CANbus Coding in FRS/BRZ

[ojuniour]

Originally Posted by Compelica

To understand this correctly... if the car was started from a remote start and the command is not resent within 5 seconds, the engine would kill itself (fuel cut) or will the entire car turn off?

And to prevent this shutoff from happening, the override command has to be sent?

if you don't continue to send the same message to the ECU for at least once per 5 second the car WILL shut off - meaning engine and acc . It completely shuts off and not just cut fuel to engine. Full shutdown regardless of the gear status be it drive, reverse, neutral,...

One more important thing I forgot to mention is that the car will ONLY start in Park or Neutral gear when sending the remote command. This also provides less code for me to in terms of the checklist compensation before starting.

In this case, the 'chip key is present' command is NOT the same as disabling the immobilizer, to allow the car to start and continue running?

With the headlight/taillights you can basically adopt some form of follow-me-home setup with the Arduino too, lots of possibilities. Would love to work on something more programmable in the future but will have to use with what I have for now.

If you need any testing with the canbus commands I can help out for sure. As mentioned before I'm using an ELM327 to send/receive commands, though it's a bit limited as ELM327 can't send more than a certain number of bytes in a single frame (IIRC turning on gauge lights require payloads larger than what ELM327 can support). I'm on a 2015 MT GT86 prefacelift.

Certainly exciting - one step closer towards a DIY remote start

Yes, the fob 'chipped' key command is only just for status reading. It doesn't change anything regarding the status of the key.
Disabling the immobilizer would be godsend though if I can find the key/seed and the algorithm performed between the immobilizer and the bus system. Quite difficult I must say.
So best way is basically going straight at the ecu and find a way to send a command that would trick the ecu that the key is detected nearby and it's a valid one. I haven't gotten to that yet.
If you know your way around here is the canbus id for the smark key system:
CanID: 0x750 (Main Body)
PID: (0xB5)


I don't understands what you mean by the "follow-me-home" phrase. That's interesting lol.

I basically have two CANBUS connected to the car at same time to be able to write/decode/ready the CANBUS messages:
Tactrix Openport 2.0 and CANduino (which is basically an arduino nano but with built in canbus Transceiver ).

Tactrix plugged in to the obd 2.
CANduino connects to the CANbus through the unused CANbus plug (close at the firewall) behind the radio system.

incase you are interested:
https://www.tindie.com/products/mass...-with-can-bus/

[ojuniour]

So At this moment I'm gonna be using the gut of an extra keyfob to bypass the immobilizer. Of course it's going to be hidden away somewhere deep in the car and since the fob will be powered directly by the arduino it will only be instantiated in a [split] second just to start the car and then powered back down.

[Compelica]

Any updates so far on the project?

[ojuniour]

Originally Posted by Compelica

Any updates so far on the project?

I'm still trying to querying through the canbus message to find message that would check for valid key fob. It seems like right now it can only be triggered when the door is opened.
As soon as a fob is detected, the car doesn't and won't periodically check until the car is shut down or an opened door is triggered to alarm the occupant/driver.
As soon as I can get the "trigger message" , then I will continue with it. I've already written most of the functionality in Arduino - being a software developer and my experience with Arduino that part was pretty easy.
If I'm unable to find it then the only thing I can do (at the moment just like most of the OEM remote starter out there) I will have to immediately shut off the car as soon as any of the doors are opened. I am trying to avoid that

[Compelica]

Originally Posted by ojuniour

I'm still trying to querying through the canbus message to find message that would check for valid key fob. It seems like right now it can only be triggered when the door is opened.
As soon as a fob is detected, the car doesn't and won't periodically check until the car is shut down or an opened door is triggered to alarm the occupant/driver.
As soon as I can get the "trigger message" , then I will continue with it. I've already written most of the functionality in Arduino - being a software developer and my experience with Arduino that part was pretty easy.
If I'm unable to find it then the only thing I can do (at the moment just like most of the OEM remote starter out there) I will have to immediately shut off the car as soon as any of the doors are opened. I am trying to avoid that

Think it would be rather difficult to 'prevent' a module on the canbus from transmitting the door ajar command, which the remote start module would shut off the engine... have read in other forums where they spam the module with messages but not sure how successful that would turn out.

Also - if you have the canbus command to turn off the car (not fuel cut) - would you be able to share it with me? Been trying to but to no avail.

