the transferred data into the
onboard Memory Block. When the Penloader operation
completes, it will display OK if the operation was
successful, and also provide an audio cue. If the file
transfer is not successful, the Penloader will display FAIL.
5.4 Troubleshooting
Penloader Issues:
Issue: Penloader doesn’t display the “-00- Send Mem block

# to computer”, or the “-03- Receive data from computer
and save” message.
Response: Penloader must be powered up with

thumbwheels set to 98 for this option to work correctly.
Powering up the Penloader with the thumbwheels set to 98
results in an alternate set of functions being allocated to the
thumbwheel settings.
Issue: Penloader appears to hang during the data transfer.
Response: 2 possibilities. First possibility is that a data

error occurred during the transfer, and the data transfer has
crashed. The second possibility is that the procedures
outlined in this document were not followed correctly, and
the data transfer has not started. It is important that the
sequence of Penloader button presses, and terminal
emulation program option selections, is done in the correct
order, else the computer and Penloader will not
synchronize correctly. If the Penloader hangs during the
data transfer, it must be power cycled.
74
Terminal Emulator Issues:
Issue: The terminal emulator data transfer window closes

but the data transfer did not complete.
Response: Most of the data transfer operations within a

terminal emulator contain a time out function, which will
stop the attempted data transfer and close the transfer
information window should the data transfer take an
abnormally long time. This should not happen unless (i) the
data transfer has crashed, or (ii) the user is taking too long
to dial through the Penloader selections.
General Issues:
Issue: No data is transferred between the Penloader and

the computer even though the instructions have been
exactly followed.
Response: Most likely problem is the serial cable, or the

COM port selection. The serial cable used should be a
standard cable with a 9 pin D male connector at one end,
and a 9 pin D female connector at the other. It should NOT
include a null modem function.
To verify that the serial cable is working, connect the

Penloader to the computer and start up the terminal
emulator (Hyper Terminal or Tera Term). If using Tera
Term, be sure to restore the setup file that contains the
serial settings. Set the thumbwheel on the Penloader to 98
and power up the Penloader. Set the thumbwheel to 03 and
press the Start button (to start receiving data for memory
block 0 from the computer). If the serial cable is working
correctly, a single uppercase letter “C” should appear in the
terminal emulator screen.
It is also possible that the incorrect COM port has been

selected. On the Windows computer start up the Control
Panel (usually found under the START menu) and double
click on the “System” icon. This will pop up the System
75
Window. Select the Hardware tab, then click on the Device
Manager button. Find the line in the window labeled as
“Ports (COM & LPT)” and click on the plus sign next to this
text. This will expand the line and display all of the working
COM ports on the computer. These are the only COM port
numbers that can be selected to function with the terminal
emulator. If using a USB to serial adapter, this screen will
confirm the COM port number allocated to the adapter.
Special note for Tera Term users – Tera Term defaults to

only accepting COM numbers 1, 2, 3 and 4, which can be a
problem if using a USB to serial adapter, as these are often
allocated to higher COM port numbers. To fix this, use
Windows Explorer or My Computer to display the folder that
Tera Term was unzipped to. In the folder there should be a
file called “teraterm.ini”. Open the file with WordPad or
Notepad and search for the word “MaxComPort”. This
should find a line of text which reads:
MaxComPort=4
Edit this line to read:
MaxComPort=16
And save the file. Restart Tera Term and more COM port
numbers should be available now.
Important:
If the data transfer crashes, hangs, or does not complete,

the operation must be cancelled on the computer (if it
hasn’t already timed out) AND the Penloader should be
powered off. Then the procedure should be started from the
beginning. This is the only assured method of clearing
errors, and retrying a transfer of data.
76
5.5 Data File
The Memory Block data transferred from the Penloader will

be saved into a text file on the computer. This text file can
be edited with any standard text editor (Notepad, Wordpad,
Microsoft Word), however if the file is to be updated and
transferred back to the Penloader it is important that the
basic structure of the file not be changed. The file should
NOT be opened with a binary hex editor – the Penloader
compatible format is text only.
An example of the contents of a file containing 256 bytes of

