Car Forum / Pontiac / Pontiac Cars / February 2006
Passlock I Hack?
|
|
Thread rating:  |
hboothe_no_spam@gte.net - 22 Jun 2004 05:29 GMT Hello, all, I have a friend who is working on a 1997 Pontiac Sunfire with Passlock I that is causing us fits. The symptoms are that it won't start because, according to his Snap-On computer, the "Theft deterrent" aka Passlock is shutting down the brain (killing crankshaft and camshaft position sensor signals). I have bypassed Passlock I & II systems before for remote start by checking the resistance across the lock cylinder with the key inserted and in the On position and then splicing in a pack of resistors that closely approximate the ignition switch's resistance but that has failed to fix this particular vehicle. The problem has been going on for sometime and has gone on too long. What I understand is that the instrument cluster, where these wires from the ignition switch for Passlock terminate, controls whether or not the brain fires the engine. If that is the case, there should be one wire that comes from the instrument cluster that can be 1) cut, 2) tied to another wire, or 3) run to battery positive or negative, to make the brain think the system is always green-lighted by Passlock. He changed the brain with no luck, and even the instrument cluster (not understanding the relationship between the brain, cluster, and ignition switch and how it works as a system) with no luck. I've tried both the original instrument cluster and the other one but neither one works. Can anybody tell me how to do a low-level hack on this Passlock system, please? Since putting the correct resistance in the system hasn't worked I am willing to strong-arm this POS by tinkering with the wires coming from the back of the cluster. :)
TIA
--HC
Neil Nelson - 22 Jun 2004 06:40 GMT > Hello, all, I have a friend who is working on a 1997 Pontiac Sunfire > with Passlock I that is causing us fits. The symptoms are that it [quoted text clipped - 21 lines] > worked I am willing to strong-arm this POS by tinkering with the wires > coming from the back of the cluster. :) Has your friend tried replacing the hall effect sensor* at the inner end of the ignition lock cylinder?
*(being a hall effect sensor explains why merely installing a fixed resistance in place in the circuit doesn't work) To enable a start, the instrument cluster has to see the signal from the hall effect sensor at the proper instant as the ignition switch is being switched on.
Most of the major manufacturers of remote starter systems sell a by-pass for the Passlock system.
hboothe_no_spam@gte.net - 22 Jun 2004 23:39 GMT > > Hello, all, I have a friend who is working on a 1997 Pontiac Sunfire > > with Passlock I that is causing us fits. The symptoms are that it [quoted text clipped - 33 lines] > Most of the major manufacturers of remote starter systems sell a > by-pass for the Passlock system. Neil, thank you for your response. My friend claims that the ignition switch is designed in such a way that it cannot be re-installed (his words, not mine). The problem we've had with the ignition switch seems to be that it's intermittent in showing the resistance value across the yellow (key-side) to black (splice) wire. I manually inserted and left resistors inline between the yellow (cluster-side) and the black wire splice and it doesn't work. I have bypassed Passlock II systems in a similar fashion, but what I did was to use a relay to flip the resistance in and out depending on the start command from the remote start system (too cheap and too impatient to wait for a bypass module) and it worked. The difference then would be that the remote start only kicks that resistance in when it's trying to start and leaving it out the rest of the time? Would running these resistors via a relay make the key difference? That would mimic the "bypass" modules I've seen in the past and the installs I've done that worked successfully for remote start.
Still, since the Passlock system is, at this point, scrappable, we're tempted just to cut a wire or splice a wire, or whatever, coming from the back of the instrument cluster if it'll just make the darned thing run. :)
Thanks again for your time.
--HC
Neil Nelson - 23 Jun 2004 01:40 GMT > Neil, thank you for your response. My friend claims that the ignition > switch is designed in such a way that it cannot be re-installed (his > words, not mine). Odd considering that it's a known weak point and a frequent repair.
> The problem we've had with the ignition switch > seems to be that it's intermittent in showing the resistance value [quoted text clipped - 5 lines] > from the remote start system (too cheap and too impatient to wait for > a bypass module) and it worked. I'm familiar with building your own by-pass with resistors and a couple of relays...
