EVA2 & MLA High-Security Key Programming: How Lock50 HW04-C & C+ Solve Armed Mode on 2022+ Range Rover, Sport & Defender Without Module Swaps

Monday, November 2, 2026
by Lock50 JLR Key Tools
Technical Guide • Live Event • New Hardware Launch

EVA2 & MLA High-Security Key Programming: How Lock50 HW04-C & C+ Solve Armed Mode on 2022+ Range Rover, Sport & Defender — Plus London Trade Show Announcements, Live 2026 Sport Challenge & HW29/HW30 Launch

An authoritative technical breakdown of JLR's modern Modular Longitudinal Architecture (MLA), EVA2 High-Security SyncB tokens, TCU Phase 4+ tethering, and why Lock50 HW04-C / HW04-C+ with SW36 is the only non-invasive solution that eliminates multi-thousand-pound dealer module replacements. Join Lock50 live this month at MECHANEX Sandown Park (London) for exclusive show offers, a live 2026 Range Rover Sport 30-second picking demonstration and Serious Locksmith Challenge (£5,000 HW04 voucher), and the world launch of the new HW29 & HW30 auto-locking keys!

Live In London This Month Join Lock50 at MECHANEX Sandown Park — 10–11 November 2026

Lock50 is heading to Greater London this month for the premier automotive trade event: MECHANEX Sandown Park 2026. Meet the Lock50 engineering team, see live on-vehicle JLR diagnostics, and get hands-on with the Lock50 HW04 OBD tool ecosystem across 2022–2026 Range Rover, Defender, Discovery, and Jaguar vehicles.

Event MECHANEX Sandown Park 2026
Dates & Times Tuesday 10 & Wednesday 11 November 2026 • 10:00am – 4:00pm daily
Venue Location Sandown Park Racecourse, Portsmouth Road, Esher, Surrey KT10 9AJ (Greater London)
Open in Google Maps →
Live Trade Demo & Official Challenge

The Serious Locksmith Challenge: Pick Open Latest 2026 Range Rover Sport in Under 30 Seconds

At Stand 50 at Mechanex Sandown Park, our Top Lock50 Master Technician will demonstrate live on-vehicle how to pick open the locked door cylinder of the latest 2026 Range Rover Sport non-destructively in under 30 seconds. We invite every serious professional auto locksmith to step up, take the challenge, and prove their high-security vehicle picking mastery!

On-Stand Live Demo
Top Lock50 Tech demonstrates live picking under 30s using professional picking tools on factory locked 2026 Sport.
Sessions Every 30 Minutes
Sessions run every 30 minutes throughout both days (10:00am – 4:00pm daily). Pre-book your slot to skip lines.
£5,000 GBP Voucher Award
Pick open the car in under 30s to prove you are a Serious Locksmith and receive a £5,000 GBP Lock50 HW04 voucher!
Voucher Terms: The £5,000 GBP discount coupon is valid strictly towards the purchase of Lock50 HW04 Package B, Package C, or Package C+ Master tool suites. Not redeemable on Package A, standalone keys, or single software tokens. Limit one voucher per company/locksmith.
Pre-Book Your 30-Minute Priority Challenge Slot Online
Free trade registration (£0.00) • Guarantees your reserved time on the vehicle at Stand 50
Pre-Book Your Challenge Slot (£0.00) →
World Launch & Live Demo

Launching Lock50 HW29 & HW30 Non-OEM Smart Keys — Simulated UWB with Full Walk-Away Auto-Locking Support

At Mechanex Sandown Park, Lock50 will officially launch and demonstrate the brand new Lock50 HW29 (433 MHz) and Lock50 HW30 (315 MHz) Non-OEM Change-ID Smart Keys. Engineered specifically for late-generation JLR vehicles, these keys feature Simulated UWB architecture — delivering 100% reliable Walk-Away Auto-Locking, Approach Auto-Unlocking, door handle request buttons, and push-button start identical to genuine dealer keys, but without the high cost or backorder delays of OEM silicon.

