RESPECT COPYRIGHT

NO PART OF THIS MANUAL MAY BE REPRODUCED IF WE ARE ANY MEANS

USED WITHOUT THE PERMISSION, IN WRITING, OF THE AUTHOR.

THE INFRINGEMENTS APPLY TO THE SANCTIONS PROVIDED FOR IN ARTICLES 102

TO 106 OF LAW 9.610 OF FEBRUARY 19, 1998.
Contents

INTRODUCTION..................................................................................
REPROGRAMMING THE INJECTION MODULE...........................
DATA STORAGE AND TRANSMISSION........................................
UNILATERAL COMMUNICATION....................................................
BILATERAL COMMUNICATION.......................................................
READ AND WRITE IN A MEMORY..................................................
UNIVERSAL PROGRAMMER.......................................................
ADAPTERS FOR MEMORIES...........................................................
EMBEDDED MEMORIES...............................................................
BOOT LOADER READING MODE...................................................
THE ST10FXXX PROCESSOR.........................................................
DIRECT READING AND PROGRAMMING................................
THE SERIAL PROGRAMMER...........................................................
INDIRECT READING...........................................................................
REPROGRAMMING DO MOTOR OPERATING DATA
THE STARTING IMMOBILIZER SYSTEM..................................
IMMOBILIZER ECU.............................................................................
ANTENNA..............................................................................................
TRANSPONDER..................................................................................
TYPES OF TRANSPONDER.............................................................
ELECTRONIC INJECTION ECU.......................................................
FIAT IMMOBILIZERS......................................................................
GM IMMOBILIZERS.............................................................................
VW IMMOBILIZERS.............................................................................
FORD IMMOBILIZERS....................................................................
REPROGRAMMING THE IMMOBILIZER DATA IN THE ECU
ECU DECODING..................................................................................
MAIN MEMORY................................................................................
AUXILIARY MEMORY.........................................................................
PROGRAMS AND DATABASE FOR DECODING....................
IMMOKILLER....................................................................................
RESET OF THE ECU IMMOBILIZER SYSTEM.............................
RESET FIAT..........................................................................................
RESET VW........................................................................................
RESET GM........................................................................................
RESET FORD.......................................................................................
PASSWORD OF THE IMMOBILIZING SYSTEM...........................
FIAT PASSWORD............................................................................
VW PASSWORD..............................................................................
GM PASSWORD..............................................................................
FORD PASSWORD.........................................................................
CHANGE ELECTRONIC INJECTION MODULE............................
COMMON DEFECTS IN THE IMMOBILIZING SYSTEM.........
CONCLUSION........................................................................................................................................
INTRODUCTION

In this volume, we will address two works that interest

many, reprogramming automotive ecus and immobilizers
starting. The scarcity of information in the market on the
subject, leads us to study and develop manuals that
assist technicians in maintenance and repair procedures.

REPROGRAMMING THE INJECTION MODULE

We find in the digital block of the electronic injection modules, an

extremely important component, memories.

The engine's operating parameters are stored in these

components, as well as confidential data, such as the
immobilizer password.

We can then, using special tools read these data, and

even reprogram those data into the memories, since they
are already programmed at the factory.

For a better understanding, we will study a little about

digital electronics, data storage and communication.
DATA STORAGE AND TRANSMISSION

Current ecus uses a powerful digital, communication and data

storage system, so it is important to address such digital systems.

The term digital is used in electronics to represent logic levels, 1 and

0.

Through these levels or digits, communications are made

between machines, computers, TV and many other
systems.
In our case, the communication between ecus and its
internal components is also digital, called serial
communication (fig2), it is the zeros and ones that do all
the work.
many wonder and how zeros and ones can read, write
and count, with just two digits. not intriguing? This is
possible through bits and bytes and training codes.

Figure 2

The bit is nothing more than a digit, which can be 1 or 0,

the sum of 8 of these bits, forms 1 byte, this byte (fig3),
within a special code, can form any number, letter or
character.
Figure 3

The most used code for encoding and decoding the bytes
and the ASCII which in the original language means
american standard code for information interchange (fig4),
which in Portuguese means american standard code for
information exchange.
Examples
00 00 0011 = 3
00 00 0111 = 7

0100 0001 = the upper

case 0110 0001 = the

lower case
Figure 4

With the examples we can conclude that the ascii

code can write any letter, number or character.
It is not necessary for our learning, a deep knowledge of
the ascii code, because what we need is only to
understand how sentences and numbers are written with
only zeros and ones.
Once the codes are understood, we will start storing
data. This storage is made in memories, in a platonic
way, the memory can be compared with a huge building
with several windows, each window represents a bit,
and the sum of eight windows form a byte. imagine then
that each window lit, represents the high logic level, or
1, and the unlit, the low logic level, or 0.

Each window in the building has an address, as in

memories, this address is formed by predefined
coordinates, for example, imagine that the building has 20
floors, and each floor has 32 windows, so compared to
the memory each floor has 4 bytes of 8 bits each.

Imagine now that I ask you to tell me which number, letter

or character has the second byte of the building, then you
will look at the top floor of the building, and start counting
the logical levels from the ninth window on the twentieth
floor, then to write down the sequence of the levels and
compare with the Asian code you will have the answer.

The same happens with the ecus processor, when

receiving a read instruction, the processor fetches the
data from the address described in this instruction, the
same thing happens for writing data.

With the communication between the ecus and its internal

components it is not very different, the data are transmitted
and received in serial form, that is, one by one.

The physical lines, which make this communication, can

have two definitions, which are:
UNILATERAL COMMUNICATION

It is common to find this type of communication in the

internal circuits of the ecus, because with unilateral
communication two transmission lines are needed, the
data sending line, which has the acronym TX, and the
receiving line, with the acronym RX.

The data is sent by TX and received by RX, it has the

advantage of the possibility of simultaneous
communication, without the need for the TX line to be
disabled for sending the RX line, thus increasing the
processing speed.

