• Hello Guest, welcome to the initial stages of our new platform!
    You can find some additional information about where we are in the process of migrating the board and setting up our new software here

    Thank you for being a part of our community!

LH 2.4 swap. Runs on brake clean, no injector pulse

If I were to design a rudimentary immobilizer, I'd wire it into the Park/Neutral interlock switch and make the ECU not inject fuel unless in Park/Neutral. I have no idea if this is what Volvo did.

For the 5-wire LH conversions, pin 9 pink wire is left unconnected. This is the P/N wire. Try connecting this to the starter side (versus battery side) of your remote start switch. Check the wiring diagrams to make sure this is OK (normally, it's wired to ignition switch pin 50, +12 during start only).

Good idea but irrelevant as my ecu is out of a stick car.
 
as a brief update to those thinking along.


SHE RUNS.

Immobiliser.

I would NEVER EVER have thought that to be the case. but hey. I had a set of chips lying around with an upgraded map.

Threw the fuel chip in in and BOOM!

I'd like to know though as this is my chip and a friends car, how to get AROUND the Volvo immo in the chip? there HAS to be a signal the ECU is looking for that I can replicate. Could put it on a hidden toggle switch and presto.
 
Proud I could help you.
Yes 0 280 000 984 is with immobilizer.
They did "safe" the ECU with a break away screw, the later ones even glued. A pita to get them out.
Simple to pass by with a chip, you know this too now ;-)

Have fun, Kay
 
Could not be done by a switch. Not as simple as you hope, sorry.

Hmmm. I beg to differ. You just need to know WHAT the ECU wants to see.

For instance, GM has PATS. The resistor in the key is matched by one in an immobiliser ECU that when it see's the right resistance it then sends a "it's all good" signal to the ecu.

In the case of PATS it's a 5.2v signal at 50hz or 60hz depending on your vehicle.

It's not vodoo, the ECU needs a reference signal from an outside source telling it the correct key is in. It could have what I described integrated or external.

The same is true of the GM stuff. You can burn a chip with it off or on OBDII cars go in with your laptop and turn off the immobiliser.

For now I'm gonna have him buy a set of chips and fit a daughter board to his EZK.


Here it is running. Thanks a million for everyone's help and idea's.

https://youtu.be/7ugcJZKBqLU
 
You only need a non-immobiliser chip for the 984 ECU, the 148 EZK is standard Turbo. Ask your local chip supplier if they could burn you a factory non-immobiliser chip for cheap (versus a custom performance chip that they'll charge more for). This is much easier than trying to figure out the magic signal from the immobiliser that tells the ECU that "it's all good".
 
You only need a non-immobiliser chip for the 984 ECU, the 148 EZK is standard Turbo. Ask your local chip supplier if they could burn you a factory non-immobiliser chip for cheap (versus a custom performance chip that they'll charge more for). This is much easier than trying to figure out the magic signal from the immobiliser that tells the ECU that "it's all good".

Just going to up the boost to 0.8 bar and run the Fins chips.

But it's just interesting to me that everyone thinks it such a mystery. I mean, I don't know the specifics but it ISN'T magic. It's a question of knowing what feedback the ECU wants. It's like any other sensor. But Volvo has kept it a secret this long I suppose, and a new chip is quick and easy.

I'm just curious.
 
If you have an oscilloscope or 12volt tolerant logic analyzer, probe the Park/Neutral input to the ECU and see what magic signaling the immobiliser sends it. (I'm still assuming that that's the pin used on the ECU, but I'd need to see a wiring diagram to confirm.)
 
If you have an oscilloscope or 12volt tolerant logic analyzer, probe the Park/Neutral input to the ECU and see what magic signaling the immobiliser sends it. (I'm still assuming that that's the pin used on the ECU, but I'd need to see a wiring diagram to confirm.)

I just look over the ECU pinout and couldn't find anything. That would be the pin though, makes sense.

