Three hundred bucks for a new car key? Nonsense! When you lose your keys or want to have an extra made for that new teen driver, don’t let the stealership lighten your wallet. Just pull the ECU and hack some hex to add the new keys.
The video below is a whirlwind tour of the process [speedkar9] uses to reprogram Toyota ECUs to allow new keys to pass the security test on your new(er) car. Since the early 2000s or so, most manufacturers have included RFID chips in their keys so that only known keys will start a car. In Toyotas, this is done by an RFID reader in the steering column that passes the inserted key’s code to the engine control unit. If the 8-byte key code matches one of three values stored in the ECU, the car will start. Clearing the EEPROM in the ECU is the focus of [speedkar9]’s process, which connecting to the EEPROM and reading the contents. His rig includes an RS-232 serial connection, so the hardest part of this hack might be rounding up a PC with a DB-9 jack, but once you’ve got that covered, it’s just a little bit-bashing to “virginize” the ECU to ready it for reprogramming.
The details of the procedure will vary by manufacturer, of course, and cars of a more recent vintage will likely have even more security to worry about. Might you even run afoul of DRM like you would by hacking a tractor? Perhaps. But $300 is $300.
https://www.youtube.com/watch?v=qRz2b1S2PGk
Thanks for [darkspr1te] for the heads up on this one.
You can also simply tape the RFID chip from an existing key inside the steering column, within range of the reader, and then duplicate the metal key. You can also find 3D printable replacement key housings on thingiverse if your plastic key is broken.
Good luck making an insurance claim if your car is stolen because the thief was able to bypass the lock thanks to leaving the immobilizer chip inside the car…
If the car is never recovered and you don’t tell the insurance company you did this, there’s little chance of them ever finding out.
Never claim, it will cost you far more in the long term. Insurance is just another tax.
Scrape your car, fix it yourself, their car, pay them at the road side.
Stolen, gps tracker, steal it back. It’s only really worth claiming if you’ve got a decent car and it ends up totally destroyed.
This is nonsense !!! Are you serious ?
Why not put the RFID chip in the new key?
lol cause there’s no reason for a new key than…
I did this when the housing on my honda key broke.
This is one of the things the instructions tell you to do when you install a remote car starter
On at least some cars it is easier to use plain metal keys and mount the RFID one inside the steering column.
A continuous loop of wire with small loops around the key and around the ignition can take care of range issues.
I’m torn on this one. On the one hand, my mom lost her spare Toyota key and did with just one for a year before she finally decided it was worth the ridiculous $400 price to not get hopelessly stranded if you misplaced the second key. So I definitely see the incentive to behind this. But if you brick the ECU that’s a lot more than $400 once you also throw in that you’ve voided the warranty. Still an awesome hack though.
wow Glad I own BMW and not toyota… spare key was $120 from the dealer. it came ready to go no pairing needed.
and the car only cost twice, what a bargain! ;)
wow Glad I own Ford and not BMW… spare key was $2.99 from the Home Depot. it came ready to go no RFID chip involved at all.
;)
wow, glad I own a bike. No key needed, so it came free (the key), ready to roll.
I thought, the bike itself came free, like standing unattended at the roadside with a very weak lock at best. :-)
My 2012 Kia came with an integrated remote-control-frob / popout key arrangement. After both of them had the keys break off near the (fairly weak) hinge joint, I grudgingly took it in to the hardware store, which had a new ChipKey machine that makes keys for $75 instead of the $200-300 the dealer charges.
Turns out the Kia isn’t a chip-key. It’s just a mechanical key, no RFIDs, and integrating it with the radio frob is just to have a nice package that fits neatly in your pocket and annoy you if you want to go surfing (because the radio frob doesn’t like salt water) or keep a spare key somewhere. So a bunch of $2 metal keys later, I’ve now got spares, and the radio frob is still on my keyring for remote control use, without worrying about carrying it around if I’m going to be in some non-electronics-friendly environment.
This defiantly not for anyone or any vehicle, the earlier cars used a simple mechanism like this to lock you out. Later model cars get a bit tricky and keep the code in different modules which all have to match. As an example my wife’s VW Amarok recently had the instrument cluster replaced (don’t get me started on why) as a result both keys needed to be re validated with the car.
