How to clone immobilizer data (& recover pin)

billp · May 25, 2023

360trev said: ↑

After the success of the 'how to clone a fob' thread (which I read today) I have decided to kick off a thread about doing its counter-part, the immobilizer clone. This way you'll never get ransomed ever again to recover your pin code or have to buy an over priced replacement when it dies.

Ok, here goes... Lets get start.

Firstly, some quick & basic background (stating the obvious), the immobilizer itself stores the other side of the equation to the key fob, i.e. the pin and the learned information about the fobs it will accept. This allows the recieved signal (once approved) to send a CAN (Controlled Area Network) bus message over to the Bosch Ignition computers to activate the fuel pump and permit starting of the engine if the pairing information in the Ignition computers also matches. Yes, the ignition computers are also paired to the immobilizer too.

So, Lets get the scarey stuff out of the way first. (What some owners don't know... head in the sand?)

1. By definition, if someone has physical access to your car they can basically override the immobilizer because Bosch Immobilizer has been cracked a long time ago. Sadly there already exists software for the Bosch Ignition computers called 'ImmoKiller' available on the web which can patch the original firmware software to ignore the immobilizer.

Rather concerningly (for worried owners) due to simple, non secure ignition ecu upgrade method used anyone who patches the ignition firmware in this way can without worry simply upload it via OBD-II port without any additional security checks (once they simply update the firmware checksums).

Q. What does this mean? Well it means all someone needs is a pre-patched Bosch ME7.3 ignition software file, access to the OBD-II and a couple of minutes connected to a laptop to completely bypass the immobilizer circuit and hence start the vehicle. Yes, very bad.

Q. Is there a counter defence? Sort of, either fit another aftermarket immobilizer (or even fit a phyiscal switch hidden somewhere to isolate the ignition) or buy another (dummy) obd-ii port wiring loom and locate it in the original place, then re-locate/hide your (working) obd-ii port away in a stealthy safe place to stop this kind of attack working.

---
Ok so lets start to examine the vehicle immobilizer circuit ecu's (There are 2), the first one responsible for recieving the signal from the key fobs (at least on the 360 anyway). It is part no. 168508. Again unsurprisingly is from Bosch. These all have a unique serial number burned into them which is used as part of the 'pairing' of key fobs.

After removing the 3 screws from the back of the board, a quick look at the board reveals a Motorola MC68HC705B16 (read the datasheet, its a full on microcontroller with rom and ram but it also contains eeprom storage too) which I'm guessing is where they PIN and pairing information is stored alone with an immobilizer unique serial number.

Unsurprisingly just like we've already been doing on the fobs themselves you can read the eeprom data straight out of it with an appropriate reader.

Here's one ($130 usd unit) http://auobd2.com/motorola-mc68hc05-eeprom-programmer-89.html

The blurb about it, "The MC68HC705B16 programmer supports programming of Motorola 68HC05Bxx, 68HC05Xxx microcontrollers internal EEPROM - most used programmable device in car radios, automotive computers (dashboards, AIRBAG, immobilizers).
A parallel port interface (LPT1, LPT2) connects the programmer to any desktop PC running DOS or Windows systems. The four jumpers located on the programmer board are intended for device type selection. Smart firmware controls all read/program operations so access to device can be establish even if device secured. Default settings permit to read and write Motorola MCU internal EEPROM without processor structure knowledge. The Device Menu displays all available functions to perform on the device (read, program, verify, program security, etc...). A full screen editor is provided to view or edit any address of the programming buffer in binary or ASCII formats.".

Seems like the bundled software also allows modifying of the eeprom too so I'm guessing it can be used to locate the PIN, change it and write it back out.

I'll leave it as an exercise to the reader to pursue this (theoretical discussion) further.
Suffice to say (until proved otherwise) I am not very impressed with the security (or lack of it) of the immobilizer circuit. I expected secure flash and one time re-programmable chips. Not so...

Come on Eric355, Gobbler or anyone else with a soldering fettish. go to work!
View attachment 1260489
View attachment 1260490
View attachment 1260491
Click to expand...

billp · May 25, 2023

I have a 2002 360 Spyder with an immobiliser problem, I only have one black fob, no pin number, car won't start (or crank) because immobiliser won't turn off and doors won't unlock with fob. Fob battery is new, car battery is new. Local specialist trying to get PIN code from Ferrari, but is saying there is an access code as well as the PIN number, and is not having any joy. Is there anyone in the UK that can read the immobiliser extract the codes and supply a set of new fobs? Alternatively, can the immobiliser be permanently disabled.

yelcab · May 25, 2023

billp said: ↑

I have a 2002 360 Spyder with an immobiliser problem, I only have one black fob, no pin number, car won't start (or crank) because immobiliser won't turn off and doors won't unlock with fob. Fob battery is new, car battery is new. Local specialist trying to get PIN code from Ferrari, but is saying there is an access code as well as the PIN number, and is not having any joy. Is there anyone in the UK that can read the immobiliser extract the codes and supply a set of new fobs? Alternatively, can the immobiliser be permanently disabled.
Click to expand...

Both Eric and Trev live in Europe so one of those gentlemen can help you.

billp · May 25, 2023

Hi Yelcab, Thanks, sorry for my lack of knowledge,? but how could I contact these gentlemen?

Qavion · May 25, 2023

billp said: ↑

but how could I contact these gentlemen?
Click to expand...

If they're not too busy, this will attract their attention...

@eric355 and @360trev

eric355 · May 25, 2023

billp said: ↑

I have a 2002 360 Spyder with an immobiliser problem, I only have one black fob, no pin number, car won't start (or crank) because immobiliser won't turn off and doors won't unlock with fob. Fob battery is new, car battery is new. Local specialist trying to get PIN code from Ferrari, but is saying there is an access code as well as the PIN number, and is not having any joy. Is there anyone in the UK that can read the immobiliser extract the codes and supply a set of new fobs? Alternatively, can the immobiliser be permanently disabled.
Click to expand...

I can recover the PIN and provide a set of fobs paired to the ECU.
For immo delete, Trev is definitively the guy you need !

BTW, have you checked that fuse #74 (cf owner manual) is not blown ?

windsock · May 26, 2023

360trev said: ↑

Phil, this is just the first tentative steps towards a solution. I'm convinced with some of the knowledge on here we could do an open source, low cost alternative to an SDx. Also possible to remap the 355's original gearbox tcu to CS speeds, etc.... So many possibilities...
Click to expand...

Some of the 355 limitations are the mechanics. 355 F1 shifts with a very different mechanism then the 360 and its going to slow you down

Conversations

Alerts

How to clone immobilizer data (& recover pin)

billp Rookie

billp Rookie

yelcab F1 World Champ
Consultant

billp Rookie

Qavion F1 Veteran
Silver Subscribed

eric355 Formula 3
Silver Subscribed

windsock Formula Junior
Rossa Subscribed

Share This Page

How to clone immobilizer data (& recover pin)

billp Rookie

billp Rookie

yelcab F1 World Champ Consultant

billp Rookie

Qavion F1 Veteran Silver Subscribed

eric355 Formula 3 Silver Subscribed

windsock Formula Junior Rossa Subscribed

Share This Page

yelcab F1 World Champ
Consultant

Qavion F1 Veteran
Silver Subscribed

eric355 Formula 3
Silver Subscribed

windsock Formula Junior
Rossa Subscribed