Why did car thieves disconnect my rear-view mirror?

[Boston Mangler]

Could be apples to pineapples

But on the Cummins forum, there is discussion about people stealing the rear view mirror because a lot of people program them to open their garage, scumbags later use mirror to access garage. How? No idea, but it’s a thing

My ram is poor folk edition and doesn’t have such a system in the mirror, but my Tundra did

I believe most Tundras and Tacos have this in the mirror.

On my 2010 LC, it’s up on roof near the sunroof control, NOT on mirror. Dunno if other years or LXs had in mirror

Maybe that’s their thought process?

Glad ya got your ride back. Thieves all need to die a slow painful death

 

[PDoyle]

The other thing regarding the stolen mirrors is the registration is in the glove box having the home address.

 

[coleAK]

The other thing regarding the stolen mirrors is the registration is in the glove box having the home address.

That is why I keep my registration and insurance in a zip lock bag under the rear floor mat.

 

[AcmeSys]

Side note: if we don’t want to go the remote ignition cut route, could we do the same for one of the important OBD port wires?

For key generation without a legit key on hand- it does not look like this requires OBD port access. They are reverse calculating the public/private key using the VIN and sniffing/interrogating the RF system then crunching the numbers and generating a real key response.

There are some CAN hacks floating around that tap the main bus and corrupt the immobilizer ECU to get it to go offline then inject a "fake" immobilizer ECU response to say "valid key" (but that is a deep and proper hack vice button mashing a tablet). Ironically these CAN attacks were first open source released by a UW Seattle engineering professor about 12 blocks from where this rig was recovered.

My EWDs are not loading for some reason. I suspect there is a gateway between the dash OBD port and the bus that has the immobilizer and the ECU on it. If there is a gateway it would probably ignore the OBD port error and go on with life (CAN has a bunch of fault tolerance capability and can tell nodes to shutup if their frames are corrupted).

If anyone has the EWD PDF's for the hardware below we can go deep into the drawings-
System Circuit > Power Source / Network > Multiplex Communication System (CAN LHD):
-Certification ECU
-DLC3
-ECM
-Main Body ECU
-Network gateway ECU
-No.2 Multiplex Network Body ECU

 

[Boston Mangler]

For key generation without a legit key on hand- it does not look like this requires OBD port access. They are reverse calculating the public/private key using the VIN and sniffing/interrogating the RF system then crunching the numbers and generating a real key response.

There are some CAN hacks floating around that tap the main bus and corrupt the immobilizer ECU to get it to go offline then inject a "fake" immobilizer ECU response to say "valid key" (but that is a deep and proper hack vice button mashing a tablet). Ironically these CAN attacks were first open source released by a UW Seattle engineering professor about 12 blocks from where this rig was recovered.

My EWDs are not loading for some reason. I suspect there is a gateway between the dash OBD port and the bus that has the immobilizer and the ECU on it. If there is a gateway it would probably ignore the OBD port error and go on with life (CAN has a bunch of fault tolerance capability and can tell nodes to shutup if their frames are corrupted).

If anyone has the EWD PDF's for the hardware below we can go deep into the drawings-
System Circuit > Power Source / Network > Multiplex Communication System (CAN LHD):
-Certification ECU
-DLC3
-ECM
-Main Body ECU
-Network gateway ECU
-No.2 Multiplex Network Body ECU

Bro…

I don’t know what 98.6% of this means…

What’s can us dummies do?

 

[AcmeSys]

Bro…

I don’t know what 98.6% of this means…

What’s can us dummies do?

Buy a 60 series and take the ignition rotor with you when you park?

 

[linuxgod]

Bro…

I don’t know what 98.6% of this means…

What’s can us dummies do?

Swap all your plug wires when you leave the truck. Just remember where they’re supposed to go because you have to put them back

 

[lx200inAR]

Side note: if we don’t want to go the remote ignition cut route, could we do the same for one of the important OBD port wires?

If you want, I can tell you which wire between the fuse box and ECU that I misconnected that kept my main ECU from booting up, even with all other wiring in place.

 

[bloc]

If anyone has the EWD PDF's for the hardware below we can go deep into the drawings-
System Circuit > Power Source / Network > Multiplex Communication System (CAN LHD):
-Certification ECU
-DLC3
-ECM
-Main Body ECU
-Network gateway ECU
-No.2 Multiplex Network Body ECU

These are for a '13 cruiser. I'm sure there are wiring differences between this and at least 2016/2018, but whatever principles we come up with could be refined for other model years.

 

[TheIcemanCometh]

Interestingly Utah annual registrations do not have home addresses. And there is some advantages to having a detached garage.

 

[TheComedian]

final note- if you air tag anything for theft recovery- open it up and epoxy/super-glue the speaker so it can't do the "find me" beep

You can just cut the cables of the speaker. Plenty of Youtube tutorials. I did this for the airtags in my luggage and toolbox since I had once an airline in Africa and one in Laos s***ting around.


