Technical unlock key from ecu

[koalar]

I think your only option is to have the ECU "virginised" - put back to factory settings. This wipes all data stored (a) when it was first powered up in the car and (b) the key data. The ECU will then lock itself into the car when first powered up and you will be able to add keys.

its not the only only way.

all the information is held in a standard EEPROM in the body computer

its possible to read, save as a bin file, modify and write back

the equipment to do this with the body computer off the car isnt that expensive. But most locksmiths will not tell you how to modify the bin file. They would be doing themselves out of businesses

or the equipment to do it via a graphic interface is going to cost several grand.

 

[DaveMcT]

Search using Duck Duck Go found these

anyone know how to virginise an ecu? | FIAT Stilo

can anyone help me please, i need to virginise a secondhand ecu i have and i don't know how.:chin:

www.fiatforum.com

https://mhhauto.com/Thread-Help-on-how-to-make-an-ECU-virgin-from-used

ECU - VIRGIN Procedure - ecufile.net

ECU - VIRGIN Procedure procedure or files

www.ecufile.net

 

[koalar]

Search using Duck Duck Go found these

anyone know how to virginise an ecu? | FIAT Stilo

can anyone help me please, i need to virginise a secondhand ecu i have and i don't know how.:chin:

www.fiatforum.com

https://mhhauto.com/Thread-Help-on-how-to-make-an-ECU-virgin-from-used

ECU - VIRGIN Procedure - ecufile.net

ECU - VIRGIN Procedure procedure or files

www.ecufile.net

not sure how useful
the key information is stored on the body computer ? not the ECU

 

[DaveMcT]

not sure how useful
the key information is stored on the body computer ? not the ECU

The FF thread shows @yellowstilo is a donated member so he should be contactable.

But it's a start point for the OP to do his own search. It looks like car maker ECUs (Body Computer - whatever) simply use whatever tech is provided by their supplier. In the context of those URLs they are all ECUs. The appropriate EEPROM has to be removed, hacked and put back.

 

[A3jeroen]

Have you given the guys in Heerhugowaard (or even YellowStilo Gert is his name) a call.
Not that you are re-inventing the wheel or something...

gr J

 

[koalar]

there seems to be some confusion
were talking about programming key not changing the ECU
the key information is stored in the body computer
you need a blank ECU when you change the ECU as it has to match the body computer. We are not changing the ECU. If blank it will then copy the correct info back on First power up

You can get all the information to program a blank key via the OBD2 connector

the only 2 tools I know that can pre program a remote I have already mentioned

but there's shed loads that can just start the car via the obd2 connector not just cloned but pre programmed

https://www.youtube.com/results?search_query=fiat+all+keys+lost

so if you are doing this as a business no problem pay the money get the correct tools. Several grand for remote and a couple of hundred for engine transponder

now if you want to do this on the cheap, its possible. The information is stored on the body computer EEPROM the programmer for reading it is around £20 a clip to read it in situ another £20 then a programmer to write the information around £30. Then you will need some software to convert all the numbers in the dump file into something more readable, no idea. Then the hard bit. Someone to show you where the relevant data is stored.

Your going to be close to £100 by the time you add some blank transponders and no gaurentee of success.

spend a couple of hundred and buy a tool and transponder to program a key to start the car

spend a few grand on the tools and a remote to have a working flip key

Or give an auto locksmith £50 and have a working key in minutes. If you key is now working they should be able to add it using there software for around the same price

or give an auto locksmith £200 and have a working remote.

that's how I see it but I could be wrong

 

[dagdromer]

I like the discussions on this. I know the thread is a little going back and forward so maybe a small recap in what I want to achieve.

I have a car with 2 keys, one with a fob one without. the simple key is working fine. the fob key is opening the doors and sending a signal but is marked as blocked in the BSI/ECU and will not start the car or open the car remote. I want that key to be unblocked so I have 2 working keys and a working fob.

Basic tooling like MES or more generic DELPHI Cars cannot perform that task. Getting information on what tools are required and how it should be done is a slow process. Some people say you need to virgin the ECU while others say that the key information is stored in the BSI so you need to read the EEPROM and modify the content. And there reacted people on that the key data in the BSI also is hashed so you need the correct parameters to make a new hash when you alter the data. Cost of this can be quite high as user friendly tools are easily around the 500 euro mark.

I'm willing to pay a fair amount of money to get tooling as this just because I'm interested into this kind of stuff but I need some help in what to get and how to start.

Whilst gathering information I still have a car that only has one working key. To get a second key I can get the simple key cloned by a locksmith, that will cost around 75 euro. money that is thrown away when I get the key with fob working again. So I was looking for a cheaper solution to get 2 working keys.
Because of that I asked the question if the transponder in the simple key also requires precoding so it matches the car. I hope it does not and that with MES I can add a new transponder to the car and temp glue that in the fob key housing.

 

[DaveMcT]

The immobiliser transponder is a simple passive chip the can be swapped from key to key.

 

[dagdromer]

So I can grab an old non remote key from the scrapyard, take the transponder out and add that transponder with MES to my car. And then when I take the battery out of the fob and put the "new" transponder in the fob housing it should start the car.

