[Cap Weir]

I had too much time on my hands.. and found this in my Immob searches

http://qcwo.com/otherdeal/Software/2005-2007-Toyota-Corolla-Immobilizer-Virgin-Dump

This is the Chip that houses the Programmed Key Info.. It's located inside the ECU housing, and is read by the Engine computer during key insertion..

They are selling the Chip already Programmed, and you solder it in.. or they will sell you the Virgin Hex Dump, and you burn it into the existing chip.. but you need a Programmer ( Hardware ) to do it.. Or they will take your ECU and for $100 put a Virgin Dump into it for you.. then the Next time it's powered up, that key will be the master..

I thought it was time that this information was posted..

EDIT:.. ECU Swap Info..

If you are Swapping ECU's and need the information from your keys to be in the 'New to you' ECU, you can always take your old Chip IC900, and MOVE the chip into the New ECU..

This has been done for converting a SMT car over to a MT Car, and then move the chip over to the new MT ECU.. it has also been done for installing Key information into a European Celica ECU ( 2ZZ Swap ) that did not have keys with it.. your 'Key Information' will be in the IC 900 Chip, and if the new ECU is Immobilizer equipped, by moving the chip over to the new ECU, your key information will move also.. ( Not for the Faint of heart )

EDIT.. Programming Information..


First step buy and ic programmer and a 8 pin soic clip so you don't have to unsolder anything. Then remove ecu from car remove the four screws from top and two more after you remove cover flip board over look for board address ic900 load the .bin file to you ic programmer software and connect the soic clip to the chip then re-flash.Then put everything back the way you found it. You will need three keys for light to shut off on older Toyota's two master and one valet. don't turn car on just put key in key way and wait two seconds then remove key then add the other keys by doing the same.
EDIT: the First key inserted ( as long as not only one is Inserted ) will be Programmed as the Valet Key. Make sure if you have a Key that is cut as a Valet Key, it is inserted First.

This is the Virgin Dump, for the Ic900.. Buffer dump

PG4UW - universal program for BK PRECISION programmers, version 2.75j/01.2011

Date: 9.June 2011 Time: 19:25:35

Selected device: Microchip 93C56 [SOIC8]



Buffer content from address: 00000000h, to address: 00000087h



Address +0 +1 +2 +3 +4 +5 +6 +7
-----------------------------------------------------------------------
0000000000 0000 0000 0000 0000 0000 0000 0000 0000
0000000008 0000 0000 0000 0000 0000 0000 0000 0000
0000000010 0000 0000 0000 0000 0000 0000 FF00 0000
0000000018 0000 0000 0000 0000 0000 FBDF 0000 0000
0000000020 0000 0000 0000 0000 0000 0000 0000 0000
0000000028 0000 0000 0000 0000 0000 0000 0000 0000
0000000030 0000 0000 0000 0000 0000 0000 7770 0000
0000000038 0000 0000 0000 0000 0000 0000 0000 0000
0000000040 0000 0000 0000 0000 0000 0000 0000 0000
0000000048 0000 0000 0000 0000 0000 0000 0000 0000
0000000050 0000 0000 0000 0000 0000 0000 FF00 0000
0000000058 0000 0000 0000 0000 0000 5A69 0000 0000
0000000060 0000 0000 0000 0000 0000 0000 FF00 0000
0000000068 0000 0000 0000 0000 0000 0000 0000 0000
0000000070 0000 0000 0000 0000 0000 0000 7770 0000
0000000078 0000 0000 0000 0000 0000 0000 0000 0000

EDIT Update:.. And to add to the Information of how to do it..

Of all the Information I have been able to gather.. the Two Options I have Found are..
1) Remove the Chip from the ECU, and Program it in the Burner with a Virgin Code..
2) Use a 'Chip Clip' to hook to the Chip while it on the Circuit Board.. and Program it there..