Next 940 I get for the motor I'll trace the immobilizer wiring and analyze it
 
Oh ****... immobilser!! Good call. It cuts injector pulse or won't ground the fuel pump relay control circuit?? (Late UK models)
 
We'll the trick is find a 983 non immobilser ECU and take the chip out of that and read it and post it if you want to be a LH 2.4 hero. Still waiting for the 983 lh2.4 hero to appear. Hasn't happened yet. Has to be from over the other side of the world from here of course. Until then the trick to run a 984 bin is to put it in 967 ECU then it will run.. 984 is the latest greatest 2.4 program so that is why you want to run with it. 983 is the same, just no immobiliser. I've seen people post on here saying they have one. I've then asked them to read the chip and post it or send the chip. Still nothing. I'd buy a complete 983 ECU with stock chip if I could find one for sale. I've already bought a couple 984's from europa. Got that.

<iframe width="560" height="315" src="https://www.youtube.com/embed/p-hPzXYeD14" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Nobody has been able to figure out how to turn the immobiliser off in the 984 bin, nobody.. But you should figure that out, yeah..

Curiosity killed the cat, go find 983. You got your marching orders..
 
Last edited:
(Engine running video)

https://youtu.be/7ugcJZKBqLU

Nice!!! So you just swapped in a non immobilizer ECU?

I just watched it again. I like how you stopped the engine by pulling a few wires from the battery positive terminal. "Only 4 wires to make it run!!!" Well done.
 
A bit off topic, but in case you are curious how the immobilizer works:
LH 2.4 DLC is connected to the OBD2 connector not directly, but through the immobilizer module. On start LH sends to the immobilizer special 9-bytes packet that contains 3 byte header, 5 crypto challenge and 1 byte checksum. The challenge LH generates by producing a random number by taking a sample from its internal timer. The immobilizer module is expected to receive the packet, encrypt the payload in the packet again with 48-bit key, and send it back to LH2.4. Then LH decrypts it back with it's own key and compare it to the initial random number - if its match LH start, otherwise you know. It is LH who decides to start or not depending on the answer. The very same algorithm and even same keys are used in some 850 and S/V70.

The immobilizer can be bypassed by patching the code inside LH2.4

Also, 2 years ago together with a friend (rkam) we disassembled and translated the code, extracted the keys and brute forced to reveal all valid key space. This took some days on a multicore machine and multiple threads that worked each on a subset of the key space.
Thus it was possible to make immobilizer emulator with arduino which plugged to ECU responds with correct answer.
 

Attachments

  • immo.jpg
    immo.jpg
    178.5 KB · Views: 97
  • immo2.jpg
    immo2.jpg
    92.5 KB · Views: 96
Whow you really impressed me
Where did you find this chart?
I never found the wiring map for a 1997 Volvo 940, where the hell did you find this?
I know about the way the immobilizer works, and have stI'll no clue about the kbytes and crypto stuff. This is all crypto to me ;-)
Thank you very much for teaching me a little bit (still I don't know how this works, I'm a mechanic person, more to steam machines addicted than to electronic bsssss bzzzzzz stuff)
Regards, Kay
 
Whow you really impressed me
Where did you find this chart?
I never found the wiring map for a 1997 Volvo 940, where the hell did you find this?
I know about the way the immobilizer works, and have stI'll no clue about the kbytes and crypto stuff. This is all crypto to me ;-)
Thank you very much for teaching me a little bit (still I don't know how this works, I'm a mechanic person, more to steam machines addicted than to electronic bsssss bzzzzzz stuff)
Regards, Kay

Hi, I don't remember how I found this scanned pdf, but it was after a lot of searching.
Here is the link: http://ipdown.net/docs/TP3933032_940_1997_1998_wiring_diagrams.pdf
Please, download, reupload, share, spread. The google will do it's job and it will be easier for everyone that needs it.
 
Last edited:
Vlad, do you have a 984 bin that has the immobilizer disabled in the bin?

The immobilizer can be bypassed by patching the code inside LH2.4

Hi Simon, I don't have. I will have to dig in my old stuff to find out the exact location of the mod. I will post the info.
 
Back
Top