Discovery II Talk about the Land Rover Discovery II within.
Sponsored by:
Sponsored by:

Definitive answer on Key Fob Reprogramming

Thread Tools
 
Search this Thread
 
Old Jan 13, 2013 | 09:13 PM
  #21  
brad_ramsey's Avatar
Drifting
Joined: Sep 2012
Posts: 41
Likes: 7
From: Denver, CO
Default

Originally Posted by jfall
I would think the code has to be rotating - or someone could record it and then play it back with a transmitter and open the truck.

So the bar code then must tell the BCeM what the key should be on the Rover end to anticipate the next code.

This is probably why you need to press the lock unlock about three times to "wake up" the BCeM on a FOB which has not been used forever.

So, is the bar code a mix of the code on the NEC chip and the metal tag for the body unlock code which is used on the driver's side door for the EKA unlock?

Trying to put the crumbs together.

So then guessing -
as the end of Discovery Assy line - some bloke will pull two FOBS from stock.

That bloke will note the EKA code and the number on the NEC chip - type it into
a computer which will then print out the bar code sticker - which he puts into the key FOB??

Then down the line someone else uses a Rovacom or such to actually program in the barcode with a scanner.
Scanner hits the code - then puts the code into a Rovacom or similar device which
programs the BCeM via the OBD-II connector??
Total guessing on my part - trying to poke the smart ones for the answers on here.
Maybe this can be figured out. Can't be too much worse than calculus.
The fob has no information about the BCU; the code it transmits is independent of the vehicle. It's output is determined entirely by the key code (the 6 hex digits on the inside sticker) and the current state of it's internal rolling code generator. To receive the rolling code the complementary NEC chip is surely present in the receiver. Both the fob and the receiver calculate the next anticipated code given the currently transmitted one. Typically the receivers accept any of the next 256 codes in the sequence to handle the case where someone presses the fob button out of range of the receiver (at least up to 255 times ).

I have made trial decodings of the waveform. So far, I don't see anything like the key code present in the data. So either a) i'm not using the proper decoding technique or b) the entire data payload is encrypted and the key code is not transmitted in the clear, or c) something that I haven't thought of yet.

There is an industry standard, called keeloq, that also uses a rolling code (Texas Instruments markets a competing device also). It does however transmit the fob's unique id in the clear. I have captured several sequential transmit data sets from my fob. It appears to be a different data sequence each time.
 
Reply
Old Jan 13, 2013 | 11:15 PM
  #22  
TwinDisco's Avatar
7th Gear
Joined: Jan 2013
Posts: 7
Likes: 0
Default

Brad, ived used your worksheet over the weekend to get the 2 codes from the key code , and it worked spot on, except for the last character in each code, the key code is;

105BC7

the 2 codes from the bar code tag;

*105BC7105BC6FFW*
*FFFFFFFFEFA4382*
 
Reply
Old Jan 14, 2013 | 01:22 AM
  #23  
brad_ramsey's Avatar
Drifting
Joined: Sep 2012
Posts: 41
Likes: 7
From: Denver, CO
Default

Originally Posted by TwinDisco
Brad, ived used your worksheet over the weekend to get the 2 codes from the key code , and it worked spot on, except for the last character in each code, the key code is;

105BC7

the 2 codes from the bar code tag;

*105BC7105BC6FFW*
*FFFFFFFFEFA4382*
Thanks! You have yet another kind of barcode that I have not seen before. Every other set of barcodes that I have encountered have a letter after the asterisk in the first code that is 'J' or 'G'.