[ojuniour]

Originally Posted by Compelica

Think it would be rather difficult to 'prevent' a module on the canbus from transmitting the door ajar command, which the remote start module would shut off the engine... have read in other forums where they spam the module with messages but not sure how successful that would turn out.

Also - if you have the canbus command to turn off the car (not fuel cut) - would you be able to share it with me? Been trying to but to no avail.

Oh and there is a way to check for valid fob status. The Canbus does broadcast that message as a standard protocol.
At this point I gave up on trying to manually trigger for "keyfob check" and let the vechicle actually handles that.

Before remote start, I will just have to check for door status - meaning door has to be closed before remote start can be activated - I will probably roll up all windows too (as a bonus).

If a remote start was initiated and any of the was opened, the car would automatically check for valid key fob.
If the driver gets in and decides to start driving, as soon as they pressed on the brake pedal I will check the broadcast message if they have valid key.
If driver does have valid keyfob, then [initiate the takeover procedure] and drive as normal.
if driver does NOT have valid key fob, the engine shuts off completely.


I was really overthinking it this whole time lol.

Now regarding your question regarding remote COMPLETE shutoff, unfortunately I don't have the canbus message for that. I can also COMPLETELY shut off the CAR only if the car was initially started as a canbus start - AKA remote start.
But if the car was initially started via the normal sequence the only option is the fuel cut - at the moment.

[Compelica]

Originally Posted by ojuniour

Oh and there is a way to check for valid fob status. The Canbus does broadcast that message as a standard protocol.
At this point I gave up on trying to manually trigger for "keyfob check" and let the vechicle actually handles that.

Before remote start, I will just have to check for door status - meaning door has to be closed before remote start can be activated - I will probably roll up all windows too (as a bonus).

If a remote start was initiated and any of the was opened, the car would automatically check for valid key fob.
If the driver gets in and decides to start driving, as soon as they pressed on the brake pedal I will check the broadcast message if they have valid key.
If driver does have valid keyfob, then [initiate the takeover procedure] and drive as normal.
if driver does NOT have valid key fob, the engine shuts off completely.


I was really overthinking it this whole time lol.

Now regarding your question regarding remote COMPLETE shutoff, unfortunately I don't have the canbus message for that. I can also COMPLETELY shut off the CAR only if the car was initially started as a canbus start - AKA remote start.
But if the car was initially started via the normal sequence the only option is the fuel cut - at the moment.

The engine cutoff when the door is opened is likely to restart the sequence of events, which is likely done to verify the person intending to enter the car has the keyfob. But AFAIK other manufacturers don't turn off the engine upon door upon, only Toyota.

On remote starts, as I'm aware of - they are merely used to warm/cool the car cabin and possibly the engine as well (though the average driver may not care). For certain VWs you can hold down the lock/unlock button on the keyfob to remotely bring down the windows to reach for something if the door isn't accessible or let air out of the cabin; very useful in hot climates.

Would you mind sharing the commands for the remote starts (ACC, IGN1, IGN2, ACC+IGN1+IGN2) and rolling up/down the windows? May come in handy for certain situations I'm thinking of...

[ojuniour]

Originally Posted by Compelica

The engine cutoff when the door is opened is likely to restart the sequence of events, which is likely done to verify the person intending to enter the car has the keyfob. But AFAIK other manufacturers don't turn off the engine upon door upon, only Toyota.

On remote starts, as I'm aware of - they are merely used to warm/cool the car cabin and possibly the engine as well (though the average driver may not care). For certain VWs you can hold down the lock/unlock button on the keyfob to remotely bring down the windows to reach for something if the door isn't accessible or let air out of the cabin; very useful in hot climates.

Would you mind sharing the commands for the remote starts (ACC, IGN1, IGN2, ACC+IGN1+IGN2) and rolling up/down the windows? May come in handy for certain situations I'm thinking of...

Yea..I tried not to go that route of actually completely turning off the engine as soon as the door is opened. I will only shut it off if the user attempts to drive the car and no valid key fob is available (which would be triggered as soon as the door state changes from closed to open).

Remote start is merely convenient to set the car to a nice/modest room temp based on the outside temp usually.
I live on the east coast, so this comes in very handy during the winter season and also during those summer heat waves. Having to step into the car, wait a few minutes to warm up while freezing your nuts off or the during the summer in which sometimes i basically have to quickly turn on the car, set AC (if it wasn't previously set), crack open the window and quickly get out of the car because of how HOT the inside can be.

