home register FAQ memberlist calendar

Go Back   Turbobricks Forums > Mechanical > performance & modifications

Reply
 
Thread Tools Display Modes
Old 11-20-2018, 12:11 PM   #26
mocambique-amazone
Board Member
 
Join Date: Jul 2012
Location: Germany
Default

Could not be done by a switch. Not as simple as you hope, sorry.
mocambique-amazone is offline   Reply With Quote
Old 11-20-2018, 12:26 PM   #27
Scuby
Board Member
 
Join Date: Sep 2015
Location: The Netherlands
Default

Quote:
Originally Posted by mocambique-amazone View Post
Could not be done by a switch. Not as simple as you hope, sorry.
Hmmm. I beg to differ. You just need to know WHAT the ECU wants to see.

For instance, GM has PATS. The resistor in the key is matched by one in an immobiliser ECU that when it see's the right resistance it then sends a "it's all good" signal to the ecu.

In the case of PATS it's a 5.2v signal at 50hz or 60hz depending on your vehicle.

It's not vodoo, the ECU needs a reference signal from an outside source telling it the correct key is in. It could have what I described integrated or external.

The same is true of the GM stuff. You can burn a chip with it off or on OBDII cars go in with your laptop and turn off the immobiliser.

For now I'm gonna have him buy a set of chips and fit a daughter board to his EZK.


Here it is running. Thanks a million for everyone's help and idea's.

https://youtu.be/7ugcJZKBqLU
__________________
1962 Amazon 121 Coupe
1967 Amazon 221 Combi
1977 2.1DL 245
1993 245 Polar b230fk/m90 implant in progress
1980 B23ET m90
1996 850 T5 chipped
1996 940 D24TIC
Scuby is offline   Reply With Quote
Old 11-20-2018, 01:15 PM   #28
bobxyz
Board Member
 
bobxyz's Avatar
 
Join Date: Aug 2014
Location: Boulder, Colorado
Default

You only need a non-immobiliser chip for the 984 ECU, the 148 EZK is standard Turbo. Ask your local chip supplier if they could burn you a factory non-immobiliser chip for cheap (versus a custom performance chip that they'll charge more for). This is much easier than trying to figure out the magic signal from the immobiliser that tells the ECU that "it's all good".
bobxyz is offline   Reply With Quote
Old 11-20-2018, 05:38 PM   #29
Scuby
Board Member
 
Join Date: Sep 2015
Location: The Netherlands
Default

Quote:
Originally Posted by bobxyz View Post
You only need a non-immobiliser chip for the 984 ECU, the 148 EZK is standard Turbo. Ask your local chip supplier if they could burn you a factory non-immobiliser chip for cheap (versus a custom performance chip that they'll charge more for). This is much easier than trying to figure out the magic signal from the immobiliser that tells the ECU that "it's all good".
Just going to up the boost to 0.8 bar and run the Fins chips.

But it's just interesting to me that everyone thinks it such a mystery. I mean, I don't know the specifics but it ISN'T magic. It's a question of knowing what feedback the ECU wants. It's like any other sensor. But Volvo has kept it a secret this long I suppose, and a new chip is quick and easy.

I'm just curious.
Scuby is offline   Reply With Quote
Old 11-20-2018, 05:44 PM   #30
bobxyz
Board Member
 
bobxyz's Avatar
 
Join Date: Aug 2014
Location: Boulder, Colorado
Default

If you have an oscilloscope or 12volt tolerant logic analyzer, probe the Park/Neutral input to the ECU and see what magic signaling the immobiliser sends it. (I'm still assuming that that's the pin used on the ECU, but I'd need to see a wiring diagram to confirm.)
bobxyz is offline   Reply With Quote
Old 11-20-2018, 05:56 PM   #31
Scuby
Board Member
 
Join Date: Sep 2015
Location: The Netherlands
Default

Quote:
Originally Posted by bobxyz View Post
If you have an oscilloscope or 12volt tolerant logic analyzer, probe the Park/Neutral input to the ECU and see what magic signaling the immobiliser sends it. (I'm still assuming that that's the pin used on the ECU, but I'd need to see a wiring diagram to confirm.)
I just look over the ECU pinout and couldn't find anything. That would be the pin though, makes sense.

Next 940 I get for the motor I'll trace the immobilizer wiring and analyze it
Scuby is offline   Reply With Quote
Old 11-20-2018, 09:00 PM   #32
soclosenotnear
Board Member
 
Join Date: Oct 2011
Location: summerville, south carolina
Default

Did we even get immobilizer ecus in the US? If so, maybe 95 940s?
soclosenotnear is offline   Reply With Quote
Old 11-21-2018, 04:26 AM   #33
ZVOLV
<Master Tech>
 
ZVOLV's Avatar
 
Join Date: Nov 2002
Location: California
Default

Oh ****... immobilser!! Good call. It cuts injector pulse or won't ground the fuel pump relay control circuit?? (Late UK models)
__________________
No Start Thread
ZVOLV is offline   Reply With Quote
Old 11-21-2018, 02:48 PM   #34
sbabbs
Board Member
 
sbabbs's Avatar
 
Join Date: Dec 2006
Location: Rushing Lane, Scappoose, OR
Default

We'll the trick is find a 983 non immobilser ECU and take the chip out of that and read it and post it if you want to be a LH 2.4 hero. Still waiting for the 983 lh2.4 hero to appear. Hasn't happened yet. Has to be from over the other side of the world from here of course. Until then the trick to run a 984 bin is to put it in 967 ECU then it will run.. 984 is the latest greatest 2.4 program so that is why you want to run with it. 983 is the same, just no immobiliser. I've seen people post on here saying they have one. I've then asked them to read the chip and post it or send the chip. Still nothing. I'd buy a complete 983 ECU with stock chip if I could find one for sale. I've already bought a couple 984's from europa. Got that.