My Results..
1) Upon Further reading, unless you have VERY Expensive Soldering Tools for removing the Chip from the Board.. your Chances of getting it off, and back on and NOT Broken.. are ZERO.. So I Opted to not try that for my first go-around..
2) Purchase a Chip Clip that was for Hooking to the Chip.. to Program.. WELL.. while the Chip is in the Board.. and the Board is Covered with the Anti Fungus Covering.. not much can get through.. Not even the Contact for the Clip.. I tried to Scratch off the Coating.. I Got the Coating Off.. but was unable to get the Clip to Conect to all 8 Pins.. and the Solder made a 'Ramp' that prevented the Clip from hooking to the Chip.

So I came up with Option 3..

Solder Jumpers to each of the 8 Pins of the Chip.. and take the 8 Wires to a header Jumper that will Plug into the Programmer ZIF Socket..

Here is the Pics..

Wires on the Chip..

Wires going to the Programmer..

I also came up with an Unusual Problem.. SOMETIMES on SOME ECU's I can not Erase/Read or Program Correctly.. Even though the Wires are Hooked up properly..

The Solution.. Power up the ECU, then Power it Down.. I have Test Plugs on the Bench.. So I can Do it from Inside the House..

Then the Chip will Read/Verify/Program with no Problems.. Not sure what that is about.. but I have a Work Around for it.. so Problem Solved..

EDIT Again: One other problem has Surfaced.. This programmer has a default set up where it will electrically 'Taste' the leads of the E-Prom chip, to see if all is hooked up properly. As of late, the 'Taste' is different, and the Programmer thinks the leads are not hooked up properly.. Even with the Chip Removed from the Board ( yes I was able to do it.. and get it back on )..

The fix for this new problem, is to not 'Verify Leads' before programming.

All is well again..

After the ECU is Virginised, it will be in “Automatic Registration Mode”. The ECU is expecting that it will encounter 3 new keys. The first two keys are designated as MASTER keys and the 3[SUP]rd[/SUP] key inserted will be designated as the VALET key. The ECU can be programmed with as few as 1 key. If less than 3 keys are programmed into the ECM the security light may flash for some time (hours to weeks) until the ECM “learns” that it is apparently not going to get any more keys.

If you are programming 3 keys:

1. Close all doors and windows.
2. Lock the driver side door with the key.
3. Unlock the driver side door with the key.
4. Insert first transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove first key from ignition.
5. Insert second transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove second key from ignition.
6. Insert third transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should go out after a few seconds. Remove third key from ignition.
7. Wait 30 seconds for the programming cycle and programming mode to close.

If you are programming less than 3 keys:

1. Close all doors and windows.
2. Lock the driver side door with the key.
3. Unlock the driver side door with the key.
4. Insert key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 15 seconds and remove first key from ignition.

1. If you are done proceed to step 6 below. If you want to add another key proceed to step 4.
2. Press brake pedal 5 times to exit programming mode.

NOTE: If less than 3 keys are programmed into the ECU the security light may flash for some time (hours to weeks) until the ECU “Gives up”.

To determine if the key(s) have been properly programmed into the ECU you may utilize the following procedure:

1. Locate the “security” light. This light should blink when there is no key in the ignition or if an unrecognized key is placed into the ignition.

1. Insert the key you have into the ignition – DO NOT TURN ON. There are 3 possible things that may occur:

(a) Security light continues to blink = unrecognized key.
(b) Security light goes off IMMEDIATELY = MASTER key
(c) Security light remains illuminated for 1-3 seconds before going out = VALET key

1. Repeat step 2 for each key that you have programmed into the car.

If you have a condition where the security light continues to blink for any of the keys, that key has not been properly programmed or recognized by the car’s computer.

If the security light goes out immediately (master key) or after 1-3 seconds (valet key) then the keys have been properly programmed into the ECM and you should be able to successfully start and run the car.

Cap

 

[Cap Weir]

Look what I found in Internet Hack Searches..

http://forums.hackaday.com/viewtopic.php?f=2&t=5596

2nd to the last line references this Forum Topic..

He has taken this A lot farther than I did..

I will add this from another post I did on the actual hardware involved in the read''

1) The Codeline Term 2 on the reader, and Term W3-7 on the ECM, is the Code as Transmittedfrom the Reader.. it goes from the Transponder to the ECM. It is a Normally Hi( 12 volt ) line, and Pulses low ( to ground ) to send key Code.


