Question: Is the code stored in the keypad or the Siemens/Fenix ECU?
If the latter, can they be readily decoded, unlocked, or recoded?
Got a spare one, code unknown, and not sure if it should just be binned.
Keypad Code - XM/605 V6
Moderator: RichardW
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Hi Addo
The code is almost certainly stored in the ECU so do not bin it.
I am currently working through my first ECU type for the 2.5XM and can now identify/read the current Immo code in one of the EEPROM's. This has enabled me to check out and reuse a previously locked ECU.
I can also now reset this ECU type to manufacturers original condition.
There are another 3 or 4 XM 2.5 ECU variants (plus a couple of 2.5 Pug 605) that I intend to check out if I can lay my hands on spare ECU's.
I hope to move onto other ECU types so am collecting any spare ones that would otherwise go in the scrap bin.
These older type ECU's are a lot easier to decode simply because of the configuration of the electronics. At the time they were designed EEPROM's (electrically rewriteable devices) were very expensive so they used small low capacity devices that just contained the Immo code and the ECU fault reporting. Later ones contain the whole engine operating programme so much more code entries to look through. If they have also thrown in an encrypting algorithm it could be real work to unravel.
I have opened a couple of Bosch petrol ECU's, a Lucas EPIC one but not any FENIX so far.
The Bosch petrol should be similar to the 2.5 ones.
EEPROM disguised simply with a unique Bosch code marking.
The EPIC's seem to have the critical chips encapsulated in a LUCAS case which will make that one more difficult to work on.
John
The code is almost certainly stored in the ECU so do not bin it.
I am currently working through my first ECU type for the 2.5XM and can now identify/read the current Immo code in one of the EEPROM's. This has enabled me to check out and reuse a previously locked ECU.
I can also now reset this ECU type to manufacturers original condition.
There are another 3 or 4 XM 2.5 ECU variants (plus a couple of 2.5 Pug 605) that I intend to check out if I can lay my hands on spare ECU's.
I hope to move onto other ECU types so am collecting any spare ones that would otherwise go in the scrap bin.
These older type ECU's are a lot easier to decode simply because of the configuration of the electronics. At the time they were designed EEPROM's (electrically rewriteable devices) were very expensive so they used small low capacity devices that just contained the Immo code and the ECU fault reporting. Later ones contain the whole engine operating programme so much more code entries to look through. If they have also thrown in an encrypting algorithm it could be real work to unravel.
I have opened a couple of Bosch petrol ECU's, a Lucas EPIC one but not any FENIX so far.
The Bosch petrol should be similar to the 2.5 ones.
EEPROM disguised simply with a unique Bosch code marking.
The EPIC's seem to have the critical chips encapsulated in a LUCAS case which will make that one more difficult to work on.
John
Xmexclusive
-
addo
- Sara Watson's Stalker
- Posts: 7098
- Joined: 19 Aug 2008, 12:38
- Location: NEW South Wales, Australia. I'll show you "Far, far away" ;-)
- My Cars: Peugeot 605
Citroën Berlingo
Alfa 147 - x 93
Hi John, thanks for responding.
The EEPROM on this one isn't at all disguised. It's an ST chip, M27C256B-20B3...
I did find a teensy (8 pin) DIP surface mount closer to the connector pins, with white paint on the top - when scraped away it was an odd marking that doesn't come up in datasheet searches. Had wondered if this was the initial code in hex.
Other people reckon they can crack the factory code off the serial, so there have to be some options yet. It's the kind of stuff that intrigues me.
The EEPROM on this one isn't at all disguised. It's an ST chip, M27C256B-20B3...
I did find a teensy (8 pin) DIP surface mount closer to the connector pins, with white paint on the top - when scraped away it was an odd marking that doesn't come up in datasheet searches. Had wondered if this was the initial code in hex.
Other people reckon they can crack the factory code off the serial, so there have to be some options yet. It's the kind of stuff that intrigues me.
-
spider
- Posts: 3949
- Joined: 05 Jan 2010, 14:28
- Location: Derby.
- My Cars: Soon, I hope...
- x 77
- Contact:
IIRC, they don't work when they are new until a shunt is placed in the fusebox. This cuts power to various bits too, so the battery lasts a bit longer while its stood for ages. There was an issue (shall we say) with very early petrol 306's with keypads that I cannot put here but that was fixed very quickly.
The factory code is 1111 until its changed, on every one I've ever seen.
The factory code is 1111 until its changed, on every one I've ever seen.
Andy.
