MR2 SpyderChat banner

1 - 10 of 10 Posts

·
Registered
Joined
·
5,596 Posts
Discussion Starter #1 (Edited)
I had too much time on my hands.. and found this in my Immob searches

http://qcwo.com/otherdeal/Software/2005-2007-Toyota-Corolla-Immobilizer-Virgin-Dump

This is the Chip that houses the Programmed Key Info.. It's located inside the ECU housing, and is read by the Engine computer during key insertion..

They are selling the Chip already Programmed, and you solder it in.. or they will sell you the Virgin Hex Dump, and you burn it into the existing chip.. but you need a Programmer ( Hardware ) to do it.. Or they will take your ECU and for $100 put a Virgin Dump into it for you.. then the Next time it's powered up, that key will be the master..

I thought it was time that this information was posted..

EDIT:.. ECU Swap Info..

If you are Swapping ECU's and need the information from your keys to be in the 'New to you' ECU, you can always take your old Chip IC900, and MOVE the chip into the New ECU..

This has been done for converting a SMT car over to a MT Car, and then move the chip over to the new MT ECU.. it has also been done for installing Key information into a European Celica ECU ( 2ZZ Swap ) that did not have keys with it.. your 'Key Information' will be in the IC 900 Chip, and if the new ECU is Immobilizer equipped, by moving the chip over to the new ECU, your key information will move also.. ( Not for the Faint of heart )

EDIT.. Programming Information..


First step buy and ic programmer and a 8 pin soic clip so you don't have to unsolder anything. Then remove ecu from car remove the four screws from top and two more after you remove cover flip board over look for board address ic900 load the .bin file to you ic programmer software and connect the soic clip to the chip then re-flash.Then put everything back the way you found it. You will need three keys for light to shut off on older Toyota's two master and one valet. don't turn car on just put key in key way and wait two seconds then remove key then add the other keys by doing the same.
EDIT: the First key inserted ( as long as not only one is Inserted ) will be Programmed as the Valet Key. Make sure if you have a Key that is cut as a Valet Key, it is inserted First.

This is the Virgin Dump, for the Ic900.. Buffer dump

PG4UW - universal program for BK PRECISION programmers, version 2.75j/01.2011

Date: 9.June 2011 Time: 19:25:35

Selected device: Microchip 93C56 [SOIC8]



Buffer content from address: 00000000h, to address: 00000087h



Address +0 +1 +2 +3 +4 +5 +6 +7
-----------------------------------------------------------------------
0000000000 0000 0000 0000 0000 0000 0000 0000 0000
0000000008 0000 0000 0000 0000 0000 0000 0000 0000
0000000010 0000 0000 0000 0000 0000 0000 FF00 0000
0000000018 0000 0000 0000 0000 0000 FBDF 0000 0000
0000000020 0000 0000 0000 0000 0000 0000 0000 0000
0000000028 0000 0000 0000 0000 0000 0000 0000 0000
0000000030 0000 0000 0000 0000 0000 0000 7770 0000
0000000038 0000 0000 0000 0000 0000 0000 0000 0000
0000000040 0000 0000 0000 0000 0000 0000 0000 0000
0000000048 0000 0000 0000 0000 0000 0000 0000 0000
0000000050 0000 0000 0000 0000 0000 0000 FF00 0000
0000000058 0000 0000 0000 0000 0000 5A69 0000 0000
0000000060 0000 0000 0000 0000 0000 0000 FF00 0000
0000000068 0000 0000 0000 0000 0000 0000 0000 0000
0000000070 0000 0000 0000 0000 0000 0000 7770 0000
0000000078 0000 0000 0000 0000 0000 0000 0000 0000

EDIT Update:.. And to add to the Information of how to do it..

Of all the Information I have been able to gather.. the Two Options I have Found are..
1) Remove the Chip from the ECU, and Program it in the Burner with a Virgin Code..
2) Use a 'Chip Clip' to hook to the Chip while it on the Circuit Board.. and Program it there..

My Results..
1) Upon Further reading, unless you have VERY Expensive Soldering Tools for removing the Chip from the Board.. your Chances of getting it off, and back on and NOT Broken.. are ZERO.. So I Opted to not try that for my first go-around..
2) Purchase a Chip Clip that was for Hooking to the Chip.. to Program.. WELL.. while the Chip is in the Board.. and the Board is Covered with the Anti Fungus Covering.. not much can get through.. Not even the Contact for the Clip.. I tried to Scratch off the Coating.. I Got the Coating Off.. but was unable to get the Clip to Conect to all 8 Pins.. and the Solder made a 'Ramp' that prevented the Clip from hooking to the Chip.