2) The TXCTline, Term 1 on transponder, and Term E3-15 on ECM, is the Read Request. I havefound this line Left in a High or a Low state, after a Read is Done.. To do aRead, the line is taken lo ( or is already lo ) for 50 Ms.. then is BroughtHigh ( only 2 volt is Hi Sig! ) for 50 Ms, then brought lo again. The Action ofbringing this line Lo ( to Ground ) will trigger a Read from the key, andTransmit to the ECM, by the Code Line

3) The RXCK is the Receive Clock Pulses. This is the Sync line that will allowthe Transponder and the ECM to Read and Transmit data at the Same Time Frame.This Signal is Apparently not a Symmetrical Square wave.. It looks like theHigh VS Lo pattern of the Wave, changes shape During Different parts of theRead.. So it MIGHT be more Accurately referred to as the Bit Read Ready line..My scope is not good enough to get a Handle as to what is happening here.. butits ABOUT .125 Ms per Period of Wave.. Im getting an Stutter from about .1 toabout .15 Ms.. This line is a Lo of Zero Volt, and a High of 5 Volt..

What I have witnessed and Surmised is. ..The Driver Puts the Key into theIgnition. As the Key is being inserted, the U1 Unlock Switch is closed toground, this will take Term KSWB on E3-17 to a Ground Potential.
This Grounding will Queue the ECM to Power it Self Up, by Outputting a BatterySig ( +12 Volt ) out of Term MREL at E3-21 to the EFI Main Relay. The out ofthe Coil from EFI Main Relay, goes to Ground By a White Black wire Hooked toGround Point EA..
When the EFI relay powers up the System the Transponder will Come Alive andOutput a High Signal on its Code line term 2 that Goes to ECM E3-7
After the ECM does some Housekeeping Chores it will Request a Read from theTransponder Amp, by taking the ECM term E3-15 High ( 2 Volt ) for 50 Ms, thenLo again.
When the Transponder recognizes the High Going Pulse of the Read Request fromthe ECM, it will take the Code line from the normal rest state of 12 volt ( HiSig ) to a Low state of Ground.
When the Transponder sees the Read Request drop from the High State to a LowState, it will trigger the Output of the Present Key Code on the Code Line. Itlooks like the Code is Sent in about the First 100Ms of the Rise of the CodeLine.. The Code line is Left in the High State when Finished.
The Code is apparently Synced by the Pulses from the RXCK line, 1 on theTransponder, and E3-26 on the ECM.. As noted this Clock Line is not aSymmetrical wave, and MAY have a Varying Time Base..
If the ECM did not get a Code it Liked, For what Ever Reason, it will readagain taking the Read Request Line ( TXCT ) High and then low.
This process is repeated for 20 Seconds, till the ECM Times Out..

I watched my read several times on my ONLY key.. and the read only took onetime.. By just inserting the Tip of the Key into the Ignition Switch, this willtrigger the Read process.. and it ALWAYS read on the First try.. The way I knowthis, is it only did One Cycle on the CODE line.. That’s Good..

In fooling around, I disconnected the Read Request ( TXCT) line from the ECM,and powered things up.. The Output line of the Transponder went High and Stayedthere.. No Read..
Then I Disconnected the Clock ( RXCK ) line from the ECM.. All I got was a Successionof read attempts ( Read request activity, and Code activity ) but the ECM couldnot do a Good Read on a Programmed Key.. and it Did the 20 Second time out..

Cap

A lot of good information in one place..

 

[Dipri]

Hi,

I need to change the ECU on a 2002 Toyota Corolla.

I need to desoldering the eeprom in order to write it. The first time I did it I damaged the ECU.
Now, I have bought a second ECU and I have the same problem

I have read the memory of the new ecu, and I have the codes of the keys.
It is possible to grab this codes on a new key on a locksmith?

Thanks,
Diego

 

[MerryFrankster]

Some locksmiths can do this: they can virginize the ECU. Then it will accept a new key. I don't know if there is a locksmith in your area that can do it. Google "Locksmith Charlie" you can send your ECU to him and he will send it back to you ready to pair with a new key. Or you can contact the member Apokryphos he provides this service for a reasonable fee.

