dme, alarm module, key swap

[steve tam]

I have a 2000 986s with manual transmission. A heavy rainstorm let the water getting into the alarm module under the driver seat. Flatbed it to home, alarm fired off 3 am in the morning, I have to pull off the fuses in the fuse box to stop the alarm. The other day, I took out the seat, removed the levers to open the trunk and killed the battery, then took off the alarm module. The small fuse in the alarm module is blown. I opened the box, it is not in a good shape, there are mold and rust on the circuit board, it seems to have moisture and water in there for some time before it is completely gone. Anyway, I dried it thoroughly, replaced the fuse, and hooked it up again. It doesn't work, the durametric cannot even detect the alarm module.

 

I read other posts, the DME, alarm module, and the key have to match. So, what I was hoping is to swap with a used set of DME, alarm module, and key. I got a set from the same year 986s manual transmission. I cannot guarantee they are a matched set, but I have no reason to doubt it otherwise. I swapped the DME and the alarm module in, and keyed in the radio code. I can now use the key remote to lock the doors and trunks, the radio works, the gauge cluster turns on. The durametric shows no error code in the alarm module, but there is a error code--39 immobilizer in the DME, I cleared it by the durametric. The car still won't start, no crank at all. I checked that the "pill" from the donor car is in the key. Any idea is very appreciated. 

 

I have couple more questions.

1. Does the gauge cluster need to match the DME, too? Now the VIN in the gauge is not the same as that in the DME, would this be a problem?

2. Can I keep the old ignition cylinder, and just swap the key blade? Particularly, does the box (transducer??) on the ignition cylinder need to be swapped, too?

 

Thank you!

[JFP in PA]

 

I have a 2000 986s with manual transmission. A heavy rainstorm let the water getting into the alarm module under the driver seat. Flatbed it to home, alarm fired off 3 am in the morning, I have to pull off the fuses in the fuse box to stop the alarm. The other day, I took out the seat, removed the levers to open the trunk and killed the battery, then took off the alarm module. The small fuse in the alarm module is blown. I opened the box, it is not in a good shape, there are mold and rust on the circuit board, it seems to have moisture and water in there for some time before it is completely gone. Anyway, I dried it thoroughly, replaced the fuse, and hooked it up again. It doesn't work, the durametric cannot even detect the alarm module.

 

I read other posts, the DME, alarm module, and the key have to match. So, what I was hoping is to swap with a used set of DME, alarm module, and key. I got a set from the same year 986s manual transmission. I cannot guarantee they are a matched set, but I have no reason to doubt it otherwise. I swapped the DME and the alarm module in, and keyed in the radio code. I can now use the key remote to lock the doors and trunks, the radio works, the gauge cluster turns on. The durametric shows no error code in the alarm module, but there is a error code--39 immobilizer in the DME, I cleared it by the durametric. The car still won't start, no crank at all. I checked that the "pill" from the donor car is in the key. Any idea is very appreciated. 

 

I have couple more questions.

1. Does the gauge cluster need to match the DME, too? Now the VIN in the gauge is not the same as that in the DME, would this be a problem?

2. Can I keep the old ignition cylinder, and just swap the key blade? Particularly, does the box (transducer??) on the ignition cylinder need to be swapped, too?

 

Thank you!

 

 

I think you have kind of gone over center trying to fix this.  If the immobilizer was cooked, that was all that needed to be replaced, but to do that the car needs to be coded to match by either a PST II or PIWIS system.  Trying to replace everything, and particularly not knowing if they are even a matched set, is only compounding the potential issues.

[Ahsai]

Did you transfer the transponder pill to the old key and put the old key in the ignition to crank the car?

My take to your questions:

1) I'm not sure but I don't think so.

2) Yes, you should be able to. Usually people just transfer the pill to the old key fob and use the old key. The ignition cylinder has a coil that reads the security credential of the pill. The coil itself is just an electronic reader so there's no need to swap it.

