Marty had a little board with an LED he had made. I think he had talked to MrSporty about how to do it, hence why I think they can both do it and why I suspect Les from Classic Rides North Wales may also have the capability. He connected the board to his laptop and when I pressed the button on my fob he captured the code. I cannot remember how it was encoded but there was no encyption. He was able to show me the fob code and the key number which did indeed match the number on the back of the key. I'm pretty sure there was a rolling code as well but I cannot recall the order they were in.
Datatek
Well-Known Member
It's easy enough to capture the output of the FOB including the rolling code and the FOB number, the problem comes in entering that information into the memory of the chip for which you need specialist kit. I can't even buy the chips as the manufacturers of the chip will only sell to bona fide FOB manufacturers for security reasons. There are companies that will clone your FOB, but the FOB construction is different as is the electronics.
Datatek
Well-Known Member
First let me say thank you to Brian for sending me 2 FOB's.
I had a chance to have a quick look at one of the FOB's today. It's all a bit of a puzzle. The chip contains code, I don't have a means of storing the trace at the moment so doing a comparison with a working FOB is difficult but the first part of the trace looks near enough identical to the trace from my FOB. Now the puzzling bit. The FOB came with batteries fitted but no blade fitted. The case is bonded shut, so fitting the blade requires splitting the case which will cause some damage, so why no blade fitted? Programming the chip requires access to the chip, again not possible without splitting the case.
The case moulding has some very small differences to the moulding compared to the 6 genuine FOB's I have in my possession. I suspect the FOB's are knock off, as the LED flashes, they could easily be sold on Ebay as working FOB's but that is just a guess.
My next step will be to split the case to see what chip is fitted, there have been at least 2 different chips fitted to my certain knowledge. I will investigate further as and when time permits.
@brianp38dse
brianp38dse
Well-Known Member
The fobs come in the open position the blades slot in and the small roll pin holds it in, you can see the hole when you close it a bit they are a bit of a fiddle and i had to line it up and push it in with grips.
Datatek
Well-Known Member
I confess I had not noticed that, I was more interested in the electronics. Still doesn't answer how the chip would be programmed to the vehicle though.
I had assumed that programming was achieved via the round PCB pads you can see when the battery holder is removed - these are often used as test points on larger PCB's for automated testing. You can see them in the pictures Brian posted earlier in the thread.
If I can work out how to attach a picture I'll take one of the IC I removed from the new fob what I switched the IC's over to make the fully working fob.
I did (at least I think) find out why the old fob was playing up so much BTW - when I removed the original IC from the old fob, I found a stray surface mount capacitor laying across the two tracks under the chip - well, this and the crap soldering on the replacement buttons, but I wasn't about to re-solder the IC back to check since I'd gone that far.
If I can work out how to attach a picture I'll take one of the IC I removed from the new fob what I switched the IC's over to make the fully working fob.
I did (at least I think) find out why the old fob was playing up so much BTW - when I removed the original IC from the old fob, I found a stray surface mount capacitor laying across the two tracks under the chip - well, this and the crap soldering on the replacement buttons, but I wasn't about to re-solder the IC back to check since I'd gone that far.
Datatek
Well-Known Member
I will look into those pads when I split the case.
New here, as for my sins purchased a p38 from a nice old couple, August 1st. 2.5 diesel....runs exactly as it should but for a new phantom.
This is exactly what mine did last night, after my wife came in and said the lights, all Amber only, were on on the p38. Opened it and "key in the ignition ".
I had just replaced the passenger door latch/actuator (mgf) after six weeks of trying to get to it. (Before starting, found that the driver door latch stopped working) As back then, the battery went flat, recharged, ran fine, came out later in the morning and the vehicle was going nuts locking and unlocking...long story short, battery dead, passenger door lock dead.
I know I need to get a drivers side latch but what one? I assume this must be tackled first?
Is the 'key in ignition' related to the work I just did?
Are the fobs faulty because of the actuator or rf interference?
I have had to twice enter the key code to get back in.
Appreciate the help and insight!
JW
brianp38dse
Well-Known Member
Hello and welcome
Key in ignition is the lock wants some electrical contact cleaner squirted in to clean the lock left to dry then some graphite powder blown in, if the little key block does not cover the key hole the BECM will not go to sleep and drain battery and so will the door lock playing up have a run through this test
Key in ignition is the lock wants some electrical contact cleaner squirted in to clean the lock left to dry then some graphite powder blown in, if the little key block does not cover the key hole the BECM will not go to sleep and drain battery and so will the door lock playing up have a run through this test
+1.
Check the RF receiver version you have as well as that can burn out door-locks.
Datatek
Well-Known Member
@Zaphodbb I think you are correct about the 4 pads visible when the batteries are removed being programming pads. I have not checked them properly yet but at least 2 go to the chip
I split the case today. The chip is a Motorola MCT705K1CDW. I spent a long time (not for the first time) searching for a data sheet without success. Eventually I found someone else searching for the same info and he had come up with a comment that the part number on the chip is incomplete, the actual part number is MC68HC705K1, I have found a data sheet for this part number. This is a Motorola 6800 series microprocessor, it remains to be seen from testing if the data sheet corresponds to the chip in the FOB. At least it's a step forward. If this is the right chip, it appears to have one time programming EPROM so once coded it cannot be changed. I have pages and pages of data to read before I can be certain of that.
If anybody feels like taking a look, search for Motorola data sheet MC68HC705K1
Got this done and the fob is working with all doors except the drivers. The drivers door with key, locks all and sets the alarm, but it does not go to sleep.
So take apart the full motor latch mechanism and then replace with new. I am willing to try, though limited in knowledge but can usually work through most things. Is there a supplier?
In my limited, Sorry, capabilities, these tests are done with a multi-metre?
Datatek
Well-Known Member
Under the parcel shelf support drivers side.
Cheers