As a disadvantage we can mention the need for two

physical lines, copper tracks, wires, connectors, etc.
These two lines are interconnected to all micro
controlled Cis (integrated circuits), that is, Cis that
has the capacity to process logical information.

The main processor then manages all communication and each

instruction has its destination programmed, example:
 Imagine that in a room of a doctor's office, expect five
people, each person has a name, and of course, so when
the doctor calls one of the five, the distinction is made by
the name, we understand then that everyone heard the
call, but only the person corresponding to the name
called out spoke up and carried out the orders given by
the doctor.

The same happens in serial communication,

everyone receives the message, but only the
correspondent interacts with it.

BILATERAL COMMUNICATION

Bilateral communication is more used in external

communications between ecus, as it makes the cost
of the project viable, requiring only one physical line
of data.
The vehicle's diagnostic line is an example of a
bilateral communication line.
Communication takes place in the same way as unilateral
communication, but when the line is busy to transmit
data, or is being occupied by TX, RX will have to wait for
the end of the message to use the line.

READ AND WRITE IN A MEMORY

Our next step is to understand how we can read and write in a

memory.

To read and write in a memory we need an electronic

tool called a universal programmer. With this
programmer we can read the data contained in a
memory and
save this data on your computer, that is, save this file. we
can also write data that is saved or saved on the computer
in a memory, changing then its original programming.

There are several needs for this reprogramming, such as

updating the ecu program, updating this so-called
downloading. They are also necessary in cases of
disabling the starting immobilizer. This disabling is done
by exchanging the original ecu file for a modified file to
disable the immobilizer function.
UNIVERSAL PROGRAMMER

Figure 5

The memory programmers (fig5) have the function of

reading and saving the contents of a memory and also of
recording new content when necessary. A universal
programmer composed of software and electronic
interface, where the memories are embedded, or where
they come from cables for a circuit connection, without
removing the memory.

The program is responsible for all contact with the user, in

this program we can find a screen called buffer
(fig6), where the data read or to be written in memory is
loaded. These data are converted from binary to
hexadecimal, where a huge reduction in the size of the data
representation is achieved, with the hexadecimal notation
we can represent any binary number, and with that, any
letter, number or character.

Hexadecimal notation is used for its practical

representation, with fewer digits than other notations,
such as decimal notation.

Figure 6
As the name implies, universal programmers are designed to serve
all types of existing memory.
In our case, we will only use a small part of these
resources, since the automotive ecus and immobilizers are
equipped with DIP, PLCC, TSOP AND SOIC housings,
and there are also special features, which many universal
programmers do not have, the programming of the
embedded memories on processors.

ADAPTERS FOR MEMORIES

Many memories need an adapter to suit the fit of

universal programmers, as their component socket has a
unique shape for use, this shape is usually the DIP
Thus, an adapter is required for each type of memory. Providing the
conversion of dip for the respective enclosures.

The adapters used in automotive ecus are: DIP PARA SOIC

Two adapters are used, a socket and tweezers (fig7).

Figure 7
DIP ADAPTER FOR PLCC

This adapter will depend on the number of

pins in the memory (fig8).

Figure 8

PSOP DIP ADAPTER

In most cases, the one adapted according to the figure (fig9) is

used:
Figure 9

EMBEDDED MEMORIES

The memories built into the processors have a different

programming mode than the conventional ones, since
they can be programmed in weldable sockets, which are
of little practicality, since it is necessary to remove the
processor from its board, a new solder in the adapter
socket, where it will be read or changed your data, and
again, the reverse process to the one described when
returning the processor to your board.

The most used process is circuit programming with

the acronym ICP (in circuit programmer).

This process consists of soldering the wires necessary for

programming on the ci plate itself (fig10), without the
exhaustive removal of the processor.
Figure 10

In general, it is necessary a specific programmer for programming

embedded memories, which in most cases, has a high cost, as such
devices have software and an interface directed to each processor,
which can also be called a development tool.
BOOT LOADER READING MODE

The reading mode in boot mode, or boot loader, which

comes from the English boot.
Through this initialization mode we can use the specific
program to load or read the processor's built-in memory.

This mode aims at savings in programming

processes, since no more expensive tools are
needed, thus attracting the interest of electronics
manufacturers.

The mode of activation of this mode is done physically,

through connections with resistors, in the specific ports.
The activation port is usually raised to 5vdc, a voltage that
denotes level 1 or high level in the internal circuits of the
ecus.
When we take this port to level 0 or low, the boot loader process
starts.

THE ST10FXXX PROCESSOR

The st semiconductors processor (fig11), the

st10fxx, was widely used in automotive ecus from
the year
2004. This processor is widely used in embedded
processes, such as ecus, toys, process automation in
general and etc.
Figure 11

There is no need for development tools and special

programmers to program the memory built into these
processors, as it uses a very practical boot loader system,
as previously described.
In addition to its practicality, the program used for the
boot loader process is free and can be downloaded from
the manufacturer's website.

Below the screen of the program st10 flasher

The use of the st10 flasher program and the activation of

the boots is simple, just open the ecu, weld the resistors as
described in the boots and ecu model manual (fig12),
connect the interface via the k diagnostic line, open the
st10 program flasher and follow the program instructions.
Figure 12

There are cases where a single resistor is required to activate the

boot mode process, as in the IAW 4AFB ecus, which uses the
ST10F168 processor (fig12).
We can read the data contained in the ecus memories
in two ways, which are:

DIRECT READING AND PROGRAMMING

In this mode, there is no need to remove memory or boots

with special tool called a serial programmer and sent via
the vehicle's diagnostic line, a read request to the ecu
processor, with communication being successful, the
processor sends the data from memory to the computer,
through the diagnostic line and the serial programmer.

In the same way with programming, however in reverse

order, the programmer asks the processor to write, or
 that is, save the data that is on the computer, in the internal memory
of the ecu.

It is important to note that not all systems use this

resource, as this resource is the specialty of some
systems in particular.

This feature is common in hybrid ecus (fig13), hybrid ecus

as its name says are ecus that use encapsulated
components in conjunction with non-encapsulated
components, only covered with a protective gel. These
ecus had their manufacturing discontinued in 2003 .