So I came up with Option 3..

Solder Jumpers to each of the 8 Pins of the Chip.. and take the 8 Wires to a header Jumper that will Plug into the Programmer ZIF Socket..

Here is the Pics..

Wires on the Chip..



Wires going to the Programmer..


I also came up with an Unusual Problem.. SOMETIMES on SOME ECU's I can not Erase/Read or Program Correctly.. Even though the Wires are Hooked up properly..

The Solution.. Power up the ECU, then Power it Down.. I have Test Plugs on the Bench.. So I can Do it from Inside the House..

Then the Chip will Read/Verify/Program with no Problems.. Not sure what that is about.. but I have a Work Around for it.. so Problem Solved..

EDIT Again: One other problem has Surfaced.. This programmer has a default set up where it will electrically 'Taste' the leads of the E-Prom chip, to see if all is hooked up properly. As of late, the 'Taste' is different, and the Programmer thinks the leads are not hooked up properly.. Even with the Chip Removed from the Board ( yes I was able to do it.. and get it back on )..

The fix for this new problem, is to not 'Verify Leads' before programming.

All is well again..

After the ECU is Virginised, it will be in “Automatic Registration Mode”. The ECU is expecting that it will encounter 3 new keys. The first two keys are designated as MASTER keys and the 3[SUP]rd[/SUP] key inserted will be designated as the VALET key. The ECU can be programmed with as few as 1 key. If less than 3 keys are programmed into the ECM the security light may flash for some time (hours to weeks) until the ECM “learns” that it is apparently not going to get any more keys.

If you are programming 3 keys:

  1. Close all doors and windows.
  2. Lock the driver side door with the key.
  3. Unlock the driver side door with the key.
  4. Insert first transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove first key from ignition.
  5. Insert second transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove second key from ignition.
  6. Insert third transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should go out after a few seconds. Remove third key from ignition.
  7. Wait 30 seconds for the programming cycle and programming mode to close.
If you are programming less than 3 keys:

1. Close all doors and windows.
2. Lock the driver side door with the key.
3. Unlock the driver side door with the key.
4. Insert key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 15 seconds and remove first key from ignition.

  1. If you are done proceed to step 6 below. If you want to add another key proceed to step 4.
  2. Press brake pedal 5 times to exit programming mode.
NOTE: If less than 3 keys are programmed into the ECU the security light may flash for some time (hours to weeks) until the ECU “Gives up”.

To determine if the key(s) have been properly programmed into the ECU you may utilize the following procedure:

  1. Locate the “security” light. This light should blink when there is no key in the ignition or if an unrecognized key is placed into the ignition.

  1. Insert the key you have into the ignition – DO NOT TURN ON. There are 3 possible things that may occur:
(a) Security light continues to blink = unrecognized key.
(b) Security light goes off IMMEDIATELY = MASTER key
(c) Security light remains illuminated for 1-3 seconds before going out = VALET key

  1. Repeat step 2 for each key that you have programmed into the car.
If you have a condition where the security light continues to blink for any of the keys, that key has not been properly programmed or recognized by the car’s computer.

If the security light goes out immediately (master key) or after 1-3 seconds (valet key) then the keys have been properly programmed into the ECM and you should be able to successfully start and run the car.

Cap
 

·
Registered
Joined
·
5,596 Posts
Discussion Starter #2
Look what I found in Internet Hack Searches..

http://forums.hackaday.com/viewtopic.php?f=2&t=5596

2nd to the last line references this Forum Topic..

He has taken this A lot farther than I did..

I will add this from another post I did on the actual hardware involved in the read''

1) The Codeline Term 2 on the reader, and Term W3-7 on the ECM, is the Code as Transmittedfrom the Reader.. it goes from the Transponder to the ECM. It is a Normally Hi( 12 volt ) line, and Pulses low ( to ground ) to send key Code.


2) The TXCTline, Term 1 on transponder, and Term E3-15 on ECM, is the Read Request. I havefound this line Left in a High or a Low state, after a Read is Done.. To do aRead, the line is taken lo ( or is already lo ) for 50 Ms.. then is BroughtHigh ( only 2 volt is Hi Sig! ) for 50 Ms, then brought lo again. The Action ofbringing this line Lo ( to Ground ) will trigger a Read from the key, andTransmit to the ECM, by the Code Line

3) The RXCK is the Receive Clock Pulses. This is the Sync line that will allowthe Transponder and the ECM to Read and Transmit data at the Same Time Frame.This Signal is Apparently not a Symmetrical Square wave.. It looks like theHigh VS Lo pattern of the Wave, changes shape During Different parts of theRead.. So it MIGHT be more Accurately referred to as the Bit Read Ready line..My scope is not good enough to get a Handle as to what is happening here.. butits ABOUT .125 Ms per Period of Wave.. Im getting an Stutter from about .1 toabout .15 Ms.. This line is a Lo of Zero Volt, and a High of 5 Volt..

