ES - 1st to 4th Gen (1990-2006) Forum for all 1990 - 2006 ES300 and ES330 models. ES250 topics go here as well.

DIY: Immobilizer Hacking for Lost Keys or Swapped ECU

Thread Tools
 
Search this Thread
 
Old 05-08-21, 09:53 PM
  #91  
cnuzum
Driver School Candidate
 
cnuzum's Avatar
 
Join Date: May 2021
Location: CA
Posts: 8
Received 0 Likes on 0 Posts
Default 30 min OBD pin short process

Hi Mauser,
I found the answer in speedkar9's original post, I must be blind! Somehow I missed this while reading his post over and over!
"a hand-shaking procedure must be performed between the Transponder ECU and Engine Control Unit before key programming by shorting two wires on the OBDII port for 30 minutes."

The post here: https://www.toyotanation.com/threads...1208642/page-2
is much more detailed, including the pinout for shorting, but didn't have the info about when you would program new keys because they just swapped the Main ECU and not the separate transponder ECU which was already matched to their keys.

So basically I believe you:
1) Virginize the separate Transponder ECU EEPROM
2) Do the OBD port pin short and code clear procedure to get the Main ECU talking to the Transponder ECU after viginizing.
3) Do the 3 key pair process.

I'm going to try it tomorrow, but I'd welcome any helpful advice you had! Writing these replies to you really helped me work it out myself! Thanks for your community spirit, I see you've been really helpful to a lot of people.

Best Regards,
cnuzum

Last edited by cnuzum; 05-08-21 at 10:18 PM. Reason: mistakes!
Old 05-09-21, 05:59 AM
  #92  
Mauser
Pit Crew
 
Mauser's Avatar
 
Join Date: Jun 2018
Location: Nm
Posts: 168
Received 43 Likes on 34 Posts
Default

Originally Posted by cnuzum
Hi Mauser,
I found the answer in speedkar9's original post, I must be blind! Somehow I missed this while reading his post over and over!
"a hand-shaking procedure must be performed between the Transponder ECU and Engine Control Unit before key programming by shorting two wires on the OBDII port for 30 minutes."

The post here: https://www.toyotanation.com/threads...1208642/page-2
is much more detailed, including the pinout for shorting, but didn't have the info about when you would program new keys because they just swapped the Main ECU and not the separate transponder ECU which was already matched to their keys.

So basically I believe you:
1) Virginize the separate Transponder ECU EEPROM
2) Do the OBD port pin short and code clear procedure to get the Main ECU talking to the Transponder ECU after viginizing.
3) Do the 3 key pair process.

I'm going to try it tomorrow, but I'd welcome any helpful advice you had! Writing these replies to you really helped me work it out myself! Thanks for your community spirit, I see you've been really helpful to a lot of people.

Best Regards,
cnuzum
You have done a lot of work on this. If all keys are lost the easiest way to do this is to just use Techstream. Toyota vehicles from 2002 on up are able to be reset onboard. If you have Techstream available I can help with a passcode.

​​​​​As far as I know this "handshake" procedure is for replacing the ecu, and will match the new ecu up with the immobilizer and the old key codes.

Old 05-09-21, 01:53 PM
  #93  
cnuzum
Driver School Candidate
 
cnuzum's Avatar
 
Join Date: May 2021
Location: CA
Posts: 8
Received 0 Likes on 0 Posts
Default

Originally Posted by Mauser
You have done a lot of work on this. If all keys are lost the easiest way to do this is to just use Techstream. Toyota vehicles from 2002 on up are able to be reset onboard. If you have Techstream available I can help with a passcode.

