ALOA CMAL cheat sheet

Wafer lock picking: a wafer must be lifted to the shear line; over-lifting past the shear line is as ineffective as under-lifting, so tension and pick depth are controlled together.

Pin tumbler keying math: the number of usable bitting depths per space equals the number of cuts available; a 5-cut key with 4 usable depths yields 4^5 = 1,024 theoretical combinations before progression constraints.

Macs (maximum adjacent cut specification) limits how far adjacent cuts may differ (commonly 2-3 steps); ignoring MACS produces keys that bind or cannot enter the cylinder.

Ignition lock removal on many column designs requires the cylinder to be rotated to the accessory or ON position to align the retaining pin or release hole before extraction.

Transponder key cloning vs. programming: cloning copies only the fixed ID of a 4C-style chip, while cryptochip keys (e.g., Megamos Crypto, Texas Crypto) require a key-learning procedure through the vehicle's immobilizer.

Door lock decoding from a removed cylinder: read wafer heights in order, translate each wafer position to its cut depth, then apply MACS before cutting the first test key.

Numeric key cutting: code-to-cut tables map vehicle-specific code numbers to bitting strings; a single code may serve multiple lock positions (doors, ignition, trunk) on the same vehicle.

Steering column damage indicators: a sheared or forced ignition actuator, broken housing tabs, or drilled pin chambers signal attempted theft and must be documented before repair.

Proof of ownership before service: verify vehicle registration or title plus photo ID matching the named owner; for third-party requests, obtain documented authorization from the registered owner.

Key code access controls: NASTF SDRM or manufacturer portals release codes only to verified, registered locksmiths; every query is logged and attributable to the requesting credential.

Immobilizer diagnostics: a no-start with a security lamp indicates the PCM/BCM is not receiving a valid transponder challenge-response; confirm key count and stored key IDs before replacing modules.

OBD-II key programming carries risk: aftermarket programmers can overwrite all-keys-lost status, so record the original key count and VIN before writing new data.

Customer data handling: key codes, VIN, and transponder secrets are sensitive identifiers; retain only what the job requires and never transmit codes over unsecured channels.

Vehicle identification integrity: compare VIN on the dash, door jamb sticker, and title; mismatched VINs indicate a cloned or salvaged vehicle and warrant refusal or escalation.

Liability documentation: record date, VIN, odometer, keys produced, and authorization signature on every job; contemporaneous records are the primary defense in disputes.

Legal scope awareness: bypassing an immobilizer without owner authorization, or servicing a vehicle reported stolen, exposes the technician to criminal liability regardless of technical skill.