> The difference then would be that the > remote start only kicks that resistance in when it's trying to start > and leaving it out the rest of the time? Would running these > resistors via a relay make the key difference? That would mimic the > "bypass" modules I've seen in the past and the installs I've done that > worked successfully for remote start. It's all in the timing between the key on and when the hall switch sends its signal to the cluster.
> Still, since the Passlock system is, at this point, scrappable, we're > tempted just to cut a wire or splice a wire, or whatever, coming from > the back of the instrument cluster if it'll just make the darned thing > run. :) Were it that easy, it wouldn't be much of a theft deterrent, would it? The top of he dash comes off pretty fast allowing access to the back of the cluster. Another possibility would be a re-program of the PCM to not need to recognize the anti-theft signal from the cluster.
Paradox - 23 Jun 2004 04:38 GMT > Were it that easy, it wouldn't be much of a theft deterrent, > would it? The top of he dash comes off pretty fast allowing > access to the back of the cluster. > Another possibility would be a re-program of the PCM to not need > to recognize the anti-theft signal from the cluster. Yeah I think something upsteam more is messed up, its not the resistor in the ignition switch, or any of the wiring, the problem probably lies with the ECU not recognizing it anymore.
hboothe_no_spam@gte.net - 23 Jun 2004 16:07 GMT > > Neil, thank you for your response. My friend claims that the ignition > > switch is designed in such a way that it cannot be re-installed (his [quoted text clipped - 36 lines] > Another possibility would be a re-program of the PCM to not need > to recognize the anti-theft signal from the cluster. Neil, thank you again for your information (and thanks to Paradox, who's post is a level below this reply). I'm going to try to go over there today and put the resistance in line using a relay as opposed to the way it's just hard-wired in place now because of what you had said about the Hall effect switch. What you say makes sense that leaving a hard-wired resistance in there would not work, so I'm going to try switching it in and out.
As for the hall-effect sensor, my friend can be very hard-headed and isn't always right; I'll contact the dealer to ask them about it and see what they say (not to question what you're saying but to find if it's available and then maybe cajole a little guidance from them in the manner of replacing the item).
Well, it still seemed like a sound idea; that you could disconnect or otherwise disable the Passlock via a single wire from the instrument cluster. I realize this would be a single point of failure for the Passlock, but I didn't consider the back of the cluster that accessible. No matter, how would a person "re-program the PCM to not need the anti-theft from the cluster"? That sounds like the most promising piece (if it's fast and easy to do).
Thanks again for your help.
--HC
hboothe_no_spam@gte.net - 24 Jun 2004 02:25 GMT > > > Neil, thank you for your response. My friend claims that the ignition > > > switch is designed in such a way that it cannot be re-installed (his [quoted text clipped - 62 lines] > > --HC As a follow up, I tried using a relay to only interject the resistance when the key was in the crank position and it at least ran for a few moments before Passlock (theft) shut it down. :) That's a step ahead of where were, but still not all the way. :( I tried a pot and ran resitances from 400 to 16,000 ohms, in roughly 100 ohm increments with no luck (passlock would shut it down each time). Supposedly, according to my friend, you have to let the system "reset" for 10 minutes after a failed attempt and I didn't do that (I hit at least 50 different stages between 400 and 16,000 ohms and that would have been almost 10 hours of waiting interspersed in there. The ability to tell the ECM to skip the Passlock "okay signal" seems to be our best hope.
--HC
Neil Nelson - 24 Jun 2004 04:05 GMT > Neil, thank you again for your information (and thanks to Paradox, > who's post is a level below this reply). I'm going to try to go over [quoted text clipped - 3 lines] > hard-wired resistance in there would not work, so I'm going to try > switching it in and out. This site shows how to build/wire the relays and resistors to bypass passlock 1 and 2
http://www.e-z.net/~iei/vatts.htm
Going off of memory, all of the hall effects switches I've ohmed out, all had the same value, don't recall what the ohmic value is but if you can put an ohmeter on a working one, odds are that value will work for your vehicle.
