DIY Immobilizer Hacking

DIY Immobilizer Hacking

This video was originally posted on my speedkar99 channel but has been moved to speedkar100 channel.

Here’s how to hack into your car’s engine immobilizer to program new keys in the invent of lost keys or a swapped ECU.

This tutorial video demonstrates how you can reset the engine immobilizer in your car (be it in the ECU or a separate transponder ECU in the dash). This will clear the EEPROM chip of all previously stored keys and “virginize” it to accept new keys. When the ECU is first powered up, it will go into Auto-Programming mode, and accept any keys that you insert into the ignition.

Full DIY PDF writeup available for download here:
https://mega.nz/#!q9pBCSSL!ckwyyjeJNNic0pT3KLWt1E95LbBUzX96skoyaZgk0RM

Modern cars use a key with an embedded RFID chip as an added means of theft prevention. The key is read by the computer and if it matches, it will enable all systems to start the car. If the key does not match, the car will only crank but not start.

The immobilizer system presents a barrier to many owners when it comes time to swap out a bad ECU, or if you lost all the master keys and can’t program new keys.

While taking the car to a dealership or locksmith is an option, it will get expensive because you are at their mercy.

The tools required are fairly basic, three 4.7K ohm resistors, three 5V zener diodes, and a computer with a serial port. To connect the 8-pin EEPROM chip to the computer you’ll either have to solder hook-up wires to the pins or get a Test Clip for onboard programming.

PonyProg, a free serial device programmer was the software used to read information from the serial port and “dump” the EEPROM’s contents. The immobilizer uses HEX programming. Each key has a unique 8 digit HEX code. There are also bits to indicate key count, enable programming mode and valet lockout.

The HEX dump is edited to remove the old keys and rewritten to the chip. When reconnected to the car, the ECU will be in auto-programming mode and will accept new keys as per the procedure below:

1. Briefly insert any key into ignition lock cylinder and remove immediately. The security light should illuminate and remain on.

2. Insert first transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on
for 3-5 seconds then go off. After security light goes off remove the
first key from ignition. Security light should come back on and remain on indicating you’re still in programming mode.

3. Insert second transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on
for 3-5 seconds then go off. After security light goes off remove the second key from ignition. Security light should come back on and remain on indicating you’re still in programming mode

4. Insert third transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on
for 3-5 seconds then go off. After security light goes off remove third
key from ignition. The security light should extinguish and then commence to blink regularly.

5. Wait 30 seconds for the programming cycle and programming mode to close.

The first two keys are internally (inside the ECM) designated as MASTER keys and the 3rd key inserted will be internally designated as the VALET key.

This procedure should work on many Toyota and Lexus vehicles from the 1990’s to early 2000’s. Newer Toyota/Lexus/Scion cars have a separate transponder ECU under the dashboard instead of having the EEPROM store key info in the ECU. The procedure is similar, though a hand-shaking procedure must be performed between the Transponder ECU and Engine Control Unit before key programming by shorting two wires on the OBDII port for 30 mins.

Reference material:
http://qcwo.com/technicaldomain/working-with-immobilizer-software-for-virginizing-files
http://www.spyderchat.com/forums/showthread.php?44760-Lost-Keys-amp-Immobilizer-Fix
http://www.locksmithcharley.com/toyotapostflash.pdf

Link to Etsy shop where you can purchase speedkar99’s brother’s socks, t-shirts or hoodies:
https://www.etsy.com/ca/shop/Speedkar

Check out the speedkar99 Facebook page:
https://www.facebook.com/speedkar9/

Check out the speedkar99 Linkedin page:
https://www.linkedin.com/company/speedkar99/

Follow speedkar9 on Instagram for behind the scenes coverage:
https://www.instagram.com/speedkar9/

Subscribe for more videos just like this:
https://www.youtube.com/subscription_center?add_user=speedkar99

157,930
Like
Save


Comments

Harry David Aererua says:

My 2002 R50 mini cooper.lost keys.Is it a good idea to grab ecu,bcm,key,barrel n door lock from another R50.

Wrazze says:

I hope you get paid well with all that studies and hard works. If you don't make like they are who have those fancy car. They still look down on you or call you a loser from time to time. But we love what we do as technician right? Love what we do and don't let those ass hole take advantage.

SEYMOUR SCAGNETTI says:

SUPER EZ HACK IF YOU LOST ALL KEYS, EASY TO FOLLOW ONE STEP PROCESS.

STEP 1) TAKE CAR TO TOYOTA DEALER TO FIX IT.

abd slil says:

Can you do it for my 2006 Audi A6 ?? I send you ECU and make me key, will pay you

vicenss vicenss says:

Good!volvo?

will romaine says:

Nice info. but aren't you at risk of frying the chip in the ICU without a heatsink during the soldering process?

john dakin says:

is this the same process for all makes of cars ? im looking to do Audi

Gary Bednarz says:

2.56 Trillion with a T

Jordan Classen says:

Hey man, just wanted to let you know that thanks to your hard work and documentation, I just successfully did this on my 1998 LS400.

I used an EZP2019 programmer and it's own software. I ended up having to remove the chip and resolder, and even then I couldn't get a proper read(locations of all the code were correct, but a bunch of repeating numbers that weren't logical. Even the valet lockout code was completely different), and it wouldn't write(I probably torched it taking it off). I bought a replacement chip for 30 cents and ended up just zero'ing and putting in the lockout code exactly like yours and it wrote/verified fine, so I tried it out and sure enough, it worked!

For 16 months I had a paperweight in the garage that I was repeatedly told by dealerships, shops and locksmiths continent wide(actually called 50+ locksmiths across North America) that it was impossible to do. Finally after some further research I came across you and now I've got my baby back.

Thank you so friggin much. Seriously, you have my utmost gratitude.

caligula says:

I don't have a bread board!

Edgar Paniagua says:

I removed the ECU on my 2014 Scion FRS located behind the glove compartment. I took it apart and can't find that chip you pointed out. I have the wires and chip reader ready. All I have to do is find that chip. Do you have any idea if it might be on another part?

Teeny Tike says:

ive lost my transponder key, i have one more, how do i copy it?

Taz Dev says:

this is great and you are a good instructor, I am impressed, is there any thing different with the 02 Altima ecm and what about the bcm on this model , thank you plz guide me with this car .thanks again

Boony says:

Never felt so thick, thanks 🙂 do you dream in algebra?

Freedom O' Forest says:

How to do if you're a normal everyday person

Johnny M says:

I’ve been having a problem with my Honda prelude 2001 type sh not starting.. it looks like it has a bad ecu. I don’t have the original keys any help would be appreciated

Kyrie Eleison says:

do u need 3 keys or can u do it with only 1 or 2?

David W says:

Ya fucking right dude

Rena Butler says:

Do not fool yourself looking for free hacking. My personal appreciation goes to hackercenamichealbest@gmail.com
Because i paid and got good result. Thank you once again for your best and honest service.

Jamil Qamar says:

Thanks for this great video! How about with NISSAN PATHFINDER 2012 ECUs?

kxpes says:

I hope it will work in my mazda's rx8 transponder module.
Having wiring harness and and modules in room with me preparing to swap, and sudently immo does not respond for key that was programmed.

Woosher Dooser says:

Id rather eat potatoe chips than dealing with these computer chips….

Ru zimba says:

This is way too advanced.
This guy is good.

Udara Idumal says:

Nice explain,very good , thank you

Tonya Rebecca says:

I feel you all pains on the rippers. I’ve had good luck with getting cc from Jarvery33 on telegram, he’s one of the few that didn’t block Me after I sent him btc

Comments are disabled for this post.