Ignition/ transponder bypass

[glitch_oz]

Better make this a separate thread, as I'm sure there are folks out there who know a hell of a lot more about electronics than I do.

The basic idea is to eliminate the need for a chipped ignition key as well as not having to worry about EWS errors (rendering the bike DEAD ) caused by some deft handling of the electrics hidden in the headlight shell through damaging the ignition-antenna-cabling.

It's a stupid setup for a bike of this kind and I'll try to find a way around it.
I don't want to worry about a key from Italy in the middle of no-where, I don't want to be stranded and lose months worth of riding caused by a little tug on some wires when changing a globe resulting a cracked connection of the antenna cable which feeds the key-code to the transponder.

The best way would be to have a map for the ECU which neglects the transponder key signal entirely and just gets on with things.
Short of that illusive "factory-only" option, the only other way I see is to rig a second antenna into the system...or better...a replacement antenna!! to prevent overlapping signals from 2 keys at once (if one is forgetful), spazzing the ECU to possibly throw a mega-fit and shutting down everything....as said, I'm a nong at this gizmo-stuff.
Use a replacement antenna to read a chipped key (better: a coded transponder chip only, taped into the center of the ring antenna) on a permanent base, activating the circuits permanently, whenever an ignition key is turned!
Then use a $5 non-chipped key for the mechanical function of starting the bike/ using the steering lock etc.

Being naive, I figure that most systems out there work a similar way and an antenna is an antenna, basta!
Honda started this electronic shit, so I ebayed one of theirs....a HISS system ring-antenna from a 2012 CB400.


It's massive !!

 

[glitch_oz]

With a 4 pin plug and 4 wires coming out of the unit, I'm guessing at a pos+neg feeding 12V to the integrated transponder-decoder as well as 2 wires going to the ECU with either an "all clear" or "wrong code" message.
The TR only has 2 wires coming from the antenna....so they must feed a separate, invisible transponder- decoder somewhere (that's working on the assumption that a key-fob contains a chip that either completes or denies a circuit via the ring-antenna....that signal being read by a decoder which in turn either frees or blocks the code read to the ECU.

Not knowing what to expect, the beltsander + Dremel are used cautiously and there it is, as hoped for....2 brass-like tongues coming from the "ring" part of the unit and soldered to the PCB of the decoder
(still encased heavily in the black "bakelite-style" plastic in this pic)

More plastic removed

There we go!
Now....if that ring-antenna is rigged via the same frequency range as the OEM-TR item, we might have something cooking.
More tomorrow, after I got the soldering iron out and jerry-rigged some stuff...

 

[mag00]

You just like using power tools, admit it...LoL

 

[glitch_oz]

You just like using power tools, admit it...LoL

was it THAT obvious? :-)

 

[mag00]

was it THAT obvious? :-)

Errrm, yea.

Too bad you aren't an electronics/programmer geek/hacker and buying the gadgets to actually crack the code for the Terra you own.

It's so sad that all the good crack/hackers go to the dark side to make the big bucks.

 

[drzcharlie]

I wish somebody with the ability to hack could crack our Magneti/Marelli ECU. I can confirm, I am NOT that person.

 

[glitch_oz]

I wish somebody with the ability to hack could crack our Magneti/Marelli ECU. I can confirm, I am NOT that person.

Me neither.

Until then...

Chipped + coded OEM key....and a plain, old $5 copy of the blade only... no chip/ no code... from the local locksmith.
The copy works fine for the seat lock and the ignition... but missing the chip, it results in the EWS error and ignition-lockout.

The trimmed down and jerry-rigged Honda HISS antenna ring hooked up to the connector in the headlight shell, replacing the OEM antenna.

Trying to start the bike with the copied key only....EWS.

Dropping the chipped OEM key into the Honda antenna....

....and using the $5 copy in the ignition lock....




















































HOO-bloody-RAY!!
Houston...we've got a GOER!!

