MEMS 1.9 Reflash to Remove Immobiliser

[Dom Williams]

Dear all,

does anyone know of someone who is able to reflash a MEMS 1.9 unit to remove the need to have the immobiliser plugged in to start the engine?

I spoke to James Portman at rovermems.com late last year who seemed perfect, but I have since been unable to get back in touch with him.

Thanks in advance.

[D Jones]

Dom,

K maps can do this for you based near Gaydon 07928 196856 

David

[Tony Whitley]

DIY or do you want someone to do it for you? revilla may have a DIY answer, e.g. https://www.caterhamlotus7.club/forum/techtalk/exploiting-vulnerabilities-mems3-deploy-execute-arbitrary-code-utilities-ram

[oilyhands]

Mems 1.9 might be a problem, have a look at rover Mems.com, Mems3 is a more straightforward proposition, Andrew Revill (Revilla) and Kmaps can modify these.

Oily

[oilyhands]

Mems 1.9 might be a problem, have a look at rover Mems.com, Mems3 is a more straightforward proposition, Andrew Revill (Revilla) and Kmaps can modify these.

Oily

[oilyhands]

Mems 1.9 might be a problem, have a look at rover Mems.com, Mems3 is a more straightforward proposition, Andrew Revill (Revilla) and Kmaps can modify these.

Oily

[oilyhands]

Mems 1.9 might be a problem, have a look at rover Mems.com, Mems3 is a more straightforward proposition, Andrew Revill (Revilla) and Kmaps can modify these.

Oily

[Dom Williams]

Thanks everyone for your helpful feedback. An update:

Kmaps are unable to get into anything earlier than a 2.0...

When I spoke to rovermems last year James seemed keen to try (even if he has never worked on a 1.9), however I still have not been able to get hold of him in the last few weeks.

I will send Revilla a message and see if he might be able to help.

Thanks again

[revilla]

Hi, the MEMS 1.9 standard hardware is not reflashable. The memory on the processor cannot be erased to rewrite, it's OTP (one-time-programmable). James Portman at rovermems.com has made programmable modules for some of the earlier ECUs but he hit some fairly major stumbling blocks with some of them, where the processor used the same lines for addressing external memory and controlling some peripherals. He was working on a solution. I'm not quite sure where he got to with which ECUs, but I am in regular contact with him so I'll drop him a message with a link to this thread and see what's what.

[revilla]

One other thought ... Well four actually ...

If all you're looking to do is remove the need to disarm the immobiliser, there may be solutions without reflashing the ECU.

There are a couple of tricks.

One well-known trick involves putting the ECU into immobiliser learning mode, and then cutting the wire between the immobiliser and the ECU. The ECU never sees an immobiliser signal and stays permanently in learning mode. I've never done it, but I've read about plenty of people who have. I think there's a slight risk of the ECU picking up a noise signal on the line at some point in the future and learning it, then refusing to start! Grounding the cut wire may well be safer. The other tricks below are probably better options.

Another trick would be to disable the passive arming feature on the immobiliser itself. That way, you turn the immobiliser off once and it stays off, forever, if you don't actively turn it back on again. On later immobilisers (I think it was MY97 or 98 when they changed, can't remember off the top of my head now) I worked out how to do that by desoldering the chip and programming it on the bench (if you're is an earlier immobiliser I've got piles of spares and they're cheap to get hold of anyway). But I know James has since worked out a lot of the communications and made up some programming cables for the immobiliser's. I think he has put an application to program them on his website, so it should be an easy job to configure.

Third option, if you can't program the immobiliser, is to disable the passive arming by exploiting a bit of a weakness in the design of the immobiliser. When you turn the ignition off, the immobiliser starts a timer, and when that runs out, it arms itself. There are two power supplies to the immobiliser, one ignition switched, one permanent. If you simply cut the permanent supply wire, when you turn the ignition off ... the immobiliser goes off ... and the clock stops! So it never gets a chance to count down and arm itself. I think that method is pretty reliable and well tested.

