Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[prj]

I have a problem with coding a key to my Omega-B FL.
Tried various tools, including universal locksmith tools and I get the same problem.

I bought the car pass from my dealer in digital form, it came with three codes - key mechanical, radio, immo (I guess "immo" is the security code?).
Now, I can use the "immo" code to log into the immobilizer and code keys.
However, if I go into the anti theft warning system, I can not login using the same code. It just says that the PIN is invalid.

From everything I have read, and from Locksmith experience, the PIN between the anti-theft warning system and the immobilizer should be identical.
It is not the case for me, however.

What could be the problem? Are the ATW control units prone to failure by any chance? Could it be that someone replaced the unit on my car?
And this will probably not answered - but does anyone know if I can open the unit, dump an EEPROM and find the pin in there? I have all the equipment...

[Kevin Wood]

Normally the same security code works for both systems so yes, it does sound like the ATWS ECU might have been swapped, although I can't recall ever hearing of one fail, so I doubt it's a common problem.

I have no idea how the unit is coded internally, so not sure if your proposed solution would work.

Do you have the keyfobs from this ATWS? Are they repairable? (normal failure is buttons and/or battery holder. Both easy to replace.)

[prj]

I have one key, I re-soldered the battery holder, and there is a voltage on both ends, however it fails to work.
If I hold a button for a really long time, sometimes I will get the activation message in diagnostics.

Tbh, I'd rather just get this coding procedure to work, as I have a perfectly valid working key, which gets detected in measuring blocks every time I press a button, but as it's not coded to it, it fails to work.

I dumped my immo EEPROM and the security code was in plaintext.
Currently I have a "Security Wait Time" on the ATWS, so I left ignition on the car, I'll go and see if that clears within 1h20 min.
I didn't actually check if I had a Security Wait Time before I tried programming, but I've had this car for a while.

I am guessing if the immo EEPROM had the code in plaintext, it can't be that hard to find the code for ATWS either.
Do you know what the procedure is by the dealer to replace the ATWS? Could someone look it up in the system?
Are they ordered from factory for a certain car by VIN code pre-programmed? Or are they programmed with the security code on the car?
I am thinking that if I could get EEPROM dumps from two ATWS units, it'd become a cakewalk to figure out the code location.

My dealer is fairly useless in this regard, if they won't be able to log in, I am for some reason quite sure they'll just say "the ATWS is broken, you have to swap it"

[prj]

Waited for the security wait time to run out, tried again, wrong code.

My only conclusion then is that the ATWS module has been replaced.

Does anyone know where exactly it is located?
The picture shows http://www.autopro.spb.ru/articles/00000014/AstG_ATWS05.jpg towards the right fender.

If this is true, I am pretty sure the car was hit into the right fender at some point, so that would be logical...

[prj]

http://i9.photobucket.com/albums/a59/Hillper/IMG_2050.jpg

That answers a few questions.

So I guess I just remove the unit and look inside then.
I see no other solution apart from swapping in a unit from a car that is being broken, with a car pass.

Of course if someone has one left over (there are a few part numbers there), and has the car pass for it, I'll happily take it off your hands so I don't have to waste my time with this...
I am pretty sure the only way to get the code will be through reverse engineering

[prj]

I know that no one probably cares, but a dealer in another city said they should be able to read the anti theft warning system's VIN code via Tech 2, then I'd have to pay for the car pass for the car it was lifted from.

I know the immo module displays the vin code, but does the ATWS also do that?
Maybe someone with a Tech 2 can comment.

I don't want to go and waste money.

[TheBoy]

prj - I would need to check this. No in a position to do so until the weekend.

Can I just confirm its the ATWS, and not the immobiliser, that you are having trouble with?

I *may* have an ATWS here, from a 2000 facelift, but guess postage would be cost prohibitive.  I'd need to find it, and more importantly, the code!


The problem does sound like the sort of damage that a common, not-legal in the UK, Opel specific diagnostic tool does to these ECUs - seen 3 like this now.

[prj]

Postage will be 10 quid if you just send it with Royal Mail, don't worry about that.

I took the unit out of the car. Basically the bit of trim was only shoved in place, no screws, nothing.
Some tabs on the unit are broken, someone has been in there.

The entire board is dipped in red laquer, and I think this is factory, there are no soldering marks.
I think the board has been changed and the case left in tact. I can not explain it otherwise.
The manufacturing date is also early 1998 on the board, while my car is 2000.

Also, I finally squeezed enough info from the dealer, the ATWS needs to be coded to the car when it's installed and that procedure can only be done once.
Well, yeah, my friendly 93C46 programmer can do it as many times as I like, but the problem is, that I don't know the format of the dump.

