Playing around with the 2.7 software (ECU and TCU)

[JeanLuke]

I think they are all for petrol vehicles.

From what I have read, the petrol ones communicate via the PCI bus whereas the diesels are on the J1850 bus. I have not read anything about encryption for the petrol/PCI comms but the FSM goes into great depth on the encryption for the diesel/J1850 comms.

[Adrian D]

I've been giving this some thought after some second-hand reports of MX5 immobilizer issues:
The main issue with emulators, even if encryption is not a problem, is that you need a functional ECU and key to be able to clone it.

[JeanLuke]

I should add that you can replace the SKIM module with a new one without replacing the ECU. It does require new keys. It also requires a DRB111 tool to program the SKIM. WJ Diag does not do it.

Sent from my moto g( plus using Tapatalk

[JoeTe]

In CRD you can start the engine without immo but instantly detect immo incorrect show the immo light in the cluster and some seconds later stop the engine automatically.

Here you can buy a SKIM bypass... maybe help you in some way
https://cartools.lv/Shop/product_inf...roducts_id=145
https://cartools.lv/PDFs/SKIM_CCD_en.pdf

[JoeTe]

Originally Posted by JoeTe

In CRD you can start the engine without immo but instantly detect immo incorrect show the immo light in the cluster and some seconds later stop the engine automatically.

Here you can buy a SKIM bypass... maybe help you in some way
https://cartools.lv/Shop/product_inf...roducts_id=145
https://cartools.lv/PDFs/SKIM_CCD_en.pdf

I'm thinking that like I said without transponder/or incorrect the car start but after some seconds shutdown and show DTC code maybe just deleting P1685 the immo is "off" and car shutdown the engine through of DTC code good thing to try

[RTB]

Originally Posted by JoeTe

I'm thinking that like I said without transponder/or incorrect the car start but after some seconds shutdown and show DTC code maybe just deleting P1685 the immo is "off" and car shutdown the engine through of DTC code good thing to try

Could be worth a try, but I can't imagine it would work. The DTC are in the flash memory where the maps are we've been playing with. It would be a big security risk to be able to override the IMMO from here.

If true, then to steal the car all you would need to do is - Hotwire the ignition, read the ECU, remove the DTC, write back into the ECU, start the car, drive away.

If you knew what you were doing, that would take minutes.

Edit:- I was hopeful it was going to be this easy, but with the research that JeanLuke has done, it is seeming less and less likely. Which makes sence.

[JoeTe]

Originally Posted by RTB

Could be worth a try, but I can't imagine it would work. The DTC are in the flash memory where the maps are we've been playing with. It would be a big security risk to be able to override the IMMO from here.

If true, then to steal the car all you would need to do is - Hotwire the ignition, read the ECU, remove the DTC, write back into the ECU, start the car, drive away.

If you knew what you were doing, that would take minutes.

Edit:- I was hopeful it was going to be this easy, but with the research that JeanLuke has done, it is seeming less and less likely. Which makes sence.

Steal the cars is very easy and quick sadly... vag cars you can immo off pluging a simply OBD like ELM327... it take seconds... in others cars just put obd system and you can make you own immo in seconds... and of course brands know it

SKIMM not was created for bosch ecu so they need to do any adaptation to "work". Normally in edc15 when you put the key without immo the engine dont start but in our vehicule the engine start (so dont work with injectors or starter engine) and after of start DTC comes and shutdown maybe dont work but I think is a good thing to try. Probably there are some ways to do immo off