That's my main reason for doing this. I mean i could have easily just go buy and install existing remote starters but what's the fun in that? Besides, those aren't exactly cheap and the ones with LTE remote start tend to be wonky and can sometimes take up to 15 seconds to send the command..among other things. At least I can control everything including my own server implementation.

Anyway, enough rant.

Now Be warned, For the Ignition 1, Ignition 2, and ACC commands needs to be sent one at a time.
Meaning if you are CONTINUOUSLY sending IGN1 message, you can't send IGN2, and ACC CONTINUOUSLY at same time.
You will have to stop sending the other message before you send another.
This only applies to the ignition states.
IF you don't HEED, then you will potentially soft lock your vehicle from starting UNTIL you clear 'engine code'.
Yea I learned my lesson. Even though the Check engine doesn't come up in the dash, the canbus is still internally confused when you send those messages simultaneously. Make sure you have an OBD adapter to perform the reset. Disconnecting the battery should also do the same (I think - not sure). I believe it's call "Cancel Code".
Good news though is that the canbus can trigger both IGN1 and IGN2, and even ACC at same time as long as you send the right code. You just can't manually send both together as explained above - I can't reiterate that enough).

here are the commands:

Ignition ACC
-----------------------------------------------------
//CanBus ID
ID: 0x750
//CanBus DATA bits
ACC: 0xE9 0x04 0x30 0x01 0x00 0x10 0x00 0x00
IGN1: 0xE9 0x04 0x30 0x01 0x00 0x20 0x00 0x00
IGN2: 0xE9 0x04 0x30 0x01 0x00 0x40 0x00 0x00 //WARNING: DO NOT USE IGN2. IT WILL SOFTLOCK THE STARTER
IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x60 0x00 0x00
ACC_IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x70 0x00 0x00

Toyobaru decides to use a nicely sequential representation here [5th bit] (How nice of them. lol)
If you only send the message once, the action is triggered and I believe it takes about 15 to 45 secs before the car system automatically deactivates (turn offs) the action. You can continue to send the message at least once per 15 seconds to keep the action alive.


Fuel Cut
------------------------------------------------------
//CanBus ID
ID: 0x7E0
//CanBus DATA bits
All Cylinder Fuel Cut: 0x06 0x30 0x1C 0x05 0x0F 0xA5 0x00 0x00


Windows
------------------------------------------------------
//CanBus ID
ID: 0x750
//
//CanBus DATA bits
Driver Full Up: 0xEC 0x04 0x30 0x01 0x01 0x80 0x00 0x00
Driver Full Down: 0xEC 0x04 0x30 0x01 0x01 0x40 0x00 0x00
Pass Full Up: 0xEC 0x04 0x30 0x01 0x01 0x20 0x00 0x00
Pass Full Down: 0xEC 0x04 0x30 0x01 0x01 0x10 0x00 0x00

One caveat regarding the windows ( I believe it applies to HVAC too) is that the car needs to have its Ignition state active prior to performing the window actions.
So basically you send the IGN1 which will power up the module for the window control system (At this point is when I realize why we have two ignition states - anyway moving on), then you can send the window commands as desired. You only have to send the command once, and the car would perform the action.
Now regarding the windows there are also some variations like roll up (or down) 1/3 or 2/3 or even at any point, but that is slightly more involved. You have to send a preliminary message first that would trigger that state.
I'm gonna assume you only care about full up or full down anyway.

Aaaand, there ya go!
For each of any of the commands the canbus will return a confirmation message. I am not going to include them since you will probably get them anyway as soon as you send these commands but I did include the receiving CanBus ID you should be listening to below:
Sending at 0x750 , returns confirmation at 0x758
Sending at 0x7E0 , returns confirmation at 0x7E8

Cheers!


MAJOR Correction : Do not use the IGN2 ... Really the only (since it will soft lock your car (from starting). I'm not going to remove it but leave it here as a reference. but you've been warned!

[geraldjust]

Originally Posted by ojuniour

Yea..I tried not to go that route of actually completely turning off the engine as soon as the door is opened. I will only shut it off if the user attempts to drive the car and no valid key fob is available (which would be triggered as soon as the door state changes from closed to open).

Remote start is merely convenient to set the car to a nice/modest room temp based on the outside temp usually.
I live on the east coast, so this comes in very handy during the winter season and also during those summer heat waves. Having to step into the car, wait a few minutes to warm up while freezing your nuts off or the during the summer in which sometimes i basically have to quickly turn on the car, set AC (if it wasn't previously set), crack open the window and quickly get out of the car because of how HOT the inside can be.