> As for the hall-effect sensor, my friend can be very hard-headed and > isn't always right; I'll contact the dealer to ask them about it and > see what they say (not to question what you're saying but to find if > it's available and then maybe cajole a little guidance from them in > the manner of replacing the item). Got a friend/fellow shop owner in town here who's the same way...;-)
> Well, it still seemed like a sound idea; that you could disconnect or > otherwise disable the Passlock via a single wire from the instrument [quoted text clipped - 3 lines] > need the anti-theft from the cluster"? That sounds like the most > promising piece (if it's fast and easy to do). One of the custom chip builders my have a way to re-program the PCM, another option would be a PCM speced for an export vehicle. In the old days of replaceable PROMs, one could just swap out the PROM for one that didn't have an anti-theft feature. Option three is to buy a by-pass from one of the remote starter manufacturers, in a day or two + $30 and it's running.
> Thanks again for your help. Glad to help.
hboothe_no_spam@gte.net - 25 Jun 2004 02:26 GMT > > Neil, thank you again for your information (and thanks to Paradox, > > who's post is a level below this reply). I'm going to try to go over [quoted text clipped - 41 lines] > > Glad to help. Here are several sections to describe how I was able to achieve a fix for a *presumed* faulty ignition switch. Bear in mind that as time wore on my attempts got more wild and were less documented, so don't crucify me if some of this seems completely hoaky, I'm just passin' on what worked in this case.
THE SHORT VERSION I had hard wired the correct resistance between the Yellow and Black wires but this failed to bypass Passlock 1. Neil had suggested that (via/because of a Hall effect switch) that the resistance was to be put in to play at specific points during the ignition sequence: Run-Crank-Run. Accepting this I attempted a simple relay circuit as I've used in the past to bypass Passlock systems which, as you've read above, failed. That was yesterday. Today I hit it again and found that I'm an idiot, I had wired the relay so that the resistance was only in play during crank, not during run. Switching the connections on the relay so that the resistance was put into play *only* when the switch was in the run position fixed the car. It ran immediately (so, no 10 minute "reset" timer, no run-off-run-off-run BS then let it sit 15 minutes, it ran immediately when the right resistance was put in the circuit at the right time. I then broke the connection between the Yellow wire and the resistance, effectively disconnecting any connection to the Yellow wire which then illuminated the Theft light, but the car kept running. Subsequent attempts to start the vehicle without the resistance/relay circuit are *successful*, with the only holdup being that the Theft light stays on constantly. A T-15, 6 or 8 screws, and a soldering iron later...no LED for the theft on the instrument cluster PCB, voila!, no Theft light. Yes, a shade-tree hack, but I live in the sticks and I don't have to put up with city traffic, so there! <grin> No resistors, no relay, the car starts fine everytime.
THE DETAILS: I had put the damned resistors in line with the black/yellow wires, but I had powered the relay with the crank wire in such a way that the relay applied the resistance *only* in the *crank* position of the ignition switch. Stupid mistake, no excuses, just stupid. I noticed my error today, which meant that yesterday, using a Pot. to try resistances from 400 to 16,000 ohms was *completely wasted time*. I put the resistance in place today correctly (the crank wire flips a relay *removing* the resistance from the circuit, but at rest, the resistance is in place) and the car ran immediately, no reset time (none of that "leave the key on, door open, hold your breath, kiss your sister, and scratch your left earlobe BS"). While it was running my buddy asked me if the car would keep running if I removed the resistance to which I replied that it would (based on a similar test on a Passlock II system I had worked on). I *disconnected the yellow* wire from the circuit, effectively leaving it open *while the car was running*. He then claimed that I might not have fixed the problem because sometimes a successful start will be repeated several times even though the theft system is not properly cleared (BS, I thought, but I didn't challenge him). However, I then remembered a post I saw online (via Deja) about a possible bypass for Passlock I (and maybe II); the process was thus, 1) start the car normally with the key, 2) while the car was running, cut the yellow wire. That's it. Supposedly that completely disabled the Passlock system. I inadvertently affected that solution when I, to prove to my buddy that I knew the car would keep running with out the resistance, removed the connection to the brain-side of the yellow wire. I proved it then when, again to prove to my buddy that the car wouldn't start without the resistance in place, started the car (to my chagrine (sp?)) without the resitance in place and *WITH THE YELLOW WIRE CUT AND NOT CONNECTED TO ANYTHING* (which means that it could *not* have been because the ignition switch worked correctly). I had read several sites (including the site that Neil had sent me a link to (http://www.e-z.net/~iei/vatts.htm)) and had seen instances of tying the bulb-test wire to ground during specific moments of the ignition sequence, and I had thought that might play a critical role in the process, however, it did not make any difference in this application as I have that wire untouched now and the car runs fine.