data transferred up from the computer, is shown below.
A5 01 02 03 04 05 06 E2 FE 09 0A 0B 0C 0D 0E 0F
10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F
30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F
40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F
50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F
60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F
70 71 72 73 74 10 36 77 78 79 7A 7B 7C 7D 7E 7F
80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F
90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F
A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF
B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 BA BB BC BD BE BF
C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF
D0 D1 D2 D3 D4 D5 D6 D7 D8 D9 DA DB DC DD DE DF
E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 EA EB EC ED EE EF
F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE 5A
*My special custom hotrod file*
Each byte of data is shown using hexadecimal (or hex)

representation. The Penloader performs the task of
translating between text and binary forms. When receiving
data from the computer, it parses each byte according to
the following rules:
- Each byte (2 hex characters) must be separated by

at least one space character, or a carriage
return(CR)/line feed(LF) pair indicating end of line.
77
There is no limit to the number of spaces, or CR/LF
combinations used between bytes.
- A byte is identified by 2 hex characters. A hex

character is a character between “0” and “9”, “A”
and “F”, or “a” and “f”.
- Any character not identified as a hex character, a

space character, or CR/LF combination, is ignored.
It is thus possible, but not recommended, to insert
other characters within the file, as they will be
ignored.
- For readability it is recommended that 16

consecutive bytes be shown on one line, however
this is not a requirement.
- Data bytes must be shown in a consecutive order,

from lowest address to highest address, as read
from left to right on a line, and top to bottom for
consecutive lines.
- At the end of the data, it is permissible to include a

short comment field, delineated by the “*” character.
This comment field will appear on the Penloader
display when the thumbwheel is used to select one
of the memory blocks as the source of data for a
programming operation (thumbwheel options 00, 01,
02 or 03 under the regular thumbwheel settings).
- Comment field may only be placed after the data

field.
- The comment field should not exceed 60 characters.
78
APPENDIX A
Toyota/Lexus Post Programming

Procedures
79
A.1 Procedure to be followed for the following vehicles:
Make Model Year Remark

4Runner 1999-2002
Avalon 1998-2003
1998-2002
Camry 4 cylinder
2001-2003
engine
Highlander 2001-2003
Toyota
LandCruiser 1998-2002
MR2 2000-2003
RAV4 2000-2003
Sequoia 2001-2002
Sienna 1998-2003
Solara 1999-2003
ES300 1998-2003
GS300 1998-2003
GS400 1998-2000
GS430 2001-2003
IS300 2001-2003
Lexus
LS400 1998-2000
LX470 1998-2002
RX300 1999-2003
SC300 1998-2000
SC400 1998-2000
A.1.1 To register Keys in a new ECU:

a. ECU is in Automatic Registration mode, and the
Security light should be blinking.
b. Insert a key into the ignition switch (do not turn
ignition on). The Security light should now be on
(not blinking).
c. The key is now registered.
d. Remove key from the ignition switch.
e. Repeat steps b through e if more keys are to be
registered.
f. Once all keys are registered, remove last key from
the ignition switch, then depress and release the
brake pedal once.
g. Programming mode completes after 10 seconds.
80
Note: The first key registered will be the new Master
Key. The last key registered will be the Valet key. If only
1 key is to be registered, cycle the single key through
the registration process 4 or 5 times.
A.1.2 To register an additional Master Key:

a. Insert a registered Master key into the ignition
switch (do not turn ignition on).
b. Depress and release the gas pedal 5 times.
c. Depress and release the brake pedal 6 times.
d. Remove the Master key from the ignition switch.
e. Insert new key to be registered into the ignition
f. Depress the gas pedal once.
g. Wait approximately 1 minute until the security light
stops blinking.
h. Remove the key.
i. Depress and release the brake pedal once.
j. Programming mode completes after 10 seconds.
A.1.3 To register an additional Valet Key:

stops blinking.
h. Remove the key.
A.1.4 To delete all other existing keys:

81
stops blinking.
h. Remove the key.

Toyota Sequoia 2003
LS430 2001-2003
Lexus
SC430 2002-2003
A.2.1 To register an additional Master or Valet Key:

a. Ensure there is no key in the ignition.
b. While sitting in driver’s seat, close all vehicle doors,
but do not lock them.
c. Insert a registered Master key into the ignition
switch.
d. Turn ignition switch ON then OFF 5 times.
e. Open, then close, the driver’s door 6 times. This
must be completed within 35 seconds of finishing
the previous step (item d above).
f. Remove the Master key from the ignition switch.
g. Insert new key to be registered into the ignition
switch (do not turn ignition on). This must be
completed within 10 seconds of removing the
Master key.
h. Wait approximately 60 seconds until the Theft light
goes out.
i. Remove the key.
j. Programming mode is complete.