Lock50 HW29 433 MHz Key
433 MHz • UK, Europe & Global
Replaces OEM Key Part Numbers:
• JK52-15K601-DL (2022–2025)
• JK52-15K601-DM (2025–2027)
(Non-OEM replacement for HW27 OEM key)
✔ Simulated UWB • Full Walk-Away Lock/Unlock
View & Order HW29 Key (433 MHz) →
Lock50 HW30 315 MHz Key
315 MHz • USA, Canada & NA
Replaces OEM Key Part Numbers:
• JK52-15K601-CL (2022–2025)
• JK52-15K601-CM (2025–2027)
• FCC ID: KOBJXF23A • Model: FOBU3LR
(Non-OEM replacement for HW28 OEM key)
✔ Simulated UWB • Full Walk-Away Lock/Unlock
View & Order HW30 Key (315 MHz) →
Simulated UWB Architecture
High-precision proximity simulation. Operates walk-away lock/unlock and door handle sensors identically to OEM keys.
All UWB RFA Modules Supported
Works across all JLR RFA modules that support UWB: 1-plug, 2-plug, and 3-plug across JPLA, K8D2, and M9R3 series.
SW36 + HW03-C Key Copy
Direct non-invasive RFA harness connection. Bypasses locked armed mode for spare keys and All Keys Lost recovery.
Understanding JLR CCF Modifications: Many late-model JLR vehicles support Walk-Away Locking and advanced security features via factory Car Configuration File (CCF) coding. With Lock50, you can activate, configure, and personalise these features directly over OBD using our SW24 CCF software. Learn how CCF coding works and browse all available features:

1. The Industry Challenge: The 2022+ JLR "Fortress" Security Wall

Since the rollout of the Modular Longitudinal Architecture (MLA-Flex) on the Range Rover L460 (2022+), Range Rover Sport L461 (2023+), and late-generation Defender L663 models, independent automotive locksmiths have encountered an unprecedented barrier: total lockout during all-keys-lost (AKL) and armed-alarm scenarios.

When an MLA or late EVA2 vehicle enters an armed theft state (alarm active, no valid key detected), traditional OBD diagnostic workflows fail completely:

  • Diagnostic Session Rejections: Central Gateway modules reject diagnostic session requests (UDS Service 0x10 0x03) and security access attempts (0x27), returning Negative Response Code (NRC) 0x33 (Security Access Denied) or 0x22 (Conditions Not Correct).
  • Immobiliser Quorum Lock: The Body Control Module (BCM) and Remote Function Actuator (RFA) lock their communication channels, preventing key registration over standard DoIP (Diagnostic over IP) routines.
  • Main Dealer Protocol is Prohibitive: JLR main-dealer protocol for an armed AKL vehicle requires replacing the entire immobiliser trifecta: a brand-new factory-ordered BCM, new RFA, and new Telematics Control Unit (TCU), plus wiring harnesses — racking up £3,500 to £5,000+ in parts and labour, paired with 3 to 6-week dealer backorder delays.
The Locksmith Dilemma: Generic multi-brand key programmers claim "JLR 2024 support" but either fail silently, freeze during the gateway handshake, or demand that the vehicle's alarm already be disarmed with an active ignition — an impossible condition on a genuine all-keys-lost job.

2. Architectural Reality: Why Generic Tools and CAN Injectors Fail

Understanding why aftermarket tools fail requires examining the multi-tiered cryptographic architecture introduced across JLR's MLA and EVA2 platforms.

A. AUTOSAR SecOC Freshness & Central Gateway HSM

Modern Range Rover and Defender models implement AUTOSAR Secure Onboard Communication (SecOC) across all safety-critical and immobiliser buses. Every start-authorisation frame exchanged between the Central Gateway Module (GWM), BCM, and Powertrain Control Module (PCM) is protected by a Hardware Security Module (HSM) running cryptographic MACs (Message Authentication Codes) with monotonic freshness values. Replay attacks and unauthorised frame injection over OBD are discarded instantly by the gateway.

B. TCU Phase 4+ Anti-Tamper Tethering

The Telematics Control Unit (TCU) is no longer a passive cellular modem — it is an active cryptographic peer in the vehicle's start-authorisation quorum. Under TCU Phase 4+, the TCU independently monitors vehicle armed status, door latch states, and cabin intrusion sensors. If the vehicle is locked and armed, the TCU continuously broadcasts tamper flags to the BCM and Gateway. Generic tools that attempt to force ignition without addressing this tethered security state trigger an immediate bus-level shutdown.

