Cloning remote controlled car lock - Page 1
Forum section: electronics / projects

author: casper.bang
author_rank: Frequent Contributor
timestamp: September 26, 2013, 06:59:59 pm
content: I just bought my first (used) car with a central locking system, though the key with the remote had been abused and could only lock, not unlock the car. Taking the key apart, I found the problem to be an SMD (smallest 2-by-2 poles I have ever seen) button which had come completely off the board.I tagged it in place with some glue and with my 6x hand-held magnifier, carefully placed the ultra tiny terminals the best I could. Luckily I had a clean pointy soldering tip, but it was damn hard to apply so little solder tin, even my thin 1mm seemed 3-4 times too thick for the task.Anyway, it turns out it worked. I also found new rubber buttons and key house on ebay, currently on the way, so now apparently I saved the $400 the mechanic wanted for installing a new key-system, which feels great.I'm curious as to how these systems work. I see a 433.94 xtal, so it obviously uses the ISM band. The HCS361 chipcan be looked upto reveal interesting stuff as well.If I wanted to construct a second key or implement some auto-lock at night, how hard would this be? It's 13 years old technology, I can't help thinking lots of people will have tried this?!

author: HeyTom
author_rank: Contributor
timestamp: September 26, 2013, 07:49:11 pm
content: It's great you were able to fix it, but I think your problem with creating another key is in the chip summary."The encoder key, serial number, and configuration data are stored in EEPROM, which is not accessible via any external connection."The receiver is going to expect all that. But for remote lock triggering, I'm sure you could wire a relay to the inside door lock button and use cheap wireless module to trigger it. For auto-lock-at-night it might be secure enough.I recently used such a module to add a wireless doorbell. On the receiver side I used a pic10f200 to listen for the specific doorbell code and trigger the relay twice.

author: SeanB
author_rank: Super Contributor
timestamp: September 26, 2013, 08:29:20 pm
content: Toyota.............. just last month spent a week putting the key back together after it fell apart. 1 tube of 2 part flexible black epoxy and a lot of fine work with a needle file and knife to put the bits of broken plastic together. I did buy a new back cover for $10 for it, was cheaper and faster than trying to put the bits back into one pieceThis is a rolling code system, and along with implementing the rolling code the engine controller is part of the remote system. To buy a spare key costs $300 for the basic key cut according to the VIN number of the vehicle. then you pay the dealer to match the 2 together.

author: casper.bang
author_rank: Frequent Contributor
timestamp: September 26, 2013, 08:33:47 pm
content: Thanks for the feedback guys. I guess the project isn't really worth pursuing... although I did find aninteresting whitepaper.

author: SeanB
author_rank: Super Contributor
timestamp: September 26, 2013, 08:41:17 pm
content: Poor implementation of Keyloq is the problem, along with it being a few decades old by now.

author: Balaur
author_rank: Unknown
timestamp: September 26, 2013, 08:50:26 pm
content: Disclaimer: I don't know if the following is possible on your car.OR you can buy another key (blank, i.e. the blade is not cut) and go to the car dealer to reprogram the car security ECU to accept the new key. You may not like the price though. (They can also sell keys and you will definitely not like the price)The key blade can be cut (copied from the one you have) by any locksmith.PS: This is what I'm doing on my cars, btw. I've bought a diagnostic and security tool (from China of course, not too expensive) and it's able to talk to my Rover/MG cars (which is rather extraordinary). One of its functions is to reprogram the security ECU to accept a new key and to transmit to the engine ECU that everything is OK and the engine can be started. I've bought a newish remote from a car breaker and a blank key from ebay.

author: Crazy Ape
author_rank: Regular Contributor
timestamp: September 26, 2013, 10:32:51 pm
content: Quote from: casper.bang on September 26, 2013, 08:33:47 pmThese two are full of good info as well.Between the two, you have what you need. The second one even has source-code (last page) for a Decryption Program in PIC assembly.A Practical Attack on KeeLoq.http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.7835&rep=rep1&type=pdfBreaking KeeLoq in a Flash.http://www.emsec.rub.de/media/crypto/attachments/files/2011/03/africacrypt2009_keeloq.pdf

author: poorchava
author_rank: Super Contributor
timestamp: September 27, 2013, 06:51:45 am
content: In most cases key is not programmable. The car body ECU is. You need a diagnostic interface to program a new key into the ECU, for which you usually need some kind of code. For most cars it's possible for change the security code by reprogramming the nonvolatile memory. If your car is a popular model or at least the ECU is bound in some popular model there is a good chance you can find the memory map on the internet.