First stab in the dark for a jackpot....that makes MY day (bounce bounce)

With that entirely unexpected event brightening the dark and wet Saturday afternoon, it's now official....a Honda HISS ring (CB400, but I'm just about certain that it's identical in its basic function to any other Honda HISS antenna, and that's good enough for our purpose) happily reads the "Husky" transponder signal.

http://www.ebay.com.au/itm/261241039506?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

Thinking about it, I'm also fairly certain that any other antenna can be used, from Hogs-to-Yammies, Zooks to KTM/BMW/Guzzi/Kwaka....whatever.

Next job is to find a neat place for it, the 2 threaded inserts in the plastic still provide about 5turns of thread to use some M4's and bolt the unit somewhere out of harms way...and wire it all up neatly.

After that, an original key can be taped into the ring to provide permanent code-verification, the bike now being started + locked etc with a cheap, copied, un-chipped key.
No need for dealers/ coding/importers and all the stupid hassle and wait in case of a lost key or broken original antenna, just grab the other original key to get another copy done at your local locksmith/ Mister Minit/ shopping center/ hardware store etc.

Even better would be to have the code read off the original key and have it copied to a blank transponder chip...just the chip!...to be taped into the Honda antenna.
Gives another OEM key as backup and takes less room as there is no key-blade/ plastic fob.

Boy, punching " ignition transponder chip" into Ebay certainly brings up some choice.
Wonder if one of the BMW chipped blanks might contain the same type of chip...
That'll be the next project then...


Needed:
Check Ebay for a "CB400 HISS ignition surround aerial/ ring antenna" (other models should work just as well, but need confirmation).
A standard copied key from the locksmith.
The entire "downward" section of the Honda item can be removed with a hacksaw (cables and all to make things quicker, then Dremel the 2 contact-tongues out of the surrounding material.

After that it's just the 2 thin wires which hook into the existing wiring, orientation of the wires shouldn't matter at all.

IMPORTANT!!!
UNPLUG the stock antenna !! to prevent any possible use of 2 coded chips ever being used simultaneously in the system, which might do harm to the transponder-decoder or ECU.

Well...how do YOU feel when wife and mother-in-law are talking at once, aye?? :-)

 

[Baddrapp]

I was thinking of bolting the ews and key to the metal crossbar above the headlight inside the fairing. Thank you. I will order an ews ring and give it a go. Great work.

 

[vodka]

But what does the chipped key do to the antenna ring that causes a recognition.. switches on in the antenna ring to feed back to ecu and alloow ECU recognition.
What is in the antenna ring . Some small magnetic switch?? I want to go deeper into understanding this.. sick of being a grasshopper.

 

[mag00]

But what does the chipped key do to the antenna ring that causes a recognition.. switches on in the antenna ring to feed back to ecu and alloow ECU recognition.
What is in the antenna ring . Some small magnetic switch?? I want to go deeper into understanding this.. sick of being a grasshopper.

When the ECU gets power, it sends a signal out to the antenna to verify the key. The waveform sent from the antenna produces enough energy to activate the RFID chip in the key, and hard coded information is harvested and returned to the ECU (via antenna). Once verified, the ECU turns on the rest of the bike.

 

[mag00]

Congrats Glitch

The listing ended, so I sent them a message.

I have a new key on order with Husky, but that could take a half year.

I'm going to get a ring antenna and mount it inside my airbox. I already have a cheapo key for the seat and tank, and mine don't even have that cool plastic handle as yours does.

I was going to wait until the new key came in, then send it (new key) off to see if it could be cloned. Your solution is good, because some of the problems with the ring antenna going bad have left some stranded. It is recommended to carry a spare antenna, and now you are. That and remotely mounting it out of harms way will save alot of possible headache if something happens to the stock one.

Thanks for the good work

 

[mag00]

Hey Glitch, I don't know if you posted the resistance of the antenna ring. Did you measure the resistance of each ring aerial?