What I have witnessed and Surmised is. ..The Driver Puts the Key into theIgnition. As the Key is being inserted, the U1 Unlock Switch is closed toground, this will take Term KSWB on E3-17 to a Ground Potential.
This Grounding will Queue the ECM to Power it Self Up, by Outputting a BatterySig ( +12 Volt ) out of Term MREL at E3-21 to the EFI Main Relay. The out ofthe Coil from EFI Main Relay, goes to Ground By a White Black wire Hooked toGround Point EA..
When the EFI relay powers up the System the Transponder will Come Alive andOutput a High Signal on its Code line term 2 that Goes to ECM E3-7
After the ECM does some Housekeeping Chores it will Request a Read from theTransponder Amp, by taking the ECM term E3-15 High ( 2 Volt ) for 50 Ms, thenLo again.
When the Transponder recognizes the High Going Pulse of the Read Request fromthe ECM, it will take the Code line from the normal rest state of 12 volt ( HiSig ) to a Low state of Ground.
When the Transponder sees the Read Request drop from the High State to a LowState, it will trigger the Output of the Present Key Code on the Code Line. Itlooks like the Code is Sent in about the First 100Ms of the Rise of the CodeLine.. The Code line is Left in the High State when Finished.
The Code is apparently Synced by the Pulses from the RXCK line, 1 on theTransponder, and E3-26 on the ECM.. As noted this Clock Line is not aSymmetrical wave, and MAY have a Varying Time Base..
If the ECM did not get a Code it Liked, For what Ever Reason, it will readagain taking the Read Request Line ( TXCT ) High and then low.
This process is repeated for 20 Seconds, till the ECM Times Out..

I watched my read several times on my ONLY key.. and the read only took onetime.. By just inserting the Tip of the Key into the Ignition Switch, this willtrigger the Read process.. and it ALWAYS read on the First try.. The way I knowthis, is it only did One Cycle on the CODE line.. That’s Good..

In fooling around, I disconnected the Read Request ( TXCT) line from the ECM,and powered things up.. The Output line of the Transponder went High and Stayedthere.. No Read..
Then I Disconnected the Clock ( RXCK ) line from the ECM.. All I got was a Successionof read attempts ( Read request activity, and Code activity ) but the ECM couldnot do a Good Read on a Programmed Key.. and it Did the 20 Second time out..

Cap

A lot of good information in one place..
 

·
Registered
Joined
·
4 Posts
Hi,

I need to change the ECU on a 2002 Toyota Corolla.

I need to desoldering the eeprom in order to write it. The first time I did it I damaged the ECU.
Now, I have bought a second ECU and I have the same problem

I have read the memory of the new ecu, and I have the codes of the keys.
It is possible to grab this codes on a new key on a locksmith?

Thanks,
Diego
 

·
Registered
Joined
·
4,128 Posts
Some locksmiths can do this: they can virginize the ECU. Then it will accept a new key. I don't know if there is a locksmith in your area that can do it. Google "Locksmith Charlie" you can send your ECU to him and he will send it back to you ready to pair with a new key. Or you can contact the member Apokryphos he provides this service for a reasonable fee.
 

·
Registered
Joined
·
5,596 Posts
Discussion Starter #5
Sound like you have already gotten the Prom Reader/Burner.. if so, just burn in the Virgin Code referenced in the First Post, and let the ECU find the Key Number for you..
 

·
Registered
Joined
·
4 Posts
Hi,

I haven't found anybody here in Spain who did the job

Without dissoldering I can read the memory, but I can't write it.
I'm not good at soldering, and I have the codes of keys associated with the new ECU.

If I carried these codes to a lock Smith, the will grab them on a new key.
The question is: does it work?

Thanks,
Diego
 

·
Registered
Joined
·
4 Posts
Yes, I have asked my local locksmith and they can write the code if I give it them.

It's in the same format in the key and in the memory?

Thanks,
Diego
 
1 - 10 of 10 Posts
About this Discussion
9 Replies
3 Participants
Dipri
MR2 SpyderChat
SpyderChat Forum is a community for Toyota MR2 Spyder Enthusiasts to discuss specs, reliability and more!
Full Forum Listing
Top