Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[prj]

I have a problem with coding a key to my Omega-B FL.
Tried various tools, including universal locksmith tools and I get the same problem.

I bought the car pass from my dealer in digital form, it came with three codes - key mechanical, radio, immo (I guess "immo" is the security code?).
Now, I can use the "immo" code to log into the immobilizer and code keys.
However, if I go into the anti theft warning system, I can not login using the same code. It just says that the PIN is invalid.

From everything I have read, and from Locksmith experience, the PIN between the anti-theft warning system and the immobilizer should be identical.
It is not the case for me, however.

What could be the problem? Are the ATW control units prone to failure by any chance? Could it be that someone replaced the unit on my car?
And this will probably not answered - but does anyone know if I can open the unit, dump an EEPROM and find the pin in there? I have all the equipment...

[Kevin Wood]

Normally the same security code works for both systems so yes, it does sound like the ATWS ECU might have been swapped, although I can't recall ever hearing of one fail, so I doubt it's a common problem.

I have no idea how the unit is coded internally, so not sure if your proposed solution would work.

Do you have the keyfobs from this ATWS? Are they repairable? (normal failure is buttons and/or battery holder. Both easy to replace.)

[prj]

I have one key, I re-soldered the battery holder, and there is a voltage on both ends, however it fails to work.
If I hold a button for a really long time, sometimes I will get the activation message in diagnostics.

Tbh, I'd rather just get this coding procedure to work, as I have a perfectly valid working key, which gets detected in measuring blocks every time I press a button, but as it's not coded to it, it fails to work.

I dumped my immo EEPROM and the security code was in plaintext.
Currently I have a "Security Wait Time" on the ATWS, so I left ignition on the car, I'll go and see if that clears within 1h20 min.
I didn't actually check if I had a Security Wait Time before I tried programming, but I've had this car for a while.

I am guessing if the immo EEPROM had the code in plaintext, it can't be that hard to find the code for ATWS either.
Do you know what the procedure is by the dealer to replace the ATWS? Could someone look it up in the system?
Are they ordered from factory for a certain car by VIN code pre-programmed? Or are they programmed with the security code on the car?
I am thinking that if I could get EEPROM dumps from two ATWS units, it'd become a cakewalk to figure out the code location.

My dealer is fairly useless in this regard, if they won't be able to log in, I am for some reason quite sure they'll just say "the ATWS is broken, you have to swap it"

[prj]

Waited for the security wait time to run out, tried again, wrong code.

My only conclusion then is that the ATWS module has been replaced.

Does anyone know where exactly it is located?
The picture shows http://www.autopro.spb.ru/articles/00000014/AstG_ATWS05.jpg towards the right fender.

If this is true, I am pretty sure the car was hit into the right fender at some point, so that would be logical...

[prj]

http://i9.photobucket.com/albums/a59/Hillper/IMG_2050.jpg

That answers a few questions.

So I guess I just remove the unit and look inside then.
I see no other solution apart from swapping in a unit from a car that is being broken, with a car pass.

Of course if someone has one left over (there are a few part numbers there), and has the car pass for it, I'll happily take it off your hands so I don't have to waste my time with this...
I am pretty sure the only way to get the code will be through reverse engineering

[prj]

I know that no one probably cares, but a dealer in another city said they should be able to read the anti theft warning system's VIN code via Tech 2, then I'd have to pay for the car pass for the car it was lifted from.

I know the immo module displays the vin code, but does the ATWS also do that?
Maybe someone with a Tech 2 can comment.

I don't want to go and waste money.

[TheBoy]

prj - I would need to check this. No in a position to do so until the weekend.

Can I just confirm its the ATWS, and not the immobiliser, that you are having trouble with?

I *may* have an ATWS here, from a 2000 facelift, but guess postage would be cost prohibitive.  I'd need to find it, and more importantly, the code!


The problem does sound like the sort of damage that a common, not-legal in the UK, Opel specific diagnostic tool does to these ECUs - seen 3 like this now.

[prj]

Postage will be 10 quid if you just send it with Royal Mail, don't worry about that.

I took the unit out of the car. Basically the bit of trim was only shoved in place, no screws, nothing.
Some tabs on the unit are broken, someone has been in there.

The entire board is dipped in red laquer, and I think this is factory, there are no soldering marks.
I think the board has been changed and the case left in tact. I can not explain it otherwise.
The manufacturing date is also early 1998 on the board, while my car is 2000.

Also, I finally squeezed enough info from the dealer, the ATWS needs to be coded to the car when it's installed and that procedure can only be done once.
Well, yeah, my friendly 93C46 programmer can do it as many times as I like, but the problem is, that I don't know the format of the dump.

There is a MCU and 93C46 on the bottom right corner of the board. Everything else seems like buffers, and radio transmitting related devices.
I will desolder the 93C46 (need to get through the lacquer) and read it with a programmer. Let's see what's inside...