 

[Baddrapp]

I ordered a key and they sent the wrong key. It's my luck. The dealer is about 150 miles one way so I have not taken it back yet. I tried to have the key cloned from a motorcycle locksmith. His key reader said it was a 80 or 90 bit and was unable to clone the key. He told me the other possible way is to read it off the computer but he was unwilling to try because it is a Husqvarna. I know there are specialized locksmiths for the BMW bikes. I tracked one down in Los Angeles but they wanted 250.00 to try and make a key with no guarantee. I will order a ring and try to place it in the fairing.

 

[drzcharlie]

Brilliant

 

[Hansi]

Awesome work, Glitch. Thank you.

 

[glitch_oz]

Yes, the listing ended (cause I bought it)
Check Ebay.com for " Honda HISS ring" and offers from this seller: aaamotorhk
He's got heaps for all different models. As said above, I'm sure ANY HISS ring will work just as well, most likely similar ring-antennas from most other makes as well!!
But $12 from HongHong with free postage is hard to beat.
No, haven't checked resistance...and don't really care as long as things work fine. The antenna is only used for a split second to verify the code off the key...after that all systems are "go" until shutdown (ignition turned off).
The actual chip (either on its own or encased in a key fob) has to be within 3/4 to 1" of the antenna, otherwise communications are lost and EWS shows up.
This goes for the OEM setup as well as for ANY of those systems, regardless of brand.

 

[BigDog]

This is awesome ****************************************!!!
On my Mercedes Sprinter van ---------I did about the same thing.
I only had one chipped key and worried I'd lose it and it would cost me $7,000 to haul the thing to a Mercedes dealer and get a new key.
So I dug the chip out of the chipped key-----taped it to the antennae ring where you couldn't even see it--under a steering column panel.
Now I can use any old copied key---------without the chip in it.

Thanks ****************************************

 

[glitch_oz]

On my Mercedes Sprinter van ...

I haven't even thought that far yet, but YO, the car's next!
Lost the main key for that years ago by losing a topbox off a bike out in the middle of no where.
Didn't realize it was gone until stopping for fuel.
Down to one $500 OEM key and guarding that like a hawk!
That'll be the fix then... Thank you, sir! :-)


Edit:
Just bought another HISS ring (CB600 this time) to rig into the car.
If it flops, I'll try it on the Husky.
If/ when THAT works, it's up for grabs.

 

[glitch_oz]

Haven't started the proper wiring yet but thinking of just splicing it in. Virtually impossible to get those specific connectors, at least over here.


Then Ebay spit out this one....
http://www.ebay.co.uk/itm/2-WAY-SUP...arts_Vehicles_CarParts_SM&hash=item4ac69c1aa1"]

Check EBAY (your country) for " 2 way superseal connector kit".
The Husky has Tyco Electronics connectors which I couldn't find anywhere.

I'll replace the original antenna connectors with the generic Ebay stuff, then use a second female connector to make a stand-alone/ plug-in lead with the Honda antenna. This way there's no chance ever that 2 antennas and transponder chips can be used at once. It also leaves the OEM wiring intact, apart from a different type/brand of waterproof connector.

For any of the local guys, thinking of doing this mod:
I've got a shyteload of connectors now, just holler!

 

[mag00]

I have to make a stern warning

Hold off on this mod until I can confirm the problem of messing up the ecu by doing this.

I was talking to a key expert, and was describing the Terra and ignition and what I wanted to do, tape an rfid chip to a remote antenna.

He immediately said he does not recommend this (strongly advised against it). I have pictures emailed to him and he will give a final outcome and identification of system.

As it is, the mag morelli technology comes in phases. The early ignition/ecu you could do this with no problem. Mag Morelli has evolved and has addressed the issue of leaving a key taped to the antenna, and now this practice has messed up ecu's in other bikes.

If he can make a key for us, it is $15, hardly worth the possibility of messing up the ecu. I should know by tomorrow. If he says he can, I will ship off my spare key to be the test case.

If you are going to go the above route, caution to the wind, at least put a switch in the circuit. That is still not a guarantee.