Oh and here comes my little moment to shine on key entry stuff.
It is definitely the case with my pre facelift 2009 and probably should also be the case with the newer 200s.
After I was fiddling around on and of for minimum a year to beeing able to teach my 200 a new key (lost the old one anywherw in the woods, jepp car also drives without key once it is started…) I found the reason why I wasn’t able in any knowing way.
It looks like from the ~7 remote key receivers in the car there is one in charge for teaching keys. Thats the one under your center console (if you pop your cup holder like an inch to the front, size of an lighter.
Friend and pre owner cut of a cable here when he was welding the hand brake but the car acts like normal even without that receiver and also doesn’t show any error code.
Once I patched the wire and plugged it in I was able to teach.

I think this could be probably another step for making the theft take more time (if they want it you cant prevent it, you can just make the time longer but thats the important thing) and is worth a try.

 

[AcmeSys]

I suspect we ar4e going to get annoying trouble codes if we dig into the CAN side and my motivation isn't high to disassemble a dash in the cold weather to hang logic leads.

Fuse 48 - is 20A fuel pump? Try pulling it and verify the no start and no major/secondary issues develop. If that works, pull the fuse (micro ATC or mini lopro?) and install a fuse extension lead and solder a NO relay onto it and run a switch to the dash.

 

[AcmeSys]

Toyota knows where the rig is via cellular... they just won't tell you. But they will sell the data. I suspect the early ones were 3G and no longer work in the US but that is just a hypothesis.
fysa- You can turn the "big brother is watching you" cell connection off via techstream.

 

[PDoyle]

Memorize the vin then hide it or scratch it off

 

[gasman4u]

Memorize the vin then hide it or scratch it off

This helps with resale I am told. AND at the DMV!

you have a semi pro crew in your area...

now that all the mopar hot hemis have all been stolen with pro pads plus the VIN or had secondary ignition cut switches installed the Toyota are next inline for parts scavenging.

you can clone fobs from a locksmith tool like an xtool tablet without having the original fob then program a $20 amazon blank fob and you are off to the races.

as mentioned- they disconnected the harness to kill cameras or the onstar type tracking.

This isn't a dip**** meth fueled junky job like a smash and grab. it was parked in a cool down area to see if it had a tracking system installed before being moved to a chop shop in 24-48 hours. the charging cords were probably for the programming tablet to stayed powered up while driving or a wave bubble type RF jammer (yeah it is a thing).

tip- shove a post-it note over the dash VIN so it can't be seen externally. It is at least a starting point for security.

XTOOL AnyToyo SK1 for Toyota 8A/4A Smart Key Programming without PIN

XTool AnyToyo SK1 is a data collector as well as a smart key emulator, allows you to do key cloning process in both add key / all keys lost situations for Toyota Lexus 2013 to 2022 models with smart key. AnyToyo SK1 can also do emergency start when there is no key available on your hand and...

www.obdii365.com

A dense and VERY helpful post here. @AcmeSys Thanks for this. I know I've got a couple projects now to sort out with airtags too.

 

[gaijin]

I recommend hiding a AirTag in your car!

Absolutely. And to avoid having to replace the battery every year, I recommend this case that supplies power for 10 years with two Lithium AA batteries:

Available on Amazon here: AirTag 10-year case on Amazon

HTH

 

[KLF]

On my 2010 LC, it’s up on roof near the sunroof control, NOT on mirror. Dunno if other years or LXs had in mirror

It's up in the mirror on later 200's. I think it got moved there in the mild refresh in '13. Terrible location, I hate it there.

 

[efred]

Fuse 48 - is 20A fuel pump? Try pulling it and verify the no start and no major/secondary issues develop. If that works, pull the fuse (micro ATC or mini lopro?) and install a fuse extension lead and solder a NO relay onto it and run a switch to the dash.

It so happens that's just the fuse I pulled last night (and my truck was still there this morning). If I can find the fuel pump relay and there's access to the wire I was going to put a switch on that (for more stealth). But maybe that's one of those relays in the fuse box. So thanks for the fuse extension idea.

 

[gasman4u]

It so happens that's just the fuse I pulled last night (and my truck was still there this morning). If I can find the fuel pump relay and there's access to the wire I was going to put a switch on that (for more stealth). But maybe that's one of those relays in the fuse box. So thanks for the fuse extension idea.

Jesus Christ...it's Jason Bourne...

jk. I hope your trials with this are soon (or already) at an end. I hate thieves of all flavors, but would be hard pressed to not be through the ceiling with all you're dealing with. Godspeed.

 

[efred]

Jesus Christ...it's Jason Bourne...

jk. I hope your trials with this are soon (or already) at an end. I hate thieves of all flavors, but would be hard pressed to not be through the ceiling with all you're dealing with. Godspeed.

I actually don’t think they’re likely to grab it again, but it helped me sleep easier