Figure 13

Some examples of hybrid ecus:

Hitachi ecu (fig14), applied to Fiat brava hgt and marea
with motor 1.8 vehicles with 16 valves. It is not possible
to reprogram the ecu's operating data memory.

Figure 14

The immobilizer data is stored in an internal memory of the soic

93c46 type.

Figure 15

To reprogram this memory, it is necessary to drill the ecu housing

(fig15).

Bosch ecu hybrid, this ecu equips Fiat palio 1.0 16v and 1.3 16v
vehicles, marea 2.4 and abarth 2.4 style (fig16).
We can reprogram both the motor and immobilizer
data via the serial programmer.

Figure 16
Bosch Ecu applied to the Astra Gm vehicle, we can reprogram
the engine and immobilizer data using the serial program
(fig17).

Figure 17

Ecu delco hybrid (fig18), this ecu model equips the Celtic ohc, corsa
meriva and zafira vehicles from Gm, we can read the immobilizer
data, but not change it, we can also reprogram the engine data via
the serial programmer.
Figure 18

THE SERIAL PROGRAMMER

As the name implies, a serial programmer and an

electronic tool that sends and receives data in a serial
manner, that is, bit by bit. In your program or software, the
programmer has all requests used for communication and
subsequent reading and writing in ecu memory.
One of the most used serial programmers in the world is EOBD2,
because its versatility and low cost enable its use
. has an easy-to-use program with multilingual features.

Another widely used programmer worldwide and KWP

2000, is named after the KWP2000 universal
automotive communication protocol.
In the figure below we can see the EOBD2 program screen.

Figure 19
The electronic interface of these programmers is very simple and
small, but with great electronic resources (fig20).

Figure 20

INDIRECT READING

The reading and indirect writing of the memory data in

automotive ecus is done through universal
programmers and boot modes, as described
previously.
This is the way in which there is a need to
remove the memory for programming.
There are many ecus that use this mode for programming (fig21)
Figure 21

REPROGRAMMING W I T H MOTOR OPERATING DATA

The vehicle's engine operation and calibration data are

stored in the internal memories of the ecus, there is often
a need for reprogramming to update the ecu software or
improve its consumption and performance.

Most of the time this data is stored in large memories

with 256 kb, 512 kb or greater.
There are programs to edit these data on the
market, in order to offer improvements in
consumption and performance.
An example of these programs is ECM 2001.

The ECM2001 is also widely used in the practice of

chiptuning, which consists of increasing in some
cases up to 100 hp of engine power, by changing
the original files.

Such programs act directly on the original

programming binary code, mainly changing the
ignition point and injection time, thus increasing the
engine's power.

In the figure below the screen of the ECM2001 program.

THE STARTING IMMOBILIZER SYSTEM

The starter immobilizer consists of an electronic passive

and anti-theft security system of current vehicles. The
principle of operation of the system is the reading of
confidential data contained in a transponder, a central
electronic system sends a magnetic signal through an
antenna that it reads the data contained in the transponder
and compares it with the data in its internal memory, with
the correct data at the start of the vehicle and released, if
not, blocked.

In case of failure or loss of keys, an emergency start is

possible. The procedure will be described in each system
and assembler in the chapters that follow.

The main components of the immobilizer system are:

IMMOBILIZER ECU
The control module of the immobilizer system is
programmed to send an electrical signal that
energizes the antenna coil, creating a magnetic field
that surrounds the transponder, thus reading its data,
and later comparing this data with its internal memory,
programmed with the same data as the transponder.

Once the data is correct, the immobilizer ecu sends a

release message to the electronic injection ecu. Otherwise
the immobilizer ecu will send an error message, and the
system will enter an emergency, in some systems there is
a pilot warning lamp on the condition of the immobilizer.

The immobilizer module can be a separate ecu or

incorporated in the instrument panel or also in the
body control module (fig22).
 Example of immobilizer built into the instrument panel.

Figure 22

Example of immobilizer incorporated into the bodywork control module

(fig23).

Figure 23
ANTENNA

The antenna consists of a coil, which has the function of

sending and receiving data from the transponder. This coil is
strategically installed in the ignition contact, where when
receiving electrical impulses, it produces a magnetic field that
interacts directly with the transponder.
TRANSPONDER

The transponder is a receiving and transmitting unit,

which operates with the energy of the field created by
the ecu, as it does not havebattery or cell, through the
antenna. contains an internal memory where the vehicle's
confidential data is stored.

TYPES OF TRANSPONDER

TEXAS - This is one of the two transponder chip models

from TEXAS. This transponder chip can be found on the
car keys of the brands Chrysler, Dodge, Infiniti, Jeep,
Lexus, Mazda and Toyota.

TEXAS 2 - This is another TEXAS transponder chip

model. This transponder chip can be found on Ford,
Lincoln and Mercury car keys.
PHILLIPS - This is the PHILLIPS automotive transponder
chip. This transponder chip can be found on the car keys of
the brands BMW, Cadillac Catera and Mercedes.

MEGAMOS - This is the MEGAMOS automotive

transponder chip. This transponder chip can be found on the
car keys of the brands Acura, Buick, Honda, Jaguar,
Porsche and Cadillac Seville.

PHILLIPS CRYPTO GM - This transponder is used in most GM

vehicles, its structure is composed of two blocks, the first one
we can call it ID which is identification of the chip. Second block
is encrypted and the data is transferred from the vehicle to the
transponder.

PHILLIPS CRYPTO VW - This transponder is used in

some VW and Seat vehicles, such as the Classic Pole,
Inca, Van and its structure is composed of two blocks, the
first one we can call it ID which is identification of the chip,
the second block is encrypted and data is transferred from
 the vehicle to the transponder.

CLONING - This transponder, also called Universal, is used

for cloning and receives protocols from Philips, Megamos,
Motorola and Temic.