That's my main reason for doing this. I mean i could have easily just go buy and install existing remote starters but what's the fun in that? Besides, those aren't exactly cheap and the ones with LTE remote start tend to be wonky and can sometimes take up to 15 seconds to send the command..among other things. At least I can control everything including my own server implementation.

Anyway, enough rant.

Now Be warned, For the Ignition 1, Ignition 2, and ACC commands needs to be sent one at a time.
Meaning if you are CONTINUOUSLY sending IGN1 message, you can't send IGN2, and ACC CONTINUOUSLY at same time.
You will have to stop sending the other message before you send another.
This only applies to the ignition states.
IF you don't HEED, then you will potentially soft lock your vehicle from starting UNTIL you clear 'engine code'.
Yea I learned my lesson. Even though the Check engine doesn't come up in the dash, the canbus is still internally confused when you send those messages simultaneously. Make sure you have an OBD adapter to perform the reset. Disconnecting the battery should also do the same (I think - not sure). I believe it's call "Cancel Code".
Good news though is that the canbus can trigger both IGN1 and IGN2, and even ACC at same time as long as you send the right code. You just can't manually send both together as explained above - I can't reiterate that enough).

here are the commands:

Ignition ACC
-----------------------------------------------------
//CanBus ID
ID: 0x750
//CanBus DATA bits
ACC: 0xE9 0x04 0x30 0x01 0x00 0x10 0x00 0x00
IGN1: 0xE9 0x04 0x30 0x01 0x00 0x20 0x00 0x00
IGN2: 0xE9 0x04 0x30 0x01 0x00 0x40 0x00 0x00
IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x60 0x00 0x00
ACC_IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x70 0x00 0x00

Toyobaru decides to use a nicely sequential representation here [5th bit] (How nice of them. lol)
If you only send the message once, the action is triggered and I believe it takes about 15 to 45 secs before the car system automatically deactivates (turn offs) the action. You can continue to send the message at least once per 15 seconds to keep the action alive.


Fuel Cut
------------------------------------------------------
//CanBus ID
ID: 0x7E0
//CanBus DATA bits
All Cylinder Fuel Cut: 0x06 0x30 0x1C 0x05 0x0F 0xA5 0x00 0x00


Windows
------------------------------------------------------
//CanBus ID
ID: 0x750
//
//CanBus DATA bits
Driver Full Up: 0xEC 0x04 0x30 0x01 0x01 0x80 0x00 0x00
Driver Full Down: 0xEC 0x04 0x30 0x01 0x01 0x40 0x00 0x00
Pass Full Up: 0xEC 0x04 0x30 0x01 0x01 0x20 0x00 0x00
Pass Full Down: 0xEC 0x04 0x30 0x01 0x01 0x10 0x00 0x00

One caveat regarding the windows ( I believe it applies to HVAC too) is that the car needs to have its Ignition state active prior to performing the window actions.
So basically you send the IGN1 (could have been IGN2 don't remember) which will power up the module for the window control system (At this point is when I realize why we have two ignition states - anyway moving on), then you can send the window commands as desired. You only have to send the command once, and the car would perform the action.
Now regarding the windows there are also some variations like roll up (or down) 1/3 or 2/3 or even at any point, but that is slightly more involved. You have to send a preliminary message first that would trigger that state.
I'm gonna assume you only care about full up or full down anyway.

Aaaand, there ya go!
For each of any of the commands the canbus will return a confirmation message. I am not going to include them since you will probably get them anyway as soon as you send these commands but I did include the receiving CanBus ID you should be listening to below:
Sending at 0x750 , returns confirmation at 0x758
Sending at 0x7E0 , returns confirmation at 0x7E8

Cheers!

This is all all interesting. so for starting, you did not have a valid key fob in the car but you keeped sending the to keep ACC, IG1 anf IG2 on? and that keeped the car alive, and your checking periodically or passively if the bit for the "valid key present". Eventually if it is, you do the handoff? If someone opens the door and the valid key isnt present just turn off the car vy stopping the power command basicly?

[Compelica]

Originally Posted by ojuniour

Yea..I tried not to go that route of actually completely turning off the engine as soon as the door is opened. I will only shut it off if the user attempts to drive the car and no valid key fob is available (which would be triggered as soon as the door state changes from closed to open).