Warranty would not likely be an issue on a 17 year old car either.
The best way to go about it would be to obtain an appropriate ECU from the wreckers make the modifications to that and then keep the original ECU in a safe place.
Why did your wife’s VW Anatolia had to had its instrument cluster get replaced?
Because the blinker sounder failed . Go figure … common problem unfortunately- but rather than replace the $2 speaker let’s replace the whole instrument cluster because vw dealers like all the others don’t realy employ mechanics- just monkeys.
Or you can clone your existing key since RFID is pretty crappy technology when it comes to security issues : https://forums.kali.org/showthread.php?3037-RFID-Cooking-with-Mifare-Classic-in-kali
That’s what many locksmiths do, clone an existing key instead of programming a new one to the ECU. It’s mainly a workaround to going to the stealership if you only have one key. Since the later 90’s the systems all require two working keys in order for the end-user to be able to program key #3 and higher.
Depending on the make and model, there may be free software that works with many USB 2 to OBD 2 code scanners to program new keys if you only have one, or no keys. For some vehicles it can also ‘marry’ a replacement ECU to other modules so you don’t need to have the car hauled to a dealer.
What’s very useful about this is some manufacturers are not requiring (or are not allowing!) their dealers to perform these services on older vehicles. For Ford if it’s over 10 years old you can forget having keys programmed or cut, even if they’re “dumb” keys for things like the tailgate and tonneau cover on a 2002 Sport Trac. Again, this is where the key cloning services come into play.
For programmed keys vehicles typically have a limit of 4 or 5. For cloned keys there’s no limit, the system just thinks they’re all the same key.
Now there’s a thing for a crime TV show. The prosecution has evidence the suspect used their car at a certain time due to the ECU recording the last key used. But the real murderer got the original key and had a locksmith clone it to use the vehicle and frame the owner for the murder.
RFID is a very generic term. Just because one RFID tech is insecure doesn’t mean ALL RFID technologies are insecure.
This is a wonderful video. Quick, clear and useful.
One small correction. It looks like the key values are 8 nibbles not 8 bytes, so that’s 4 bytes which is 65,536 combinations rather than 15^8 = 2,562,890,625 combinations. (and 15^8, where did that come from?)
This is just a small correction. I think the project is very well documented. Thanks for making the video and posting it.
two bytes give 65536 combinations. Eight nybbles = 32 bits = 2^32 combinations = 4,294,967,296. Or alternatively 16 possibilities per nybble, raised to the power eight (number of nybbles) Not sure why the video says 15^8 rather than 16^8, I’ve not watched it yet, maybe a typo or maybe each nybble doesn’t use a reserved value like 0x0 or 0xF.
For a lot of Toyotas there is a complicated procedure you can do while in the car without any special equipment to “program” a new key. On my Highlander I have to do this convoluted process of opening/closing the door turning and half turning the key; when its over the car will beep and the new key I bought off ebay works perfectly. You can usually find the process for your specific model by googling the toyota nation forums. I mean I looked like an idiot in the drive way closing my door repeatedly, but I saved $300. I don’t know if other manufacturers so a similar thing, or why they would bother to put it in there in the first place if they weren’t going to tell anyone.
General Motors (most, at any rate) are on-board programmed as well.
My Prius had that option too. Sadly my Smart car with only one key doesn’t :)
My Hyundai has a similar procedure of insanity, however it requires two already-programmed keys plus the new ‘blank’ key to be programmed into memory.
I assume the car came new with two original keys, however I bought it used and it only came with one so I can’t add a new key to the system myself now :/
Worse, I would need to buy two new keys (at least one from the dealer) to ensure I could perform the reprogramming procedure of insanity if I ever lost one in the future.
But I was pleasantly surprised to find the procedure of insanity to program new keys fairly clearly documented in the user manual.
Used cars only ever come with one key fob…
They keep the other one so they can sell it for $$$. ;)
Similar process here. Involves the brake pedal and some patience, or I just bring it to my dealer and pay 20 bucks for a new key and activation while they attempt to get me to purchase another vehicle; worth it!