​​​​​As far as I know this "handshake" procedure is for replacing the ecu, and will match the new ecu up with the immobilizer and the old key codes.
Thanks for the reply. The tutorial using Techstream I watched seemed to imply you had to start with at least one working key and my mom lost all keys so I thought virginizing the Transponder ECU EEPROM was the only way to do it yourself. So you are saying this can actually be done over the OBD2 port with a cable and no working keys? The car is a 2011 Toyota Camry.
Thanks!!!
Old 05-10-21, 04:54 AM
  #94  
Mauser
Pit Crew
 
Mauser's Avatar
 
Join Date: Jun 2018
Location: Nm
Posts: 168
Received 43 Likes on 34 Posts
Default

Originally Posted by cnuzum
Thanks for the reply. The tutorial using Techstream I watched seemed to imply you had to start with at least one working key and my mom lost all keys so I thought virginizing the Transponder ECU EEPROM was the only way to do it yourself. So you are saying this can actually be done over the OBD2 port with a cable and no working keys? The car is a 2011 Toyota Camry.
Thanks!!!
Yes, there is an option to reset the immo without any keys. You are given a 96 digit seed code that is entered along with the VIN into a calculator to get a passcode that will allow you to reset the immo. I can help with the passcode.
Old 05-10-21, 06:07 PM
  #95  
cnuzum
Driver School Candidate
 
cnuzum's Avatar
 
Join Date: May 2021
Location: CA
Posts: 8
Received 0 Likes on 0 Posts
Default Found one Master key!

Originally Posted by Mauser
Yes, there is an option to reset the immo without any keys. You are given a 96 digit seed code that is entered along with the VIN into a calculator to get a passcode that will allow you to reset the immo. I can help with the passcode.
Here's a little history, it's a little funny. So my mom lost all her keys but one. Then that one broke where the key blade attaches to the plastic head so I got a new shell and put the alarm clicker part and the transponder chip in the new shell and all was good. I then ordered 4 new uncut keys with the intent to program the ECU to accept them and was researching the ways. I told her to be real careful not to loose the one key before I the new ones got here and I got them programmed and cut. I definitely saved the key blade that broke away from the plastic so that new keys could be easily cut from it if she did in fact loose the last key. So she called me 2 days later and said she lost the key! She hadn't gone anywhere so we knew it was at or near the house somewhere. I considered the idea she may have gone out to her car to get something and dropped them inside and then the car locked itself. But she looked though all the windows and I really thought it was a low probability.

I went over to my mom's last night with the key blade to open the door and check. Her keys were right between the seat and center console!

So long story short, I still need to pair some keys to the car, but I have a master now!

So is using Techstream with a passcode to reset the immo still the best/simplest way now that I have a master key?
Also, what is the maximum number of keys your can pair to the car? The method I was going to use only programmed 2 masters and one valet.

Thank you very much for your help!

Last edited by cnuzum; 05-10-21 at 06:16 PM. Reason: forgot something
Old 05-13-21, 01:04 AM
  #96  
cnuzum
Driver School Candidate
 
cnuzum's Avatar
 
Join Date: May 2021
Location: CA
Posts: 8
Received 0 Likes on 0 Posts
Default One way to possibly write to the chip without removing

To those who can read but not write to the chip there is something I've used in the past when reading EEPROMS that may help. My preferred method is to leave the chip on the board (especially for chips with many more pins than this one). What you want is the EEPROM powered up and not the rest of the board which may hold up or down certain data lines that you need to control to program the chip. So I drop a little solder on the Vcc and slightly lift the pin up from the pad on the board with a pick while heated. Then you can solder wires to the chip, careful to solder the wire to the lifted pin without bridging the gap back to the pad..(You could try a clip but I'd use wires) This way nothing else on the board will receive power and the chip should usually program fine. Afterword, remove the wires and solder the lifted pin back down. I only recommend this to those with some reworking experience, you don't want to break the pin off. This is what I was going to do, but I found that the Immobilizer ECU is hard to get to so I am using Techstream instead. I was looking forward to building the circuit! I got this cool breakout box for the serial cable!
Old 05-20-21, 09:41 PM
  #97  
Zzoomer939
Driver School Candidate
 
Zzoomer939's Avatar
 
Join Date: Feb 2021
Location: New Jersey
Posts: 1
Received 0 Likes on 0 Posts
Default