ELECTRONIC INJECTION ECU

The injection ecu is responsible for whether or not the

engine starts, depending on the response of the
immobilizer ecu. Like the immobilizer ecu, the injection ecu
also has a memory where confidential data is stored.

The immobilizer systems divided by national automakers

will be described below
 FIAT IMMOBILIZERS

In vehicles of the Fiat brand there are two generations of

immobilizer systems which are:

Figure 24

FIAT CODE PHASE I (fig24): It consists of 1 (one) master key and 2

(two) slaves. In this system, the master key (red) encrypts the slave
keys (blue). With the tracker it is not possible to encrypt the keys.

FIAT CODE PHASE II (fig25): In this phase, the master key has
been eliminated. Transponder keys can only be coded with the aid
of a diagnostic device.

Figure 25
The immobilizer error fault light is on the instrument panel, is yellow
and has a key symbol. When the ignition key is turned on, the code
light comes on for 0.8 seconds and goes out. If it stays on or
flashing it means FIAT CODE problems. At that moment, if the
engine is started, the engine spins, but then dies, as the CODE
system cuts off the fuel pump, ignition coil and injection valves.

The vehicle comes from the factory with two blue keys, but up to 8
keys can be coded.

At FIAT, the immobilizer center is housed under the steering column

finish or incorporated into the instrument panel or body control
module. If it's necessary The your replacement, may to be changed
individually for CODE FASE I in cases of box type ecu, or to be
exchanged together with the central injection for CODE FASE II as
they form a married pair.

VEHICLES INVOLVED
• CANOPY
• SIENA
• STILO
• MAREA
• BRAVA
• UNO FIRE
• DOBLO
•
COMPOSITION OF THE IMMOBILIZER SYSTEM:
• Ignition key with transponder.
• Master key (for FIAT CODE PHASE I vehicles).
• Immobilizer central (CODE).
• Electronic control unit, ecu.
• Anomaly light
 IGNITION KEY CODING WITH TRANSPONDER:

There are two procedures for encrypting keys:

1 In this procedure the system is CODE FASE I and

therefore has a master key:

This system only accepts encryption if we have at least

2 keys to program and a maximum of 8.
Place the master key in the ignition and turn until the
lights on the panel come on.

Note that the CODE LAMP on the panel lights up for

0.8 seconds and then goes out. At that moment,
remove the master key and in less than 10 seconds
place the key to be programmed in the ignition and
turn the key.

Note again that the LAMPADA DO CODE lights up for

0.8 seconds and then goes out. At that moment, remove
the key already coded and in less than 10 seconds place
another key to be programmed in the ignition and turn the
key.

• Notice again that the LAMPADA DO CODE lights for

0.8 seconds and then goes out. At that time .
remove the 2 key already coded and in less than 10
seconds place the MASTER key in the ignition and turn the
key.

CODE LAMP will light for 0.8 seconds and go out.

2 key coding is ready. The procedure is the same for more keys.

The procedure to be followed is for FIAT CODE FASE II.

This system does not have a master key, but a diagnostic
device can be used. However, it is necessary to have in
hand the key code that comes stamped on a card called ''
CODE CARD '' and that code is 5 digits (electronic code).

• This system only accepts encryption if we have at least

2 keys to program and a maximum of 8.
• It is not necessary to delete the keys that already
exist, before making new programming. But if you
want, you can delete them using a tracker

• The diagnostic device must be enabled to enter the can

network, since the key coding is via the VENICE
system.
• With the device in the venice system, follow the
procedures provided by the equipment itself.

ELECTRONIC INJECTION MODULE (ECU)

To program the new OR RESETED module, just turn

on the ignition key and the FIAT CODE panel will program
it.
Therefore, it is important to know if the injection plant
is really damaged at the time of its replacement, as it only
accepts a single schedule.To prevent the new panel from
being programmed, simply disconnect the connector from
the FIAT CODE panel.

FIAT CODE CENTRAL

The immobilizer center can be replaced individually.

If replacement is necessary, use the master key to

program the central code (same procedure for key
coding). From then on, the new FIAT CODE control unit
will be synchronized with the keys and the injection unit.
 EMERGENCY DEPARTURE

This procedure is used for FIAT CODE FASE I and FASE

II.

It is important to note that this operating strategy only serves to

break the
code system. For example: the key with a transponder
has been lost and the vehicle is to be operated with a
common key (without a transponder).

Every time the vehicle is switched off, the entire

procedure must be performed again.
• Switch on the ignition without starting.
• Step on the accelerator until the end and keep it pressed.
• Note that the injection lamp will blink twice and go out.

• At that moment, release the accelerator pedal and start

counting how many times it turns on. When the number
corresponding to the first digit of the key code (electronic
code) flashes, step on the accelerator again until the
end.

• Note that the injection light will turn on and off again.

• Take your foot off the accelerator and start counting

again how many times the injection light comes on.
When the number corresponding to the second digit of
the key code flashes, step on the accelerator again.

• Repeat this procedure for the other key code numbers.

• When you finish the last number, step on the

accelerator again and notice that the injection light
flashes about 2 times and goes out.
• At this point the code was accepted.
• Without turning the key back, start the engine.

TIP

Many times we are faced with electrical breakdown in Fiat

vehicles, and then we need to know precisely whether the
breakdown is part of the immobilizer system or if it is caused by a
failure in some isolated component of the electronic injection, or
even the injection ecu.

The emergency start can assist us in this diagnosis, the

first step and step on the accelerator pedal and wait, if the
anomaly light does not blink, we have a great chance of
having a problem of lack of electrical power in the
injection ecu, or even even if it burns. if we manage to
insert the correct secret code, the game will be released,
and then,The system immobilizer will be disabled, if
there is a failure, the vehicle will turn on, if it does not, we
will be sure that the failure and the injection.

GM IMMOBILIZERS

Figure 26
 GM's immobilization system is called IMMOBILIZER (immobilizer),
and was introduced in Brazil in August 1996 with VECTRA B (fig26).

The error light on the immobilizer is the same as the electronic injection.
When the ignition key is turned on, if it is flashing it means immobilizer
problems. If it is lit, normal operation.