 

[Cap Weir]

Sound like you have already gotten the Prom Reader/Burner.. if so, just burn in the Virgin Code referenced in the First Post, and let the ECU find the Key Number for you..

 

[Dipri]

Hi,

I haven't found anybody here in Spain who did the job

Without dissoldering I can read the memory, but I can't write it.
I'm not good at soldering, and I have the codes of keys associated with the new ECU.

If I carried these codes to a lock Smith, the will grab them on a new key.
The question is: does it work?

Thanks,
Diego

 

[MerryFrankster]

Some locksmiths are able to clone a key with the same keycode as the original. Usually the equipment requires to have the original key.

 

[Dipri]

Yes, I have asked my local locksmith and they can write the code if I give it them.

It's in the same format in the key and in the memory?

Thanks,
Diego

 

[MerryFrankster]

This is a good question. I don't know.

 

[Dipri]

We will wait for more opinions. I think it would be easy than virginize the ecu

 

[Davgnzls]

I had too much time on my hands.. and found this in my Immob searches

http://qcwo.com/otherdeal/Software/2005-2007-Toyota-Corolla-Immobilizer-Virgin-Dump

This is the Chip that houses the Programmed Key Info.. It's located inside the ECU housing, and is read by the Engine computer during key insertion..

They are selling the Chip already Programmed, and you solder it in.. or they will sell you the Virgin Hex Dump, and you burn it into the existing chip.. but you need a Programmer ( Hardware ) to do it.. Or they will take your ECU and for $100 put a Virgin Dump into it for you.. then the Next time it's powered up, that key will be the master..

I thought it was time that this information was posted..

EDIT:.. ECU Swap Info..

If you are Swapping ECU's and need the information from your keys to be in the 'New to you' ECU, you can always take your old Chip IC900, and MOVE the chip into the New ECU..

This has been done for converting a SMT car over to a MT Car, and then move the chip over to the new MT ECU.. it has also been done for installing Key information into a European Celica ECU ( 2ZZ Swap ) that did not have keys with it.. your 'Key Information' will be in the IC 900 Chip, and if the new ECU is Immobilizer equipped, by moving the chip over to the new ECU, your key information will move also.. ( Not for the Faint of heart )

EDIT.. Programming Information..


First step buy and ic programmer and a 8 pin soic clip so you don't have to unsolder anything. Then remove ecu from car remove the four screws from top and two more after you remove cover flip board over look for board address ic900 load the .bin file to you ic programmer software and connect the soic clip to the chip then re-flash.Then put everything back the way you found it. You will need three keys for light to shut off on older Toyota's two master and one valet. don't turn car on just put key in key way and wait two seconds then remove key then add the other keys by doing the same.
EDIT: the First key inserted ( as long as not only one is Inserted ) will be Programmed as the Valet Key. Make sure if you have a Key that is cut as a Valet Key, it is inserted First.

This is the Virgin Dump, for the Ic900.. Buffer dump

PG4UW - universal program for BK PRECISION programmers, version 2.75j/01.2011

Date: 9.June 2011 Time: 19:25:35

Selected device: Microchip 93C56 [SOIC8]



Buffer content from address: 00000000h, to address: 00000087h



Address +0 +1 +2 +3 +4 +5 +6 +7
-----------------------------------------------------------------------
0000000000 0000 0000 0000 0000 0000 0000 0000 0000
0000000008 0000 0000 0000 0000 0000 0000 0000 0000
0000000010 0000 0000 0000 0000 0000 0000 FF00 0000
0000000018 0000 0000 0000 0000 0000 FBDF 0000 0000
0000000020 0000 0000 0000 0000 0000 0000 0000 0000
0000000028 0000 0000 0000 0000 0000 0000 0000 0000
0000000030 0000 0000 0000 0000 0000 0000 7770 0000
0000000038 0000 0000 0000 0000 0000 0000 0000 0000
0000000040 0000 0000 0000 0000 0000 0000 0000 0000
0000000048 0000 0000 0000 0000 0000 0000 0000 0000
0000000050 0000 0000 0000 0000 0000 0000 FF00 0000
0000000058 0000 0000 0000 0000 0000 5A69 0000 0000
0000000060 0000 0000 0000 0000 0000 0000 FF00 0000
0000000068 0000 0000 0000 0000 0000 0000 0000 0000
0000000070 0000 0000 0000 0000 0000 0000 7770 0000
0000000078 0000 0000 0000 0000 0000 0000 0000 0000

EDIT Update:.. And to add to the Information of how to do it..

