Remote key coding

[prj]

TheBoy, I don't want to push you around, but do you reckon you can get that unit shipped?

[TheBoy]

TheBoy, I don't want to push you around, but do you reckon you can get that unit shipped?

Was posted a few days ago

[prj]

I received it today... thank you!

[prj]

With that out of the way...

First thing to do is to take the unit off of the car. It is on the right side of the car in the cabin, behind a piece of trim next to the passengers (LHD) or drivers (RHD) right foot. It is held by two M10 nuts, you will need a deep socket to get them off.

Disassembly of the unit is fairly straightforward. There are four tabs on the plastic housing. Carefully bend them away one by one (just a bit, easy to break) and slide the two halves open.
A picture of the tabs:


After you got the board out, the chip will be located on the lower right side, by the big round component that is on a 90 degree board next to it.
It's a SOIC-8 93LC46B, this needs to be removed from the board. The entire board is dipped in lacquer. My original board had a light dip, the one TheBoy sent me, had a real heavy dip, which makes it annoying as hell to get it off. Before removing, note the orientation.
Here is a picture of the board with the chip removed:


Then you just stick it into a programmer. If you have a SOIC-8 adapter, well, congratulations.
I did not, so that meant soldering on 6 wires (2 pins are NC on it).
Here is what it looked like in my programmer:


And finally, read the chip.
Here is the original dump from my unit:


And here is the dump from the unit that TheBoy sent me:


Now, TheBoy told me that the security code for that unit is 0296.
As you can see the last two bytes in the dump in hexadecimal are 02 96:


And that actually is the security code right there. Ripe for the picking.
I went to my car, entered the last two bytes out of my unit (0858), and it logged me right in. Mystery solved and key coded.

Thank you TheBoy for sending me the unit. I must add that he did not take any payment for it, not even for the shipping cost.
Walking up to the car and being able to pop the trunk with the button and lock/unlock remotely after all this time feels so damn good...

[TheBoy]

Brilliant write up prj

[Grrrrrr]

Fantastic. Mine's started working again but with this I should be able to source one on a tip and reprogram if need be!

Cheers,

J

[Grrrrrr]

Assuming you can reprogram the chip, of course. The Stealers here said it wasn't possible but you never know until you've tried. At £400 a replacement unit they haven't got a lot of motivation to try.

J

[prj]

The chip is read-write, yes, but you don't need to do anything with it, except reading it and noting the code.
I don't know if there is a checksum in it or not.

You can always try to change the code and see if it works. If it doesn't, put the old dump back.

[Grrrrrr]

Actually, thinking about it I'm being a donk. Should be able to swap the board and then then just switch the chips with the info in, I think?

So far no issues, which seems odd. Everything still works. Whatever I did, it seems to have cured it.

[prj]

Actually, thinking about it I'm being a donk. Should be able to swap the board and then then just switch the chips with the info in, I think?

So far no issues, which seems odd. Everything still works. Whatever I did, it seems to have cured it.

Yea, you could probably do that.

[TheBoy]

prj - that unit arrived back safe and sound last week (sorry, forgot to mention it when it arrived).

Thanks

[prj]

Glad to know it did, and thank you again for lending it over quite some distance.

[TheBoy]

Glad to know it did, and thank you again for lending it over quite some distance.

No problem at all - we sorted your problem, and learnt something in the process

I'm sure the unit enjoyed its little holiday