Phil Thanks for looking at this from your perspective. Here is a pretty much "everything" about the system BMW E36 EWS II immobilizer bypass
I am pretty sure the Immobilizer system on the Ferrari does not do what the BMW system does. Many after market alarm systems have their own batteries to keep the processor alive during power shut off from the car. The way that the processor enters "programming mode" is to detect the car shutting off a number of times, in succession, during a number of seconds. My "pure educated" guess is the Ferrari immobilizer computer has its own battery that allows the CPU to stay alive and monitor the number of times, sequence, and duration of power being on-off (by the key switch) and enter a program mode, or allowing the car to start. If that is true, OBD port is not used on the Alarm ECU.
Looks like an "add on" to the ECU. A small chip that talks to the immobolizer to say OK were cool lets run I cant remember off my head but I think this is the chip in the ecu that talks to the theft system. I have the flash tool for BMW that works fine, you simply remove the chip flash reinstall it Have not tried it on the ferrari ecu but pretty much all of them from this primitive electronics era work the same. I tend to think how things were developed back then when things were more simple then today Disclosure LOL Under no stretch of anything am I knowledgeable on how ICs work. I am mearly a retired hacker Image Unavailable, Please Login
Disarming the immobilzer is one subject here and I suppose it is worthwhile. Discovering the embedded PIN in the ECU is what the OP needs at this time if possible. I like Phils idea of replicating the pin key sequence via a PC. If we can determine the wiring connections that replicate a key turn and he can develop a program to do that it would ge a great solution. If the brain trust here can determine the above I would be willing to prove it on my car.
So you have the PC churning away feeding in pins. You have figured out how to connect the PC to the car so the pins are entered into the immobilizer. So now there is one thing left. How does the PC recognize that it entered the correct pin? Please add that to the "to do" list.
Right John. Which is why I said above someone may have to sit in the car and watch the process for when the led stops blinking which is the sign as per in the instructions that you have entered it correctly. 9) At this point the PIN is entered. After 5 seconds or so, turn the key back to on and after 2 seconds or a bit more with the key in the on position, the alarm light emitting diode (LED) will go off and you can start the car. Starting the car confirms you can correctly enter the PIN, the first step in reprogramming the Alarm ECU to accept new remote alarm fobs. Keep trying if you do not succeed the first time, remembering to wait more than 20 seconds before the next attempt. I suppose Phil could program in the last contact which is turning the key to start position after every event and feedback some sort of of yes or no on that to continue or stop the sequence based on success or not.
The user should need to press an input to cycle the next pin sequence. This would take a while. Or, you could tap into the LED and have the PC get feedback when it does out.
Does anyone know if these instructions will work? This seems pretty easy and Very doable for us. I could try it this weekend. This would be a great way to hear the car run and then figure out the best way to get some fobs. Sounds like the guys in Australia seem to be able to make it work. It is expensive but seems like they have the cost beat compared to the dealer. Also where is the Bosch unit located on the 355?
I would jump the starter side of the immobilizer relay first. All you need to do is energize it to a ignition source.
Again.... Bypass the immobilized or recover the pin for proper OEM operation? No right or wrong but two approaches depending on your desires.
This is what I was thinking. But this needs to be done in a clean, re-usable way. We can't "Frankenstein" it by splicing in multiple wires coming out of the dashboard. Especially since this would be a multi function utility: 1) Find Your Pin - the app would essentially use a brute force hack to run every sequence until the correct one is found. A user entered parameter would set the "pause" in between each sequence to account for each car's nuisances. The intent here is you would plug it in, accept the default pause or adjust it, hit "start" and walk away. and 2) Enter Your Pin - so your fobs are dead, lost and broken, but you (now) know your pin and don't want to flick your key 6000 times, so you pull your android fon out, plug it in and enter your pin to disable your immobilizer. Then use your ignition key to start the car. The application code is the easy part, it's the interface to the car that's the enigma here.
This is a hack job and it will not be plug and play IMO. It will require defining the wiring connections and activation of then insitu, tapping them and replicating their function within the analog nous of the key barrel. Some homework needs to be done to Hotwire the car from this standpoint
Elementary My Dear Watson! Im sure you've never heard that one. Your right I'll try it this weekend D-
http://www.ferrarichat.com/forum/challenge-cars/344852-alarms-challenge-cars.html This 2011 thread may give some clues. In particular from respected Jim at PS a real mechanic. If what he says is true and the other posters agree that an alarm module is in the challenge cars then it jives with what Jim says about the challenge cars being bypass wired. So it makes sense to try and see if a less advanced system like the 355 can also be bypassed. I would start at tricking starter, fuel pumps, and ignition. Perhaps if these can be bypassed and car started the normal motronic functions will take over for mixture control. Maranello Skunkworks guys hard wired the FOB guts to an external control board who's FOB can then be keyless entry, open trunks, alarm etc... So the OEM FOB then just becomes part of another circuit with improved reliability and robustness. So that is another way out of Ferrari while partly using their system.
Where I would start would be, with the car immobilized, measure the voltage on each wire from the immobilizer. Then with the car mobilized, measure the voltage on each wire again. The repeat with the key in the ON position. Then with the key in the start position (disconnect the power to the starter motor first for this one so the engine doesn't crank). That should give some kind of starting point to move forward from.
I hope this thread pops up again...I am curios what did they pay for this car? And after getting it running how did this buy pan out? worth it or not?