author: amyk
author_rank: Super Contributor
timestamp: September 27, 2013, 11:12:08 am
content: Many cars will accept more than one remote (of the same type) to be "paired" with the receiver; there's a procedure to pair them that usually involves turning the ignition switch on and off a few times - Google for your specific car model to find it.(What the official dealers charge for these remotes and the programming process is ridiculous - an HCS361 is not much more than $1 and the protocol is documented very well by Microchip themselves.)

author: poorchava
author_rank: Super Contributor
timestamp: September 27, 2013, 12:54:23 pm
content: Of course you can program multiple remotes. In the past every car came with 2 remotes, and they had different numbers, codes etc. I bwelieve AL cars can accept more than one code (there might be upper limitation though).

author: GeoffS
author_rank: Unknown
timestamp: September 27, 2013, 01:08:32 pm
content: My vehicle doesn't have a remote but does have a passive transponder chip in the key which is needed to start the engine.Dealer method for spare key is to provide one with a new code and program the ECU to accept it - cost about $A200. The ECU can hold the code for 4 different keysA locksmith with a suitable key cloner just reads the code from the existing key and writes it to the newly cut one - cost around $A170.I'm sure the read/write mechanism would not be that difficult to do emulate. A suitable chipped key bank can be had for about $A5

author: peter.mitchell
author_rank: Super Contributor
timestamp: September 27, 2013, 02:54:58 pm
content: Quote from: GeoffS on September 27, 2013, 01:08:32 pmUghk, fucking car keys.I recently bought a Ford BA Falcon, only came with one key, no remote, so must have been a spare key. To add a new key, you need to "authenticate" the new key, by providing at least 2 already "authenticated" keys, I only have one. Cost $200 for a key + remote and an additional $400 from the dealership to ""manually"" add the new key. Bull. fucking. shit.

author: GeoffS
author_rank: Unknown
timestamp: September 27, 2013, 02:58:25 pm
content: Quote from: peter.mitchell on September 27, 2013, 02:54:58 pm$400 for a Ford! And I though Mercedes were bad. Dealership == Stealership.

author: peter.mitchell
author_rank: Super Contributor
timestamp: September 28, 2013, 04:58:31 am
content: Quote from: GeoffS on September 27, 2013, 02:58:25 pmYeah, it's unfortunate that the locksmiths/3rd partys dodn't have the required equipment, it most certainly would be cheaper.

author: BravoV
author_rank: Super Contributor
timestamp: September 28, 2013, 05:13:51 am
content: Quote from: peter.mitchell on September 27, 2013, 02:54:58 pm+1, been there too when wifey lost a nissan smart key, had to go to the dealer, bought the new key, went thru registration, authentication and of course big lump of money after selling one of my kidney.

author: G7PSK
author_rank: Super Contributor
timestamp: September 28, 2013, 04:34:01 pm
content: Stealership just about sums it up. I bought a new VW, about 9 months on a rear window motor failed, so for some reason they disconnected the battery, I got a call asking me for the radio code I replied I thought they had it, apparently the code is on a sticker on the radio in a new car and the purchaser is supposed to stick the sticker into the hand book and or make a note of the code. Before the car was delivered it was valeted by the dealer, why a new car needs this I don't know but it was and the stupid cleaner removed all stickers including the radio code, the dealer wanted to charge me £50.00 to remove the radio and look up the number on VW web site, I told them it was their fuck up and that I was not going to pay for it after much arguing in which the MD was contacted they relented and I did not pay.

author: SeanB
author_rank: Super Contributor
timestamp: September 28, 2013, 04:42:41 pm
content: If you have seen how the card look after the delivery shipment a valet will not be out of the question. Then again I have called the dealer principal a few times for certain vehicles shipped in then driven to the dealerships, always to complain about the drivers speeding, running red lights ( saw a brand new Hyundai Atoz get totalled by that at work one morning, and the other party being the military was not going to pay out for the costs) and otherwise abusing the vehicles. Have had a few drivers fired for that. You would think having a big sign hanging in the windows with a number and a phone number would help them remember the vehicle they are driving is the property of somebody else who might not appreciate the way they are driving.