98 LX470 lost keys ECU hack

[Mauser]

I started this project because I was told by too many people that it couldn't be done and it was going to cost a lot of money and I would have to send my ecu off to have someone do it. Well those choices were unacceptable to me so I started googling. I came across a thread on another forum that had the info I wanted to see so I picked up a few parts and figured I would give it a try. Here is the link to the forum where I got my info:
DIY: Immobilizer Hacking for Lost Keys or Swapped ECU - ClubLexus - Lexus Forum Discussion

And here is my adventure:

I started by getting the proper parts for my programming board:

3@ 4.7k resistors
3@ 1w 5.1v zener diodes
1@ serial cable
1@ small prototype board
various wires

I built my programmer according to the schematic on the site. I soldered it to a board instead of using a breadboard.

After I got my board built I got out an old desktop computer with a serial port and downloaded Ponyprog2000. This is a free easy to use serial device programmer.

I then pulled the ECU out of my LX and got the board out. After you get the board out you need to locate IC900. I didnt take any pictures when I did my LX, but I did when I flashed my wife's RX300. The chip looks the same.

First I tried doing the flash without removing the chip from the board. I was able to read and delete the chip, but could not write to it no matter what I did so I ended up buying a hot air rework station and pulling the chip from the board. You can use a soldering iron and desoldering wick, but the rework station makes it a whole lot easier. With the chip off the board I soldered wires to 6 of the legs. #1 on the chip is the one closest to the little indent on the chip.

I can only figure out how to thumbnails of screenshots. This is the info on the chip.

This is what I wrote to the chip

After writing to the chip I soldered it back to the board and re installed the ECU in the car. Make sure the battery is disconnected and the key isnt in the ignition.

After hooking up the battery make sure the security light is flashing. Then insert the key for a second and remove. The light should stay on now. Insert the key to be programmed as a master for about 20 seconds then remove and insert another key to be a master. then a third to be a sub key. After 3 keys the auto program will end. I only had one key so I made sure it started the car and used techstream to close auto registration mode.

I know I am lousy at explaining these things, I just wanted to make this info available here on this forum. The link I posted has better instructions and a video. I am good at answering questions though so ask away.

 

[FxFormat]

How much will you charge me for this? This looks nothing short of rocket science. Great job

 

[Mauser]

How much will you charge me for this? This looks nothing short of rocket science. Great job

I will do it for free if I can find the virgin files for it. What year is yours? What is the part number of your ECU?

 

[FxFormat]

I have a 2001, not sure about ecu part number how do I find that out? I will gladly pay for this service, the only key I have now is the valet key

 

[Live to Ski]

Looks like the prototype to mission control for next mars launch.....very impressed!

 

[FxFormat]

Looks like the prototype to mission control for next mars launch.....very impressed!

Lol seriously, there are some very smart and resourceful members on this forum. I’m just lazy.

 

[yotasavg]

Wow this is cool, nice work!

 

[Eicca]

Damn. This is why IH8MUD is the king of all car forums.

 

[Mauser]

I have a 2001, not sure about ecu part number how do I find that out? I will gladly pay for this service, the only key I have now is the valet key

The part number is on the ECU. Did you get your glovebox open? It looks like yours uses the same virgin file as mine. I have learned to read a little hex so I can figure it out. Its just nice to have someone else with the same answer.

I have no problem doing it for free if you send me either the whole ECU or just the chip. I would like to help out here if I can. If it weren't for this place I would spend twice the amount of time working on my stuff.

 

[cmck]

I like the whole attitude here. You told
me it could not be done so I just did it. Nice work.......

 

[Benjamin Ebrahim]

Awesome to see your work around, and glad it all worked out. I did this same thing to my 01, but I am not as confident in my soldering abilities so I bought a cheap EEPROM reader and did the reset through there

 

[Mauser]

Awesome to see your work around, and glad it all worked out. I did this same thing to my 01, but I am not as confident in my soldering abilities so I bought a cheap EEPROM reader and did the reset through there

Yeah. A reader would have been nice. I ended up buying a hundred each of the zener diodes and the resistors and plenty of the prototype boards, but with the cheap rework station I still have less than a hunderd bucks in flashing 2 cars.

