How to clone a black remote fob ....

[ferraridriver]

I have everything, one red, two blacks, PIN tags, but one of the black remotes went through the wash. The LED lights, no corrosion on the board, but no response from the car. I followed the instructions in the manual, but without success.

Do you think my one dead black remote can be saved/reporgramed?

[GCalo]

Originally Posted by nt6d

Greg, I was out of town this week and just got back.
This is a very interesting thread as I am also one of those people who have only one black FOB.

I do not know much about the ‘Rolling Code’ skim, as my specialty is in RF, analog and some digital hardware design.
However, what Yin brought up makes a lot of sense since the rolling code stops one from spoofing the over the air transmitted code by changing the counter. My understanding of Keeloq is that the transmitted code changes every time by XORing remote’s unique SN and counter with a pseudo random number which is known by both the remote and alarm unit. If a thief spoofs and sends the same code, the alarm will reject the spoofed code.

The interesting thing here is that we are cloning not spoofing the system. Cloning actually clones the original remote’s unique SN and the counter, which can be used to generate genuine valid code to the alarm unit.
The question is – as Yin brought up – what would happen if the original remote is used after the cloned remote has been used for awhile (the counter has been advanced).
I am guessing that the alarm will do either 1) rejects so the old remote is no longer usable, or 2) rejects the code but allows the system to re-sync so can be used again once re-synchronization is completed.

One can do a quick test to confirm this without cloning any remote.
Take a known working remote and move away far enough so that the alarm can no longer listen to the remote.
Advance the counter by pressing the FOB button (say 100, 200 or 500 times) so the counter is completely out of the window of sequence (I think the Keeloq system has a window of counter it looks for).
Bring the FOB back within the range and try if the system works.
If the counter has been advanced enough, the system should not work at the first try.
Re-synchronize the system by pressing the FOB button for a few seconds and try if the alarm unit response. If it works we know we can clone and use both remotes safely. Otherwise you will have to look for your RED remote to relearn your alarm system.


Maybe we should wait to see if Eric has already done some research and anything to report back since he already has cloned remotes.

I think Porsche 993 uses the same system from Bosch (http://cgi.ebay.com/ebaymotors/PORSC...spagenameZWD1V) since they both have the same FCCID number. One might be able to get the fob made for Porsche at possible lower cost(?).

Chris,

Thanks for adding in here. I am in La Jolla, and I forgot to check this thread.

I'll go through it and when I get back I'll examine what you offered. I am waiting for TonyC to get back next week as well, and then we'll examine the software side of this.

Once we read the code we may have a few answers. I think we may try to read the master eeprom as well as there may be clues here.

I still believe the system is able to decipher the pulses from all the remotes, but that's my speculation at this point.

Ferraridriver,

I think you can consider that washed fob as toast at this point!

[Argento360]

Hi All,

Having read through all the explanations about disassembling and reprogramming one black remote from another and personally not being electronically inclined, I'm wondering if there's anyone who might be willing to do this for other ferrarichat members?

I too have one black remote and currently no PIN code (although I plan to get this myself from Ferrari at some point). I'm thinking of maybe contacting Bruce at Security Unlimited who cut my gray Enzo key (awesome key, great locksmith) since he's a f-car enthusiast and locksmiths are likely to have some experience with PIN codes and remotes.

I think the last post to this thread was on 12/26. Just wondering if anyone's learned anything more about this, tried it, etc. since then. I'm concerned about having only one remote, but even more concerned that it could cost $1500 or more to have to order all new remotes and have the dealer do the work.

Any success stories out there?

Thx,

JTW

[GCalo]

Originally Posted by jwinslow

Hi All,

Having read through all the explanations about disassembling and reprogramming one black remote from another and personally not being electronically inclined, I'm wondering if there's anyone who might be willing to do this for other ferrarichat members?

I too have one black remote and currently no PIN code (although I plan to get this myself from Ferrari at some point). I'm thinking of maybe contacting Bruce at Security Unlimited who cut my gray Enzo key (awesome key, great locksmith) since he's a f-car enthusiast and locksmiths are likely to have some experience with PIN codes and remotes.