Mauser i would greatly appreciate all the help I could get. I have a 2005 es330 I am in the process of installing a passive keyless entry with remote start and smart key push to start.problem is I had to drill the ignition tumblers out and now I have damaged the immobilizer coil and possibly the module. Is there any way to disable the immobilizer completely? I will use the aftermarket alarm to prevent theft. If not I could realy use one of those chips also thx in advance....
Old 10-30-23, 06:18 PM
  #98  
altamaeashley83
New Member
 
altamaeashley83's Avatar
 
Join Date: Oct 2023
Location: Texas
Posts: 1
Likes: 0
Received 0 Likes on 0 Posts
Default Help I need it badly

Originally Posted by speedkar9
Thanks for the feedback. Its cool stuff, and I enjoyed doing this project, especially given how helpful it would be to many potential used car buyers who buy with just a valet key.

I believe the owners manual (or service manual?) tells you about distinguishing valet and master keys through the security light. Valet keys can start the car, but it won't allow you to program new key fobs, new keys or open the glove box and trunk.

Since the IC900 chip is a surface mount EEPROM chip you won't be able to easily socket it the way I did the odometer chip:

http://www.toyotanation.com/forum/10...ogramming.html





Thanks. Those last few links in the references really helped me a lot to understand how the chip is programmed. Locksmiths virginize Immobilizer chips all the time but don't reveal their secrets and want you to buy the virgin dumps. I got a few chips and a used ECU with some keys from the junkyard and did a bunch of experimenting with the HEX values in the dump until I found out what each set of characters translated to. A lot of trial and error but having the odometer reprogramming experience behind me made it a lot easier to tread through unknown territory.



I have a 2006 Toyota Corolla CE and am trying to replace the immobilizer ecu box but cannot locate it bcuz my original immobilizer was stolen so I ordered a new one with a new key and cylinder a d it came also with the transponder box but I cannot locate it and I feel if it was plugged in I wouldn't have to take it all the way to Toyota to get the new/used immobilizer programmed to my ecm is it possible u can help me figure this out if be forever greatful
Old 02-10-24, 03:46 AM
  #99  
MatClever3
10th Gear
 
MatClever3's Avatar
 
Join Date: Oct 2022
Location: Mo
Posts: 10
Likes: 0
Received 3 Likes on 2 Posts
Default 96 Lexus ls400

I know this thread is a few yrs old but hopefully someone might have an answer for me. I have a ecu that I got from a donor car but no keys. Would taking the eeprom chip off my original ecu and swapping it with the one on my donor ecu do the trick?
Old 02-10-24, 10:04 AM
  #100  
LeX2K
Lexus Fanatic
 
LeX2K's Avatar
 
Join Date: Sep 2010
Location: Alberta
Posts: 20,340
Received 2,974 Likes on 2,504 Posts
Default

That should work.
Old 02-22-24, 10:09 PM
  #101  
LeX2K
Lexus Fanatic
 
LeX2K's Avatar
 
Join Date: Sep 2010
Location: Alberta
Posts: 20,340
Received 2,974 Likes on 2,504 Posts
Default

Has anyone programmed 89661-0W121 from a 2000 ES300 specifically? Flashing the eeprom won't be a problem but not 100% sure how to register keys to the ECU I'm reading conflicting info. There are 2 eeproms anyone know why?





Old 02-25-24, 10:28 PM
  #102  
LeX2K
Lexus Fanatic
 
LeX2K's Avatar
 
Join Date: Sep 2010
Location: Alberta
Posts: 20,340
Received 2,974 Likes on 2,504 Posts
Default

Was able to flash 2 ECU's don't know if they will accept new keys yet. I watched several vids all of them used the supplied clip from this programmer attached to the 93C56 eeprom
Amazon Amazon

I couldn't get the chip to read, testing the clip connection showed it was not making proper contact so I soldered wires directly. Still no go. Digging into the pin-outs, the supplied clip is not wired correctly for the 93C56 on the 2000-2001 ES300 ECU. Very odd since others were programming the exact same chip using the supplied cable. Instead I removed the chip from the ECU and soldered to one of the supplied boards


Plugged that into the adapter I made shown here
https://www.clublexus.com/forums/es-...l#post11669843

It connected and programmed no problem. Set the bytes to exactly this


Think I should replace the capacitors?