The vehicle comes from the factory with two keys, but up to 5 keys can
be coded.

This encoding can only be done with the aid of a tracking device,
therefore it does not have a master key.
GM has two types of immobilizers:

1 °)In the first model that equips VECTRA B; OMEGA 4.1 L e

2.2 L; CORSA 98 to 2001; TIGRA 97 to 99, can be placed
new or used command centers simply by synchronizing it with the
aid of a tracker
2 °)In the second model that equips CELTA 2000 to 2001;
ZAFIRA 200 to 2001 and ASTRA 98 to 2001, the used
switches must be erased before receiving new
programming.

VEHICLES INVOLVED
• VECTRA B
• OMEGA 4.1
• OMEGA 2.2
• CORSA MPFI after 96 (optional)
• ASTRA NEW
• TIGRA
• OMEGA NEW
• MONTANA
• AGILE
• PRISMA
• MERIVA
• ZAFIRA

COMPOSITION OF THE IMMOBILIZER SYSTEM:

• Ignition key with transponder.
• Immobilizer center incorporated with the coil / antenna.
• Electronic control unit.
• Anomaly lamp.

IGNITION KEY CODE WITH TRANPONDER: To code the

ignition key, INFO CARD must be in hand. It is a card that comes
with the vehicle, which contains the immobilizer code, key code
and radio code and chassis number.

With the immobilizer password in hand, enter a diagnostic device

in the vehicle, enter the immobilizer function and following the
steps determined by the device, encrypt the keys. It is important
to remember that, when encoding the new key, the old key must
also be encrypted, otherwise it will not make the car work.

In the new OMEGA, the key only accepts one programming, it is

not possible to reprogram them.

If the customer does not have the INFO CARD, a request can be
made with the vehicle manufacturer through a dealership, or with
electronic resources.

It is good to remember that the first GM vehicles with immobilizer

came with the key transponder only attached and that it was
common in case of a key fall to lose the transponder. Today the
models younger ones come with the glued transponder.
 ELECTRONIC INJECTION MODULE (ECU)

The injection module can be replaced with a new or

used one. However, it is necessary to do the coding and
for that it is necessary the aid of a tracking device.
Enter the immobilizer function, and in possession of
the key code, follow the procedures provided by the
diagnostic device.

If the command center recognizes any anomaly in the

immobilizer, a fault will be registered that can be seen
either by a tracker or by making a jumper between pins A
and B or 5 and 6 (in the case of VECTRA B) of the existing
diagnostic connector in the vehicle.

In the case of ASTRA NOVO, ZAFIRA and CELTA it is

only possible to see the faults with a tracker
Failures can be:
Code 143 - communication error between the immobilizer
control panel and the ECU

Code 144 - unrecognized key code

Code 145- unrecognized key code

IMMOBILIZER CENTRAL

The immobilizer control unit is combined with the coil / antenna and can
be replaced. The new or reset immobilizer panel, this virgin and accepts
a single code entry. However, this code can be any number.

Serious
preferably the old code that comes marked from INFO
CARD, because that way it will be easier to memorize.
Record the immobilizer center first, then the keys and then
the injection center.
 In the second generation of the immobilizer, as is the case
with ASTRA NOVO, ZAFIRA and CELTA, the new code
must be the same as the previous one, since the injection
plant has already been coded with this code.

The harness of the CORSA FAMILY immobilizer is the

same for cars with or without this safety device, since in
these models the immobilizer is optional. If the vehicle
comes without the factory immobilizer, a jumper will be
made between pins 6 and 7 of the harness of the
immobilizer control panel so that the control center can
receive the signal from the speed sensor. In the absence of
this information, the anomaly light comes on and the vehicle
begins to die in deceleration.

EMERGENCY
DEPARTURE

In the GM line, only the OMEGA NOVO has an emergency

start in case of immobilizer failure. To make it work, follow the
procedure:

• Turn on the ignition key without starting for a period of two (2)
hours.

• When the anomaly lamp of the alarm that will be

flashing goes out, start the engine.
This lamp is located on the on-board computer switch.
VW IMMOBILIZERS

VW's immobilization system is called IMMOBILIZER

(fig27).

Figure 27

The error light on the immobilizer is yellow and has a key symbol.
However, not every VW vehicle has this lamp. For example,
imported ones.

When the ignition key is turned on, if it stays on or

flashing it means problems with the immobilizer. At that
moment, if the vehicle is started, the vehicle starts and then
dies.
The vehicle comes standard with two keys, but up
to 8 keys can be coded.
This encoding can only be done with the aid of a
tracking device, therefore it does not have a master
key.
At VW, the immobilizer control unit is coded,
therefore needing to synchronize the keys and the
injection control unit:
VEHICLES INVOLVED
• GOAL (all)
• SAVEIRO
• FOR YOU
• KOMBI
• SANTANA
• GOLF (NATIONAL AND IMPORTED)

COMPOSITION OF THE IMMOBILIZER SYSTEM:

• Ignition key with transponder.
• Immobilizer Center
• Coil / antenna.
• Electronic control unit.
• Anomaly lamp. (Not all)

IGNITION KEY CODE WITH TRANSPONDER: To code the

ignition key, you must have the immobilizer code.

With the immobilizer password in hand, enter a

diagnostic device in the vehicle, enter the immobilizer
function and following the steps determined by the device,
encrypt the keys. It is important to remember that, when
new key, the old key must also be encrypted, otherwise it
will not make the car work.

This programming can only be done with the aid of a tracker.

If the customer does not have the code, a request
can be made to the vehicle manufacturer through a
dealership, or through electronic resources.

It is important to note that if the key is submitted to a

magnetic field. For example, standing next to a speaker. It
can be decoded. Before encoding the key using a tracker,
perform the following procedure:
Turn off the battery, leave it off for 1 (one) hour. Then turn
it on again, turn on the ignition key without starting, wait for
45 minutes and without turning the key back, start the
engine. If the vehicle is idling it is because synchronism
was successful.

