Pop-a-Lock

Keypro Team,
Hope all doing well.
Who all interested in stepping into the ECU/TCU Cloning/Virginizing/Reading/Writing Business?
I am looking to create a support group for those looking to buy the Flex tool and offer tips/hints/videos through me as I am the official distributor of their tools.
If you have local business who do transmission swaps for euro cars, or ecu swaps, the flex is a low investment high return tool to own.
You can also allow mail in service for these types of jobs and this is where it becomes lucrative once your name is out.
You have 2 versions of the Flex, Flex Master and Flex Slave. Flex Master is more expensive but gives you the raw data read, this is helpful when you want to modify data yourself, requires experience. Flex Slave on the other hand is a reasonable priced tool which reads the data and encrypts it, you would send the file to me to unlock, which then allows you to write back into a used module.
Flex Slave FULL version (ECU/TCU/OBD/BENCH/BOOT) - $3000
Flex Slave ECU OBD/BENCH - $2000
File unlock service $50/file
I'm planning to do an introduction video for the product and give an example on how to clone let's say a BMW N20 or N55 ECU which have common failures.
Yaser

Shop installed brand new PCM. Micropod required to program. Most Chrysler vehicles have an option to replace PCM under the BCM. This vehicle does not have that option. You need to select PCM from the topology then update the flash after which you need to update the odometer and then the pcm vin.

While this is true (about Cardaq M with Mega Can) the cost is about the same as having a micropod2. You need to have a Witech script and have the CardaqM w/MegaCan. So to save the $1800 for a pod isn't really worth it that much for the hassle you can save. Also, the new Cardaq 3 should meet the requirements and be an approved device soon for Chrysler R2R software soon.
 
Nissan is going to change their R2R software wither this month or next. It should do All 1996+ with the consult software including programming which it currently doesn't offer. I'm hopping this works better than Nissan track record of J2534 software. The best part is no CF19 required or Consult 3+ interface. This is one I would gamble on because the OEM tool is crazy money due to the fact it comes with a CF19

I have a chat Group on Whatsapp with six of us at this point.  Some of them will send me pictures and a short description which I write up as a PDF.  Send a message to me on Whatsapp and I will add you.
 

I"d like to thank everyone who participates in the forum! It is very helpful to me, thank you.
 
As an update, in compliance with R2R (Right to Repair) you can now use a Cardaq-M with Megacan module and Witech 2 software to program all keys lost for at least a 2018 Chrysler Pacifica Hybrid Limited.
We couldn't complete a 2018 Nissan Kick with J2534 as of yet but was told that Nissan will have this new system available through R2R but only supporting fully 2018+ vehicles for full diagnostic and immobilizer. As I understand Nissan's response it is Consult 3+ only AND the Computer, the security card, plus a new subscription for 2018 Immobilizer software which has to be purchased with an LSID and that subscription is tied to your LSID so it can't be shared without sharing your LSID, which of course is a No-No.
Do any of you participate in Messenger or Whatsapp in a security focused diagnostic chat group, if so can you provide some info or lets start one for us? I"m dumb on whatsapp but would be willing to learn. 

This is how to program a used ECM using the Otosys IM600. The IM100 will not do this. It’s pretty much the same as using the Maxisys on any other Chrysler product, but this one through me for a loop so I figured I would post how I finally got it programmed.  This vehicle uses the FOBIK prox system (Keyless Go).  This was a running vehicle with the original computer. They replaced the ECM in an attempt to correct a misfire issue.  It didn’t fix it.
I went to diagnostics, then hot function, then Immo, then PCM replace. It wrote the VIN just fine but no matter how I tried it would fail when transferring the secret Key and the immobilizer light would flash.
I tried going through the control unit (WCM) same result.  I tried running the PCM replace function using a new key, same result. I tried reprogramming the original key using the Program Ignition Keys function, same result.  
Finally I deleted the old keys and programmed one new key, actually I just unlocked their original key, and then everything worked as it should. 
Here’s some pictures:

Remote Function Actuation

Used Autel to do Used ECM swap. Must start with orig ECM installed read info then transfer.Autel failed to program prox back to vehicle but Zed Full finishes the job.

Update. Added skim programmed key car starts and runs. After plugging in the skim and turning the key on the security start flashing in the the dash. Then did a skim vin edit , program key , transfer secret key car starts and runs. Thanks.