91 205D-Turbo, gone but still missed
02 106D, TUD5B, gone but not really missed apart from the MPG
91 205D-Turbo, gone but still missed
02 106D, TUD5B, gone but not really missed apart from the MPG
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Hi Addo
The chip you have identified is the EPROM (read only memory).
That is the main ECU programme which stays fixed all the time.
The little 8 pin chip is the EEPROM and will contain the Immo code.
These are usually marked B58196 in a Bosch ECU.
If they are standard ST chips then they will most likely be 93C46's
I have some Fenix3 ECU's somewhere in the unit so will look them out.
See if I can find and identify the contents.
On the 2.5 ECU's I chose to cut out these chips to read them.
I then socket the ECU PCB ready to take a new chip.
The test ECU currently has a ribbon cable header lead so I can remove the 93C46 to read it without taking the ECU out the car.
Working my way through read chip contents, changing Immo code, read chip again and look for differences. This has gone very well helping me understand how the Immo records its information. Will move onto how the engine fault codes are stored next.
Hi Spider
With the 2.5 ECU's I am working with the factory code is 0001.
This was not changed to 1111 until about 6 months into production.
That would be about January 1995 so I think that all Citroen cars supplied with an Immo prior to this date will have used the 0001 as the factory code. The shorting or isolating fuse on the XM main fuse box was not introduced until autumn 1996.
On most XM's the factory code is also the garage code and fixed as 0001 or 1111 and cannot be changed. From about 1997 the ECU code was rewritten so that the ECU could hold two variable codes. Owners code and Garage code both selectable as any chosen 4 digit code.
This can be a disaster if you buy a car that is running on the garage code. To be able to change either code you must know the current owners code. If you have just the garage code all will be well as long as the battery keeps the ECU in good order but you will be stuck with using only the existing garage code.
I would be very interested to know about the 306 Immo problems even if it is only outline details for security reasons.
John
The chip you have identified is the EPROM (read only memory).
That is the main ECU programme which stays fixed all the time.
The little 8 pin chip is the EEPROM and will contain the Immo code.
These are usually marked B58196 in a Bosch ECU.
If they are standard ST chips then they will most likely be 93C46's
I have some Fenix3 ECU's somewhere in the unit so will look them out.
See if I can find and identify the contents.
On the 2.5 ECU's I chose to cut out these chips to read them.
I then socket the ECU PCB ready to take a new chip.
The test ECU currently has a ribbon cable header lead so I can remove the 93C46 to read it without taking the ECU out the car.
Working my way through read chip contents, changing Immo code, read chip again and look for differences. This has gone very well helping me understand how the Immo records its information. Will move onto how the engine fault codes are stored next.
Hi Spider
With the 2.5 ECU's I am working with the factory code is 0001.
This was not changed to 1111 until about 6 months into production.
That would be about January 1995 so I think that all Citroen cars supplied with an Immo prior to this date will have used the 0001 as the factory code. The shorting or isolating fuse on the XM main fuse box was not introduced until autumn 1996.
On most XM's the factory code is also the garage code and fixed as 0001 or 1111 and cannot be changed. From about 1997 the ECU code was rewritten so that the ECU could hold two variable codes. Owners code and Garage code both selectable as any chosen 4 digit code.
This can be a disaster if you buy a car that is running on the garage code. To be able to change either code you must know the current owners code. If you have just the garage code all will be well as long as the battery keeps the ECU in good order but you will be stuck with using only the existing garage code.
I would be very interested to know about the 306 Immo problems even if it is only outline details for security reasons.
John
Xmexclusive
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Hi spider
My best guess is that these early ECU's are written in simple machine code.
The EPROM & EEPROM reading has taken me back to the simple HEX code that I was using in the early 1980's with Z80 eight bit micros.
Biggest problem was getting a true read with memory chips that were not type identified. EPROM's were easier than the EEPROM's and I wasted a lot of time with part defective reads. Once I got a true read it became easy as the Immo code was actually stored in plain text. Then I could start changing the code, reread and identify what changes.
Once the work is done on the first ECU the other 2.5 variants should drop out easily. Each variant has a different Immo setup with changed delays and functions.
Will look at the PM with great interest.
John
My best guess is that these early ECU's are written in simple machine code.
The EPROM & EEPROM reading has taken me back to the simple HEX code that I was using in the early 1980's with Z80 eight bit micros.