C. Door Modules Are Command Sinks — Physical CAN Tapping is Dead

On older JLR platforms (2010–2017), illicit "emergency start" devices tapped into headlamp or door mirror CAN lines to spoof unlock commands. On 2022+ MLA vehicles, door control modules act as command sinks, not cryptographic authorities. The Driver Door Module (DDM) and Passenger Door Module (PDM) report physical microswitch states to the BCM over encrypted LIN or secured CAN sub-buses; they cannot authorise ignition or disarm the immobiliser. Physical wire tapping is rendered obsolete.

The Lock50 Breakthrough: Key Copying in Armed Mode (SW36)

Rather than attempting to disarm an unwilling gateway or forcing a destructive ECU reflash over a blocked DoIP port, Lock50 HW04-C and HW04-C+ utilise an advanced hardware-assisted key replication protocol via SW36.

By connecting directly to the vehicle's RFA wiring harness using the Lock50 HW03-C cable, the HW04 hardware interfaces safely with the vehicle's immobiliser network without intrusive soldering, MCU desoldering, or board modification. The tool reads the encrypted transponder pairing data and security synchronisation tokens directly from the vehicle's keyless module, and replicates them onto a specialised Lock50 HW13 (433 MHz), HW14 (315 MHz), or the new HW29/HW30 Change-ID Smart Key.

The Lock50 Armed Mode Workflow:

  1. Non-Destructive Cable Connection: Connect the HW03-C / HW03-CB cable harness to the vehicle's RFA module located in the rear luggage compartment. No chip lifting, no cutting traces, no risk of PCB damage.
  2. Execute SW36 Security Extraction: Run the automated read cycle on the Lock50 HW04 tool. The software reads transponder configuration and rolling code alignment safely in under 3 minutes.
  3. Write to Lock50 Change-ID Key: Insert a Lock50 HW13, HW14, HW29, or HW30 key into the HW04 induction antenna. The tool configures the transponder ID, secret crypto keys, and UWB proximity parameters.
  4. Immediate Vehicle Recognition: Take the new key to the driver's door. The vehicle instantly recognises the valid transponder signature, disarms the factory alarm system, awakens the Central Gateway, and enables immediate engine start.

Hardware Requirements: Lock50 HW04 Tiers & Cable Setup

To deliver this capability, Lock50 provides structured hardware tiers matched to your business volume and vehicle coverage requirements:

Version B • Professional Tier

Lock50 HW04-B Tool Kit

Ideal for shops that adapt replacement unlocked RFA modules on 2017–2024+ locked BCM vehicles without swapping the BCM. Uses discounted tokens for key duplication.

  • Replace locked RFA without touching BCM (SW28)
  • SW36 tokens discounted to £400 (1 key) / £500 (2 keys)
View HW04-B Kit →
Version C • Master Locksmith Tier

Lock50 HW04-C Tool Kit

The ultimate armed-mode key copy solution. Includes unlimited key programming with £0 tokens for life. Duplicates keys on locked RFA & UWB without buying per-job licences.

  • SW36 Armed Key Duplicator built-in (£0 tokens)
  • SW34 KVM Key Duplicator built-in (£0 tokens)
View HW04-C Kit →
Version C+ • Ultimate Freedom

Lock50 HW04-C+ Master Package

Top-tier package. Includes unlimited key programming (£0 tokens for life), Lifetime Software Updates included free (never pay annual subscriptions), RFA EVA2 Unlock & IPC Reset.

  • Includes 20 Free Keys
  • Lifetime Updates • Zero Yearly Subscriptions
  • HW03-CB 2-in-1 bench cable included in the box
View HW04-C+ Kit →

Summary for Professional Locksmiths

The 2022–2026 JLR security barrier is not an insurmountable roadblock — it simply marks the transition to modern cryptographic architectures where generic multi-car tools can no longer cope. By deploying the specialised Lock50 HW04-C or HW04-C+ tool kit and Lock50 Change-ID smart keys, professional auto locksmiths can solve Armed Mode all-keys-lost jobs on Range Rover, Defender, and Discovery models in under 15 minutes, preserving all original vehicle modules and capturing thousands of pounds in specialist trade revenue.

See it live in London this month: Visit Lock50 at MECHANEX Sandown Park (10–11 November 2026) and see the official world launch of the HW29 & HW30 Walk-Away Smart Keys!

• Order HW04 Packages: Lock50 HW04 OBD Tool Range
• Learn CCF Coding: JLR CCF Activations Directory | Lock50 Tech CCF Platform
• Need Mobile Service for Your Car? Book a Lock50 Technician Near You