 

The key fob that has the correct pill needs to make contact with the ignition cylinder for the coil to read the pill.

Edited July 14, 2015 by Ahsai

[Qmulus]

I am a little late to this, but it is possible to transfer the data from the old damaged alarm module to another used or new alarm module.  BTDT with mine.  When I got my car the alarm module had been severely water damaged.  I found a used alarm module of the same part number, and transferred the data from the damaged alarm module to the used one.  The nice thing was that the module was cheap as the seller did not have matching keys or ECU. 

[JFP in PA]

I am a little late to this, but it is possible to transfer the data from the old damaged alarm module to another used or new alarm module.  BTDT with mine.  When I got my car the alarm module had been severely water damaged.  I found a used alarm module of the same part number, and transferred the data from the damaged alarm module to the used one.  The nice thing was that the module was cheap as the seller did not have matching keys or ECU. 

 

That is going possible only if the old module can be "read" by a PIWIS system, or you have all of the correct key codes for programing.  Quite often, the old module is stone dead and won't read, and the key codes a long gone.

[Qmulus]

Not true, my module was pretty much trash.  The module had been sitting wet for weeks, then a new battery was installed by the previous owner backwards which did more damage.  

 

I didn't use the factory tools to read the information.  I got it directly out of the ICs on the board, which, in my experience, rarely get damaged.  I did not need the programming codes.  In fact, I didn't even connect diagnostics to the car for a couple weeks after I got it running.  I just got the programming codes for my car a couple of weeks ago.

 

I will say that this is what I do.  I have been designing, building and repairing automotive electronics for over 20 years.  Porsches are/were a bit new to me before I got the Boxster, but I have since done quite a bit of Porsche work, including 996/986 instrument clusters, ABS modules, climate controls and of course alarm modules.  I find Porsches quite easy to work on comparatively.

Edited July 24, 2015 by Qmulus

[JFP in PA]

Interesting.  As most people would not think of that approach, can you post more information on how you extracted the information, or did you swap chips?

[Qmulus]

Interesting.  As most people would not think of that approach, can you post more information on how you extracted the information, or did you swap chips?

Well, no offense, but I consider that proprietary information that took me a bit to figure out. This is how I pay my bills, so I don't tend to give out that information so others can profit from it.   I can say that I have done it twice now, on my car and a 996 Cabriolet that got wet.   A used module and an hour of my labor is a lot less expensive than a new module, programming and possibly keys from a dealer.

[mikefocke]

And if everyone who ever figured something out took the same attitude, just think where we'd be.

 

I'm impressed by those who share.

[Qmulus]

And if everyone who ever figured something out took the same attitude, just think where we'd be.

 

I'm impressed by those who share.

 

Yes, it is nice when people can afford to share all their knowledge.  Someone may even share this information.

 

You could also look at from the point of view that if I didn't charge for my services, but just shared everything I learned with the world, then I wouldn't be able to afford to buy the education and thousands of dollars of equipment that I have that has allowed me to do what I do.  Catch 22.   If I was somehow magically wealthy I could share LOTS of trade secrets. 

 

In the past I have shared more than I do now.  I have also been burned more than once by people that took knowledge that _I_ gave them and used it for their own personal gain or just so they could be a youtube hero.  There are a lot of people these days with what I call a "Google Mentality" in that all knowledge should be free and shared and are offended if you don't answer all their questions or tell them what I consider trade secrets that come from knowledge, hard work and experience.  I did that once and the guy made a video of himself doing the repair and posted it on youtube.  It took me months to find the exact cause and extent of a certain failure, perfect a process to do the repair and make it so it couldn't happen again.  All that was lost, costing me (and my family) a lot of potential income.  I don't do that anymore.  I have also had an automotive diagnostic product I designed get knocked off by a couple of Chinese companies (maybe more) who still sell it, and definitely made more money off of it than I will, as I spent the years on development.  Yes, I am a bit bitter.

 

Sorry for the rant...

