ECU Programmer

How Does Xtool X100 PAD2 Read Security Code For Citroen C-Quatre 2009

X-100 PAD2 is a dealer level key programmer. It provides customers with professional key programming and some special functions. This article records how uobdii engineers use X100 PAD2 to read security code for Citroen.

Vehicle model: Citroen C-Quarte 2009

Device: XTOOL X100 PAD2 Special Functions Expert

Here is detailed steps:

X100 PAD2 user manual:

Connect to vehicle directly with cable (picture shown below)


Go to the main menu and click the icon


Then select [DITROEN]


Choose [Read Security Code]


Then switch ignition off and press OK to continue


After press OK, switch on ignition immediately


It is reading password


Switch ignition off and press OK


Follow the prompts

-press OK, switch on ignition

-Switch ignition off, press OK for several times

Finally the security code read successfully!


In the final step, be patient!

Read Security Code function is just a small part of XTOOL X100 PAD2 FROM, if you want to learn more about this tablet key programmer,

Ktag flashes Marelli IAW 6LP from Citroen C5 2008

This is IAW 6LPB Magneti Marelli Bench Flashing with a Ktag master ecu programmer in Boot Mode.

Citroen MB SD Connect C5 bench flashing – STF10280 boot mode


Disassemble the ECU

24-2 24-3 24-4 24-5 24-6

Run Ktag kusite software

Select the model


Manufacturer: Citroen

Model: C5 (II)

Version: 2000 16v

Type: RFJ (EW10A)

KW: 103

HP: 140

Fuel: Petrol

MY: 2008

ECU Chip Tuning: Magneti Marelli IAW 6LP


FAM: 45

CHK: √

RO: √

Connection instruction



24-10 24-11 24-12 24-13

So, the connection mode of Magneti Marelli IAW 6LPB is like what displayed in the Galletto Manual Type B, but use K TAG BOOT PIN connection

24-14 24-15 24-16 24-17

Connected to CAN High and CAN Low, but CAN protocol not woek

Connect ed through K Line

24-18 24-19 24-20

K-Tag is reading Marelli IAW 6LP1.49 PSA

24-21 24-22


Ktag master reads Marelli successfully

Save ECU data

Exit Ktag Ksuite software.

KtagKess unlock CRP3 LPC2478 via J-link (Pinouts attached)

As you know, for crp3 we can do the trick for unlock crp3 heating on KTAG or KESS V2 programmer or buy a new NXP and write it (only one time)
Here are some questions & answers on Google form, questions about “how will you use J-ink if its crp3 ?”…

Q: Can I update NXP directly if at this moment I have Ktag 6.070? Or I will need to replace it with new one and then to update to 7.030 ?
A: if your actual fw is crp3 you will have to do “heating trick ” or change nxp, you will know if jlink doesn’t recognise firmware ( i think message about cannot find cpu chain or something like that) , simple

Q: More information this real version or china version? and whats this you can update or or only talk?? thanks
A: this is fw 7.030 we are talking about REAL firmware, not modding number in sw or similar, about second question i don’t understand what you ask.

Q: Need connect 12v ? my led red always off if not connect 12v

A: LED needs to monitor the state of the processor and it must be switched by the controller. If you do not have the power on the controller when connected by USB, then connect the other power source.

Q: How work on ktag ECU Chip Tuning, i tried but led already on

A: LED need to monitor the state of the processor and it must be switched by the controller. If you do not have the power on the controller when connected by USB, then connect the other power source.
To flash the LPC2478 via J-link, the level of protection should be CRP0, ie protection should be disabled. If security levels CRP1 and CRP2 have the ability to erase and reflash LPC2478 via UART, eg via USB to UART TTL adapter ftdi232 or cp2102 and Flashmagic program.

Q: LPC2478 connect Flash Magic, KESS or KTAG?

A: …KESS V2 & KTAG…both ok

Note: not all ktag 5.001 can be read with j-link
some are crp3 protected
some are not

Attachment 2: Here are all pinouts

A method of disabling the protection CRP3 microcontroller LPC2478…. make a photo high resolution of connection on pcb of that wire…and also,what pin you must to touch on nxp



K-Tag pins.


Attachment 3: Photos ofLPC2478 connect Flash Magic

It allows you to erase the NXP MCUs on both Kess & KTag via UART0. This will work for firmwares up to CRP2. CRP0, best off using J-Link as it only takes 30s as opposed to 30 minutes. If you’ve blocked your KTag properly (CRP3), it won’t help you. You will need to swap the processor.

Kess V2 connection method 1:


Kess V2 connection method 2:


KTag connection:


Disclaimer: Photography of Pinouts is not mine. I am not responsible for a bad use.