THE BACKROUND (for those who didn't read the whole post history) 1997 Pontiac Sunfire. Stars. Dies moments later. Snap-On computer indicates theft system/CMK & CRK (I think those were the codes) undetected (those are the cam shaft and crank shaft position sensors). Buddy replaces the computer, no improvement; car starts, dies. Buddy replaces the instrument cluster (which houses, at least in part, the Passlock circuitry to check the resistance of the ignition switch).
THE (hopefully) REPRODUCIBLE PROCESS Cutting into the *thin* yellow wire on the passenger-side of the steering column, by the ignition switch (one of three; black, white, yellow (search online for "bypass passlock I" or "bypass passlock II", or visit the link that Neil has provided earlier in his post, or quoted here in mine)) and measuring the resistance between the *cut* end of the yellow wire on the switch-side to a bare, stripped spot on the black wire, with the key in the Run position, yielded a particular resistance. Mimicing that resistance with resistors and placing it between the computer/instrument cluster side of the yellow wire and that bare patch on the black wire by using a relay controlled by the *thick* yellow crank wire (on the driver's-side of the steering column) such that the relay inacted the resistance at run, but *not* crank, caused the vehicle to start properly. While it was running, breaking the connection from the yellow (thin) wire to the resistance *seems* to have caused (corroborating another post online) the system to permanently bypass the Passlock I system; subsequent starts neither required the resistance/relay setup, NOR the yellow wire (thin) to be hooked to *anything*, not even itself. Opening the instrument cluster and de-soldering the THEFT LED prevents the LED from staying on constantly, which it did after this permanent bypass.
THE NAGGING TRUTH This was all today. It may fail tomorrow and never start again. I hope this helps y'all. Thanks to all who replied to my question, especially Neil.
Thank God, it's runnin'. :)
--HC
=AB Paul =BB - 25 Jun 2004 02:43 GMT I wonder if it would reset if the battery was removed and capacitors drained?
hboothe_no_spam@gte.net - 25 Jun 2004 17:16 GMT "=?x-user-defined?Q?=AB?= Paul =?x-user-defined?Q?=BB?=" <stapy@houston.rr.com> wrote in message news:<40DB82FB.71E67102@houston.rr.com>...
> I wonder if it would reset if the battery was removed and capacitors drained? Hmmm, if it isn't Captain Killjoy! <grin> That's a very very good point. I will have my buddy test it. Damned good thought. I'll let y'all know how that turns out.
--HC
hboothe_no_spam@gte.net - 26 Jun 2004 04:21 GMT > "=?x-user-defined?Q?=AB?= Paul =?x-user-defined?Q?=BB?=" <stapy@houston.rr.com> wrote in message news:<40DB82FB.71E67102@houston.rr.com>... > > I wonder if it would reset if the battery was removed and capacitors drained? [quoted text clipped - 4 lines] > > --HC I disconnected the battery today (both positive and negative terminals to be thorough) for 20 minutes. I then re-connected the battery terminals and attempted to start the vehicle. It started and ran perfectly. It would *seem* that loss of power did not affect the bypass. I suppose a more thorough test/answer would be to disconnect the battery for a day or more and then to start and kill the engine repeatedly, over days of testing. However, this prelimnary and short test indicate that the solution is a permanent fix.
HTH, and thank you for your suggestion which was very valid and which I had not even thought of until you mentioned it.
Take care.
--HC
Neil Nelson - 25 Jun 2004 15:21 GMT <snip>
> THE NAGGING TRUTH > This was all today. It may fail tomorrow and never start again. I > hope this helps y'all. Thanks to all who replied to my question, > especially Neil. > > Thank God, it's runnin'. :) Hot damn, ya got it!