Remote start is merely convenient to set the car to a nice/modest room temp based on the outside temp usually.
I live on the east coast, so this comes in very handy during the winter season and also during those summer heat waves. Having to step into the car, wait a few minutes to warm up while freezing your nuts off or the during the summer in which sometimes i basically have to quickly turn on the car, set AC (if it wasn't previously set), crack open the window and quickly get out of the car because of how HOT the inside can be.

That's my main reason for doing this. I mean i could have easily just go buy and install existing remote starters but what's the fun in that? Besides, those aren't exactly cheap and the ones with LTE remote start tend to be wonky and can sometimes take up to 15 seconds to send the command..among other things. At least I can control everything including my own server implementation.

Anyway, enough rant.

Now Be warned, For the Ignition 1, Ignition 2, and ACC commands needs to be sent one at a time.
Meaning if you are CONTINUOUSLY sending IGN1 message, you can't send IGN2, and ACC CONTINUOUSLY at same time.
You will have to stop sending the other message before you send another.
This only applies to the ignition states.
IF you don't HEED, then you will potentially soft lock your vehicle from starting UNTIL you clear 'engine code'.
Yea I learned my lesson. Even though the Check engine doesn't come up in the dash, the canbus is still internally confused when you send those messages simultaneously. Make sure you have an OBD adapter to perform the reset. Disconnecting the battery should also do the same (I think - not sure). I believe it's call "Cancel Code".
Good news though is that the canbus can trigger both IGN1 and IGN2, and even ACC at same time as long as you send the right code. You just can't manually send both together as explained above - I can't reiterate that enough).

here are the commands:

Ignition ACC
-----------------------------------------------------
//CanBus ID
ID: 0x750
//CanBus DATA bits
ACC: 0xE9 0x04 0x30 0x01 0x00 0x10 0x00 0x00
IGN1: 0xE9 0x04 0x30 0x01 0x00 0x20 0x00 0x00
IGN2: 0xE9 0x04 0x30 0x01 0x00 0x40 0x00 0x00
IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x60 0x00 0x00
ACC_IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x70 0x00 0x00

Toyobaru decides to use a nicely sequential representation here [5th bit] (How nice of them. lol)
If you only send the message once, the action is triggered and I believe it takes about 15 to 45 secs before the car system automatically deactivates (turn offs) the action. You can continue to send the message at least once per 15 seconds to keep the action alive.


Fuel Cut
------------------------------------------------------
//CanBus ID
ID: 0x7E0
//CanBus DATA bits
All Cylinder Fuel Cut: 0x06 0x30 0x1C 0x05 0x0F 0xA5 0x00 0x00


Windows
------------------------------------------------------
//CanBus ID
ID: 0x750
//
//CanBus DATA bits
Driver Full Up: 0xEC 0x04 0x30 0x01 0x01 0x80 0x00 0x00
Driver Full Down: 0xEC 0x04 0x30 0x01 0x01 0x40 0x00 0x00
Pass Full Up: 0xEC 0x04 0x30 0x01 0x01 0x20 0x00 0x00
Pass Full Down: 0xEC 0x04 0x30 0x01 0x01 0x10 0x00 0x00

One caveat regarding the windows ( I believe it applies to HVAC too) is that the car needs to have its Ignition state active prior to performing the window actions.
So basically you send the IGN1 (could have been IGN2 don't remember) which will power up the module for the window control system (At this point is when I realize why we have two ignition states - anyway moving on), then you can send the window commands as desired. You only have to send the command once, and the car would perform the action.
Now regarding the windows there are also some variations like roll up (or down) 1/3 or 2/3 or even at any point, but that is slightly more involved. You have to send a preliminary message first that would trigger that state.
I'm gonna assume you only care about full up or full down anyway.

Aaaand, there ya go!
For each of any of the commands the canbus will return a confirmation message. I am not going to include them since you will probably get them anyway as soon as you send these commands but I did include the receiving CanBus ID you should be listening to below:
Sending at 0x750 , returns confirmation at 0x758
Sending at 0x7E0 , returns confirmation at 0x7E8

Cheers!

Much appreciated @ojuniour.

As expected it works on my 86 as well, albeit with slightly different behavior. For example, ACC+IGN1+IGN2 only lasts for about 5 seconds before shutting off, and the window control commands have to be fired multiple times until it fully opens/closes. And in my logger (had to dig out the other stuff) - SSM4 is doing the same thing unlike yours which the entire window goes up/down with the command is only issued once.

