Old school problem: 406 keypad bypass

Janne100 · Unread post by **Janne100** » 17 Dec 2025, 09:22

Just bought a 1996 P406, with 2.0L petrol engine. Car is in good condition and just inspected, but a mechanic fixing brake lights happened to see unplugged wire, and put it in. Well, this wire was keypad connector which was disconnected to prevent the need to input pin code in every start. This has been used for years, and now when car wants the code (which is not original 1111), none of previous owners remembers it.

So, I have tried to figure out way to bypass the keypad. Keypad itself seems to be a "dumb box" without memory. Car has Bosch Motronic 5.1.1 ECU, where I found one eeprom, B58097, equals 93C46. Immobilizer should be off by reprogramming first 6 digits to 00 (right?). I haven't done this yet.

Does anybody remembers how this works? Where is the passkey code burned, to read it, overwrite it or disable it? Can I use some jumpwire to tell car to "go"?

Unread post by **mickthemaverick** » 17 Dec 2025, 09:29

I'm probably being dumb here but why can't you just take the wire out again? Or is it a case that you have to put in the code and then take it out?

Unread post by **myglaren** » 17 Dec 2025, 09:38

I seem to recall that the plug has to be removed with the engine running.
May be worthwhile asking on the BXClub too.

furriegurrie · Unread post by **furriegurrie** » 17 Dec 2025, 09:59

That was indeed the way you could do that on the Xm with some of the engine ecus so probably the same with the 406. I don’t know the work around if you do not know the code. I made a habbit of writing the code on the ecu. Maybe that has been done with this car too? Or somewhere in the onboard documentation?

Janne100 · Unread post by **Janne100** » 17 Dec 2025, 10:41

Well, yes and no, code is not written anywhere, and as said, none of the latest owners has used it or remembers it. The keypad may be disrecarded when the Engine Is Running, as has been done before. But now, when the plug is put back, the code is needed.

Stickyfinger · Unread post by **Stickyfinger** » 17 Dec 2025, 12:24

Yes, once the keypad is "reinstalled" the ECU goes back to "demand code" mode....if you do not have the code then you are looking at modifying the ECU or switching the ECU to one with a code ......

Janne100 · Unread post by **Janne100** » 17 Dec 2025, 15:15

Yes, do you have knowledge, how to modify, or where to find which code ecu (suppose you mean engine ecu Bosch) has now? I have found eeprom IC (B58097 /93C46), which I think is for immo. I could modify that, but right now I don't have any spare chip, so I don't want to mess with it before I'm sure I don't burn the last opportunity..

Trickiedickie · Unread post by **Trickiedickie** » 17 Dec 2025, 16:15

I would use a cheap ch341a usb programmer.
First read the ic and save the dump as a backup.
Make the required changes to the first 6 bytes and save the file as modified.
Now write the modified file to a new replacement ic.
That is how I would do it.

Unread post by **xantia_v6** » 17 Dec 2025, 17:41

Can you inspect the keypad buttons and identify 4 or less which are more worn to reduce the number of codes to randomly try?

Reprogramming the code is probably not practical unless you have an ECU with known code to practice on to find where the primary and secondary copies of the code (and the service code) are stored in the EEROM. The location of the codes varied with ECU versions.

wheeler · Unread post by **wheeler** » 18 Dec 2025, 17:53

Janne100 wrote: 17 Dec 2025, 09:22 So, I have tried to figure out way to bypass the keypad. Keypad itself seems to be a "dumb box" without memory.

You are correct that the keypad is just a dumb box and the code is stored in the ECU however i believe that if you read the dump of the MCU in the keypad it can reveal the last successful code that unlocked it.

Are you able to post the dump of the ECU eeprom here? an the dump of the keypad MCU if you can?
I wouldnt mind taking a look at them. You may need to put them in a zip file first

PS some default codes are 0001 as well as 1111

Janne100 · Unread post by **Janne100** » 19 Dec 2025, 09:47

Hi wheeler!
Thanks for trying to help..

I didn't see any suitable IC in keypad, so I don't know if I can read anything from it.

Engine ECU has this B58097 (eq. 93c46) chip. Included is the dump. According to wear, I suppose the numbers could be 1,2,7,0.

wheeler · Unread post by **wheeler** » 19 Dec 2025, 10:46

Ok i will have a look tonight, as far as the keypad goes i believe its the big square motorola MCU

Janne100 · Unread post by **Janne100** » 19 Dec 2025, 16:06

Here are pics of engine ECU and keypad PCB. Keyboard seems to have 3 ICs, one timer, one regulator and one unknown to me.

wheeler · Unread post by **wheeler** » 19 Dec 2025, 16:10

The dump looks very small??
I ran it through a couple of programs i have & the only meaningful code i can see is potentially 0 0 8 0
Give it a try & fingers crossed.

Trickiedickie · Unread post by **Trickiedickie** » 19 Dec 2025, 18:46

This might help. Its the dump viewed in a simple hex editor.....

French Car Forum

Old school problem: 406 keypad bypass

Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass

Re: Old school problem: 406 keypad bypass