Cool hack though.
Also, if someone is pulling an ECU and dumping hex, why aren’t they providing the hex dump so someone can figure out what the CANbus messages the official programming procedure uses are?
Only works with two master keys.
“Stealership”? Really? SMH…
Yah, really, that’s been a word since Compuserve auto repair conferences at least…. and the use of SMH negates your follow up argument.
Dealerships are the best places to get work down nowadays though. SMH…
ive been calling them that since i was a child. so yes, Stealership.
Curtis makes 2 types of replacement keys: permanently serialized, like the factory keys, and programmable serials.
The pre-serialized keys are $11, the programmable keys a $34.
Any decent locksmith has the scan-tool required to program new keys into a car ECU. The going rate is usually about $90.
The locksmith makes more money programming your car than selling you a cloned key, even though the cloned key is more convenient for you.
You have been mislead. I am a locksmith and I assure you I am more than “decent”, but I don’t touch automotive other than simple key duplications and the occasional on-board programming for well known clients. The cost of entry for an auto locksmith is prohibitive to the tune of 10’s of thousands of dollars, so those that do generally specialize in just automotive work. There is no one tool for all makes and models and some require manufacturer-specific tools that have to be purchased from the factory and registered to the locksmith. You are not paying for the key, you are paying for the EQUIPMENT they needed to make that key for you.
It’s not worth it for me and there are enough of them out there trying to be a dollar cheaper than the next guy.
I would love to see a diligent hacker reverse engineer the CAN bus communication between the programming tools and ECU and produce an OSHW version. There are one or two companies (off the top of my head) that hold a near monopoly on this market and one them is token-based usage. Buy the $4,000 tool, but you still have to pre-purchase USE of the tool at $40 a pop. Read the EEPROM? Token. Remove lost key? Token. Program new key? Token.
The Chinese have done it, obviously, and introduced fakes and clones into the market at a fraction of the cost and that don’t require tokens. But may God have mercy on your soul if the lockjock community catches wind that you’re running that equipment.
donniedarko – see jadams comments. I live in [near] Jacksonville, FL. Not a HUGE city, but not the boonies either. I called every single locksmith in the area, and not a one of them would make me a key for less than $175. Since I had one working key, I offered to bring the vehicle to them, but of all the locksmiths in the area (about 20 I think) not a single one of them has an office that I could go to. Every last one of them is ‘mobile’ now and insisted on coming to me. So that accounts for part of the cost. And as jadams points out, he has to pay a $40 licensing fee every time he uses his very expensive equipment. There’s more of the cost. The dealership though, doesn’t have those costs and yet they also charge $175. Walmart sells duplicate keys for the bargain(?) price of $75, but their keys just clone the RFID number of your existing key, so no programming of the vehicle is necessary. ** SCAM **
” I live in [near] Jacksonville, FL. Not a HUGE city,”
Huh? I heard somewhere that Jacksonville, Florida, was the largest (in terms of square miles) in the United States.
B^)
Largest in the continental US. I think Fairbanks, Alaska is supposedly bigger. And Jacksonville, being so physically large (747sq mi) without being really populus (866K), means Jacksonville actually is kinda “the Boonies”. It’s the least dense of the major cities (1120 per sq mi). There is certain no shortage of rednecks and trailer trash here. It takes about 2 hours to drive from end to end of city limits, mostly at highway speed, and you pass thru large tracts of forest, still within city limits.
The sad part is, there are no makerspaces or hacker groups in this area. A few have started, but all have failed.
“I live in [near] Jacksonville, FL. Not a HUGE city, but not the boonies either. ”
Man, you are home to the Largest Cocktail Party the world ever sees, every year. Go Dawgs….
Or go the simple route and order a $15 mvci cable and program it without hacking, as I did for my toyo.
Plus, the complicated door, brake, gas pedal procedure hasn’t worked for programming new keys since 2006. You can still program the keyless entry remote using the door procedure but it does not register the RFID tag.
2 spare keys, cable and a little time was still cheaper than paying the $200+ price tag on a single new key from the dealer.