Of all the Information I have been able to gather.. the Two Options I have Found are..
1) Remove the Chip from the ECU, and Program it in the Burner with a Virgin Code..
2) Use a 'Chip Clip' to hook to the Chip while it on the Circuit Board.. and Program it there..

My Results..
1) Upon Further reading, unless you have VERY Expensive Soldering Tools for removing the Chip from the Board.. your Chances of getting it off, and back on and NOT Broken.. are ZERO.. So I Opted to not try that for my first go-around..
2) Purchase a Chip Clip that was for Hooking to the Chip.. to Program.. WELL.. while the Chip is in the Board.. and the Board is Covered with the Anti Fungus Covering.. not much can get through.. Not even the Contact for the Clip.. I tried to Scratch off the Coating.. I Got the Coating Off.. but was unable to get the Clip to Conect to all 8 Pins.. and the Solder made a 'Ramp' that prevented the Clip from hooking to the Chip.

So I came up with Option 3..

Solder Jumpers to each of the 8 Pins of the Chip.. and take the 8 Wires to a header Jumper that will Plug into the Programmer ZIF Socket..

Here is the Pics..

Wires on the Chip..

Wires going to the Programmer..

I also came up with an Unusual Problem.. SOMETIMES on SOME ECU's I can not Erase/Read or Program Correctly.. Even though the Wires are Hooked up properly..

The Solution.. Power up the ECU, then Power it Down.. I have Test Plugs on the Bench.. So I can Do it from Inside the House..

Then the Chip will Read/Verify/Program with no Problems.. Not sure what that is about.. but I have a Work Around for it.. so Problem Solved..

EDIT Again: One other problem has Surfaced.. This programmer has a default set up where it will electrically 'Taste' the leads of the E-Prom chip, to see if all is hooked up properly. As of late, the 'Taste' is different, and the Programmer thinks the leads are not hooked up properly.. Even with the Chip Removed from the Board ( yes I was able to do it.. and get it back on )..

The fix for this new problem, is to not 'Verify Leads' before programming.

All is well again..

After the ECU is Virginised, it will be in “Automatic Registration Mode”. The ECU is expecting that it will encounter 3 new keys. The first two keys are designated as MASTER keys and the 3[SUP]rd[/SUP] key inserted will be designated as the VALET key. The ECU can be programmed with as few as 1 key. If less than 3 keys are programmed into the ECM the security light may flash for some time (hours to weeks) until the ECM “learns” that it is apparently not going to get any more keys.

If you are programming 3 keys:

1. Close all doors and windows.
2. Lock the driver side door with the key.
3. Unlock the driver side door with the key.
4. Insert first transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove first key from ignition.
5. Insert second transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 5 seconds and remove second key from ignition.
6. Insert third transponder key into ignition lock cylinder for registration DO NOT TURN ON. The security light should go out after a few seconds. Remove third key from ignition.
7. Wait 30 seconds for the programming cycle and programming mode to close.

If you are programming less than 3 keys:

1. Close all doors and windows.
2. Lock the driver side door with the key.
3. Unlock the driver side door with the key.
4. Insert key into ignition lock cylinder for registration DO NOT TURN ON. The security light should remain on. Wait about 15 seconds and remove first key from ignition.

1. If you are done proceed to step 6 below. If you want to add another key proceed to step 4.
2. Press brake pedal 5 times to exit programming mode.

NOTE: If less than 3 keys are programmed into the ECU the security light may flash for some time (hours to weeks) until the ECU “Gives up”.

To determine if the key(s) have been properly programmed into the ECU you may utilize the following procedure:

1. Locate the “security” light. This light should blink when there is no key in the ignition or if an unrecognized key is placed into the ignition.