Edited July 28, 2015 by Qmulus

[The1Rebl]

I had the same water damage problem with my 99 Boxster. I bought a used immobilizer, ECU, ignition with key, and drivers side door lock as a matching set and when I installed everything car still would not crank or anything. I basically wasted $400. I had read somewhere that removing the circuit board from the immobilizer and dipping it in 91% rubbing alcohol would sometimes work. I removed my circuit board and filled a Tupperware container that was large enough to accomadate the board with about 1 inch of alcohol and used a toothbrush to clean off all the mold and all the other gunk left behind by the water damage and left it overnight to dry. The next day I put the board back in its casing and installed the immobilizer, original ECU, and ignition and to my surprise the car started right up with the only issue is that the passenger side door still does not lock. This is after weeks of trying everything else and having a totally dead immobilizer. I did this only with the notion that it wouldn't hurt to try never thinking for a second that it would actually work. For anyone else who has an immobilizer with water damage I suggest giving it a try as it will only cost you less than $2 for the rubbing alcohol and there is always an extra toothbrush around the house somewhere. Good luck and I hope it works for you should you try it.

[Qmulus]

I had the same water damage problem with my 99 Boxster. I bought a used immobilizer, ECU, ignition with key, and drivers side door lock as a matching set and when I installed everything car still would not crank or anything. I basically wasted $400. I had read somewhere that removing the circuit board from the immobilizer and dipping it in 91% rubbing alcohol would sometimes work. I removed my circuit board and filled a Tupperware container that was large enough to accomadate the board with about 1 inch of alcohol and used a toothbrush to clean off all the mold and all the other gunk left behind by the water damage and left it overnight to dry. The next day I put the board back in its casing and installed the immobilizer, original ECU, and ignition and to my surprise the car started right up with the only issue is that the passenger side door still does not lock. This is after weeks of trying everything else and having a totally dead immobilizer. I did this only with the notion that it wouldn't hurt to try never thinking for a second that it would actually work. For anyone else who has an immobilizer with water damage I suggest giving it a try as it will only cost you less than $2 for the rubbing alcohol and there is always an extra toothbrush around the house somewhere. Good luck and I hope it works for you should you try it.

 

You can actually use hot water and a good cleaner/degreaser with a toothbrush to clean the boards.  I do it all the time.  Chances are these boards were cleaned with water after assembly, and _most_ components are designed to be cleaned.  The exception is some electrolytic capacitors and non-sealed electro-mechanical devices like relays.  Don't be afraid to scrub fairly aggressively and just be careful to make sure that it is thoroughly dry before you apply power again.  The key is to get all of the metal salt deposits and mold off, as that is what is conductive and will cause erratic behavior as it will cause shorts between adjacent components.  I recently bought a large-ish ultrasonic cleaner that does a really good job of getting off deposits that can't be removed with a brush.

 

If the module was left wet with power applied for a very long period of time, electrolysis will eventually eat away the power and or ground pins until they are totally corroded away and the electrolysis finally stops.  Even this damage can often be repaired, but it can be difficult to find and repair all the damage.  My original immobilizer/alarm module fell into this category as the previous owner had left it sit for months with a wet module.  When I opened it I couldn't even make out the components because of the mold and corrosion.  After a thorough cleaning I found that too many of the ICs had corroded power pins and the circuit board itself had a significant corrosion damage, so while I probably could have gotten it working, it wasn't worth the time compared to just getting a used one and swapping over the data

 

I believe that the "lock" signal from the alarm module goes to both doors from the same wire.  If you have access to a PST2 check to see what faults are in the module and what it shows to be the status of the door locks, etc..  I am not sure if Durametric will give real time status data from the alarm module.  From there you can determine what signals are not correct and maybe where the fault may be. .

[Canada-Eh]

Having just swapped the immobilizer, ECU/DME and key fob on my 1999 986 here is some useful info:

- Ignition lock mechanism can be out of steeling column and it will still start, assuming you have the ignition switch and immobilizer/transformer wires still connected

- Cluster gauge can be out and it will still start

- Cluster does NOT need to match ECU/DME.  In fact, car mileage appears to be stored IN the cluster so swapped ECU does not affect shown miles/kms.  