It worked on my 2007, but I can’t speak to later models than that. I agree with you on the mvci cable. I was under the impression that only worked if you had the techstream software though (don’t remember how much the subscription costs). While it is easy enough to get on torrents some people may not be comfortable pirating the program.
Legality aside, most sellers will supply the software as well.
You can find the software in the normal places with minimal effort. Plus I think there is a 48 hr techstream subscription for ~$30. However this does not help you in the case where you lost the master key which is needed to add new keys. There is a immobilizer reset capability in techstream, but it is protected with a challenge/response code which you need to get from toyota after proving you are a locksmith. I ended up spending a week reverse engineering the software and making a excel spreadsheet to calculate the response code
Hmm…. I don’t think I ran into that issue. Erased all logged keys, then logged the original as a master with no issues.
I started by erasing everything as there were key logged that I did not receive from the dealer. This was on a 2007 rav4.
Meh-1974 Chevy pickup. No problemo, mate!
Use a screwdriver if you are really desperate, right? ;)
You probably don’t even need a screwdriver, the locks are probably so worn down by this point a Popsicle stick would work.
Yah, even up to 2000ish GM locks wore so bad that it’s pretty much a given that any GM key opens any other GM more than 5 years old.
My 32 Coupe doesn’t have a key. You just push a button. I’ve been hoping someone would steal it so I can buy a truck, but even with the windows left down, no one has stolen it in 17 years… P.S. No keys to lose :-)
Where do you park it at night?
Oh, first… is it a Ford ’32 coupe? Does it have a V-8?
B^)
Luke said, under the Consumer Guarantees Act, a manufacturer must guarantee reasonable availability of spare parts. Toyota had breached that, he said.
“I am satisfied that the price charged by Armstrongs was not a price whereby Toyota New Zealand could say the keys as spare parts are reasonably available.
“The part is simply not reasonably available when what is being charged is more than 10 times its manufacturing cost and that cost is likely to grow to some 10 per cent to 20 per cent of the value of the vehicle within the reasonable lifetime of the vehicle.”
http://www.stuff.co.nz/business/90293847/raging-businessman-takes-toyota-to-tribunal-over-525-key
Where I am located we only have one toyota dealer in the entire country, they wanted $400 for a set of two keys, we used this video and new keys from a online agent at $55 for 3 keys (two are remote unlock, one is valet, no button) , the lock smith agents wanted $300, most of our vehicles are JDM and over 4 years old at least, so they either are just out of the ‘easy open door’ reprogramming window or never saw it at all.
$300 at the dealer sounds pretty cheap and much faster considering all the cr@p and work you have to go through with this instructable
well yes and no, my time is worth money but there were other costs we saved, main one is having to tow the car to the locksmith (we dont have visiting locksmiths here) , also they could not do the works same day, we already had the keys and just needed them coded. all round we did save money and learned a few things at the same time.
Most people vastly overestimate how much their time is worth, especially when so much of it is spent watching TV.
I bought a used ’03 Ford which only came with one key. Cost me $175 at the dealership to get a second key. And I called every dealership and locksmith within a 150 mile radius. I was furious and determined this was not gonna happen again. On my Ford (and this is true from about ’98 onward) if you have 2 working keys (and the second is not just a clone of the first) then you can easily program additional keys yourself, up to 8. https://www.fordf150.net/howto/patskey.php I ordered 4 blank keys from that e-site for $6 apiece (Colored to match my vehicle!), had them cut at H.D. for $1 each, and programmed all of them. I can now lose up to 4 keys, and still have 2 left to program in more. Murphy’s law: Since I am now prepared, I haven’t lost a single one of them.
Since most people only have 2 keys, once you lose your spare, the one remaining key is not enough. Be proactive and get and program additional keys while it is still easy and cheap!
While a fun hack, check with a local locksmith. I was able to get a new chipped key for my Acura for $40 and that included cutting the key with the factory keying numbers instead of duplicating my very worn down key.
I am a specialist Automotive Locksmith and would like to clear a few things up.
The video is demonstrating an ECU reset on a Toyota, most likely an older USA spec vehicle. This is something that Locksmiths do when we have new master keys to code. UK/European vehicles use different parts to USA vehicles as due to US laws their vehicles use much simpler/older security.