ELECTRONIC INJECTION MODULE (ECU)

The injection module can be replaced with a new or

used one. However, it is necessary to do the coding and for
that it is necessary the aid of a tracking device.
Enter the immobilizer function, choose the ADAPTA
ECU function and in possession of the key code, follow the
procedures provided by the diagnostic device.
If the command center recognizes an anomaly in the
immobilizer, a fault will be recorded that can be seen by a
tracker.

IMMOBILIZER CENTRAL

The immobilizer center on most VW vehicles is

mounted behind the steering column finish and can be
replaced. The new immobilizer center is already coded

Then code the keys and only then code the

injection center. Some VW vehicles have the
immobilizer ecu incorporated into the instrument panel,
such as the case of golf, Passat, bora and jetta.

EMERGENCY DEPARTURE

In the VW line, only the IMPORTED GOLF has an

emergency start in case of immobilizer failure. To make
it work, follow the procedure:
• Turn on the ignition key without starting
• Turn the hour dial to the right and simultaneously press
the zero button on the partial odometer.
• The odometer will mark “0000” and the first digit will start to flash.

• Keep pressing the odometer reset button until the

number corresponding to the first digit of the secret
code appears. Confirm by turning the hour dial to the
right.

• The second digit will start to flash. Then follow the

same procedure as described above.
• After entering the 4 (four) numbers, turn the hour
adjustment knob to the right again and press the partial
odometer reset button.

• Run the engine.

• The engine must remain in operation and the fault light will remain
on.

NOTE: Whenever you turn off the ignition key, the same
procedure mentioned above must be done for the vehicle
to start operating.
FORD IMMOBILIZERS

FORD's immobilization system is called PATS (passive

anti-theft system), and can be divided into three systems:

PATS I: Introduced in 1997 and has 1 (one) master

key and 2 (two) slaves. In this system, the master key (red)
encrypts the slave keys (black). With the tracker it is not
possible to encrypt the keys. Just take readings, see fault
codes, test actuators and delete keys.

PATS II: Introduced in 1999, it has no master key.

Transponder keys can only be coded with the aid of a
diagnostic device.

PATS CAN: equips vehicles after 2005, and keys can

only be coded with the aid of a scanner.
The immobilizer error anomaly LED is mounted next to
the clock and is colored red, or has a padlock design in the
center of the instrument panel. When the ignition key is
turned on, the LED lights for 3 (three) seconds and goes
out. If if it stays on or flashing it means immobilizer
problems. At that moment, if the engine is started, it
rotates, as the starter inhibitor relay cuts the starter. If a
“lock” is given, it will not work either, as the immobilizer
system also cuts the fuel pump, ignition coil and injector
valves.

The vehicle comes from the factory with two black

keys, but up to 15 keys (for PATS 1) and 8 (for PATS 2 and
can) can be coded.

In FORD, the immobilizer control panel can be

incorporated into the coil / antenna or incorporated into the
ECU or the instrument panel as in the case of the pats can.

VEHICLES INVOLVED
• FORD KA
• FIESTA
• MONDEO
• TAURUS
• F250
• ESCORT
• ECOSPORT

COMPOSITION OF THE IMMOBILIZER SYSTEM:

• Ignition key with transponder.
• Master key (for PATS I vehicles)
• Immobilizer control panel (incorporated in the coil
/ antenna) or Immobilizer control panel
(incorporated in the ECU, or panel)
• Electronic control unit.
• Starting inhibitor relay
• Anomaly LED
 IGNITION KEY CODING WITH TRANSPONDER:

There are two procedures for encrypting keys:

1 In this procedure, the system is PATS I and therefore has a

master key:

• This system only accepts encryption if we have at least

2 keys to program and a maximum of 15.
• Delete the keys that already exist, before making new
programming. It is only possible to delete them with
the aid of a diagnostic device.

• Place the master key in the ignition and turn until the
lights on the panel come on.
• Note that the PATS LED on the watch lights up for 3
seconds and then goes out. At that moment, remove the
master key and in less than 10 seconds place the key to
be programmed in the ignition and turn the key.

• Notice again that the PATS LED lights up for 3 seconds

and then goes out. At that moment, remove the key
already coded and in less than 10 seconds place the
new key to be programmed in the ignition and turn the
key.

• Notice again that the PATS LED lights up for 3 seconds

and then goes out. At that time . remove the 2 key
already coded and in less than 10 seconds place the
MASTER key in the ignition and turn the key.

• The PATS LED will light for 3 seconds and then go out.
• 2 key coding is ready. The procedure is the same for more keys.
NOTE: To delete the keys you will need a password that
will be obtained as follows.

Serial number of MPI (in the case of RASTHER) Ex .:

598632 where the:

No. 1 = 5
No. 2 = 9
No. 3 = 8
No. 4 = 6
No. 5 = 3
No. 6 = 2

The password is the numbers placed as follows:

N ° 3 N ° 5 N ° 2 N ° 6 N ° 4 N ° 1 ie 839265

2 The procedure to follow is for PATS II.

This system does not have a master key, however one of
the black keys can be used as the master key. :
• This system only accepts encryption if we have at least
2 keys to program and a maximum of 8.
• It is not necessary to delete the keys that already
exist, before making new programming. But if you
want, you can delete them using a diagnostic device.

• This procedure example will assume that we have an

encrypted key and we want to encrypt another one. Let's
call the key encrypted key 1 and key to be encrypted key
2

• Place key 1 in the ignition and turn until the lights on the panel
come on.

• Note that the PATS LED on the watch lights up for 2

seconds and then goes out. At that moment, remove key
 1 and in less than 10 seconds, place key 2 to be
programmed in the ignition and turn the key.

• Notice again that the PATS LED lights up for 2 seconds

and then goes out. At that moment, remove key 2
already coded and in less than 10 seconds put the key 1
back in the ignition and turn the key.

• The PATS LED will light up for 2 seconds and go out.

• 2 key coding is ready. The procedure is the same for more keys.

