Originally Posted by Stroker347

I have tried all the various methods found on the internet, including the one posted below by jeepfreak82, and found that they did not work on my 2004 GC WJ. So I figured out how to simulate the factory method that is performed using the OBD2 port. There are four memory slots in the Remote Keyless Entry (RKE) module that is part of the Passenger Door Module (PDM) so up to four different key fobs can be programmed. Using a USB ELM327 based OBD2 interface and an RS232 terminal software program running on a PC I experimented with a spare PDM and wiring harness that was not installed in the vehicle by creating a mini-network powered by a 12V hobby battery and attaching an OBD2 port connecter to the appropriate terminals on the PDM. The commands, in HEX format, that need to be sent to the vehicle to program key fobs (a currently programmed key fob is not needed for this procedure) are as follows:

Step 1) To put the RKE into programming mode:
24 A1 31 00 00 00
a successful vehicle response to this command is: 26 A1 71 00 00 00
Step 2) To specify the memory slot to be programmed:
24 A1 31 XX 00 00 where XX is 01, 02, 03 or 04
a successful vehicle response to this command is: 26 A1 71 XX 00 00.
Step 3) Press either the Lock or Unlock button on the key fob to be programmed until the lock relays are heard to actuate.
This completes the programming for the selected memory slot.

Repeat steps 1 thru 3 for each key fob to be programmed by incrementing XX appropriately.

The ELM327 assumes that there are 3 header bytes for every vehicle command and automatically appends these to the commands. The header bytes are set up before sending the remaining command bytes.
The following commands, sent thru an RS232 terminal program to the ELM, will set it up and send the desired commands to the vehicle:
AT L1 (sets line feeds on)
AT H1 (sets headers on)
AT E1 (sets echo on)
AT SP2 (sets protocol to VPW)
AT RA A1 (sets return address to A1)
AT SH 24 A1 31 (sets the three header bytes that are appended to the each of the following two lines)
00 00 00 (performs Step 1 of the procedure)
XX 00 00 (performs Step 2 of the procedure where XX is 01, 02, 03 or 04)

As with any interaction with the vehicle thru the OBD2 port proceed with caution and at your own risk. When performed as described above no harm was done to my vehicle or the spare PDM that I experimented with.

If a currently programmed key fob is available it can be assumed that it is assigned to memory slot 1 and the procedure above can be started with memory slot 2 thru 4 for additional key fobs. Alternatively, the currently programmed key fob can be reprogrammed to any memory slot that is not used for another key fob.

Originally Posted by Stroker347

I don't know if my procedure would work on a 1998 grand Cherokee, but I suspect not because the Chrysler TSB did not include model years prior to 1999. As long as you have a way to interface with the OBD2 port you can try the procedure and if you get a 26 A1 71 response back from the 24 A1 31 request its very likely that it worked otherwise not.

Originally Posted by mephestopheles

Sorry for bringing up an old thread but can anybody confirm this will work on a 1996-1998 Grand Cherokee ZJ? I know the 1995 and older one have a procedure.