There is a MCU and 93C46 on the bottom right corner of the board. Everything else seems like buffers, and radio transmitting related devices.
I will desolder the 93C46 (need to get through the lacquer) and read it with a programmer. Let's see what's inside...

P.S.
Yes, I am talking about ATWS. Immo is real easy, if you read the EEPROM the security code is in plaintext

[prj]

Chip is a 93LC46B, 16bit.
MCU is a M37733 mitsubishi.

Got the chip off as well, the lacquer is a bitch, gets in the way of everything, resoldering will be fun...
I don't have a SOIC8 adapter, so I had to just solder on wires, not fun.

Anyway, here's the contents of the chip:


And as a comparison, the immo chip, the security code being 3922 for this car:


Doesn't look that easy in the ATWS.
I wish I had a second dump to compare. The changed bytes would show where the code is.
Or maybe there some sort of tool that can extract the code from the dump.

[prj]

I am going to solder that thing back on for now and put the block back in my car so central locking works...

I can't find any info anywhere on the web, any dumps, anything for the 93LC46B. And I am 100% sure that this chip contains the pin code, because it is the only programmable memory on the board.
The processor only has ROM, it's one time programmable as far as I can see...

There are two ways to get the code:
* A serial EEPROM emulator with address hit tracing, and watch it like a mofo when you enter the code (it'll probably access it at that point)
* A second dump from a similar block, and then compare them

I don't have a serial EEPROM emulator, only parallel ones, and I don't have a second block. I'm screwed

[prj]

Soldered it back on, connected unit to car, car starts flashing blinkers, central locks don't work.
Took it back out, looked with a magnifying glass, sure enough all that lacquer made sure one of the pins wasn't soldered on properly.
Cleaned, re-soldered, re-connected to car, works...

At least I see why these are not known to fail, that thick lacquer dip takes care of most moisture.
Still not gotten anywhere with the code for the damn thing...

I guess I could try to visit the local breakers and get another of these things, then dump it...
But if someone has a block from a car with a car pass, I'll take it off your hands.

[TheBoy]

Wonder if the code is on the controller's ROM, as a 1 hit only program?  If its in that flash dump, I guess its well encrypted

I found the ATWS unit, just need to dig out code, so that may be a way out for you if postage isn't that expensive?

[prj]

Wonder if the code is on the controller's ROM, as a 1 hit only program?  If its in that flash dump, I guess its well encrypted

I found the ATWS unit, just need to dig out code, so that may be a way out for you if postage isn't that expensive?

It's not in the ROM. The unit comes from factory, then it can be adapted once, when it is first fitted to the car.
The ROM is just that. Read only memory. The ROM is programmed in those processors once, and that's it. The data sheet does not mention any flash memory, so I am guessing those things can't even be programmed in-circuit, and even if they were, it would need to be done in download mode...
My point is, that the ONLY memory which can be possibly altered by the Tech 2 is that 16 bit serial EEPROM. So that means the code is in there.

As for being encrypted - just look at the immo dump. Does that look encrypted to you?
I am 100% sure it is just a two-byte value, little-endian or big-endian, if not plaintext like in the immo ECU.
It's possible to rig up some stuff and brute force the code, but it's way too much work.
The reason they put those codes in plaintext, is because ascii characters are transmitted over the serial connection. So if they wanted to store it in some weird format, they'd have to do some translation in the MCU. They mostly don't do that

As for the anti-theft unit you found - If you want to send it over (postage won't be too bad) and you don't want to charge me a lot for it, I'll gladly have it.
More than that, I'll actually open up that unit and read the chip off it, so we have two dumps, and can compare the differences... If that is even needed - I am pretty sure knowing the code you can easily locate exactly where it is.

[Vega]

Can you tell me where the eeprom is located, photo?
I can take look over here.

[prj]

Can you tell me where the eeprom is located, photo?
I can take look over here.

I don't have a photo, because I already refitted everything to the car.
It's not hard, there is only one chip that is 93C46.

1. Remove the unit from the car (front right side, behind plastic, there are two size 10 nuts holding it on, and two connectors).
2. Open the unit by carefully bending the tabs on each side to allow the plastic casings to separate
3. Pull the board out from the top plastic.
4. Look at the board so that the connector is facing UP, then the EEPROM will be in the LOWER RIGHT corner, next to the only MCU on the board. There will be also a big round metal component on a 90 degree board near/on the top of it. It is SOIC-8, 93LC46B, this is also written on the chip if you look against the light.