82
b. While sitting in drivers seat, close all vehicle doors,
switch.
d. Turn ignition switch ON then OFF 6 times.
e. Open, then close, the driver’s door 7 times. This
must be completed within 35 seconds of finishing
the previous step (item d above).
g. The Master key is the only key now programmed
into the ECU.

Lexus LS400 1997
A.3.1 To register a new Master Key after installing a new

ECU:
a. While sitting in driver’s seat, close all vehicle doors,

b. Insert a working "Master" key into the ignition
switch.
c. Turn ignition switch ON then OFF.
d. Remove key from ignition switch.
e. Open, then close, the driver’s door. Programming
mode is complete.
A.3.2 To register an additional Master Key:

c. Insert a working "Master" key in the ignition and turn
lock to On 5 times.
d. Open and shut the driver door 6 times.
e. Remove the "Master key from the ignition.
83
f. Insert the new in-programmed key in the ignition to
the ON position for a few minutes until the security
light goes out.
g. Remove the key, open and shut the driver door
once. The key is now programmed as a master.
A.3.3 To register an additional Valet Key:

b. While sitting in drivers seat, close all vehicle doors,
switch.
d. Turn ignition switch ON then OFF 4 times leaving
the ignition switch in the ON position on the 4th
cycle. This operation must be completed within 15
seconds of inserting the key into the ignition switch.
e. Open, then close, the driver’s door within 15
seconds of starting step d (timing starts when
Master key was inserted into the ignition switch).
f. Open, then close, the driver’s door 4 times. This
must be completed within 20 seconds of closing the
door in the previous step (item e above).
g. Remove the Master key from the ignition switch.
This must be completed within 20 seconds of
closing the door in step e above.
h. Insert new key to be registered into the ignition
switch. This must be completed within 10 seconds
of removing the Master key.
i. Turn ignition switch ON. This must be completed
within 10 seconds of inserting the key into the
ignition switch.
j. Wait at least 60 seconds, then turn ignition switch
OFF and remove key.
k. Key is now registered in ECU.
l. Another key may be registered if it is inserted into
the ignition switch within 10 seconds or removing
the previous key, and repeating steps i through k.
m. Open, then close, the driver’s door. Programming
mode is complete.
84
switch.
d. Turn ignition switch ON then OFF 6 times leaving
the ignition switch in the ON position on the 6th
cycle. This operation must be completed within 15
seconds of inserting the key into the ignition switch.
e. Open, then close, the driver’s door within 15
seconds of starting step d (timing starts when
Master key was inserted into the ignition switch).
f. Open, then close, the driver’s door 6 times. This
must be completed within 20 seconds of closing the
door in the previous step (item e above).
g. Remove the Master key from the ignition switch.
This must be completed within 20 seconds of
closing the door in step e above.
h. Open, then close, the driver’s door. Programming
mode is complete.

Toyota Prius 2001-2003
A.4.1 To register Keys in a new ECU:

c. Insert first new Master key into the ignition switch.
d. Wait 5 seconds, then remove key from ignition
switch.
e. Insert second new Master key into the ignition
switch.
f. Wait 5 seconds, then remove key from ignition
switch.
g. Insert new Valet key into the ignition switch.
85
h. Wait 5 seconds, then remove key from ignition
switch.
i. All 3 keys should now turn off the theft light, but will
no start the vehicle.
j. Insert a Master Key into the ignition switch, and turn
ignition switch on.
a. Short OBD2 connector terminal 4 to terminal 13
using a wire or paper clip.
i. Wait 30 minutes, then turn ignition switch off and
remove shorting wire from OBD2. Programming
mode is complete. Vehicle should now start with any
of the 3 keys.
A.4.2 To register an additional Master or Valet Key:

switch.
d. Quickly turn ignition switch ON then OFF 5 times.
e. Quickly open, then close, the driver’s door 6 times.
g. Insert new key to be registered into the ignition
switch (do not turn ignition on). This must be
completed within 10 seconds of removing the
Master key.
h. Leave key in the ignition switch for a minimum of 60
seconds, until the Theft light goes out.
i. Remove the key from the ignition switch.
j. Key is now registered in ECU.