Also, running ACC+IGN1+IGN2 when the car alarm is armed, triggers the alarm.

My fuel cut command is slightly different from yours, but it works all the same. It was captured from Techstream though.

Since ACC+IGN1+IGN2 is initiated by the BIU (with header 750), the turn off command should be coming from there as well. I can probably use the ELM327 to monitor and find that command somehow.

[ojuniour]

Originally Posted by geraldjust

This is all all interesting. so for starting, you did not have a valid key fob in the car but you keeped sending the to keep ACC, IG1 anf IG2 on? and that keeped the car alive, and your checking periodically or passively if the bit for the "valid key present". Eventually if it is, you do the handoff? If someone opens the door and the valid key isnt present just turn off the car vy stopping the power command basicly?

You still need a keyfob somewhere in the car for the initial starting sequence (although you can still start the car but it would die in like few seconds as the ECU unable to find any valid key).
I have a dummy keyfob that I removed from its case (and just the bare PCB). It will be powered by Arduino as i send a ground pin to it momentarily to kick off the sequence. as soon as the car starts, i can then deenergize the key.
The car will still continue to run and would still think there is a valid key because it doesn't periodically check until one of the doors is opened ( and closed). The car will still continue to run until you stop sending the command or somehow the arduino was removed/disconnected.
In my case, as soon as the door is opened and stayed open, and you don't have a valid keyfob and you initiated the takeover sequence (by holding the push start and brake at same time), the car would shut off. Period.

[ojuniour]

Originally Posted by Compelica

Much appreciated @ojuniour.

As expected it works on my 86 as well, albeit with slightly different behavior. For example, ACC+IGN1+IGN2 only lasts for about 5 seconds before shutting off, and the window control commands have to be fired multiple times until it fully opens/closes. And in my logger (had to dig out the other stuff) - SSM4 is doing the same thing unlike yours which the entire window goes up/down with the command is only issued once.

Also, running ACC+IGN1+IGN2 when the car alarm is armed, triggers the alarm.

My fuel cut command is slightly different from yours, but it works all the same. It was captured from Techstream though.

Since ACC+IGN1+IGN2 is initiated by the BIU (with header 750), the turn off command should be coming from there as well. I can probably use the ELM327 to monitor and find that command somehow.

Oh yea , you are right. That is 5 seconds. But for the actual live canbus broadcast message, the ecu continues to broadcast canbus message for abou t15 seconds, and the power to the window/HVAC.. (via IGN1/IGN2) will stays on for about 45 seconds.

[geraldjust]

Originally Posted by ojuniour

You still need a keyfob somewhere in the car for the initial starting sequence (although you can still start the car but it would die in like few seconds as the ECU unable to find any valid key).
I have a dummy keyfob that I removed from its case (and just the bare PCB). It will be powered by Arduino as i send a ground pin to it momentarily to kick off the sequence. as soon as the car starts, i can then deenergize the key.
The car will still continue to run and would still think there is a valid key because it doesn't periodically check until one of the doors is opened ( and closed). The car will still continue to run until you stop sending the command or somehow the arduino was removed/disconnected.
In my case, as soon as the door is opened and stayed open, and you don't have a valid keyfob and you initiated the takeover sequence (by holding the push start and brake at same time), the car would shut off. Period.

There is a couple of things you can do, for push start cars the challenge response can be just brute force by keep sending challenges to the certification ecu. Record all the responses (will take a while). Once you have all those saved. You can replay it. The possibilities are very large, so you have to have some sort of external EEPROM, or flash. Turnkey cars are slightly different on some IDs due to the fact the BCM and Cluster are involved. but its doable.

[ojuniour]

Originally Posted by geraldjust

There is a couple of things you can do, for push start cars the challenge response can be just brute force by keep sending challenges to the certification ecu. Record all the responses (will take a while). Once you have all those saved. You can replay it. The possibilities are very large, so you have to have some sort of external EEPROM, or flash. Turnkey cars are slightly different on some IDs due to the fact the BCM and Cluster are involved. but its doable.

It is possible to replay the key. But the hardest part is actually finding/intercepting the valid replay messages between canbus without connecting directly to the transponder in which most (if not all aftermarkets do - including OEM ones). Having to do this strictly on the canbus means that you need to have access to the key seeding and you have to be able to expose and read the fob data frame. I tried. I just decide to go the easiest route and can be implemented without much hassle.