Desoldering it will be hard, the problem is there is a metal component in the way, and a small resistor next to it. Also the entire board is dipped in lacquer.
I used the soldering iron to melt the lacquer, and then used paste flux and chipquik to precisely remove the chip... Once you have heated all the 8 pins, it will come away without any force at all with your tweezers.

Before soldering it back, lightly scrub every pad with a needle, because the lacquer will get in there, and then you will have bad contact between the pad and the chip, so the solder can't flow in between.

Hope that helps... and I'll be really grateful if you could provide me with a dump

[prj]

So, this started to become hopeful, with Vega offering to take a look and TheBoy finding a second unit...
And now silence, so back to square 1?

I guess I'll have to start going through breakers.

[TheBoy]

Sorry prj, been busy with friends all long weekend (Monday was a UK holiday), will try to find the security code for the unit I have, but may take me a day or 2 (if you saw my garage, you'd understand )

[Vega]

So, this started to become hopeful, with Vega offering to take a look

Be patience, just ordered a new programmer, it will arrive within a few days.

[prj]

Ok, cool.
Thanks for helping out guys

[TheBoy]

I found the code

Where does the ECU need to go prj?  If you don't need any more, no problem, there is another member about 50 miles away that could do with one for testing a problem he has...

[prj]

I found the code

Where does the ECU need to go prj?  If you don't need any more, no problem, there is another member about 50 miles away that could do with one for testing a problem he has...

I'll take it!
I messaged you with my details.

Thank you!

[TheBoy]

I found the code

Where does the ECU need to go prj?  If you don't need any more, no problem, there is another member about 50 miles away that could do with one for testing a problem he has...

I'll take it!
I messaged you with my details.

Thank you!

I'll get it sent off in the week when I can get to postoffice

[prj]

Very good, one step closer to solving this.
I'll read the EEPROM off of the unit you send me, and compare as well.

Whether I find where the code is or not, I will still be able to fit the unit you send me to the car and get everything to work

[prj]

So I connected the diagnostics again.
Basically the first row of characters in the dump is exactly what is shown in the diagnostics as ECU ID, except it's read 2 bytes at a time, and the high and low byte are swapped.

So we can pretty much rule out any of that being the code, it goes like ES,2442,6916,1200,4700.
Also, it can not address individual bytes, rather it has to always read two bytes at a time, as it is a 16 bit memory.

So if we assume it is an integer and the integer is between 1000 and 9999, and it is stored exactly the same as the string data (the high byte and low byte are swapped), then looking through the dump, we get the following possible numbers:
3855, 2560, 5140, 2590, 1124, 1310, 2077, 4313, 7423, 4096, 4401

I wish I had an emulator for that 93LC chip. I could just see where it stores it's countdown timer and bruteforce it.
Ah well.

[TheBoy]

prj - just to confirm, it is this bit?



Note that the ident may be different, but I think that as long as yours is a facelift saloon, this should work (although you'll have the usual early facelift problem of key out of ignition to open boot).

[prj]

prj - just to confirm, it is this bit?

Yup, it's this one.

Note that the ident may be different, but I think that as long as yours is a facelift saloon, this should work (although you'll have the usual early facelift problem of key out of ignition to open boot).

Yea, I have that problem anyway.
But doesn't matter, I think I can open the boot with the key I have, once I get it paired (I got a 3 button spare).
The biggest ball ache really is not having to take the key out of ignition, but the fact that if I want to put something in the boot I have to first get to the car, get in, then press the boot release button, then get out again, because my remote doesn't work :/

[Vega]

Yea, I have that problem anyway.
But doesn't matter, I think I can open the boot with the key I have, once I get it paired (I got a 3 button spare).
The biggest ball ache really is not having to take the key out of ignition, but the fact that if I want to put something in the boot I have to first get to the car, get in, then press the boot release button, then get out again, because my remote doesn't work :/

You will need the YP ident, than its possible to open the boot with the key in, just hold the boot release button for 3 seconds.
Or modify it with a TIS solution.

Ident release ES ES LT YP

[prj]

Yea, I have that problem anyway.
But doesn't matter, I think I can open the boot with the key I have, once I get it paired (I got a 3 button spare).
The biggest ball ache really is not having to take the key out of ignition, but the fact that if I want to put something in the boot I have to first get to the car, get in, then press the boot release button, then get out again, because my remote doesn't work :/

You will need the YP ident, than its possible to open the boot with the key in, just hold the boot release button for 3 seconds.
Or modify it with a TIS solution.