GX470 2003 - 2004
LS430 2001-2003
Lexus
LX470 2003 - 2004
SC430 2002-2003
C.5.1 To register Keys in a new Immobilizer:
86
a. Theft light should be on indicating that the
immobilzer is in Auto learn mode.
b. Insert first Master key (4D with an id of 32, 52 or b)
into the ignition switch. Theft light will blink once
then remain on.
c. Remove key from ignition switch.
d. Repeat steps b and c for the remaining 3 keys. Last
key registered is the Valet key (4D with an id of 72
or 92).
e. Removing fourth key closes Auto learn mode.
f. Once Auto learn mode is closed the Immobilizer
must be resynchronized with the ECU, else vehicle
will not start. Insert a Master Key into the ignition
switch, and turn ignition switch on (do not try to start
the vehicle).
g. Short OBD2 connector terminal 4 to terminal 13
h. Wait for 30 minutes.
i. Remove shorting wire from OBD2 connector.
j. Turn ignition switch off and remove key.
k. Reinsert key and verify that vehicle can now be
started.
Notes: Up to 4 keys may be registered. If less than 4 keys

are registered, Auto learn mode must be closed manually.
To close Auto learn mode, turn ignition switch on, then off,
5 times within a 10 second period, then remove the key
from the ignition switch.
Theft light blinking two long blinks, and one short blink,
indicates that Auto learn mode failed.
Theft light blinking two short blinks, and two long blinks,
indicates that a key that has already been registered, was
registered a second time.
87

Toyota Sequoia 2003
Toyota Camry 2001 - 2004
Toyota Solara 2003 - 2004
Lexus LS430 2004
Lexus ES330 2004
VIN starts with
Lexus RX330 2004
J or 2
A.6.1 To register 3 Keys (2 Master, 1 Valet) in a new

Immobilizer:
c. Insert first Master key into the ignition switch and
wait 5 seconds.
d. Remove key and insert second Master key into the
ignition switch and wait 5 seconds.
e. Remove key and insert Valet key into the ignition
switch and wait 5 seconds.
f. Remove key.
l. The Immobilizer must be resynchronized with the
ECU, else vehicle will not start. Insert a Master Key
into the ignition switch, and turn ignition switch on
(do not try to start the vehicle).
m. Short OBD2 connector terminal 4 to terminal 13
n. Wait for 30 minutes.
o. Remove shorting wire from OBD2 connector.
p. Turn ignition switch off and remove key.
q. Reinsert key and verify that vehicle can now be
started.
To register less than 3 Keys in a new Immobilizer:

88
c. Insert first Master key into the ignition switch and
wait 5 seconds.
d. Remove key. If required, insert a second key into
the ignition switch, wait 5 seconds then remove key.
e. Insert first Master key into the ignition switch.
f. Quickly turn ignition switch ON then OFF 5 times.
g. Remove key.
h. The Immobilizer must be resynchronized with the
ECU, else vehicle will not start. Insert a Master Key
into the ignition switch, and turn ignition switch on
(do not try to start the vehicle).
i. Short OBD2 connector terminal 4 to terminal 13
j. Wait for 30 minutes.
k. Remove shorting wire from OBD2 connector.
l. Turn ignition switch off and remove key.
m. Reinsert key and verify that vehicle can now be
started.

4Runner 2003
Camry 2003 V6 Engine
Toyota
LandCruiser 2003
Sienna 2004
A.7.1 To register Keys in a new Immobilizer:

a. Theft light should be on indicating that the
immobilzer is in Auto learn mode.
b. Insert first Master key (4D with an id of 32, 52 or b)
into the ignition switch. Theft light will blink once
then remain on.
c. Remove key from ignition switch.
d. Repeat steps b and c for the remaining 3 keys. Last
key registered is the Valet key (4D with an id of 72
or 92).
e. Removing fourth key closes Auto learn mode.
f. Once Auto learn mode is closed the Immobilizer
must be resynchronized with the ECU, else vehicle
will not start. Insert a Master Key into the ignition
89
switch, and turn ignition switch on (do not try to start
the vehicle).
g. Short OBD2 connector terminal 4 to terminal 13
h. Wait for 30 minutes.
i. Remove shorting wire from OBD2 connector.
j. Turn ignition switch off and remove key.
k. Reinsert key and verify that vehicle can now be
started.
Notes: Up to 4 keys may be registered. If less than 4 keys

are registered, Auto learn mode must be closed manually.
To close Auto learn mode, turn ignition switch on, then off,
5 times within a 10 second period, step on the brake, then
remove the key from the ignition switch.
Theft light blinking two long blinks, and one short blink,
indicates that Auto learn mode failed.
Theft light blinking two short blinks, and two long blinks,
indicates that a key that has already been registered, was
registered a second time.