Nobody has been able to figure out how to turn the immobiliser off in the 984 bin, nobody.. But you should figure that out, yeah..

Curiosity killed the cat, go find 983. You got your marching orders..
__________________
1988 245 White slicktop M47 Wagon! 2.5L NA 8v going in.
1990 745 B230FT Getrag JohnV flywheel 240mm clutch 13c A-cam 3.54 G80 548K MILES
1991 740SE B230FT NPR Strut braces IPD bar A cam 550cc EV14's. 3.73 G80 M90 to put in.

Last edited by sbabbs; 11-21-2018 at 02:54 PM..
sbabbs is offline   Reply With Quote
Old 11-22-2018, 12:11 PM   #35
ZVOLV
<Master Tech>
 
ZVOLV's Avatar
 
Join Date: Nov 2002
Location: California
Default

(Engine running video)

https://youtu.be/7ugcJZKBqLU

Nice!!! So you just swapped in a non immobilizer ECU?

I just watched it again. I like how you stopped the engine by pulling a few wires from the battery positive terminal. "Only 4 wires to make it run!!!" Well done.
ZVOLV is offline   Reply With Quote
Old 12-02-2018, 01:44 PM   #36
ipdown
Член на форума
 
ipdown's Avatar
 
Join Date: Jul 2008
Location: Bulgaria, Sofia
Default

A bit off topic, but in case you are curious how the immobilizer works:
LH 2.4 DLC is connected to the OBD2 connector not directly, but through the immobilizer module. On start LH sends to the immobilizer special 9-bytes packet that contains 3 byte header, 5 crypto challenge and 1 byte checksum. The challenge LH generates by producing a random number by taking a sample from its internal timer. The immobilizer module is expected to receive the packet, encrypt the payload in the packet again with 48-bit key, and send it back to LH2.4. Then LH decrypts it back with it's own key and compare it to the initial random number - if its match LH start, otherwise you know. It is LH who decides to start or not depending on the answer. The very same algorithm and even same keys are used in some 850 and S/V70.

The immobilizer can be bypassed by patching the code inside LH2.4

Also, 2 years ago together with a friend (rkam) we disassembled and translated the code, extracted the keys and brute forced to reveal all valid key space. This took some days on a multicore machine and multiple threads that worked each on a subset of the key space.
Thus it was possible to make immobilizer emulator with arduino which plugged to ECU responds with correct answer.
Attached Images
File Type: jpg immo.jpg (178.5 KB, 59 views)
File Type: jpg immo2.jpg (92.5 KB, 59 views)
ipdown is offline   Reply With Quote
Old 12-03-2018, 03:50 AM   #37
mocambique-amazone
Board Member
 
Join Date: Jul 2012
Location: Germany
Default

Whow you really impressed me
Where did you find this chart?
I never found the wiring map for a 1997 Volvo 940, where the hell did you find this?
I know about the way the immobilizer works, and have stI'll no clue about the kbytes and crypto stuff. This is all crypto to me
Thank you very much for teaching me a little bit (still I don't know how this works, I'm a mechanic person, more to steam machines addicted than to electronic bsssss bzzzzzz stuff)
Regards, Kay
mocambique-amazone is offline   Reply With Quote
Old 12-03-2018, 09:11 AM   #38
ipdown
Член на форума
 
ipdown's Avatar
 
Join Date: Jul 2008
Location: Bulgaria, Sofia
Default

Quote:
Originally Posted by mocambique-amazone View Post
Whow you really impressed me
Where did you find this chart?
I never found the wiring map for a 1997 Volvo 940, where the hell did you find this?
I know about the way the immobilizer works, and have stI'll no clue about the kbytes and crypto stuff. This is all crypto to me
Thank you very much for teaching me a little bit (still I don't know how this works, I'm a mechanic person, more to steam machines addicted than to electronic bsssss bzzzzzz stuff)
Regards, Kay
Hi, I don't remember how I found this scanned pdf, but it was after a lot of searching.
Here is the link: http://ipdown.net/docs/TP3933032_940...g_diagrams.pdf
Please, download, reupload, share, spread. The google will do it's job and it will be easier for everyone that needs it.

Last edited by ipdown; 12-03-2018 at 09:17 AM.. Reason: link edit
ipdown is offline   Reply With Quote
Old 12-05-2018, 06:09 PM   #39
sbabbs
Board Member
 
sbabbs's Avatar
 
Join Date: Dec 2006
Location: Rushing Lane, Scappoose, OR
Default

Vlad, do you have a 984 bin that has the immobilizer disabled in the bin?

The immobilizer can be bypassed by patching the code inside LH2.4
sbabbs is offline   Reply With Quote
Old 12-06-2018, 12:48 PM   #40
ipdown
Член на форума
 
ipdown's Avatar
 
Join Date: Jul 2008
Location: Bulgaria, Sofia
Default

Quote:
Originally Posted by sbabbs View Post
Vlad, do you have a 984 bin that has the immobilizer disabled in the bin?

The immobilizer can be bypassed by patching the code inside LH2.4
Hi Simon, I don't have. I will have to dig in my old stuff to find out the exact location of the mod. I will post the info.
ipdown is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump


All times are GMT -4. The time now is 02:01 AM.

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2018, vBulletin Solutions Inc.