If the PCM came from a donor vehicle that was immobilizer equipped, you will need all related immobilizer components from that donor vehicle to create a running vehicle on your end. Nothing you can do to that PCM will revert it to non-transponder. Add the cost of transponder keys, labor, and programming, of course.
As an aside, I've had a couple of shops call me that have installed boneyard columns on non-transponder Chrysler vehicles. The replacement columns they sourced, came with SKIM modules from transponder equipped vehicles. They unwittingly made all the available connections and attempted to start the vehicle.
At that point, what was once a non-transponder PCM, was instantly and irreversibly transformed into an immobilizer PCM.
To any naysayers who may question the validity of these statements, I realize this may sound preposterous. But yes, it's entirely possible and completely factual. If still in doubt, I implore you to conduct your own field tests and report back here with your results.
Edit: When I said, "you will need all related immobilizer components from that donor vehicle". I meant that you will need the remainder of the immobilizer system components. Not necessarily those components directly from the PCM donor vehicle...

Installed a new BCM in 2003 Impala today.Used Tech2Win to do set up.Set the Vin ,Country Code and the options by build tag.Didnt give a lot of options ,Daytime running lights,Auto lights ,police car.After set up you need to unlock the radio with the tech2 then switch over to Tis2000 and do a Security relearn.Start car all seems ok.Air bag light is out now but the Keyless entry does not work. Tried to program won’t take it.I used it to open trunk when I started ?Back in to setup on BCM turn on RFA and program fob in.How does RFA stand for Keyless entry ?
 

Needed a Micropod to program all keys lost on this vehicle recently. 
Per Nastf.org:
Has anyone been successful programming 2018 FCA keys through J2534 as implied would be possible in the Nastf release above? This would be significant as it means that a Micropod would not be required for many of these.
Also in terms of module reflashing support for FCA/Mopar, I've had to dig for the following page before but it has good some good info, especially the "Reflashing Availability" document indicating which vehicles can be 'Reflashed' through J2534 by vehicle and module. Update 6/2/2017 as of this writing.
FCA/Mopar Support Page on Techauthority.com

I made this a few weeks ago.
 

Live Note with Images: http://www.evernote.com/l/AAn7iYuDxQ1M147UhT8ysWWrB00DVOYvmRs/
Task: Restore operation to a No Start vehicle after Engine Control Module has been changed.
Conditions: 2011 Chevrolet Malibu using Ae Tools and Computers Aezflasher 1 (with USB drivers installed), Windows 10, Latest version of Java, strong internet connection (get the shops internet connection if you are at one), you should be using a battery maintainer during this procedure. GM recommends the Deltronics products line, jump pack, new or existing B111 Key. 10mm socket to work on battery terminals.
Pro Tip: If you have multiple partitions, you must install your J2534 drivers to the partition you are working on! Example if you have a generic partition and that is where you installed you J2534, but later switch to a GM partition then you will need to install the driver's there as well.
AE tools drivers page: https://www.aetools.us/catalog-flipbook/softdownload/

www.acdelcotds.com is your starting point.
Steps: 

    1. There is no "SPS" software, the programming is done via Internet Explorer browser. 
    2. Check and download the latest version of Java www.java.com, make sure you are using Internet Explorer
    3. Log into Acdelcotds.com (If you don't have a log in then jump through the hoops to register, you do not need a Nastf ID to perform these procedures fyi.)
    4. Click Service and Programming Information
    5. Buy the Service Programming Only subscription. Pay for your subscription and come start back at the home page and select Service and Programming Information again to go back to the same page, but now it will show Access Your Subscription.
    6. Click Access Your Subscription, follow the prompts and approve the installs etc until you get a button that says, "Start Sps". If you don't have all of your Java updated, then this is where you will have problems. Download from java.com and restart the process.
    7. Choose Ecu replace and program
    8. Type in the Vin number
    9. Select Engine Control Module - Programming
    10. Next, Next, Next follow the prompts until programming is complete. Time to program depends on speed of Internet. I suggest getting on the shops wifi first before you get started.
    11. After you see the completion screen, click "Proceed with Same Vin".
    12. Select Theft Deterrent System - Program
    13. Select the option with Powertrain in it it, not just the program key option.
    14. Follow the on screen prompts till complete. Lights will blink on and off and put you in a 12 minute wait. 
    15. At the end of the 12 minutes you are done. Cycle the key watch the security light to make sure it comes on briefly then goes off. If you turn the key right after you program the ECM the light will come on, blink twice, then start blinking at a moderate rate. Note: If you come out to a vehicle that displays that 2 blink behavior you may want to ask if they changed the computer.
    16. You MAY need to do a hard reset to reset the HVAC system, in this case we didn't do that.
    17. Let the customer/shop know if they need an extra key, now would be a good time to purchase that from you and let them know about your other services and ask for referrals to other shops that may need your services, try to get a name and shop name to make a marketing stop at!

When you are done with the ECU programming select Vehicle Theft Deterrent Learn PowerTrain option and follow the prompts to get the key reprogrammed. (You can reprogram the same key as before or a new key.)
Robert Reynolds
Special Thanks to: Donnie S., Brandon T. and Bill B. for the prep, help and helping have the confidence to get this done!
 
