Alfa Romeo Forum banner

1 - 20 of 56 Posts

·
Registered
Joined
·
38 Posts
Discussion Starter · #1 · (Edited)
Extract unlock code from key remote: GTV, Fiat Coupé/Brava/Punto and equivalent cars

Hi, can somebody explain how to extract the unlock code from an Alfa GTV red remote key?
 

·
Registered
2003 Spider 3.0 V6 24v Lightning Blu
Joined
·
2,281 Posts
I'm looking for this too. Tony from datarecall doesn't respond to emails anymore.
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #4 ·
There is a guy called Giallo who is on the Alfa 145 forum and he has been offerering this service before, but he does not respond.
 

·
Registered
2003 Spider 3.0 V6 24v Lightning Blu
Joined
·
2,281 Posts
Let us know if you get a response. I've got one working key that 'talks' to the reciever but doesnt operate the alarm module. As far as I understand I need to re-program my reciever in protected mode to get the key, reciever and alarm box all to recognise the same code.

Sooooo I really need the code recovered from the one working key.
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #7 ·
Based on the few photos of the circuit board that I have seen, there is a PIC processor doing the work.

According to some research it is possible to hack the PIC processor by manipulating the voltage level required to power up the processor; power glitch vulnerability or what it is called.

Obviously this is possible since there used to exist services that were able to read the contents of the remote key processor without damaging it.

Thoughts, anyone?
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #8 · (Edited)
Problem solved:
1. bougth a spare GTV receiver
2. extracted the memory from the receiver
3. calculated the code to unlock the receiver
4. hooked up the receiver to an external power source
5. unlocked the receiver with the recently extracted unlock code
6. programmed the original GTV key to the receiver
7. disconnected the receiver
8. extracted the memory again and calculated the code for my real GTV key that I previously added to the receiver

Went to my beloved GTV, unlocked the receiver on site using a pen, then added two used one button blue Fiat Brava/Punto/etc remotes bought on Ebay to the receiver and voilá, now I have got three working remote keys that operates the remote locking system flawlessly :)

The blue Fiat one button remotes can regularly be found on Ebay, and the circuit boards come equipped with either PIC or ATMEL processors, both work with the remote locking receiver (I tested them on the spare receiver).
And as always, a working remote flashes constantly when pressing the button. I have a non-working remote and it flashes only once.
 

Attachments

·
Registered
Joined
·
38 Posts
Discussion Starter · #9 ·
And:
- yes, a blue Fiat one button remote (as shown above) with CODE2 does also work, the circuit board is the same, the only difference is the transponder and the CODE2 marking on the key blade
- once you have added a new remote to the receiver and extracted the code for the new remote, that code will also unlock the receiver along with the other known unlockning codes.
 

·
Registered
Joined
·
81 Posts
Very interesting post. Is there any other way of calculating the reciever code to unlock it? Or just with that PIC reader?

When the unit is unlocked, can you add a new key as described in the workshop manual (simple programming)?
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #11 ·
It is not a PIC reader :), it is a PROM reader that reads the memory of the receiver, where the unlock codes can be found.

And yes, when the unit is unlocked a new key can be added as described in the workshop manual. Which is protected programming, meaning, you have to unlock the receiver in order to add new keys.
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #12 ·
As far as I know there is no other known way to obtain the unlock code other than extracting it from the receiver.
Maybe it is possible to hack the PIC processor but I would not bother since the receiver method is so simple.
 

·
Registered
Joined
·
81 Posts
Thanks ;)

I will look for somebody here, in Canary Islands, with a PROM reader. Don know when, but I will open my gtv with a remote key. I swear!!! :D :D
 

·
Registered
Joined
·
1,390 Posts
Receiver

:thumbu p::thumbu p::thumbu p:
Problem solved:
1. bougth a spare GTV receiver
2. extracted the memory from the receiver
3. calculated the code to unlock the receiver
4. hooked up the receiver to an external power source
5. unlocked the receiver with the recently extracted unlock code
6. programmed the original GTV key to the receiver
7. disconnected the receiver
8. extracted the memory again and calculated the code for my real GTV key that I previously added to the receiver

Went to my beloved GTV, unlocked the receiver on site using a pen, then added two used one button blue Fiat Brava/Punto/etc remotes bought on Ebay to the receiver and voilá, now I have got three working remote keys that operates the remote locking system flawlessly :)

The blue Fiat one button remotes can regularly be found on Ebay, and the circuit boards come equipped with either PIC or ATMEL processors, both work with the remote locking receiver (I tested them on the spare receiver).
And as always, a working remote flashes constantly when pressing the button. I have a non-working remote and it flashes only once.
Hi and well done for managing to acheive this. I have also tried to contact Giallo on the Alfa 145 forum without success - I think he has had too many requests! On that topic - I don't suppose you'd be willing to do the same thing for me?? There is money and beer waiting for you!! Pretty Please? :beer:
 

·
Registered
Joined
·
1,390 Posts
PROM reader

OK then, if you can't do it for me, how easy is it to buy and use a PROM reader?? :devious:
 

·
Registered
Joined
·
515 Posts
OK then, if you can't do it for me, how easy is it to buy and use a PROM reader?? :devious:
I don't know if you noticed but m54b30 is located in Sweden, so there might be some logistic problems. :classic:

Try contacting Cromwell on this forum. He will probably be able to help you.
 

·
Registered
Joined
·
1,390 Posts
Logistics

Hi Redtop - yes I did notice but I thought maybe I could post him my receiver and keys, so he could repeat the process :thumbup:
I guess its too much to ask someone when I'm a newbie!
Thanks for the tip - I'll try to contact Cromwell.
Tack!
 

·
Registered
Joined
·
38 Posts
Discussion Starter · #18 · (Edited)
No worries (that's a New Zealand thing I know :) )
PM works best to get in contact with me since I am not visiting the forum everyday.

Anyway, for those equipped with any technical knowledge doing this by yourself is not a big deal, so I am encouraging everybody to try :)

The challenge is to find a spare receiver, but I got mine from Autolusso so it is possible.
How others are doing this I don't know but I would not be surprised if they also are using a spare receiver. According to legend it is possible to hack the PIC processor in the remote but I would not do that unless I really knew what I was doing.
 

·
Registered
2003 Spider 3.0 V6 24v Lightning Blu
Joined
·
2,281 Posts
GialloEvo extracted the codes from one of my keys programmed into the receiver and one that was not. My main problem was twofold:
-I had only one working remote and no way to program another.
-my alarm didn't work because on initial remote programming the alarm module reads the key code from the receiver and only disarms on receiving the correct code.

Once I'd received my remote boards back from him it took me literally 5 minutes to program into the receiver and the whole system (alarm and all) sprang to life.

I've got his email address on an old laptop in th cupboard. I'll have a look tonight and PM To you UncleJam.

He does take awhile to respond but he's a top bloke and incredibly helpful.
 

·
Registered
Joined
·
1,390 Posts
Many thanks for that - much appreciated.
 
1 - 20 of 56 Posts
Top