Ahh .. sorry Bladerunner919. For some reason (half asleep this morning after a nights soldering) I read your post as "Do you think its feasible to expect people to open their BECM's" and not "Do you think its feasible to do this work via the OBD port" Unfortunately as mentioned this does (at...

Anything is feasible if the circumstance dictates. I haven't dissembled the BECM MCU's code yet but I'm sure people have in the past and reached the conclusion that the only solution to fully unlocking the BECM is hardwiring. Here's another option. Open the BECM once to install a DB9 port...

Well, another day, another burnt finger :) I got another few hours work done and Im pretty happy with the results. Ive got a dead basic menu that has most of its functions working (just need to fixup the individual byte editing) : But the best result : I GOT SOLDERLESS ONBOARD READ/WRITE...

That's good news :) Even better news. I got the write functions working fine now so I have full control over the entire EEPROM. This is of course on a bench mounted MCU. and .. Prototype "Solderless" adaptor ! Seems to work fine with the pinout. All that's needed is to gently scrape, scrub...

I never looked at it that way. For some reason I always thought the Sync tools forced the EMS to recalibrate, i,e the security code comms direction was BECM->EMS. If its EMC->BECM then yes, what Bladerunner919 describes should be possible.

Forgot to mention. In Laymans terms, this tool would allow you to take the information from your existing (and possibly faulty) BECM, back it up using the tool and then re-write it back into a spare (working) BECM. It would also allow you to set the unlock bit of your BECM, allowing you to...

A BECM sync tool isn't something that this research would bring about immediately. That being said I am interested in how the Sync tool works and am pretty sure one could be produced for a much reduced price. I'll look into it once Ive finished this project.

That info includes the fob codes, sync codes, all general settings and importantly the lock bit using a PCB that is simple, cheap (£10!) and easily available on Ebay or Amazon.

Another quick update. Did a bit more work on the bootloader code this weekend. First I got the MCU wired upto a very popular and easily accessible dev tool .. an Arduino Uno ! I also hooked up a Logic Analyser to see what was happening with regards the bit timings. I used my programmer to...

Hehe, I know what you mean .. it can get a bit bogged down with the technical stuff at times. I like to include as much info as possible so that other people with the same inclination can have a try themselves. In plain english, the end result will hopefully be a readily available circuit board...

Replacement BeCM hasn't arrived yet but I am making pretty good progress porting the bootloader code to an Arduino Uno. The current code uses a pretty non standard baud rates (14300 and 17900). Luckily i found a software serial library that lets me set non standard bauds.

Well, setbacks and progress in equal measures today. I hooked up one of my programmers that I know can read these devices to the relevant pads on the PCB and .. it wouldn't read. I kept getting a "device silent" message and after checking the pins with a logic analyser, I could see the...

Hurray, my BECM turned up from Fleabay .. A quick whizz round it with the T10 Torx and out she popped ! Turns out its a Motorola MC68HC11KS2 (Mask 1E59B) Funny thing is, a quick look at it shows some curious solder deposits on some familiar parts .. that's right, it's already been unlocked...

I've been rebuilding them for £29.99 for years but as stated this isn't about existing fobs or the cost of anyone's current services. The current P38 fob in any of its 3 revisions is over engineered. The battery compartment/terminals is the most serious design flaw. All a re engineered fob...

Thanks for the positive input Steve, done a bit of 68k in my Amiga days so it might be fun if I have to write some bootloader code :) I'm not sure if any part of what I intend to do would render anything invalid. Apparently there are P38 shipped from factory with the BECM unlocked. That...

BTW, literally as I was typing I received this as a message from a potential customer : I'd love to be able to request a simple picture of that guys key blade and then ship him 2 brand new compatible fobs and the necessary kit so he wouldn't have to mess about shipping things across Europe...

Unfortunately extracting the code from a non working fob wouldn't be possible. Just as an OT bump, can anyone confirm the markings of their BECM controller chip ?

In order to make a compatible replacement fob, you need to know the FOB code. As I mentioned in a previous post there are only 3 ways of getting this code. 1.Official dealers. 2.Unrolling and decoding and an existing fobs transmission. 3.Extracting from the BECM. I'm looking at BECM access...

I too cut and program keys for a range of vehicles but repairing and re-engineering remote fobs is my main interest. This all came about as I keep getting asked by my customers if I can provide spare P38 keys, usually in the situation where they have a single working key and they can't afford...

Luckily these older MCU's are quite well documented. Freescale (who took over Motorola) are good enough to host datasheets that describe the Bootstrap Modes in detail. This is the mode that is used to login and read/write the internal EEPROM, the key part of unlocking the BECM. Another nice...