This does not work for newer cars, cars from the rest of the world, cars from other manufacturers.
I regularly charge £500+ to code keys to newer Toyota vehicles, the above procedure doesn’t work for these, the dealer cannot program new keys either, they replace the ECU and immobiliser (which are separate) and code new keys to these.
We take out the immobiliser, read the chip and write the new key data directly into the encrypted file on the immobiliser chip. The dealer charge £1,800+ to do the same.
In order to become an Automotive Locksmith there are startup costs of £30,000 for “reasonable” coverage and a good Locksmith will have invested closer to double that amount with at least £5,000 every year on new equipment, software, licensing etc. We all run at least one 3-axis CNC key machine, to make keys when the old ones are not available, these are not cheap as you can imagine.
This does mean the costs to make a new key seem high, and many people buy keys from eBay, copy leads from China, second hand remotes, all to try to save money. In the rare cases where this works then a saving has been made. We as businessmen have to recoup our costs and so we charge more for the cars that can’t be done with cheap keys, overall we make the same amount of money, and we can continue to offer a mobile, lower priced than the dealer, service.
One thing that crops up a lot is “I already have the key, can you cut/program it” my answer is always “get it cut/programmed by the person who sold it to you” There are sellers who’s only expense is buying £1 Chinese copy keys then reselling them from their bedroom for £5. Customers think that it costs £2 for a key to be cut and £10 for programming, a new key for >£20 and I am robbing them with my key prices. It is not possible, but it’s hard for the public to see why.
The Chinese keys are hard steel, poorly made, and contain no transponder chip.
I would not risk my £100+ cutters on such keys and so use quality European keys that are brass or nickel silver, these cost more. I then have to supply a transponder chip, for Mazda these are £35 trade cost just for the chip. Programming usually requires a pin code, where these cannot be read from the vehicle they need to be purchased and cost up to £40 to obtain from the dealer.
There are situations where the physical key costs £65 at trade price to me, security codes cost £40, secure delivery of the key costs £11, it is a 30 mile journey to the vehicle, I have to cut the key in my £10,000 machine and program with my £18,000 programmer. The dealer charges £400 for their service, I quote £200 to be told “that’s expensive, there is a key on eBay for £5, I’ll just buy that”
I completely understand that you have to cover your expenses with a profit margin to keep your buisness running. Still, charging £200 or £500+ for a key is still robbery. It is not your fault, it’s robbery by proxy by over charging you. £18,000 for a programmer? Really? And the licensing on top of that. What would you charge if a programmer cost £180 and all other prices where divided by 10 or so?
The prices I charge are set by market forces, I would charge the same even if i got the parts and equipment for free.
No one is forced to pay for anything, if you want £5 keys then drive a pre 1995 car.
Anyone who feels aggrieved at paying “robbery” prices should take their custom to somewhere that the prices are to their liking. If it turns out that the price is the same everywhere then that is the price set by the free market.
If you feel that £18,000 for a programmer that will earn 20 times that is a robbery then make your own and sell it at a lower price.
Ultimately the market sets the prices.
You’re kind of right, you fu$#ing crook. The dealership exploits customers for the most they can.
They know the locksmiths will want to charge less and offer them equipment to this end, but are careful to keep most of the profits for themselves. The programmer can be sold for a good profit at $500, but they’re significantly more and use tokens/license fees to simply push the profits back.
Here’s what you do. Purchased a RFID programmer for wallet sized cards ~$50. Clone the transponder in your key to the card. Taped the card behind the dash near the cylinder and just use non-chipped keys. Works like a treat.
Again…. F U Crooks.
Has anyone tried to reverse engineer their car to power up the ecu or main relay or fuel pump relay to completely bypass the security system? I ran ignition power from the wiper fuse to the main relay on about a 98 BMW that had a security problem and that ran the car for a long time. What I mean is – the security system cuts power to the starter, fuel, spark or some combination of those 3. In another old 95 BMW I taped an old key inside the reader ring that surrounded the key and put it under my dash and drove it for a year like that using an uncoded key in the ignition switch.
What’s the RFID protocol for car keys? Specifically Fords.