I think the last post to this thread was on 12/26. Just wondering if anyone's learned anything more about this, tried it, etc. since then. I'm concerned about having only one remote, but even more concerned that it could cost $1500 or more to have to order all new remotes and have the dealer do the work.

Any success stories out there?

Thx,

JTW

Stand by, because we are working on perfecting this process. It has atkena while to get the equipment and to refine the read and write process.

It looks like we will be able to do it.

Stay tuned.

[Argento360]

Thanks Greg, that sounds really encouraging. I just bought a used, black remote on e-bay (not sure if I was bidding against any f-chat members), so I'm hoping this solution will work. I'll keep an eye on this thread.

Thx,

JTW

[GCalo]

Originally Posted by jwinslow

Thanks Greg, that sounds really encouraging. I just bought a used, black remote on e-bay (not sure if I was bidding against any f-chat members), so I'm hoping this solution will work. I'll keep an eye on this thread.

Thx,

JTW

Yes you were, and yes we can use that remote to reprogram.

[Argento360]

Greg,

Oh no, was that you (dynam_tech_group)? If so, sorry about that. I guess I wanted it exactly $1 more than you did. But I guess great minds (or Ferrari owners with only one remote left) think alike!

Is there another source for black remotes other than random used ones and Ferrari dealers who sell them (I think) only in sets?

Thx,

JTW

[GCalo]

Originally Posted by jwinslow

Greg,

Oh no, was that you (dynam_tech_group)? If so, sorry about that. I guess I wanted it exactly $1 more than you did. But I guess great minds (or Ferrari owners with only one remote left) think alike!

Is there another source for black remotes other than random used ones and Ferrari dealers who sell them (I think) only in sets?

Thx,

JTW

No problem. At least we know it's going to a good cause!

I will have more coming from Italy very soon.

[eric355]

Originally Posted by jwinslow

Hi All,

Having read through all the explanations about disassembling and reprogramming one black remote from another and personally not being electronically inclined, I'm wondering if there's anyone who might be willing to do this for other ferrarichat members?

I too have one black remote and currently no PIN code (although I plan to get this myself from Ferrari at some point). I'm thinking of maybe contacting Bruce at Security Unlimited who cut my gray Enzo key (awesome key, great locksmith) since he's a f-car enthusiast and locksmiths are likely to have some experience with PIN codes and remotes.

I think the last post to this thread was on 12/26. Just wondering if anyone's learned anything more about this, tried it, etc. since then. I'm concerned about having only one remote, but even more concerned that it could cost $1500 or more to have to order all new remotes and have the dealer do the work.

Any success stories out there?

Thx,

JTW

As the originator of this process I can do it for you if you want ... PM me!
I can confirm that it still works after several months ... just had to press the non used remotes SEVERAL times (btw same number as the prime) to reach synchronisation with the car.
I saw one black remote on ebay recently. I think it was from UK. Where are you? Have you checked that it uses the same radio-frequency than yours (eg 433MHz for Germany/France, 315 MHz for US, probably 433 MHz for UK but not sure I have not tested one)? If it is not the same frequency it will not works without other modification of the remote.

[Argento360]

Thanks Eric, I don't currently have a PIN code so I'll have to wait, plus I'd like to see confirmation from GCALO to see if this is easily replicable. Also not quite sure if I want to risk mailing my only two remotes to France! LOL!

We'll see what the guys from Northern California can do....

JTW

P.S. I am in Southern California

[GCalo]

Originally Posted by jwinslow

Thanks Eric, I don't currently have a PIN code so I'll have to wait, plus I'd like to see confirmation from GCALO to see if this is easily replicable. Also not quite sure if I want to risk mailing my only two remotes to France! LOL!

We'll see what the guys from Northern California can do....

JTW

P.S. I am in Southern California

We are getting closer.

We are trying to both read and to rewrite the info to the eeprom w/o having to remove it from the board. The leads are sooooo small and damage is so likely, it would be better to read and to rewrite while the eeprom remains on the board.

Almost there. Don't give up.