1. Insert the key you have into the ignition – DO NOT TURN ON. There are 3 possible things that may occur:

(a) Security light continues to blink = unrecognized key.
(b) Security light goes off IMMEDIATELY = MASTER key
(c) Security light remains illuminated for 1-3 seconds before going out = VALET key

1. Repeat step 2 for each key that you have programmed into the car.

If you have a condition where the security light continues to blink for any of the keys, that key has not been properly programmed or recognized by the car’s computer.

If the security light goes out immediately (master key) or after 1-3 seconds (valet key) then the keys have been properly programmed into the ECM and you should be able to successfully start and run the car.

Cap

Thanks for the reply on the other forum man!
just one question, you said it may take weeks for the car to register 1 key, thatwould really suck, would it be possible to just clear1 master key or am I just delusional at this point because of the fact my car is sitting on the street with no way of starting it

 

[Cap Weir]

Thanks for the reply on the other forum man!

Not Me..

Reading between the lines from what you say here, it sounds like you have been directed to Install a NON Registered key into the Ignition, and it will regester it after some time?..

That is not how the Toyota's work.. You must Program the key.

That is why I started this thread in the First Place.. to tell others the Methiods I know of to Re-Program your ECU to accept keys when you have No keys to start the Process with..

Cap

 

[Davgnzls]

Not Me..

Reading between the lines from what you say here, it sounds like you have been directed to Install a NON Registered key into the Ignition, and it will regester it after some time?..

That is not how the Toyota's work.. You must Program the key.

That is why I started this thread in the First Place.. to tell others the Methiods I know of to Re-Program your ECU to accept keys when you have No keys to start the Process with..

Cap

pretty sure it was you Cap, unless someone else runs your account?? but just to be on the same page I lost my master key, I ordered a new key and will have it cut by my vin at Toyota. ill make more copies later but im broke, just to be sure will the instructional hackaday forum you listed be the complete way to reconfigure the programmed keys or do I have to follow the buffer dump you posted here? Hackaday Forums • View topic - DIY: Car Immobilizer Hacking for Lost Keys
some real heroes we have here, thanks again for this invaluable information
referring to what you said, I meant the fact I need 3 keys, otherwise it may take time for the ECU to give up programming the 2nd or 3rd key?
Also im not really familiar with this if you can tell, but is there a specific sequence as to soldering each of the 8 pins on the eeprom??? maybe I should google that...

 

[rande]

Some locksmiths have the equipment to program new keys.

 

[Cap Weir]

D..

Please PM Me with the 'Other Forum' Information.. I'd like to see why you think it was me!..

The Hackaday and the Methiod I describe in this post are the same.. It involves Re-Writing the IC900 ROM.. The Only Difference, Is I use a different Technique of Burner.. and the PROM Code I posted is Different than the PROM Code posted in the Hackaday Post.. It must not make that big of a Difference which PROM Code you use..

Cap

 

[FormInFunction]

[QUOTE="ill make more copies later but im broke...[/QUOTE]

Just as an FYI you can get a chipped key for like $15 - 20 off of ebay...get it cut and then program it yourself...after you figure out the master key of course. Cheap insurance if you ever lose a key again

 

[Davgnzls]

So after some days of being scared to do it, I’ve finally virginized my immobilizer! Big thanks to Cap, and also worth mentioning speedkar100 on YouTube, he’s the one that made the forum here Hackaday Forums • View topic - DIY: Car Immobilizer Hacking for Lost Keys
I really wouldn’t be as confident if these heroes didnt take time out of their lives to do this research! I barely have any soldering experience, completely trash at it. I found an old broken direct tv cable box to practice on but I completely burned it. Although I messed up and paid way too much on tools I didn’t even need, some tools worked some tools didn’t, I may as well help you save time and tell you which helped me! (Or waste you’re time with pointless Autobiography lol)