2011 Chevy Malibu ECM Swap by Rob Reynolds.pdf

I had a Saturn L300 recently that had multiple issues with the BCM (lighting, wipers, shift lock, etc.) in addition it also had an intermittent "No Start" issue. It came in as a "No Start", I began troubleshooting (blah,blah,blah) and pulled the BCM to check for bad connections and possible bad solder joints. I re-flowed the solder joints and luckily corrected the "No Start", however the other issues still existed. Don't ask why, but at one point I reconnected the BCM, started the vehicle, then disconnected the BCM. After the initial reconnect and start up, the vehicle would continue to start with the BCM disconnected. It would restart without the BCM until I disconnected power to the ECM. I even used the TECH 2 to put all modules to sleep and it would still restart without the BCM. It would ONLY reset and look for security data after disconnecting power directly at the ECM or unhooking the battery. I installed a new BCM, flashed it and all problems went away. With the new BCM installed it will not run with the BCM disconnected.
After mentioning corrupt files, I am wondering if the bad BCM somehow sent corrupted security data to the ECM, that for whatever reason prevented the ECM from looking for the security data again thus allowing a restart with the BCM disconnected, until I disconnected power from the ECM and at which point it would reset and look again only to get corrupted data again.......
One other thing I found odd it that after installing the new BCM it would only allow the on board passlock relearn, it would not allow any other method to work.
 
 
 

I was at a shop yesterday to make a key for a different vehicle. While I was there they asked if I would take a look at this 2016 Honda Civic, the immobilizer light was flashing and the vehicle wouldn’t start. I walked over to the vehicle and saw they already had their Maxisys Elite connected, so I thought great I don’t need to get mine since that would be my tool of choice for this scenario. I didn’t get any info and I didn’t really ask any questions because I wanted to make an initial assessment so I knew what questions to ask. 
I want to share the diagnostic process I used to repair this vehicle thinking that it may help others. 
The first thing I did was go into immobilizer setup and attempted to perform an “all keys lost” programming. I was pretty certain it wasn’t going to work but I was looking for a specific response from the vehicle. I got what I was looking for- “immobilizer system not normal” if you get this message you can try to program the keys as many times and with as many different keys as you want and it will never work. 
Next I grabbed my antenna tester out my pocket and tested the immobilizer coil. It was putting out a signal. 
After that I went to diagnosis and did an auto scan on all modules. There were no codes in the ECM or immobilizer system but there were codes in the ABS/TCS/VSA, EPS, and a few other systems. I started checking the codes in each system one by one. I would read the codes, clear them, cycle the Key, and read them again to see which ones came back. 
The ABS system had a hard fault for “internal failure”. I ask the technician if he had checked the ABS system. “Oh ya, I put a new ABS module in it.”  Did you run the replace function in Immobilizer setup?  “What’s that?”
Then I went to the main screen on Maxisys, selected hot functions, then Immo, then immobilizer setup, then MICU,VSA replace. I followed the screen prompts and when I was done the immobilizer light was off and the vehicle started. After that I went back to the ABS system cleared and rechecked codes. Surprisingly the internal failure code was still there but my job was done. 
Normally I wouldn’t even take a job like this, the only reason I even looked at it was because I was standing next to it and they already had their Maxisys hooked up to it. If you’re going to tackle a job like this you need the right combination of tools, knowledge and luck. As the saying goes sometimes it’s better to be lucky than good!  
The only thing better than fixing somebody else’s car with your Maxisys, is fixing somebody else’s car with their Maxisys!  

Okay the RL66 did not have much data on it. Had about a screen full and the rest was ff ff ff ff all the way down. The L56R came from a BSM I had laying around. The L56R accepted the data from the RL66 just because there wasn’t much of data. Well I guess that statement was flipped. The RL66 would handle more data. But at any rate the shit went in.  I even transferred it to the tango wrote a key, checked the key, checked the previous key,  and all was good. Pulled the pin. Using Arlabs by the way. I got all the tools, vvdi, xprog, smok, orange 5. But arlabs seems to be the most consistent in doing the job.

The RL66 should be a 93LC66 and the R56L should be a 93LC56. The L in the part number indicates that it's capable of operating at a lower voltage (2.5 V). The difference in the two is that the 93C66 holds 8 kb of data and the 93C56 only holds 4 kb. If you look at your RL66 dump and no data is being stored in the latter half of the file, the L56R will probably work. If there's anything being stored in that area though, I wouldn't even attempt it.

This vehicle had an intermittent no start- key wouldn’t turn. Also, the key would sometimes turn but no crank.  When the key would turn but no crank, occasionally a light or two would flicker on the instrument cluster.  It uses the BMW style key with H92 blade and the Land Rover exclusive EWS4.5 system. At first I thought it might be the steering lock but it ended up being the instrument cluster. 
With the used cluster plugged in the vehicle would not start. The 8 leg EEPROM in the pictures was read off the original cluster and written to the new/used cluster. The vehicle then started and the miles were also correct. 

