Rovin,

If you're willing, would you compare your algorithm against mine here:
https://landroverforums.com/forum/di...s-45057/page3/ (message 23)?

Just working the codes for these inner codes would be a good start:
26AFA7
4074C3
404223.
These are all culled from various web references.

Thanks,

Brad

 

Hi, whats the latest with this thread, has anyone managed to succesfully decypher the 6 digit code?

 

There is no new information other than what's in this thread. I have not gotten any feedback regarding success (or failure) of the code generation worksheet (available here: https://landroverforums.com/forum/di...s-45057/page3/).

One note: the problem is not decyphering the 6-digit code. It is creating a usable set of "bar codes" given the 6-digit code that is present inside the fob. These bar codes can be used by programming tools such as the Hawkeye.

I have begun to look at the bits transmitted by a fob when the keys are pressed. It looks to be differentially manchester encoded but does not appear to be the industry-standard keeloq format. The IC that generates the pattern is an NEC 75076177. There is zero information available on this chip via a google search.

 

Txs for the reply Brad. I am from South Africa, also got a Hawkeye and would love to be able to do the fob programming with it, hence my interest w.r.t. your worksheet.

 

Based on my experience, there is no harm in trying a set of barcodes using the Hawkeye even in the case where they are incorrect. I've used my Hawkeye to attempt a dozen or so codes that I later learned were not correct. It did not affect my working fob. So if you're willing, give the worksheet codes a try and report on your result.

Keep in mind that the "G" or "J" designation is a guess. It is likely a way to specify the frequency used by the fob, and therefore market-dependent. In the U.S. it is 315MHz and I believe that corresponds to the "J" designation.

 

Where is the bar code located? Inside the FOB?
Why does the bar code go missing?
Does the glue decay and the bar code just falls off when someone is in there doing the battery?

 

It's attached to the key when new.

Land Rover Discovery Genuine OEM Factory Key Keyless Remote

 

The bar codes are two sequences of numbers and letters that are unique to each key and are used to program the body control unit to accept the key for use with your vehicle. There is a separate code, which I call the key code, that is printed on a sticker and attached to the NEC chip on the circuit board inside the fob.

There is a document available to LR techs that allows them to build the two bar codes given a key code. It is not publicly released.

I have not heard of a case where someone has lost the key code. The bar codes however are routinely separated from the key and are usually not available on used key fobs.

 

For those interested, here's a capture of my fob when the "unlock" button is pressed.

 

I would think the code has to be rotating - or someone could record it and then play it back with a transmitter and open the truck.

So the bar code then must tell the BCeM what the key should be on the Rover end to anticipate the next code.

This is probably why you need to press the lock unlock about three times to "wake up" the BCeM on a FOB which has not been used forever.

So, is the bar code a mix of the code on the NEC chip and the metal tag for the body unlock code which is used on the driver's side door for the EKA unlock?

Trying to put the crumbs together.

So then guessing -
as the end of Discovery Assy line - some bloke will pull two FOBS from stock.

That bloke will note the EKA code and the number on the NEC chip - type it into
a computer which will then print out the bar code sticker - which he puts into the key FOB??

Then down the line someone else uses a Rovacom or such to actually program in the barcode with a scanner.
Scanner hits the code - then puts the code into a Rovacom or similar device which
programs the BCeM via the OBD-II connector??
Total guessing on my part - trying to poke the smart ones for the answers on here.
Maybe this can be figured out. Can't be too much worse than calculus.