• PATS CAN

It is necessary to use a scanner to carry out the

programming of the keys. The procedure is very simple,
but a little time consuming, since the immobilizer system
asks for a 10-minute time for coding, and if you miss the
procedure it doubles the time requested. procedure and
everything described by the scanner.

ELECTRONIC INJECTION MODULE (ECU)

The injection module can be replaced with a new or

used one. However, it is necessary to do the coding and
for that it is necessary the aid of a tracking device.
Enter the immobilizer function, choose the ADAPTA
ECU function and in possession of the code provided by
the equipment company, follow the procedures provided by
the diagnostic device.

If the command center recognizes an anomaly in the

immobilizer, a fault will be recorded that can be seen by a
tracker
IMMOBILIZER CENTRAL

The immobilizer control unit can be incorporated into the

ECU control unit, panel or incorporated into the coil /
antenna.

EMERGENCY DEPARTURE
There is no emergency start on the FORD line.

REPROGRAMMING THE IMMOBILIZER DATA IN THE ECU

We can reprogram the starting immobilizer

data contained in the ecus memories,
whether this is the main memory, which is
the largest, where the vehicle operation
data, or secondary, are also, which are
smaller and exclusive for immobilizer.

In the figure below, an example of reprogramming

with the soic type clamp (most used).
ECU DECODING

The decoding of the ecu consists of disabling its internal

immobilizer system, so that it works without the need for
other components of the immobilizer system.

This disabling is done by reprogramming the memories

where the immobilizer data is, these memories can be of
the main or auxiliary type.

MAIN MEMORY

In some ecu the immobilizer data is stored together with

the engine's operating data, being possible to disable it,
just changing the original file for a modified file, in order to
disable the system.

Some examples of ecus that have the immobilizer data next to the
engine.

Ecu Sirius 32 by Siemens

AUXILIARY MEMORY

Auxiliary memories are exclusive for storing immobilizer

data and km generally have small data storage capacities
and small size, memories are usually used with 8-pin soic
wrapper, the most used are:

95040 and
family
24c02 and
family
93c46 and
family
The datasheets of these memories can be found on the website:

http://www.datasheetcatalog.com/
PROGRAMS AND DATABASE FOR DECODING

There are several programs on the market used

for decoding and ecus resets.
It consists of loading the original file in the decoding
program, where this program will identify the data to
be changed in the original file, eliminating or resetting
the immobilizer system.

When creating a new decoded file, the technician can

save this file, forming a valuable database, for future use.

IMMOKILLER

Immokiller (fig28) is a program widely used by

technicians in ecu repairs, as it has several decoding
resources, reset and reading of immobilizer passwords.

Figure 28
RESET OF THE ECU IMMOBILIZER SYSTEM

The reset of the ecu immobilizer system consists of a

reprogramming of the internal memories of the ecu, in
order to renew its original recording ability, leaving the
piece in the new state.

There are several differences between the systems, described

below:

RESET FIAT

It counts on the practicality of not having to use tools for recording

on the vehicle, just installing the ecu, when the ignition is switched
on, the injection ecu combines with the immobilizer ecu, receiving its
code and enabling it. .

RESET VW

In the VW vehicles it is not necessary to reset the

injection ecus used to enable the immobilizer system.
The immobilizer system integrates the ecu when
programming via the diagnostic tool (scanner).
 RESET GM

The ecus of Gm vehicles are considered the most

laborious in terms of resetting the injection ecu done
through the diagnostic tool. the internal password of
the ecu is necessary, that is, the password of the
immobilizer in which it was found.

WARNING:

NEVER PERFORM THE RESET PROCEDURE IN ECU OF

VEHICLES CELTA OHC, BECAUSE THE RESET OF THIS
SYSTEM WITH GENERIC SCANNERS, THAT IS,
DIFFERENT FROM THE ORIGINAL GM TECH 2, WILL LOCK
THE ECU OPERATING SYSTEM.

RESET FORD

There is no reset in injection ecus on vehicles of this brand.

PASSWORD OF THE IMMOBILIZING SYSTEM

The immobilizer system has a password to access the

system. in emergency cases, a password is required for a
motor connection without the transponder. in some
systems it is also necessary to release the system for
programming new keys.

We have two ways to obtain the immobilizer system

password, the first and most conventional and the request
to the vehicle owner of the card that accompanies the
vehicle's user manual. This card is delivered to the owner
when purchasing the vehicle, and then special attention
to the card is recommended, as it contains the
immobilizer’s confidential password.
This is often kept in a secret place, in which the owner
at the time of sale, forgets to pass it on to the new
owner.
With the loss or lack of the card, the current owner
can request the concessionaire of the brand, a new
card. Each brand has a price and a delivery time.

Another way of obtaining the password and using

electronic resources, which we will now discuss. Through
serial programmers, universals and programs designed to
obtain passwords.

The programs have the function of searching in the

specific positions of the file read in the memory of the
immobilizer or injection ecu. But many times this data
can be encrypted, a system used since antiquity to protect
data and messages. It consists of shuffling data or
messages in such a way that whoever receives it has the
same knowledge as whoever shuffled it, that is, has the
sequence and can then receive and understand the
message, but whoever intercepts it will not be successful
in trying to read it, as he will not be able to unscramble
that message, he will not be able to decrypt it.

The already described immokiller has the function of decrypting

some systems.

The immobilizer password can be entered in injection ecus,

immobilizer ecus and instrument panels.
We will deal with systems based on brands.
FIAT PASSWORD

In Fiat vehicles, the password can be obtained by reading

the memories embedded in the ECU processors of the
immobilizer system. In systems equipped with a body
control module (fig29), the immobilizer system is
incorporated into this module, making it possible to read
the password through of memory 93c66 as described in
fig.in the iaw4sf models can be obtained through the
injection ecu.

Figure 29
Memory position on the board.

We can also obtain the password on panels, in the case of

canyons from 2007 onwards and a new one.

Printed circuit board of the new unit.