Biggest problem was getting a true read with memory chips that were not type identified. EPROM's were easier than the EEPROM's and I wasted a lot of time with part defective reads. Once I got a true read it became easy as the Immo code was actually stored in plain text. Then I could start changing the code, reread and identify what changes.
Once the work is done on the first ECU the other 2.5 variants should drop out easily. Each variant has a different Immo setup with changed delays and functions.
Will look at the PM with great interest.
John
Xmexclusive
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Just looked back over this post.
Andmcit seems to have the answer on Fenix3 ECU's.
If those sold on ebay de with Immo code work using the existing keypad then the Immo code must be stored in the ECU and not the keypad.
This is definitely the case with 2.5 XM Immo codes which move as set when the ECU is put in another car.
John
Andmcit seems to have the answer on Fenix3 ECU's.
If those sold on ebay de with Immo code work using the existing keypad then the Immo code must be stored in the ECU and not the keypad.
This is definitely the case with 2.5 XM Immo codes which move as set when the ECU is put in another car.
John
Xmexclusive
-
addo
- Sara Watson's Stalker
- Posts: 7098
- Joined: 19 Aug 2008, 12:38
- Location: NEW South Wales, Australia. I'll show you "Far, far away" ;-)
- My Cars: Peugeot 605
Citroën Berlingo
Alfa 147 - x 93
Hi John,
This is a very entertaining read; I think most of our cars are no longer theft risks so the aspect of code cracking is more about usability of spare parts, or getting a paddock car fired up!
Circled is the little DIP chip, S2267 and XAIR are its markings. The whole board is slathered in a UV-sensitive coating.
The board pictured was full of water for a good while; I actually scrubbed it and rinsed thoroughly!
This is a very entertaining read; I think most of our cars are no longer theft risks so the aspect of code cracking is more about usability of spare parts, or getting a paddock car fired up!
Circled is the little DIP chip, S2267 and XAIR are its markings. The whole board is slathered in a UV-sensitive coating.
The board pictured was full of water for a good while; I actually scrubbed it and rinsed thoroughly!
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Hi Addo
Over here theft of cars is an issue and will I think get worse for our type of cars as far as joy riding is concerned. The security systems on modern cars makes theft much more difficult. Theft of keys by assult on driver seems more common and shows how difficult other methods of expensive car theft are now. These modern security systems will cascade to general car production over the next few years giving joy riders far less cars to target and use.
Despite this I do not think information on ECU code cracking is a security issue. Unlike information on rewiring or bypassing ignition components it is not something that can be done just by breaking into a car. Carrying a small electronics work bench kit around is hardly practical for the thief and prepreparing a replacement ECU for a target car just as unlikely.
No doubt the moderators will curtail us if we overstep what is reasonable to publish.
John
Over here theft of cars is an issue and will I think get worse for our type of cars as far as joy riding is concerned. The security systems on modern cars makes theft much more difficult. Theft of keys by assult on driver seems more common and shows how difficult other methods of expensive car theft are now. These modern security systems will cascade to general car production over the next few years giving joy riders far less cars to target and use.
Despite this I do not think information on ECU code cracking is a security issue. Unlike information on rewiring or bypassing ignition components it is not something that can be done just by breaking into a car. Carrying a small electronics work bench kit around is hardly practical for the thief and prepreparing a replacement ECU for a target car just as unlikely.
No doubt the moderators will curtail us if we overstep what is reasonable to publish.
John
Xmexclusive
-
xmexclusive
- Posts: 419
- Joined: 18 Dec 2008, 22:50
- Location:
- My Cars:
Hi Addo
Citroen handbooks recommend using the garage code to avoid giving out your owners code when putting the car in for repair or servicing.
I guess no one realised the implications of having all the parked cars outside a Citroen dealer set to a single Immo code that was widely published.
The XM garage code system had a series of variations over less than 2 years. Ranged from just dissabling the Immo to an independant 4 digit code that could only be selected and put into operation by knowing and using the owners chosen 4 digit Immo code. This last version is a real problem if you buy a car set to a garage code thinking it is the real owners code.
John
Citroen handbooks recommend using the garage code to avoid giving out your owners code when putting the car in for repair or servicing.
I guess no one realised the implications of having all the parked cars outside a Citroen dealer set to a single Immo code that was widely published.
The XM garage code system had a series of variations over less than 2 years. Ranged from just dissabling the Immo to an independant 4 digit code that could only be selected and put into operation by knowing and using the owners chosen 4 digit Immo code. This last version is a real problem if you buy a car set to a garage code thinking it is the real owners code.
John
Xmexclusive