Anyone know if I can use 89661-0W151 in place of 89661-0W121 (this is what my car has)





The following users liked this post:
Margate330 (02-25-24)
Old 02-25-24, 10:53 PM
  #103  
Margate330
Lexus Test Driver
 
Margate330's Avatar
 
Join Date: Apr 2019
Location: FL
Posts: 7,163
Received 1,007 Likes on 802 Posts
Default

Originally Posted by LeX2K

Think I should replace the capacitors?


I had to replace 4 or 5 capacitors on my RX330 spare ECM but I did not replace them all, no reason to.

If my ESR meter says they are good, they get left alone.
I've been repairing circuit boards for many years.

This unit ESR meter below has served me well for profession use for over 12 years, I bought it when they first came out at $300 but they have come way down in price these days and they sell them on ebay now..

For anyone following along, need clean solder contacts to get a good reading using an ESR meter.
A little brake cleaner on a paper towel cuts the clear conformal coating on the circuit board like magic(if needed) and that is how I do it.

PS- I used standard replacement caps, nothing special and not low ESR and worked ok, it's what I had in stock so that's what I used. Add- if you want to play it safe, can use low esr caps.

GREEN is GOOD! haha



Last edited by Margate330; 02-25-24 at 11:01 PM.
The following users liked this post:
LeX2K (02-25-24)
Old 02-25-24, 11:34 PM
  #104  
LeX2K
Lexus Fanatic
 
LeX2K's Avatar
 
Join Date: Sep 2010
Location: Alberta
Posts: 20,340
Received 2,974 Likes on 2,504 Posts
Default

I cleaned the conformal coating off the eeprom area using lacquer thinner it works great. Also cleans flux up nicely and 100x cheaper than flux cleaner and cheaper than brake cleaner. Lacquer thinner is harsh stuff but so far I've never had it damage PCBs or electronic components.

That rom clip is crap the pins don't stay in place and the spring is in the wrong location seems to work for some people though. I'm still baffled how people had that clip work on the 93C56 or maybe it didn't and they said it did.

edit - think I'll replace all the electrolytic caps in a desperate attempt to get rid of the flicker problem recommend me the specific brand/type.

Last edited by LeX2K; 02-25-24 at 11:38 PM.
The following users liked this post:
Margate330 (02-25-24)
Old 02-25-24, 11:46 PM
  #105  
Margate330
Lexus Test Driver
 
Margate330's Avatar
 
Join Date: Apr 2019
Location: FL
Posts: 7,163
Received 1,007 Likes on 802 Posts
Default

Originally Posted by LeX2K
I cleaned the conformal coating off the eeprom area using lacquer thinner it works great. Also cleans flux up nicely and 100x cheaper than flux cleaner and cheaper than brake cleaner. Lacquer thinner is harsh stuff but so far I've never had it damage PCBs or electronic components.

That rom clip is crap the pins don't stay in place and the spring is in the wrong location seems to work for some people though. I'm still baffled how people had that clip work on the 93C56 or maybe it didn't and they said it did.
Yeah, you got that right.
Flux cleaner is over priced junk for what ya get. lol

Only reason I use brake cleaner is because sometimes the stuff I work on comes off a nasty machine and I need to quickly decrease the enclosure before digging into it, plus takes off sticky glue too. lol

I've never tried laquer thinner, good one to try.

They make some good clips that stick better but I just do like you did and pull the chip or solder in some wires on the board.
I have chip holders for all the popular smd chips that plug into my programmer if I need them.

Sometimes I'll program something in circuit but only if I look at the circuit first and know for sure I won't mess something up cuz I've seen some sneaky booby traps over the years to keep in circuit programming from being done by mfg's.

Subscribed to see what you find out and hoping for your success friend.


Quick Reply: DIY: Immobilizer Hacking for Lost Keys or Swapped ECU



All times are GMT -7. The time now is 10:34 PM.