In Fiat vehicles, the transponder is manufactured using data

obtained from the memories of both panels, body control modules
and immobilizer ecus.
There are programs that use these data to generate the
encoding for the transponder, as in the case of TMMAKER
PRO (fig30)

Figure 30

We can find a lot of information about immobilizer on

the website of the manufacturer of this device:
http://tmpro2.com/index.php/modulesdescription1
VW PASSWORD

The password for VW vehicles can be obtained in several ways,

as described below:

Polo classic, golf and van VW: the password can be obtained by
reading the memory built into the MOTOROLA processor
MC68HC05B16 PLCC52 . requires a special programmer dedicated
to this processor.

Read internal processor memory via socket.

Goal family, Fox, Santana, sloop and etc: in this family
until the year 2007 the password can be found in memory
93c56 of the immobilizer ecu. It can be read through the
universal programmer or directly through serial
programmers such as vag tacho 2.5. in vehicles of this
family after 2008 the password can be obtained from the
injection ecu or instrument panel.

Ecu Audi golf megamos, memory 93c46

Password reading via soic forceps.

Ecu IAW 4GV, from gol g5, the password is in memory
95320 as shown in figure31.

Figure 31

Golf v, polo, bora, Passat: with German technology, which uses

the immobilizer module incorporated into the instrument panel,
these vehicles have a variety of systems, only golf (golf5, in
Brazil, golf has two versions, but this model in Europe is already
in the fifth version), has 16 panel versions, most of them and it is
possible to obtain the password in memories 24c02, 93c66 or
93c86 from the instrument panel, with the vag tacho 2.5 serial
programmer.
 Golf panel.

24c02 memory location.

Reprogramming with the soic forceps.

Screen of the TACHO 2.5 program.

we can also obtain the password quickly and conveniently,

as it eliminates the need to remove and disassemble the
panel.
GM PASSWORD

In GM vehicles, the password can be found in the

memories of the injection ecus, immobilizer ecus, and and
some cases in the instrument panels and body control
ecus. The Gm immobilizer system has two versions, called
opel 1 and opel2, and we found an evolution of opel 2,
opel2r.

In opel1 systems we can read the password via the

memory built into the Motorola zc 430 754 processor
(fig32)

Figure 32
 Figure 33

In figure 33, we can see the socket used to surround the processor for
reading.
In the opel 2 system the password is located in the internal
memory of the tms 370 processor, which can be read
through the programmer specific to this processor.

The opel2r system has the password located in the

Motorola processor's built-in memory (fig34).

Label of the immobilizer ecu, where the system version can be identified.

View of the ecu without the housing and antenna.

Figure 34

FORD PASSWORD

Ford vehicles do not use a password and do not have

an emergency start feature.

CHANGE ELECTRONIC INJECTION DO MODULE

We are constantly faced with the need to exchange an

ecu, there are many cases where we need to test an ecu
in good condition in a vehicle with suspected defects in
the injection module. the exchange of the injection ecu
will depend on its internal memory where the immobilizer
information is contained.

In cases of ecus with memory built into the processor, as

in the case of units with a st10fxx processor, just
transferring the entire contents of the main memory to
the ecu that will be installed is sufficient.

In cases like the corsa 98 multec system, the necessary

programming will be only of the isolated block where the
immobilizer data is, which are of a few bytes, only 256
bytes inside the Motorola MC68HC11 processor (fig35).

Figure 35

The vast majority of ecus uses auxiliary memory for storing

immobilizer data, usually memories of small storage capacity and
small size.

We can then remove this memory and exchange it with

 the part we are going to use, thus facilitating the
exchange of the ecu.

We can also change the memory programming using the

universal programmer.
Some examples:

Ecu hsfi delfhi, Fiat and Gm

Soic memory location on the HSFI ecu.

Ecu family Fiat IAW49FB

Bosch ecu marea system M 2.10.4 (fig36)

Figure 36
Ecu Ford system ECC V PATS 2 memory 25020 (fig37)

Figure 37

Ecu VWM 7.5.10 memory 95040

COMMON DEFECTS IN THE IMMOBILIZING SYSTEM

Like any electronic system, the starting immobilizer is

also susceptible to failures, the most common of
which are:

TRANSPONDER FAILURE

The most common failure occurs with the transponder, as

it is a small component, suffers many with the impact of
the keys where they are housed. recorded in the fault
memory of the immobilizer ecu in case of failure. we can
also subject the transponder to a test on specific
transponder identification devices, and if this device does
not detect the transponder, its failure is attested,
otherwise, the failure it may be on the antenna or on the
immobilizer ecu.
ANTENNA FAILURE

The system's antenna is also the cause of many breakdowns,

because if the magnetic field does not reach the transponder, it
cannot be read. In practice, the antenna works like a coil, so if its
winding goes into a short circuit or open circuit, it cannot work.
Figure 38 shows the test of the antenna with the multimeter.

The measured value should be around 10 OHMS.

Figure 38
ELECTRIC CIRCUITS FAIL

It is very common to fail in the electrical wiring of the ecus,

as many are installed in places unprotected from moisture.
This humidity causes oxidation of the ecus connectors,
leading toWiring interruptions for various reasons, such as
installation of accessories, can cause serious damage.
 IMMOBILIZER ECU FAILED

It is also common to detect flaws in the immobilizer ecus,

in these cases and a little more careful diagnosis is
required.

The first step is to measure with the aid of the

electrical scheme of the system, multimeter or low
electric current test lamp the polarization (power supply)
of the ecu.

Having verified the correct polarization,

and its electrical circuit, we will start to
exchange the ecu.

WARNING

DO NOT USE HIGH ELECTRIC POWER

TEST LAMPS BECAUSE THIS TYPE OF
TEST MAY INSERT AN ELECTRIC
CURRENT TO OTHER CIRCUITS
CONNECTED TO THE IMMOBILIZER
ECU, CAUSING POSSIBLE OVERLOAD.

PREFERENCE TEST PENS THAT USE LEDS.

THIS NOTICE IS FOR TESTING ALSO FROM
OTHER ECU.

CONCLUSION

We then conclude the of our training, we hope that this manual will
be of great value to those who are interested in it.