Note that my worksheet attempts to generate codes that are usable on a Hawkeye diagnostic device, not the full code39 barcodes. The octave program (listed out in a previous comment in this thread) does create fully compliant code39 barcodes. When I use the octave program to create the codes from your key code, I get:

1. Using a 'G' prefix:
octave:15> [code1,code2] = plipcodes('G','105BC7')
code1 = *G105BC7105BC6FFV*
code2 = *FFFFFFFFEFA4382*

2. Using a 'J' prefix:
octave:14> [code1,code2] = plipcodes('J','105BC7')
code1 = *J105BC7105BC6FFY*
code2 = *FFFFFFFFEFA4382*

code1 does not match your code because of the last "check" character per the barcode rules. I tried some other starting letters and got one to work:

3. Using an 'H' prefix:
octave:16> [code1,code2] = plipcodes('H','105BC7')
code1 = *H105BC7105BC6FFW*
code2 = *FFFFFFFFEFA4382*

Of course you don't show a leading H (or any character for that matter). The fact that you have a 'W' as the check character means that somehow the 'H' got left off on your tag or your barcode is not using the same code39 check character math.

What market is your fob from?
 
Reply
Old Jan 14, 2013 | 04:00 AM
  #24  
TwinDisco's Avatar
7th Gear
Joined: Jan 2013
Posts: 7
Likes: 0
Default

I am in South Africa
 
Reply
Old Jan 14, 2013 | 04:09 AM
  #25  
TwinDisco's Avatar
7th Gear
Joined: Jan 2013
Posts: 7
Likes: 0
Default

Brad, you are 100% correct, i made a mistake and left out the H;

Key Code;

105BC7

and in fact, the 2 codes from the bar code tag;

*H105BC7105BC6FFW*
*FFFFFFFFEFA4382*
 
Reply
Old Jan 15, 2013 | 06:14 AM
  #26  
TwinDisco's Avatar
7th Gear
Joined: Jan 2013
Posts: 7
Likes: 0
Default

I could not download the Octave software (firewall), so i gave the code to 1 of our software engineers which compile a small exe from it. The exe runs from the command prompt and now I dont need Octave any more, txs for sharing the code Brad.
 
Reply
Old Jan 15, 2013 | 07:21 AM
  #27  
LR Techniker's Avatar
Winching
Joined: Jun 2012
Posts: 692
Likes: 73
From: Denver, NC
Default

Brad's worksheet seems to work with known good barcodes, but you need to manually calculate the checksum for both barcodes and know the region code for it to work.
 
Reply
Old Jan 15, 2013 | 01:39 PM
  #28  
brad_ramsey's Avatar
Drifting
Joined: Sep 2012
Posts: 41
Likes: 7
From: Denver, CO
Default

Originally Posted by LR Techniker
Brad's worksheet seems to work with known good barcodes, but you need to manually calculate the checksum for both barcodes and know the region code for it to work.
This is good information, thanks. I had gotten some information that the checksums were not required when using a Hawkeye to program the BCU and so left that part out. I'll add instructions and some space to calculate the checksums in the worksheet.

For those jumping in at this point, the octave code listed in a previous comment does calculate the checksums for both codes. The region code must be provided by the user. So far my best guess is:
G = EU
H = South Africa
J = North America

I don't know if Australia and Asia (others?) use one of the above codes or have their own at this point.
 
Reply
Old Jan 16, 2013 | 03:02 PM
  #29  
brad_ramsey's Avatar
Drifting
Joined: Sep 2012
Posts: 41
Likes: 7
From: Denver, CO
Default Update worksheet

As promised, I have updated the worksheet for calculating the bar codes for a DiscoII keyfob based on the keycode sticker from inside the fob. The worksheet is now more complicated, but does provide instructions for calculating the check characters according to the code39 barcode spec.

The updated revision is available here:
https://landroverforums.com/forum/di...s-45057/page3/
post #23.
The new document is named disco2_fobcode_worksheet_20130116.pdf

I left the original document as well for reference.
 
Reply
Old Jan 16, 2013 | 10:47 PM
  #30  
TwinDisco's Avatar
7th Gear
Joined: Jan 2013
Posts: 7
Likes: 0
Default

Txs Brad, much appreciated.
 
Reply



All times are GMT -5. The time now is 04:58 AM.