Ident release ES ES LT YP

Not too bothered about it tbh, more important to get the remotes working
Did you get anywhere with reading the dump?

[Vega]

Did you get anywhere with reading the dump?

No did not receive the programmer yet.

[Grrrrrr]

Yea, I have that problem anyway.
But doesn't matter, I think I can open the boot with the key I have, once I get it paired (I got a 3 button spare).
The biggest ball ache really is not having to take the key out of ignition, but the fact that if I want to put something in the boot I have to first get to the car, get in, then press the boot release button, then get out again, because my remote doesn't work :/

You will need the YP ident, than its possible to open the boot with the key in, just hold the boot release button for 3 seconds.
Or modify it with a TIS solution.

Ident release ES ES LT YP

Not too bothered about it tbh, more important to get the remotes working
Did you get anywhere with reading the dump?

I have an LT ident and don't have to take the key out to open the boot. Or didn't. My unit packed in a month or so back. Now the central locking, courtesy light and boot button have stopped (although boot still opens on key fob.) Oddly enough I tried an SW board in mine (straight swap) and it didn't work at all. Put the original board back in and took the SW board back to the scrappy. TheBoy tried to read my board with the tech2. Nada.

I'll be following this thread with interest to see if I can fix mine afterwards!

[prj]

TheBoy, I don't want to push you around, but do you reckon you can get that unit shipped?

[TheBoy]

TheBoy, I don't want to push you around, but do you reckon you can get that unit shipped?

Was posted a few days ago

[prj]

I received it today... thank you!

[prj]

With that out of the way...

First thing to do is to take the unit off of the car. It is on the right side of the car in the cabin, behind a piece of trim next to the passengers (LHD) or drivers (RHD) right foot. It is held by two M10 nuts, you will need a deep socket to get them off.

Disassembly of the unit is fairly straightforward. There are four tabs on the plastic housing. Carefully bend them away one by one (just a bit, easy to break) and slide the two halves open.
A picture of the tabs:


After you got the board out, the chip will be located on the lower right side, by the big round component that is on a 90 degree board next to it.
It's a SOIC-8 93LC46B, this needs to be removed from the board. The entire board is dipped in lacquer. My original board had a light dip, the one TheBoy sent me, had a real heavy dip, which makes it annoying as hell to get it off. Before removing, note the orientation.
Here is a picture of the board with the chip removed:


Then you just stick it into a programmer. If you have a SOIC-8 adapter, well, congratulations.
I did not, so that meant soldering on 6 wires (2 pins are NC on it).
Here is what it looked like in my programmer:


And finally, read the chip.
Here is the original dump from my unit:


And here is the dump from the unit that TheBoy sent me:


Now, TheBoy told me that the security code for that unit is 0296.
As you can see the last two bytes in the dump in hexadecimal are 02 96:


And that actually is the security code right there. Ripe for the picking.
I went to my car, entered the last two bytes out of my unit (0858), and it logged me right in. Mystery solved and key coded.

Thank you TheBoy for sending me the unit. I must add that he did not take any payment for it, not even for the shipping cost.
Walking up to the car and being able to pop the trunk with the button and lock/unlock remotely after all this time feels so damn good...

[TheBoy]

Brilliant write up prj

[Grrrrrr]

Fantastic. Mine's started working again but with this I should be able to source one on a tip and reprogram if need be!

Cheers,

J

[Grrrrrr]

Assuming you can reprogram the chip, of course. The Stealers here said it wasn't possible but you never know until you've tried. At £400 a replacement unit they haven't got a lot of motivation to try.

J

[prj]

The chip is read-write, yes, but you don't need to do anything with it, except reading it and noting the code.
I don't know if there is a checksum in it or not.

You can always try to change the code and see if it works. If it doesn't, put the old dump back.

[Grrrrrr]

Actually, thinking about it I'm being a donk. Should be able to swap the board and then then just switch the chips with the info in, I think?

So far no issues, which seems odd. Everything still works. Whatever I did, it seems to have cured it.

[prj]

Actually, thinking about it I'm being a donk. Should be able to swap the board and then then just switch the chips with the info in, I think?

So far no issues, which seems odd. Everything still works. Whatever I did, it seems to have cured it.

Yea, you could probably do that.

[TheBoy]

prj - that unit arrived back safe and sound last week (sorry, forgot to mention it when it arrived).

Thanks

[prj]

Glad to know it did, and thank you again for lending it over quite some distance.

[TheBoy]

Glad to know it did, and thank you again for lending it over quite some distance.

No problem at all - we sorted your problem, and learnt something in the process

I'm sure the unit enjoyed its little holiday