pcmhacking.net

So I have a bit of a story here, and curiosity is eating at me, so I was wondering if you anyone had any insights on the following.

I had one of my cars stolen (VZ model). The alarm beeped for maybe 2-3 seconds and then stopped, with the engine immediately starting up after that, and the car was driven off.

It was found the next day. Completely intact luckily for me!!! But what got me confused was they did not break anything on the car. Nothing was removed, barrel was completely intact. The car started up fine and my remotes worked as per usual.

So i've come to a couple conclusions:

They were not able to turn the immobilizer/alarm off from outside the car, as I believe they set the alarm off when they opened the door. But once inside how were they able to turn it off so quickly (2-3 seconds within alarm going off)

Is there a common way to bypass the alarm/immobolizer on these cars? You don't have to tell me how it is done, but I am more curious if there is a simple way?

In regards to the turning of the door and ignition barrels, I figure it is easy for someone who does these things to maybe get a key cut from the VIN on the windscreen. They just have to know someone in Holden. Or some tool. This part of it doesn't really concern me.

It is more so the immobolizer/alarm side of things.

Any help is much appreciated.

If you open the door with your key after locking it with the remote you will set the alarm off.
As soon as you put your key in ignition and turn it the alarm will go off as it recognises the key.
I would take a guess they have a key that has been copied and synced with the car, could possibly do this off the vehicle VIN with the right contacts.

It would be possible to connect over ALDL, silence the existing BCM, then re-link the PCM (PIM in this case) to a dummy device, and then send an "ok to start" message acting as the BCM. Then the engine would start fine (This is kind of how my BCM simulator works)

However:
- It would take more than 2-3 seconds to even find the diagnostic port,
- They would still have to butcher the barrel to physically turn the ignition on (unless they have a physical key cut)
- The car wouldn't start with your keys afterwards (because the PIM would no longer be linked to the BCM in the car)

yoda69 wrote:If you open the door with your key after locking it with the remote you will set the alarm off.
As soon as you put your key in ignition and turn it the alarm will go off as it recognises the key.
I would take a guess they have a key that has been copied and synced with the car, could possibly do this off the vehicle VIN with the right contacts.

This is the confusing part!! If they had a copied and synced key as you say, then they could have opened the door with the remote, thus not setting the alarm off. But who ever did it, had to get in physically with the door lock barrel, set off the alarm. But once inside was able to switch the alarm off within seconds

pman92 wrote:It would be possible to connect over ALDL, silence the existing BCM, then re-link the PCM (PIM in this case) to a dummy device, and then send an "ok to start" message acting as the BCM. Then the engine would start fine (This is kind of how my BCM simulator works)

However:
- It would take more than 2-3 seconds to even find the diagnostic port,
- They would still have to butcher the barrel to physically turn the ignition on (unless they have a physical key cut)
- The car wouldn't start with your keys afterwards (because the PIM would no longer be linked to the BCM in the car)

Yep. That's why I figure it wasn't done this way. Someone had to get in via the door lock barrel, thus set off the alarm.
They must have a device that either attaches to the OBD port and shuts the BCM down in seconds, or they attach something to the slip ring, and fool the BCM into thinking the correct key is present.

Keys have a rolling code, sometimes it can loose synch with the BCM and not work, to resynch you need to put key in the ignition. When you get a key cloned at mister minute or similar this is why they want you start car with new key. Not sure how far back history for the rolling code goes so with cloned keys it’s possible to get out of synch.
To me it sounds like they had a cloned key that was linked to the BCM but was out of synch. Open door, alarm goes off, put key in ignition and turn to start, alarm goes off, car starts and drives away.
Could be a previous owner still had a key, was cloned during a service, or if you got a key cut they did a second one as well.
There maybe somebody with more smarts out there that has found away around, but nothing I’m aware of that can be done in a few seconds.

yoda69 wrote:Keys have a rolling code, sometimes it can loose synch with the BCM and not work, to resynch you need to put key in the ignition. When you get a key cloned at mister minute or similar this is why they want you start car with new key. Not sure how far back history for the rolling code goes so with cloned keys it’s possible to get out of synch.
To me it sounds like they had a cloned key that was linked to the BCM but was out of synch. Open door, alarm goes off, put key in ignition and turn to start, alarm goes off, car starts and drives away.
Could be a previous owner still had a key, was cloned during a service, or if you got a key cut they did a second one as well.
There maybe somebody with more smarts out there that has found away around, but nothing I’m aware of that can be done in a few seconds.

This sounds most plausible. when we bought our VX it came with a 2nd (new) key but the seller said it didn't work and we were still using the original Key. I used the above method to get the new key to sync again and has worked fine since.

admir87 wrote: This is the confusing part!! If they had a copied and synced key as you say, then they could have opened the door with the remote, thus not setting the alarm off. But who ever did it, had to get in physically with the door lock barrel, set off the alarm. But once inside was able to switch the alarm off within seconds

No, a cloned/copied key would not have the correct rolling code for the BCM to accept its door-open remote control signal. They would have to physically open the door with the key and then insert it into the barrel for the BCM to resync with the key's rolling code.

So the key used had the correct cut and was either previously paired to your BCM or was unpaired (previously unused).

Joe.

Don't know how good these are but maybe it was used on your car.
http://www.uobdii.com/wholesale/new-typ ... tml?f=8dld

j_ds_au wrote:

admir87 wrote: This is the confusing part!! If they had a copied and synced key as you say, then they could have opened the door with the remote, thus not setting the alarm off. But who ever did it, had to get in physically with the door lock barrel, set off the alarm. But once inside was able to switch the alarm off within seconds

No, a cloned/copied key would not have the correct rolling code for the BCM to accept its door-open remote control signal. They would have to physically open the door with the key and then insert it into the barrel for the BCM to resync with the key's rolling code.

So the key used had the correct cut and was either previously paired to your BCM or was unpaired (previously unused).

Joe.

Hi Joe,
I know a locksmith who has a machine which can read exactly which position the remote is programmed on(for the memory seats, etc), and when he clones them, they work exactly like the original. So for instance if your key is programmed on position 3, the cloned one is also position 3. It works from the get go, without having to put it in the ignition, remote and all!!!
He has done a remote for me in the past, but i've known him for a long time and he isn't into any crime.

But I assume the way mine was stolen, it was not an exact clone like that, as they had to open the door physically first and set off the alarm