Those are the type of cases I use when recasing. You have to be a bit lucky as there are plenty of cases that look fine but the original key blade will not lock in place properly once fitted. Not an issue for me as I also own a key cutting machine but worth highlighting.

Hehe, lentils, peas, ball bearings .. i've had the works :)

Unfortunately not. Once those inserts drop out, its because the metal capping has come loose. Basically its a PCB out job.

If you are fully confident in being able to open the case without damaging the PCB and your ok with surface mount soldering, I will happily send you a couple of switches.

The original buttons have a small plastic insert that is capped in place by a soldered down metal cover. Over time, the solder breaks, the cover pops off and the plastic insert falls out.. leaving the switch as pictured. I do provide services to fully repair those if you require. Your case...

Thanks for the kind words guys. I am still fixing plenty of these and will hopefully be offering a replacement key service this year.

What kind of condition is the key in ? .. Is the battery cover all chewed up (most are!) and do the buttons cause the red LED to light consistently every time ? The most popular sync methods I know of are the door lock method on early models and active sync on the later models which should...

Super stuff, have dropped you a PM John.

Exactly that yes, the code that comprises of a 3 sets of 3 digits. They are a decimal representation of the 3 hex bytes of each locksets unique code.

Right now this can be used by anyone who would like to test the ability to clone their BECM to a spare. It could be someone who is putting up with a water damaged unit or just likes to tinker. Being able to map the EEPROM values in the dumps to the different functions is difficult (at the...

Yay .. another day, another set of PCB's ! I can highly recommend "Dirty PCB's" if anyone ever needs any making. Just need to source a few bits and then they are ready if anyone still wants to help test.

Still waiting on the P38 BECM boards winging their way from China .. so in the mean time, I found something else to play with ... A Discovery 2 BCU. The MCU looks pretty easy to access. I would imagine a non solder option should be doable in less than 4 years...

It all depends on your dealer but £150 isn't too far from the mark.

Hi Buster Think it might be my service that your using and yes, the fob was unfortunately empty ! It looks like the previous owner had been at it and forgot to put the PCB back in. I'm working on a replacement fob service but as it stands right now your most accessible option is a new dealer...

Waiting on some other bits and bobs to come together hence the lack of updates. Did manage to spin a batch of *REALLY* dirty PCBs which should be processed in the next week or two : If anyone wants one to play with one just let me know. Ill post when they arrive.

Did a little more digging and it looks like they use 2 different mask sets on the Disco2 BCM. An MC68HC11P2 (Mask 0G10V) and a MC68HC11PH8 (Mask 0H30R). Both are easily readable and writeable using a variety of different available programmers. Most people are accessing these BCM's to change...

Thanks for the encouragement Rick. Out of curiosity, Which MCU did you crack years ago .. the 68HC11 or the one next to it with the external ROM ? And the Disco2 BCM .. cracked as in accessible via OBD or cracked as in accessible via direct chip access. I just had a quick look around and it...

My research is purely an offshoot of my business which is keyfob repair and replacement so my end goal is still an easier way to provide P38 owners with reliable and reasonably priced replacement keys. That's not to say I don't try to have fun investigating but even I don't think I'm crazy (or...

Access to the EEPROM in all instances is done by a proxy upload technique. A bootloader (in this case a SCI port bootloader) is uploaded to allow access to the EEPROM via the SCI port. Regular diagnostic access can see part of the EEPROM if not all of it. This is bounds checked by the lock bit...

Is it a .. "I've personally seen the disassembled source of the BECM and know for certain there are no bugs, loopholes, hidden vendor specific commands or buffer overflows, to the best of my knowledge" .. not possible. Or is it a .. "I've never seen anyone else do it so I don't think it can...