 

[koalar]

So I can grab an old non remote key from the scrapyard, take the transponder out and add that transponder with MES to my car. And then when I take the battery out of the fob and put the "new" transponder in the fob housing it should start the car.

don't quote me here I could easily be wrong as I haven't tried myself

but as far as I know the transponder in a Panda is precoded using unique data that's specific to the immo which is then written to the key before it can be matched to the car.

unlike VW where the data in the key is generic, fiat key are tied to the car and can not be reused

 

[koalar]

The immobiliser transponder is a simple passive chip the can be swapped from key to key.

incorrect the transponder is tied to the immo information stored in the body computer

its possible to read the information via OBD2 connector without removing it

FiatPrecoding

Fiat Transponder precoding Each Fiat model has a 5 digit pincode. In order to program keys into a Fiat you must know what this pincode is. The HT2 software will read it directly from the vehicle for you. Before any transponder can be programmed into a bladed key Fiat system, it must be...

halkyardtech.com

some other cars use generic information in the transponder so this would be possible but not for the Panda

 

[dagdromer]

Update time,

bought a zed-bull key programmer and 2 correct fiat transponders, hoping that this would clone the simple key. Obviously it did not. the zed-bull requires data from the BSI to create pre-coded transponder that later can be added to the bsi using MES (or any other tool). The precoding requires the use of another software tool that works with the zed-bull, called EFFI.

To get a data dump from the BSI you need a programmer that can reed the BSI EEPROM. There are many alternatives in various prices, i have chosen voor UPA simply because it is the cheapest (less than 50 euro's including shipping).

Soldered the required wires on the BSI PCB and got a dump. With that dump you can calculate the security code with EFFI, this will give you some guarantees that the dump was correct. Then you can precode the transponders. I tried it 2 times and both attempts where successful according to EFFI but when I wanted to add them to the car it complained about incorrect transponder...

So that was a fail. But since i got the BSI dump and both the transponder Id's for the official keys it was time to compare some data. You can find on the internet several websites that help people to read their security code from a BSI dump. They post their dump on the internet and that helped me a lot identifying where in the dump the key related stuff was placed.

I found the area where the active keys where stored and where the banned ones are and as a third a set of data what seemed a list of total keys, blocked, active etc. I altered my BSI dump to what I thought should work. As a additional failsave loaded the new BSI dump into EFFI to check if the security code was still the same, it was. Then used the option to identify keys in the programming part. before my edit I only got one key found (the working one) and now it spotted 2 keys and Identified my locked key as number 2.

I said my prayers, and pushed the write button in UPA and wrote my own BSI dump into the EEPROM. No errors. So connected everything back up in the car and... Victory both keys are starting the car. MES does not see any locked key anymore.
The only downside is that the remote does not seem to work. I need to figure out if it is not sending data or that it is related to the BSI programming.

Does anybody know if you need to perform any additional operations when learning the keys into car to make sure that the fob is working. MES does display a fob and it is connected to the correct key id.

 

[DaveMcT]

Just to add -
The immobiliser transponder is a passive chip in the key fob. When you need a new fob (e.g. worn out switches, etc) you simply swap the key blade, electronics board and transponder chip. Everything that matters is the same but you now have a key with working switches.

 

[dagdromer]

the chip is soldered onto the pcb, it is the pcf7946. but indeed the car starts without the battery in the housing.

 

[koalar]

the chip is soldered onto the pcb, it is the pcf7946. but indeed the car starts without the battery in the housing.

correct

 

[dagdromer]

It seems I was impatient as I got to the car just yet and the remote is working perfect so problem solved.

 

[judderbar]

It seems I was impatient as I got to the car just yet and the remote is working perfect so problem solved.

I was fortunate on my 2004 punto I was able to clone my ECU and potentially can virginise the ECU very simply by downloading the eeprom file using free software created for VW enthusiasts and changing it using a simple hex editor. I can even do this from the obd2 port by adding a wire to the ECU plug.

 

[dagdromer]

I was fortunate on my 2004 punto I was able to clone my ECU and potentially can virginise the ECU very simply by downloading the eeprom file using free software created for VW enthusiasts and changing it using a simple hex editor. I can even do this from the obd2 port by adding a wire to the ECU plug.

Are you willing to share the program and the virgin files? now I got into it, would like to see if I can create something simular to virginise the BSI so that you can add new keys.

 

[judderbar]

Are you willing to share the program and the virgin files? now I got into it, would like to see if I can create something simular to virginise the BSI so that you can add new keys.

I am interested to know what you come up with regarding the body computer as it annoys me my punto BCU cannot be duplicated as a back up. Doing that for the ECU was in the end surprisingly easy. It is about 5 years since i did this. I was very strongly motivated to have a way to swap out my ECU if it died on me but otherwise i have no expertise in this area. I was a mid range computer programmer but dont really know much about computers.

ME7 EEPROM programmer

ME7 EEPROM programmer

nefariousmotorsports.com

The Me7 ECU is a hybrid ECU.

But I just noticed this:

ME7 EEPROM programmer

ME7 EEPROM programmer

nefariousmotorsports.com

The eeprom reader tool enables you to download your file and modify it or in my case simply do a straight copy to the same type of ECU.

With my cloned ECU the keys worked same as before. Ie with no other changes, just copying the ecu eeprom to the spare ECU enabled me to start and operate the car normally.

Edit: From reading your comments it appears I can read my body computer eeprom without removing it by adding wires and then I can copy to a backup body computer but I think I have now got to an age where I am not likely to risk doing that just for a back up.

 

[DaveMcT]

Do you think this would allow a 100HP body computer to work with a Multijet engine? I have a 100HP that was a Cat (whatever) right-off and a Multijet that needs the engine cam chain fixed. Combining the best of both would be a nice idea.