So some backstory, I have a 2001 MR2 spyder, I happen to lose my only master key (dumbass) I had a TILE tracker but it was on my wallet for a short time. I suggest investing on TILE, at least the newer ones cause I’ve had good experiences with it, last location marked, (if you’re lucky a community that has a lot of tiles, it will use other tile users to track it if you’ve lost it at a previous place you’ve been) and you can also use tile to search for your phone (IE, you lost your phone but you have the tracker on your keys, theres a button and it’ll ring the phone and help you track it)
Only con is my model is not rechargeable, and it’s only Bluetooth, not GPS.

my first call was to the locksmith, they quoted me 500 bucks for 2 new keys and a different ECU (I Did not want to lose my stock ECU, I just like my car stock for the most part lol. Plus I can’t really afford that) I spent 3 days searching for my keys. Finally I gave up and called Toyota for a new key, they charged me 50 dollars for the key ( I know it’s overpriced but they had it right away, I needed to push my car before I get another street cleaning ticket) and got it cut for another 47 bucks (wow that’s expensive too) so a total of around 100 bucks for my new master key. They kept arguing with me saying you can’t get Use this key without programming it, some threatening me thay it’ll break the ecu ( what a fraud) but just say you’re doing an engine swap or something. I said I was going to program it somewhere else. (Another dealer) and that shut them right up.

In where I am, all I needed was my title and ID to get the key cut from VIN ( I suggest not mentioning the “10 year expiration” for key cuts, because the guy lied to my face saying it’s true, and that he couldnt get it cut without bringing the car to the dealer. I just pretended I didn’t hear That and hung up. (It’s the same guy who said I’ll destroy my ecu if I put the wrong key in)

I had an ATHLON 64 PC LYING AROUND, i built it years ago in a Mac carrying box (lmao) cause I wanted to make fun of Macs. idk if you do but any computer that has a serial port will be your help from the method I took on. I had to build this a little because the power supply failed, and I upgraded to a solid state drive. I installed windows XP through E2B (easy2boot) USB drive.i used the tutorial from this utuber:

YouTube.com/watch?v=-nZAhE0SetM

it’s PhilsComputerLab, retro pc gaming enthusiast. I Downloaded my ISO from a specific website, I got no virus from it so I’ll help you save time, :

getintopc.com/softwares/operating-systems/windows-xp-sp3-6689179/

this was from a forum I think 4 years ago, glad the link survived. I had a little trip down memory lane, I don’t ever know why I stopped using XP, It’s still the fastest OS I ever used.

i had a 3m respirator so that I wouldn’t inhale the fumes, magnifying headset that didn’t really help me while soldering, only seeing the results (lmao it was messy) nice lamp that’s bendy, sponge for the solder, a handy wire cutter (really need one) and a confidence inspiring white board lmao

you can just print out the one from the hackaday forums, for me personally this helped me Feel science (lol)

So I went to micro center to buy my circuitry stuff, that place is awesome

list of stuff I bought:

ELENCO Diode kit $20
(You can save by looking for place that sells ZENER DIODES that are 5V, or 1N4733)

Jumper wires set $10 (these will be useful for the breadboard I will be copying from the forums at hackaday Hackaday Forums • View topic - DIY: Car Immobilizer Hacking for Lost Keys )

NTS electric solder (rosin core) 60/40 .75mm $4
(if I can actually g advice if this is a good option for something this small? I went out and bought stuff in a rush lol)

Cheap power supply $25

ELENCO Breadboard metal base $8

NTE 1/4w 4.7k ohm resistors $0.99

cheap soldering iron 40 watts $13
(I would suggest not wasting money like I did buying a 12 watt that’s thin, barely a worked and sucked. Or maybe that’s just me. If you can, if you’ve never had soldering experience like I did, buy something expensive that has a controller, and really small tips to avoid burning the circuitry lol)

I bought 3 wires and only ended up using one, it was a 25 ft roll for 2.49, I made the mistake buying spliced wires, MAKE SURE it’s solid.

ELENCO 22 awg SOLID WIREPurple $2.49


and a $20 ssd for my temporary computer (micro center special)

in total including the mistakes I made was $140

but subtract the mistake, at least $100

if you have a fully built athlon or pentium PC with a serial port, you can buy minus the power supply and SSD (solid state drive) for around $60, (this is with using the cheap solder gun)



I had a multimeter lying around and was scared if the computer’s power supply was too much to power my breadboard, so I tested it. Heres a pic of how I powered mine,

to make sure I used the voltmeter and tested 5.2, MAKE SURE ITS THE RED WIRE AS POSITIVE AND EITHER OF THE BLACK ONES AS GROUND, THE YELLOW IS 12VOLTS!!!
at this point my confidence of success grew cause I had a bad time thinking of how in the heck they powered the breadboard.

