DIY: Immobilizer Hacking for Lost Keys or Swapped ECU
#106
Lexus Champion
Can also confirm the programming and key learn procedure shows in this thread does not work correctly on a 2000 ES300. Inserting first master key does program but after that it will not register any new keys. Car does start with the first master key but the security light does not behave normally. Which is, insert key light goes out instantly. Inserting key causes the light to go out after about 5 seconds, like the programming procedure is not complete.
If anyone knows the proper procedure post it.
#107
Lexus Champion
Made a programming header so I don't have to keep removing the eeprom can only remove it so many times before the PCB is damaged.
Liquid electrical tape blob to keep the wires stable
This is the eeprom dump from my car
After me trying to do the key learn on the flashed ECU
Definitely didn't work correctly.
Liquid electrical tape blob to keep the wires stable
This is the eeprom dump from my car
After me trying to do the key learn on the flashed ECU
Definitely didn't work correctly.
#108
Pole Position
Hello,
The FSM for a 2001 ES300 shows a bit of a different procedure for the Automatic Registration Mode than the one shared in the first post:
It seems like the procedure is designed in such a way that you have to have All 3 keys on hand to get registered correctly. As before, the Last key used in the Automatic programming becomes a Valet key even if it is physically cut as a Master Key, meaning that it could start a car, but it can't be used to program any new keys.
The manual mentions that you can terminate the procedure without registering all 3 keys, but the wording is not all that clear, and it will require a proper scan tool, below is a quote from the manual.
Hope this helps and best of luck!
The FSM for a 2001 ES300 shows a bit of a different procedure for the Automatic Registration Mode than the one shared in the first post:
- Right after the EEPROM is cleared, the Security Light will Blink until the first key is inserted into the ignition.
- Start by Inserting the First Key, do not turn it, the Security Light should stay On.
- The Security Light will remain On until the Programming is complete, after which Security Light should turn Off.
- After the Security Light turned Off, take the key out, the Security Light should start Blinking.
- Start the procedure over by Inserting Next key in the Ignition.
It seems like the procedure is designed in such a way that you have to have All 3 keys on hand to get registered correctly. As before, the Last key used in the Automatic programming becomes a Valet key even if it is physically cut as a Master Key, meaning that it could start a car, but it can't be used to program any new keys.
The manual mentions that you can terminate the procedure without registering all 3 keys, but the wording is not all that clear, and it will require a proper scan tool, below is a quote from the manual.
Originally Posted by Automatic registration mode completion
If completing the mode forcibly when more than 1 key code have been registered on the automatic registration mode, perform the following procedures.
After 1 more key code have been registered with master key, perform step (1) or (2) without pulling the key out or inserting the already registered key.
(1) Depress and release brake pedal 5 times or more within 15 sec.
(2) With the LEXUS hand−held tester, require automatic registration mode completion.
After 1 more key code have been registered with master key, perform step (1) or (2) without pulling the key out or inserting the already registered key.
(1) Depress and release brake pedal 5 times or more within 15 sec.
(2) With the LEXUS hand−held tester, require automatic registration mode completion.
Last edited by Arsenii; 02-28-24 at 06:24 PM.
The following users liked this post:
LeX2K (02-28-24)
#109
Lexus Champion
I'll give that a try although that is basically what I attempted. I have 2 master keys and a valet key, the originals that came with the car. I'm wondering if the transponder is remembering the keys, and I put in the 2nd master key instead of master #1. My main key could actually be the 2nd master. Not sure that's just a guess.
But now that I can program the ECU *****-nilly until the cows come how I can experiment. The way I read the force completion procedure is either/or. Brake pedal or scan tool.
But now that I can program the ECU *****-nilly until the cows come how I can experiment. The way I read the force completion procedure is either/or. Brake pedal or scan tool.
#110
Pole Position
Interesting.. You mentioned that only the first key programs, all the rest fail, how it manifest itself, does the light show any different behavior? They do have the light flash codes 2-1 or 2-2 in case if the registration fails for whatever reason..
I would be quite bemused if it is the case, I am pretty sure all the key does is store its unique identification code, as even Valet keys are only made so by different bitting and different programming into the car, they have the same exact transponder. That said, I've heard of cases with some VAG models where if you program a key into a different car, it would stop responding to the car it came with originally, again, for whatever reason..
Could be, but usually they are a lot more upfront about it, not listing it as a second step, can't hurt to try though ... I guess..
Uhhh, careful not to trigger that Nuke-Mode, it usually comes with a big red button..
Hope this helps and best of luck! (May need it this time)
Hope this helps and best of luck! (May need it this time)
#111
Lexus Champion
I would be quite bemused if it is the case, I am pretty sure all the key does is store its unique identification code, as even Valet keys are only made so by different bitting and different programming into the car, they have the same exact transponder.
That said, I've heard of cases with some VAG models where if you program a key into a different car, it would stop responding to the car it came with originally, again, for whatever reason..
Could be, but usually they are a lot more upfront about it, not listing it as a second step, can't hurt to try though ... I guess..
#112
Pole Position
Other than that, parameter 0x00000040 - 0C shows the number of keys stored in the system as an inverse hex, you have FF after an attempted programming, which means no keys stored, and your original ECU with I am assuming 3 factory keys stored is FC. Not only that, this parameter is shifter one row to the Right in the New ECU, being in 0D column this time instead of 0C, I wonder if was placed in the correct row during the cleanout, as it still indicates that you have no keys stored, even though you do have one Valet key recorded in the system.
I know you tried flashing the EEPROM with the dump from the original ECU and it didn't work, but have you tried altering the dump from the New ECU to the values of your keys from the Original ECU, as EEPROM usually stores a lot more than just key values, which could be the reason behind the car not starting. You only need to add at least one Master key, after that you will have all the freedom to add the rest of the keys the *normal* way.
Though go tell that to Mercedes from early to mid 2000's, I doubt they changed much since then. Coming to think of it, I can't recall any factory diagnostics equipment that would be usable, let alone good, not off the top of my had that is, Toyota is not the worst in this tournament, for better ... or for worse..
Hope this helps and best of luck!
#113
Lexus Champion
It did seem like the first key programmed as a valet now that I think about it, when inserted the security light stays on for a bit then goes out (I'm not in programming mode, regular car operation) that is exactly how the valet key behaves. Still would like to know why there are two identical eeproms but I don't feel like desoldering it and checking if it clones the first eeprom.
#114
Pole Position
You are in pretty unique position where you have the actual codes for all your keys already. Below is what makes up all your keys as per the post made by speedkar9, just a bit more concise. Try changing only those variables in the EEPROM dump that you got from the New ECU and see what happens, with any luck, you should have your keys programmed with none of the hassle.
If that won't play out, try adding only One of the keys, changing the Key Count to FE for 1 key, instead of FC for all 3 keys. Again, with any luck, you will have at least one Master Key programmed in, and you will be able to add all the rest of the keys with normal programming sequence from there should you need it.
Sorry if it sounds like beating a dead horse, just wanted to make everything clear.
Hope this helps and best of luck!
Last edited by Arsenii; 02-29-24 at 11:04 PM.
The following users liked this post:
LeX2K (03-01-24)
#115
Lexus Champion
Great info thanks! I have some cool things to try.
Thread
Thread Starter
Forum
Replies
Last Post
jehmin
Lexus Audio, Video, Security & Electronics
7
11-07-23 12:12 AM
Kadrian21
GS - 2nd Gen (1998-2005)
16
03-09-17 10:32 PM
63Galaxie
GS - 2nd Gen (1998-2005)
3
10-27-16 02:50 PM