- Seats can be out of car and it will still start but you will get an airbag light that you will have to clear later (it does not self-clear)

- Make sure to transfer the key blade from your old key fob to the new one.  I tried holding up the new key fob directly in front of the ignition ring and use my old key but the immobilizer gets confused / read the wrong pill and it wouldn't start.  

- After you reconnect your battery there are some re-training procedures (window stops, etc.) that the service manual outlines.  

 

Best

 

[Canada-Eh]

Car still won't start?  Here is my untested theory on how to bypass the immobilizer "kill" function.  

 

UNTESTED THEORY:  I have NOT tested this and your car may catch fire, blow up, fry itself, and/or generally be unhappy.  I suspect however, it will work and am happy for your feedback, so we can finally have a workable solution for a car that is 20+ years old and often sub-$5K.  I’m not worried this solution would lead to stolen cars because it will take a long time to access all these parts and for whatever reason, thieves who know of a quicker way (sub 5 minutes) have not posted how they are doing it – that would be nice to know by the way!   

 

Theory:  The lack of a valid RFID signal from key results in an 86S fault (i.e., no power is supplied to 86S, fault code 25), which is why a suggested fix is to check fuse E1 (fifth row down from the top - first fuse on the left (7.5A)).   Bridging 30 and 86S at the ignition switch stage provides power to 86S, which is pin 16 [Terminal 15] on the immobilizer.  You also need power on pin 36 at the immobilizer, which I believe happens if you have a valid RFID.  Thus, you will need to bridge 16 and 36 on the immobilizer.  I’m not sure what the ECU does with the signal from the immobilizer but you can force your ECU to power up by bridging it at the relay and best to bridge the start lock relay as well.   Your car “should” start now. 

 

STEP 1: IGNITION SWITCH

Bridge wires/pins 30 and 86 S  [when I say bridge, I mean keep the wires connected to the switch but splice in some wire that will connect 30 and 86S so that 30 will power 86S) 

STEP 2: IMMOBIZLIER

Bridge wires/pins 16 - Terminal 86 S [Orange Wire] and 36 - Terminal 15 [Black/Brown Wire]

STEP 3: DME/ECU RELAY IN REAR TRUNK

Pull out relay and bridge wires/pins 30, 87 and 87B

Do NOT leave this in place, as the fuel pump will continue to run and the DME will continue to draw power. 

STEP 4:  START LOCK RELAY IN REAR TRUNK

Pull out relay and bridge wires/pins 30 and 87

STEP 5:  OPTIONAL:  CLUTCH SAFETY SWITCH (not needed but easier to test if you don’t need to push in clutch all the time; and switch often fails and car won’t start]

Pull both connectors out of switch and connect the wires to each other so your car will now start without the need of pushing in the clutch. 

 

986 IMMOBOLIZER PINS MAP

 (see attached image below)  

Plug I [Blue connector]

Terminal: - Antenna

3 - Immobilizer data

4 - Immobilizer control

5 - Driver's door secured

6 - Convertible top closed

7 - Driver's door closed

8 - Passenger compartment monitoring on

9 - Convertible top compartment lid

10 - Central locking button open

11 - External input 1

13 - Luggage compartment lid, rear

14 - External input 2

15 - Deactivation

16 - Terminal 86 S (buzzer contact) [Orange Wire]

17 - Luggage compartment light, rear

18 - Power window control

22 - Antenna (shield)

24 - Passenger compartment monitoring, signal input

25 - Driver's door closed

26 - Oddments tray

27 - Radio contact

28 - Passenger's door secured

29 - Central locking button closed

30 - Driver's door locked

31 - Luggage compartment lid, front

32 - Passenger's door locked

33 - Input, crash sensor

34 - Release, luggage compartment lid, rear

35 - Priming

36 - Terminal 15 [Black/Brown Wire]

