Passkey I/VATS and Passkey II fuel enable signal generators

[RobertISaar]

i can build these things stupid-cheap, so much so that i would need to buy parts for about 30 of them from my favorite supplier to meet their minimum order requirement of $5. and i know how much we all LOVE the PK2 systems.

this would take care of the signal to the PCM part of the passkey module, the other half is the starter enable relay.

you could either bypass it entirely by connecting two wires together or if you want to keep the relay for some reason, connect a single wire to ground. it's fairly simple to show on a diagram.



i can probably make these for ~$10 USD + shipping and in an almost waterproof box and still turn a decent profit. i may even add a LED to indicate operation, though that would certainly remove the waterproof aspect.

anyways, if even one or two people is interested, i'll go ahead and order the parts to make all 30 or so since i would likely cover my costs from that alone. all W-bodies would need is a 50Hz setup, though some of the earlier passkey setups in mid 80s vettes/f-bodies used a 30Hz setup, either can be made easily enough. it's certainly possible to make one module that can produce either signal as well, would just need a SPDT switch to switch between the resistor necessary to create the frequency you want.

any interest? as you can see, i'm certainly not in this for the money.



1. Urbex, 50Hz

[slick]

So would this be considered a passkey/vats bypass or disable system?

[RobertISaar]

both?

it creates the 30/50Hz signal that the PCM wants to see to allow the injectors to fire and allows for the cranking disable relay to be removed.

essentially, it makes it non-existant, since not even your security light should even come on during a bulb-test anymore.

[Dark Ride]

I'm interested in one for sure, would you be able to make one that would work with a 00 Grand Am? I know the concept is similar but not sure whether they are the same signal or not.

[RobertISaar]

00 GA seems to use a different setup, not PK2 anyways.

there seems to be a special key cylinder that has a hall effect sensor, a magnet, and a tampering sensor.

through that combination of stuff, it generates a signal that goes to the BCM. the BCM then sends a "password" to the PCM, then the engine can run.

if i had a sillyscope, i might be able to crack the signal that the cylinder generates, then recreate it and send it to the BCM. at that point, it would be bypassed.

however, if you have the engine running, then disconnect the BCM from the PCM, the system will go into fail-enable mode and allow any key that is cut correctly to start it, exactly the same way it works with PK2.

[Dark Ride]

00 GA seems to use a different setup, not PK2 anyways.

there seems to be a special key cylinder that has a hall effect sensor, a magnet, and a tampering sensor.

through that combination of stuff, it generates a signal that goes to the BCM. the BCM then sends a "password" to the PCM, then the engine can run.

if i had a sillyscope, i might be able to crack the signal that the cylinder generates, then recreate it and send it to the BCM. at that point, it would be bypassed.

however, if you have the engine running, then disconnect the BCM from the PCM, the system will go into fail-enable mode and allow any key that is cut correctly to start it, exactly the same way it works with PK2.

And we complain about PK2, that sounds much worse .


Good info on disconnecting the BCM, I had never heard of that.

I love how GM designs all these security systems and its the OWNERs not thieves that have to disable them.

[RobertISaar]

http://newrockies.com/
i wonder.... the circuit this guy makes and sells for $180( ) and is ~90% identical to the circuit i have planned claims to work with the 96-05 grand ams... so your system MAY be a PK2 setup, just different than the average W-body system.... i'll have to look into it.

[Dark Ride]

http://newrockies.com/
i wonder.... the circuit this guy makes and sells for $180( ) and is ~90% identical to the circuit i have planned claims to work with the 96-05 grand ams... so your system MAY be a PK2 setup, just different than the average W-body system.... i'll have to look into it.

I appreciate it. Its the girlfriends car, but I'm sick of it leaving her stranded and me having to go get her. Let me know what you find out and when you plan to build these, I want one as a back-up for the TGP (its running OBD II from a 99 Lumina).

[urbex]

I know I mentioned in the pm, but I'm putting it in the thread officially that I would like one.

[RobertISaar]

http://www.bergerweb.net/PasslockFix/

frickin 2.2K resistor is all that's necessary for a 99-up GA.

i imagine other cars that use the same "wireless" method of testing the keys would be similar/identical.

[BXX]

http://www.bergerweb.net/PasslockFix/

frickin 2.2K resistor is all that's necessary for a 99-up GA.

i imagine other cars that use the same "wireless" method of testing the keys would be similar/identical.

The N-body and a few other IIRC have a passlock sensor that is hall effect and generates a voltage and nothing else, depeding on how the key is cut. So the resistor just takes the 5v signal down to whatever (too lazy to calculate) and then thats what voltage the BCM gets learned.

I've had severely worn keys on these cars actually throw the voltage off enough to disable the car, yet the key would still turn the tumblers

[RobertISaar]

hmm.... so somehow GM "improved" their theft system by allowing a single resistor to start any car with that specific system after a learn procedure is done and a single resistor spliced in.....

well, teh moar u no.

[BXX]

hmm.... so somehow GM "improved" their theft system by allowing a single resistor to start any car with that specific system after a learn procedure is done and a single resistor spliced in.....

well, teh moar u no.

But you still need a key that will actually turn over the ignition. No key, cant remove lock cylinder or turn over electical switch. Cant remove lock cylinder cant manually turn over electical switch or ever remove it to get access to what turns, cant release detent to get outta park without turning over ignition.

Basically, without a key that turns over the ignition, you cant even remove the detent cable to get outta park even if you hotwire the car through the switch pigtails.

However, I know how to easily defeat and get the lock cylinder out without a key or a key that works. I only know this from cars that have been towed into my shop where the key will not turn over the lock cylinder (the tumblers jamb, game over) so they need new lock cylinders and keys and passlock sensors.

Takes me aboot 30 seconds once I have access to the ignition switch assembly to completely defeat all antitheft features and be able to shift outta part and be able to turn over the ignition electrical switch.

[RobertISaar]

anyways, from the looks of it, it's not passkey II, since there is no resistor in the key, it's not passkey III since it doesn't use a transponder embedded in the head of the key, and i keep seeing references to the term "passlock".

so from the looks of it, the later n-bodies used passlock, and if i had to guess, any other passlock system can likely be disabled in the same manner.

[slick]

Every nbody that I did a remote start- measure resistance with key in, cut wires, add proper resistor, and security disabled completely. They are like the easiest systems to bypass.

I haven't looked yet at what the century has (2002), but I will need a bypass or disable system at some point. I have a remote start system sitting in my garage, bnib, that I want to put on it.