I agree seneding two fobs to Europe is a big risk but that was a nice gesture on Eric's part.

[GCalo]

Originally Posted by jwinslow

Thanks Eric, I don't currently have a PIN code so I'll have to wait, plus I'd like to see confirmation from GCALO to see if this is easily replicable. Also not quite sure if I want to risk mailing my only two remotes to France! LOL!

We'll see what the guys from Northern California can do....

JTW

P.S. I am in Southern California

We are getting closer.

We are trying to both read and to rewrite the info to the eeprom w/o having to remove it from the board. The leads are sooooo small and damage is so likely, it would be better to read and to rewrite while the eeprom remains on the board.

Almost there. Don't give up.

I agree sending two fobs to Europe is a big risk but that was a very nice gesture on Eric's part.

[garybryan]

hey guys. well i'm another one that bought a car with only one remote. but i was crazy enough to buy the full set from ferrari. i really don't wish to clone,
but would like to program the new ones myself. the procedures with the pin code & key cycles don't seem to work. after many attempts i'm left frustrated. any help on this would be great

[Rifledriver]

Originally Posted by garybryan

hey guys. well i'm another one that bought a car with only one remote. but i was crazy enough to buy the full set from ferrari. i really don't wish to clone,
but would like to program the new ones myself. the procedures with the pin code & key cycles don't seem to work. after many attempts i'm left frustrated. any help on this would be great

Describe in exact detail how you are doing it and I will tell you where you are going wrong. I have done it a hundred times.

[Argento360]

Just FYI, another black remote just sold on ebay:

http://cgi.ebay.com/ebaymotors/ws/eB...m=290092553666

This time it wasn't me (although I tried!).

JTW

[garybryan]

to rifledriver, thanks for the reply. i have 3 new remotes including a red one. been using the directions from the 360 repair manual. enter the pin wait 2-20, then turn key on-off 10 times, on the 10th on wait till the led turns off & turn the key back to off. turn the key back on for the 11th time: the led will start flashing, then press the button on the red master remote. eric355 had a slight variation on this in a earlier thread. tried this as well. that one was on the 10th key cycle. any help will be greatly appreciated

[Rifledriver]

Originally Posted by garybryan

to rifledriver, thanks for the reply. i have 3 new remotes including a red one. been using the directions from the 360 repair manual. enter the pin wait 2-20, then turn key on-off 10 times, on the 10th on wait till the led turns off & turn the key back to off. turn the key back on for the 11th time: the led will start flashing, then press the button on the red master remote. eric355 had a slight variation on this in a earlier thread. tried this as well. that one was on the 10th key cycle. any help will be greatly appreciated

The specifics are very important and you have not given me those. Also the procedure as written is not totall correct. If you get specific I can help.

[Kent A]

I have the same problem - only one black remote for my 2001 456 and I do have the PIN code. Ferrari of Houston quoted me $400 for the set of three remotes (1 red, 2 blacks) but I am concerned about programming them. What is the procedure?

My other option is to buy another black one off of e-bay like someone else did but then that remote has to be programmed. If GCalo can come up with a method that would be great.

Which way should I go?

p.s. I bought the car in December from Ferrari of Silicon Valley and they are no help!!!! They claim the previous owner didn't give them the remotes and the previous owner claims he did.

[GCalo]

We can do it, but we are trying to refine the process a bit to make it easier.

Stay tuned. We are only a few days +/- away from full success.

[gareeb]

Originally Posted by garybryan

to rifledriver, thanks for the reply. i have 3 new remotes including a red one. been using the directions from the 360 repair manual. enter the pin wait 2-20, then turn key on-off 10 times, on the 10th on wait till the led turns off & turn the key back to off. turn the key back on for the 11th time: the led will start flashing, then press the button on the red master remote. eric355 had a slight variation on this in a earlier thread. tried this as well. that one was on the 10th key cycle. any help will be greatly appreciated

I bought a set a from the dealer after my only remote died.

When you are making the additional 10 key turns to on make sure that you wait for the LED to turn off with each key turn to on before you switch the ignition to off.
It took me about 4 times before I got it exactly right.