Saab 2003-2009
A.8.1 To register Keys in the Immobilizer – use AD t-code

Pro or MV Pro:
a. Go to type 5 under immo. section with key in the
"on" position.
b. Next menu you will see "Learn Key".
c. After that has been completed key has been
registered. Car will not start until the immo is
married to the ECU.
d. Use the black dongle provided in the kit to marry
system.
e. Turn key to "ON" and install the black dongle to the
data port "OBDII".
90
APPENDIX B
User Manual – Circuit Board Photos
91
Penloader kit
92
Attachment of Pomona clip to Penloader
Correct installation of extension cables to

Pomona clip
93
Circuit Board from 34010 module
94
Chrysler (Type 1) PIN read
95
Chrysler (Type 1) – circuit board pad to
ground before reading PIN
96
97
98
Circuit Board from AA010 module
99
Toyota-Lexus 16bit ECU circuit board
100
Penloader installed on Toyota-Lexus 16bit
ECU circuit board
101
Penloader installed on Nissan 09 BCM
circuit board
102
Pomona clip installed on Nissan 09 BCM
circuit board
103
2003 and later Sequoia immobilizer location
behind instrument cluster.
104

User Manual: Penloader Tool

Uploaded by

Copyright:

Available Formats

User Manual: Penloader Tool

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

User Manual: Penloader Tool

Uploaded by

Copyright:

Available Formats

PENLOADER TOOL

Thumbwheel Setting Penloader Operation

3.1 General Operation 9

3.2 Visual and Audible Cues 13

3.3 Memory Blocks 15

3.4 Restore Original Contents 15

3.5 THUMB 1 Settings 16

4 THUMBWHEEL SELECTIONS IN DETAIL 20

4.1 General Operation 20

4.2 THUMB 1 Settings 51

5 UPLOADING/DOWNLOADING SERIAL DATA 56

5.1 Introduction 56

5.2 General Setup 57

5.3 Transferring Memory Blocks Between The

5.4 Troubleshooting 74

5.5 Data File 77

Features of the tool are:

 Small sized unit for hand held use

Figure 1 – Penloader Unit

7 12V dc input connector

3.1 General Operation

(i) Remove module containing memory device to

00 Write using data from Memory Block 0

01 Write using data from Memory Block 1

02 Write using data from Memory Block 2

03 Write using data from Memory Block 3

04 Displays 2 keys for use with thumbwheel setting

05 Lexus or Toyota 3 key file program

06 Lexus or Toyota - 16bit file program

07 Lexus or Toyota - 32bit file program

08 Toyota Prius - 47010 file program

09 Toyota Sequoia - 34010 file program

10 Lexus LS400 - 50020 file program

11 Lexus GX470 - 60330 file program

12 Lexus LX470 - 60230 file program

13 Lexus ES330 - 33110 file program

14 Toyota Camry – aa010 file program

15 Toyota 4runner - 35090 file program

16 Toyota Landcruiser - 60220 file program

17 Toyota Sienna - 08010 file program

18 Lexus LS430 - 50050 file program

20 Lexus RX330 - 0e010 file program

21 Toyota Prius - 47020 file program

22 Lexus LS430 - 50030 file program

23 Lexus LS430 - 50031 file program

24 Lexus SC430 - 24020 file program

25 Lexus or Toyota - nontrans file program

26 Honda Red/Black keys program

27 Displays 2 keys for use with thumbwheel setting

28 Erase device to all FF

29 Erase device to all 00

30 Toyota – EarlyToyota file program

31 Toyota FJ Cruiser - FJ_S93C66 file program

32 Saab CIM- SaabCIM03_09 file program

34 Toyota - id box 93C86b virgin file program

35 Toyota Camry - 2010Camry file program

36 Toyota - iSmart_Key_proxy_IDbox file

84 Chevrolet Cruze PIN read

85 Fiat Punto/500 PIN read