P.S.
Yes, I am talking about ATWS. Immo is real easy, if you read the EEPROM the security code is in plaintext

[prj]

Chip is a 93LC46B, 16bit.
MCU is a M37733 mitsubishi.

Got the chip off as well, the lacquer is a bitch, gets in the way of everything, resoldering will be fun...
I don't have a SOIC8 adapter, so I had to just solder on wires, not fun.

Anyway, here's the contents of the chip:


And as a comparison, the immo chip, the security code being 3922 for this car:


Doesn't look that easy in the ATWS.
I wish I had a second dump to compare. The changed bytes would show where the code is.
Or maybe there some sort of tool that can extract the code from the dump.

[prj]

I am going to solder that thing back on for now and put the block back in my car so central locking works...

I can't find any info anywhere on the web, any dumps, anything for the 93LC46B. And I am 100% sure that this chip contains the pin code, because it is the only programmable memory on the board.
The processor only has ROM, it's one time programmable as far as I can see...

There are two ways to get the code:
* A serial EEPROM emulator with address hit tracing, and watch it like a mofo when you enter the code (it'll probably access it at that point)
* A second dump from a similar block, and then compare them

I don't have a serial EEPROM emulator, only parallel ones, and I don't have a second block. I'm screwed

[prj]

Soldered it back on, connected unit to car, car starts flashing blinkers, central locks don't work.
Took it back out, looked with a magnifying glass, sure enough all that lacquer made sure one of the pins wasn't soldered on properly.
Cleaned, re-soldered, re-connected to car, works...

At least I see why these are not known to fail, that thick lacquer dip takes care of most moisture.
Still not gotten anywhere with the code for the damn thing...

I guess I could try to visit the local breakers and get another of these things, then dump it...
But if someone has a block from a car with a car pass, I'll take it off your hands.

[TheBoy]

Wonder if the code is on the controller's ROM, as a 1 hit only program?  If its in that flash dump, I guess its well encrypted

I found the ATWS unit, just need to dig out code, so that may be a way out for you if postage isn't that expensive?

[prj]

Wonder if the code is on the controller's ROM, as a 1 hit only program?  If its in that flash dump, I guess its well encrypted

I found the ATWS unit, just need to dig out code, so that may be a way out for you if postage isn't that expensive?

It's not in the ROM. The unit comes from factory, then it can be adapted once, when it is first fitted to the car.
The ROM is just that. Read only memory. The ROM is programmed in those processors once, and that's it. The data sheet does not mention any flash memory, so I am guessing those things can't even be programmed in-circuit, and even if they were, it would need to be done in download mode...
My point is, that the ONLY memory which can be possibly altered by the Tech 2 is that 16 bit serial EEPROM. So that means the code is in there.

As for being encrypted - just look at the immo dump. Does that look encrypted to you?
I am 100% sure it is just a two-byte value, little-endian or big-endian, if not plaintext like in the immo ECU.
It's possible to rig up some stuff and brute force the code, but it's way too much work.
The reason they put those codes in plaintext, is because ascii characters are transmitted over the serial connection. So if they wanted to store it in some weird format, they'd have to do some translation in the MCU. They mostly don't do that

As for the anti-theft unit you found - If you want to send it over (postage won't be too bad) and you don't want to charge me a lot for it, I'll gladly have it.
More than that, I'll actually open up that unit and read the chip off it, so we have two dumps, and can compare the differences... If that is even needed - I am pretty sure knowing the code you can easily locate exactly where it is.

[Vega]

Can you tell me where the eeprom is located, photo?
I can take look over here.

[prj]

Can you tell me where the eeprom is located, photo?
I can take look over here.

I don't have a photo, because I already refitted everything to the car.
It's not hard, there is only one chip that is 93C46.

1. Remove the unit from the car (front right side, behind plastic, there are two size 10 nuts holding it on, and two connectors).
2. Open the unit by carefully bending the tabs on each side to allow the plastic casings to separate
3. Pull the board out from the top plastic.
4. Look at the board so that the connector is facing UP, then the EEPROM will be in the LOWER RIGHT corner, next to the only MCU on the board. There will be also a big round metal component on a 90 degree board near/on the top of it. It is SOIC-8, 93LC46B, this is also written on the chip if you look against the light.

Desoldering it will be hard, the problem is there is a metal component in the way, and a small resistor next to it. Also the entire board is dipped in lacquer.
I used the soldering iron to melt the lacquer, and then used paste flux and chipquik to precisely remove the chip... Once you have heated all the 8 pins, it will come away without any force at all with your tweezers.

Before soldering it back, lightly scrub every pad with a needle, because the lacquer will get in there, and then you will have bad contact between the pad and the chip, so the solder can't flow in between.

Hope that helps... and I'll be really grateful if you could provide me with a dump