Soldering is easy. The hard part for me was to admit that my eyes are getting old and I had to have reading glasses to see.

Do you remember the program you wrote to your eeprom?

 

[Benjamin Ebrahim]

Yeah. A reader would have been nice. I ended up buying a hundred each of the zener diodes and the resistors and plenty of the prototype boards, but with the cheap rework station I still have less than a hunderd bucks in flashing 2 cars.

Soldering is easy. The hard part for me was to admit that my eyes are getting old and I had to have reading glasses to see.

Yeah that looks like a lot of work getting all the wiring down, but it beats paying Mr. T to put in a new ECU

 

[Mauser]

I was hoping to be able to program the chip on the board. I am not giving up on that yet. I have a used ecu coming from ebay that I will experiment with. (If anybody has an old one they want to sell cheap Ill buy those too.) If I can get it to work with a test clip I can make the programming boards available dirt cheap. Right now I can make them with a socket for the chip, but getting the chip off the board isn't so easy for everybody. I have also thought about making pre programmed chips available. It really is an extremely simple process. Just took me a while to figure it out.

 

[BEG]

I've been thinking about this very thing since I saw that immobilizer hack, but I just don't have the electrical chops to do it myself. It'd be great if there was a member offering some kind of service and/or plug and play solution to us valet-key-only folks. Are the IC-900 chips an off-the-shelf item? I could probably manage to desolder/solder the board to replace the chip without any serious issues and would happily plunk down some money for a reflashed chip.

 

[BEG]

I was hoping to be able to program the chip on the board. I am not giving up on that yet. I have a used ecm coming from ebay that I will experiment with. (If anybody has an old one they want to sell cheap Ill buy those too.) If I can get it to work with a test clip I can make the programming boards available dirt cheap. Right now I can make them with a socket for the chip, but getting the chip off the board isn't so easy for everybody. I have also thought about making pre programmed chips available. It really is an extremely simple process. Just took me a while to figure it out.

Looks like you answered my question before I asked it. A pre-programmed chip and some directions on desoldering/soldering and programming a new master key would be awesome.

 

[Mauser]

I've been thinking about this very thing since I saw that immobilizer hack, but I just don't have the electrical chops to do it myself. It'd be great if there was a member offering some kind of service and/or plug and play solution to us valet-key-only folks. Are the IC-900 chips an off-the-shelf item? I could probably manage to desolder/solder the board to replace the chip without any serious issues and would happily plunk down some money for a reflashed chip.

Yes, just the chip could be bought. The cheapest I have found them is 16 cents each. I could buy the chip, program it, and mail it out for less than a dollar.

 

[BEG]

Yes, just the chip could be bought. The cheapest I have found them is 16 cents each. I could buy the chip, program it, and mail it out for less than a dollar.

Throw in a hot air rework station, a new 3-button master key, some detailed instructions and charge $100 for the kit

Still wouldn't scratch the surface of what a locksmith would charge, let alone the install cost of an ECU from Toyota.

 

[Benjamin Ebrahim]

I was hoping to be able to program the chip on the board. I am not giving up on that yet. I have a used ecu coming from ebay that I will experiment with. (If anybody has an old one they want to sell cheap Ill buy those too.) If I can get it to work with a test clip I can make the programming boards available dirt cheap. Right now I can make them with a socket for the chip, but getting the chip off the board isn't so easy for everybody. I have also thought about making pre programmed chips available. It really is an extremely simple process. Just took me a while to figure it out.

I tried using an EEPROM clip so i wouldn't have to desolder the IC900, but my programmer didn't have the juice to power the board and read the chip, plus it was a nightmare to even get the clip prongs to line up. I still have the program that I used to flash the chip if that'd be any help to you

 

[toyotaspeed90]

Yes, just the chip could be bought. The cheapest I have found them is 16 cents each. I could buy the chip, program it, and mail it out for less than a dollar.

I would also suggest buying sockets (they are also cheap) - solder the socket in just in case one chip doesn't work, then it's literally plug and play.