37 - Luggage compartment light, front

39 - Alarm readiness light

40 - Comfort, opening

41 - Indicator, door locked

42 - Comfort, closing

 

Plug II

Terminal:

1 - Terminal 31

2 - Positive, alarm horn

3 - Servo motor, central locking system

4 - Load disconnection

5 - Actuator, tank cap

6 - Direction indicator light, left

7 - Terminal 30 input

8 - Terminal 30 output

9 - Servo motor, central locking system 10 - Actuator, tank cap

11- Interior light

12 - Direction indicator light, right

 

Edited January 9, 2018 by Canada-Eh
Inserted photos

[Ahsai]

I think the immobilizer will be a joke if your theory works. There's a "W" lead single wire communication between the immobilizer and the DME. I suspect the DME relies on some higher layer protocol exchange with the immobilizer, and not by getting power on some pins (which could  easily be defeated like you proposed).

[JFP in PA]

1 hour ago, Ahsai said:

I think the immobilizer will be a joke if your theory works. There's a "W" lead single wire communication between the immobilizer and the DME. I suspect the DME relies on some higher layer protocol exchange with the immobilizer, and not by getting power on some pins (which could  easily be defeated like you proposed).

 

Duncan is correct. As I understand it, the DME and immobilizer box have to both "handshake" (acknowledge each other) and then communicate certain data in order for the car to start; it takes a lot more than just some electrical current to make it happen, otherwise there would be a lot of missing Porsches............

[Canada-Eh]

3 hours ago, JFP in PA said:

 

Duncan is correct. As I understand it, the DME and immobilizer box have to both "handshake" (acknowledge each other) and then communicate certain data in order for the car to start; it takes a lot more than just some electrical current to make it happen, otherwise there would be a lot of missing Porsches............

 

It is interesting to note that my current 986 was previously stolen and recovered.  Porsche's are stolen quite frequently, that's the problem.  Not sure how they do it but their ingenuity and experience is impressive; can't deny that.  

[Ahsai]

There are professional tools (e.g., transponder emulator) that can hack the system but I'm pretty sure if involves customized s/w and h/w, and not just supplying power to a few pins. This paper was published 5 yrs ago https://www.cs.bham.ac.uk/~garciaf/publications/Dismantling_Megamos_Crypto.pdf It talks about how the security flaws and how one can hack the system (academic presentation, not a DIY blueprint).

[Canada-Eh]

1 hour ago, Ahsai said:

There are professional tools (e.g., transponder emulator) that can hack the system but I'm pretty sure if involves customized s/w and h/w, and not just supplying power to a few pins. This paper was published 5 yrs ago https://www.cs.bham.ac.uk/~garciaf/publications/Dismantling_Megamos_Crypto.pdf It talks about how the security flaws and how one can hack the system (academic presentation, not a DIY blueprint).

 

Looks like you are right: 

 

Relay Theft in Seconds with No Key: 

http://www.telegraph.co.uk/news/2017/11/27/mercedes-car-stolen-without-using-key-seconds-relay-theft/amp/

 

New Porsche Press Release on Theft (Nov 2017) and Solution: 

Innovative anti-theft protection now also available for Porsche Classic vehicles: https://www.porsche.com/usa/aboutporsche/pressreleases/pag/?pool=international-de&id=463315

 

Lol, not sure why the text is so large. 

[Ahsai]

Yes, the first link is a well known attack. I think some even suggested wrapping the key fob with tin foil when not in use sitting at home.

 

However, that attack only works on key fobs with the keyless entry feature, which our 996 don't have. The keyless entry feature lets you just carry the key fob in your pocket. Once you get to the proximity of the car, the car doors just unlocks automatically without you doing anything. The relay attack basically amplifies the wireless signals from the key fob to trick the car thinking the key fob is close by while it's really far away in the bedroom drawer.

Edited January 10, 2018 by Ahsai