I will try to be as detailed with the bread board as I can, cause I literally looked at the pictures in the forum And constantly paused the video to do the exact circuitry that Mr. speedkar100 did.
The resistors are obviously in series, and the Zener diodes are connected to the ground with the bias towards the resistors and jumpers (idk help me out on that one, how do you refer to the Zener diodes polarity lol)
(WARNING: VERY GRAPHIC IMAGES)

This is horrifying to look at, and very confusing. But I’ll be posting more angles. To help everyone out, sorry if I didn’t have enough angles before taking the ecu out, I was in a rush

This is the one from the video (lol, yeah mine was worse) see I could’ve been as organized as him and had different colored wires, but I didn’t have solid core so all those big darker non jumper purple wires you see on mine are from the chip itself, the infamous IC900

soldering this was frightening, I practiced on another eeprom from an old direct tv Box,
And working on the eeprom made my hands shake (bruh) felt like i was a surgeon
Here’s more angles to help

I ran Into the files limit,sorry, will be posting the next part.
following the map is important,
What helped me was being able to follow the jumpers and wires from the video, how the resistors and diodes are placed. Like PIN number 2 in the chip connecting to 7 and 6 in the serial port, so there would be 2 purple wires at the end of its circuit in the breadboard leading to the serial port.
The first thing I soldered was the 6 wires on to the EEPROM chip. So that I could get that out of the way., I would then just connect them in the corresponding part of the breadboard, I’ll post more pictures so you can see which one is which, very sorry for the clutter that it is. If you are good with breadboard and circuits you wouldn’t even need the pictures I just posted (lol) and to be honest I could’ve used the whole big board that I have, I’m just scared that maybe it was gonna go wrong, as you can see I have no experience in this field, so I just followed the video. I barely passed AP physics in high school. will post more pictures and how I soldered it on to the serial port!

 

[Davgnzls]

Here’s some more angles, let me know which part of this horror you want to see more specific of

Here’s the serial port I got mad at

Before this I tried to use the tape method and I sucked at it.

as per the tutorial on the video I used pony prog using a USB drive to transfer the setup to my win XP super computer

the probe was a success And I was able to read and write my EEPROM! At this point I was so happy and excited. Was up all night and was supposed to write this yesterday but I slept the whole day

This is similar to the VERY similar to the 2001 solara ECU from the video ( mine being a 2001 spyder, actually might be on every year model so don’t quote me on this) again I was so happy I could not believe what was happening. I used the same method by zeroing it and is basically the virginize dump from this forum, although I did keep the valet key lockout mentioned in the video.

Overall I was so happy I did it with this measly setup, I was able to take caution in unwiring the chip, and finally putting it in the car to start!

Unfortunately I only have one key, but i programmed it anyway. The security flashes periodically as expected, it wants 3 keys which I don’t have, I will have them cut later cause I didn’t want to pay the Toyota premium -_-
It was midnight so I had to push my car at the end of the street and fired her up, I turned the key and it started! I celebrated so much but it was a mess and the seat wasn’t even in (I took it off for easier access lol) even with one key for now, you can still start the car But the security light will be flashing for a long while.
Feel free to ask and Or add more into what I’ve done! Advices are completely needed

overall this was tough but I was willing for the experience. I’m located in NJ northeast if you ever need help in person!
Again, thank you so much Cap! I wouldn’t have been able to survive this week if it wasn’t for you!

 

[Davgnzls]

there was a post before that one, its being viewed for moderation, sorry idk how

 

[Cap Weir]

Again, Congratulations..

There is that satisfying feeling when you done it yourself!..

I'm still smiling cause you were able to get it done!.. this is not for the faint of Heart, cauze things can go way wrong.. But Hey, it's only an ECU!..

Cap