Just an FYI when swapping used modules on GM Architecture A vehicles.  Please watch the video in the link provided to understand what can happen if you install
used Electronic Modules in these vehicles.    I have seen this happen, fortunately it was the owner of the vehicle that put the used components into his Camaro and bricked the car!
 

does anyone have a list of plug and play ECU/BCM's whatever they are called as per OEM title? This would be amazingly handy for me.
I get a LOT of things like  customer:"  ECU went bad, I replaced it but now my car wont start? can you come program my key?"
if its an old toyota or lexus or honda I know exactly what I can and can't do but these newer cars IDK if its because the ECU is not plug and play or what exactly.
I also get the same scenario only the customer/mechanic was smart enough to get the doner immobilizer unit/1key that was factory paired with the doner ECU, they only need me to cut a key that fits the car receiving the new parts.
 
EDIT: here's my list as far as I know PLEASE CORRECT/EDIT/ADD TO THIS IF I AM WRONG
as far as I know all the 16 bit toy/lexus are all plug and play. 98-about 2002
Honda type 1 (red key programming key 1997'ish) is plug and play swapping the immo box with a matched chip will start the vehicle
ALL Honda's after type 1 require IMMO matching witch is built into the antenna coil, a new ECU is NOT plug and play due to this.
Ford PATS 1/2 are plug and play damaged/ antenna coil's are plug and play
 
 
 
 

Live Note with Images: http://www.evernote.com/l/AAn7iYuDxQ1M147UhT8ysWWrB00DVOYvmRs/
Task: Restore operation to a No Start vehicle after Engine Control Module has been changed.
Conditions: 2011 Chevrolet Malibu using Ae Tools and Computers Aezflasher 1 (with USB drivers installed), Windows 10, Latest version of Java, strong internet connection (get the shops internet connection if you are at one), you should be using a battery maintainer during this procedure. GM recommends the Deltronics products line, jump pack, new or existing B111 Key. 10mm socket to work on battery terminals.
Pro Tip: If you have multiple partitions, you must install your J2534 drivers to the partition you are working on! Example if you have a generic partition and that is where you installed you J2534, but later switch to a GM partition then you will need to install the driver's there as well.
AE tools drivers page: https://www.aetools.us/catalog-flipbook/softdownload/

www.acdelcotds.com is your starting point.
Steps: 

    1. There is no "SPS" software, the programming is done via Internet Explorer browser. 
    2. Check and download the latest version of Java www.java.com, make sure you are using Internet Explorer
    3. Log into Acdelcotds.com (If you don't have a log in then jump through the hoops to register, you do not need a Nastf ID to perform these procedures fyi.)
    4. Click Service and Programming Information
    5. Buy the Service Programming Only subscription. Pay for your subscription and come start back at the home page and select Service and Programming Information again to go back to the same page, but now it will show Access Your Subscription.
    6. Click Access Your Subscription, follow the prompts and approve the installs etc until you get a button that says, "Start Sps". If you don't have all of your Java updated, then this is where you will have problems. Download from java.com and restart the process.
    7. Choose Ecu replace and program
    8. Type in the Vin number
    9. Select Engine Control Module - Programming
    10. Next, Next, Next follow the prompts until programming is complete. Time to program depends on speed of Internet. I suggest getting on the shops wifi first before you get started.
    11. After you see the completion screen, click "Proceed with Same Vin".
    12. Select Theft Deterrent System - Program
    13. Select the option with Powertrain in it it, not just the program key option.
    14. Follow the on screen prompts till complete. Lights will blink on and off and put you in a 12 minute wait. 
    15. At the end of the 12 minutes you are done. Cycle the key watch the security light to make sure it comes on briefly then goes off. If you turn the key right after you program the ECM the light will come on, blink twice, then start blinking at a moderate rate. Note: If you come out to a vehicle that displays that 2 blink behavior you may want to ask if they changed the computer.
    16. You MAY need to do a hard reset to reset the HVAC system, in this case we didn't do that.
    17. Let the customer/shop know if they need an extra key, now would be a good time to purchase that from you and let them know about your other services and ask for referrals to other shops that may need your services, try to get a name and shop name to make a marketing stop at!

When you are done with the ECU programming select Vehicle Theft Deterrent Learn PowerTrain option and follow the prompts to get the key reprogrammed. (You can reprogram the same key as before or a new key.)
Robert Reynolds
Special Thanks to: Donnie S., Brandon T. and Bill B. for the prep, help and helping have the confidence to get this done!
 
2011 Chevy Malibu ECM Swap by Rob Reynolds.pdf

Sir,
Tons of thanks, I don't do this type of work but read your PDF, really liked it.
 
Singh