Fourth option. I decoded the signal that the immobiliser sends to the to the ECU. It was just a fairly simple repetitive bit stream broadcast which encodes the immobiliser's unique (-ish!) code. It would be an easy and cheap job to build a little module that just output that signal continuously. A tiny little Arduino module and an output transistor. If you connected that to the ECU wire instead of the immobiliser, then the ECU would think it was connected to a disarmed immobiliser at all times. In fact, I think someone has already built such a thing and sells it, I'll see if I can find a link.

Give me five mins ... be right back ...

 

 

 

[revilla]

It was Paul at Technozen Electronics: https://www.technozen-electronics.co.uk/

His website still mentions his immobiliser emulator module, but he says all his services are on eBay and I can't see it in his shop. All his contact details are on his website though, so you can ask him.

[revilla]

It was Paul at Technozen Electronics: https://www.technozen-electronics.co.uk/

His website still mentions his immobiliser emulator module, but he says all his services are on eBay and I can't see it in his shop. All his contact details are on his website though, so you can ask him.

[DirtBuddha]

I have a 2005 1.6 K Series with immobiliser - how can I tell which version of the ECU (MEMS?) my car has? 

Sorry if this is a silly question... I'm good with spanner's - not electrickery(!)

 

[oilyhands]

Yours will most likly be a Mems3, if it doesnt have a distributor cap then it will be Mems3

Oily

[DirtBuddha]

Yours will most likly be a Mems3, if it doesnt have a distributor cap then it will be Mems3

 

 

Mine definitely doesn't have a distributor cap.

So likely the immobiliser can be deleted/coded out...?

 

[revilla]

MEMS3 looks like this:

If you've got one of those, yes the immobiliser can be deleted easily. You can do it with my FREE MEMS3 Mapper tool and a cheap-as-chips cable off eBay, or I can do it for you if you send me the ECU.

https://andrewrevill.co.uk/MEMS3ToolsIndex.htm

 

 

[DirtBuddha]

Thanks Revilla - yes, mine looks exactly like that. 

Does the immobiliser delete also delete the 5AS? I'm not exactly sure what the 5AS is/does, but I've been told it may be a problem...?

Can you enlighten me pls?

 

[revilla]

The 5AS is the Body Control Module from when the ECU and engine were in a Rover. In a Rover it handles all the central locking and windows, but also the alarm and immobiliser.

In a Caterham the only feature of it that is used is the immobiliser.

The way in which it works is that when it has been disarmed / unlocked, it continuously transmits an encoded signal on one wire to the ECU. This encodes a number that is stored in the immobiliser, different in different immobilisers, and the ECU is trained to recognise. So it will only allow the engine to run when it has received the code (like a password) from the immobilser it has been paired or, or trained to recognise.

The immobiliser is programmed with the unique IDs of the keys it is matched with, and the ECU is programmed with the code of the immobiliser it is matched with.

There's a flag in the map that tells the ECU not to require a coded signal from the immobilser. When this is set, the ECU will continue to run the injection even when it doesn't have "permission" from an immobiliser. This is what you set when you do an "immobiliser delete" in the map with my tool.

As we don't use anything else from the 5AS, once the ECU has been told to ignore it, you can just unplug and remove it if you want as it isn't doing anything useful. The only thing you would lose by removing it is that the alarm LED on the dash would no longer flash. Some may see this as a useful deterrent. Leaving it in won't cause any problems even if it malfunctions.

Incidentally, in a Rover the 5AS also controls the starter motor relay coil, so just deleting the immobiliser isn't enough as the starter still won't operate. You have to cut a wire and wire it to ground, but none of that is connected in a Caterham.

Also Rover 75s, MG ZTs and later Freelander models have much more aggressive BMW EWS 3.D security and these don't have a flag to disable the immobiliser. My tool now allows you to circumvent this too by removing the actual code that kills the injectors. Again this "Firmware Immobiliser Delete" options shouldn't be needed on a Caterham but it's there as a last resort.

[revilla]

5AS looks like this. Located on the bulkhead inside the car near your knees!

[DirtBuddha]

That is brilliant info - thank you so much. Extremely helpful. 

[Dom Williams]

Good evening all,

just wanted to let you know that Paul at Technozen did indeed modify the ECU, I have since received it back and it runs beautifully (without immobiliser). Complete success, one satisfied customer...

Thanks all for your support, as ever!

Yours,

 

Dom