Post back in a few days and let me know if what you did effectively neutered the anti-theft for good.
hboothe_no_spam@gte.net - 26 Jun 2004 04:35 GMT > <snip> > [quoted text clipped - 9 lines] > Post back in a few days and let me know if what you did > effectively neutered the anti-theft for good. Neil, I posted back about the "disconnect battery" post trying to keep it in-line for those who will read this in Deja for years to come, and I'm posting it here, too, for your convenience; disconnecting the battery seemed to have *no* effect on the bypass/hack/plunder of the Passlock I system. While the time of only 20 minutes of the battery being disconnected may not be long enough, it *should* have been more than enough, I would think. I will be out of town and pocket for the next few days during which I will have to rely on my buddy's reports of the effectiveness of the solution. In all honesty, I think a more *elegant* solution would have been to wire the relay and resistance into the circuit and have simply left that there, along with the functioning Theft LED, but the strain on my time prevented such elegance. BUT, for those in need of a simpler solution, the temporary attachment of the relay and resistance coupled with breaking the connection to the yellow wire while the car was running, therefore allowing the complete removal of any resistance/relay/etc. may be the perfect solution.
In the end, thank God, it runs, I gave some assistance to my buddy who is the person I always call when I need car questions answered, and I've passed it on to the Groups. I feel pretty good. :)
Y'all take care.
--HC
Dog - 05 Dec 2005 22:21 GMT My security light started coming on again about a year after paying the dealership $450 to replace a faulty Ignition lock cylinder. I was at my wit’s end. My wife and kids would be stuck at night in some shopping center parking lot waiting 10 minutes to reset the stupid thing. After reading the above thread, I was able to Bypass, disable or Ghetto Hack my passlock II system on my 2002 Oldsmobile Alero without relays or resistors. I had my local Auto wiring tech install a $5 on/off toggle switch into the yellow (resistance) wire that you are supposed to cut and mount it under my dash in the event that a dealership tech reset the security “fail- enable” mode or the battery stayed disconnected for an extended period of time. All I need to do is flip a switch to break the circuit again while the car is running. Here is another thread and some supporting evidence of why this actually works. The entire job took 25 minutes. If my security light goes out, that’s when I know that there’s a problem. You could also remove the bulb if the security light really bothers you. This apparently works for both passlock I and passlock II. There is an incredible link below with high resolution pictures of the wiring for your specific car. I included the actual photos that I used to access my ignition lock cylinder wiring. Good luck and post with your success stories! 12/4/05 http://www.the12volt.com/installbay/forum_posts.asp?TID=59694&PN=1&TPN=1
http://www.insurorsservicebureau.com/ISB%20technical/ISB_QA.pdf page 4, The PASS Key Module also has the ability to allow engine operation if it recognizes a system fault in the ignition key reference circuit while the engine is running. In this case the Module enters and remains in a mode which allows the engine to be started and run without reading the resistance chip. This mode requires that the original factory resistance chip key be in the ignition lock cylinder at the time the fault occurs. During this mode, the security light will be ON all the time. When the key reference circuit is repaired, the module will automatically reprogram itself to the mode requiring the original resistance chip.
http://www.motorage.com/motorage/data/articlestandard/motorage/292005/169809/art icle.pdf page 3, If the correct key is in the cylinder and that circuit fails while the engine is running, this is considered a malfunction, not a theft attempt. The “Security” light may turn on to warn of a system malfunction, but even if it doesn’t, a key recognition circuit failure with the proper key in the lock will cause the TDM to enter what GM calls a “fail-enable” mode. Essentially, the theft-deterrent system goes offline and the engine will start and run with any key that turns the lock.
http://www.directwholesale.net/diagrams/Images.asp?ImageID=84&link=BULLDOG http://www.directwholesale.net/diagrams/Images.asp?ImageID=87&link=BULLDOG
http://www.bulldogsecurity.com/ and click on vehicle wiring diagrams to select your particular make.
Dog - 25 Feb 2006 21:07 GMT Here is the finalized procedure. There is no need to install a remote starter.
PASSLOCK I or II DISABLEMENT
The following is a procedure to disable Passlock I or II Systems for vehicles in which remote start/stop system installations are required. This procedure is required because a remote start system will not function with the current Theft Deterrent System (Passlock) which is included on many 1996 and up GM vehicles.
Please note that this modification is intended to be used only in conjunction with the installation of a remote start/stop system and does not provide a procedure to install a remote start/stop system.
CAUSE If an attempt is made to start a vehicle by a means other than a key rotation in the ignition switch, the Body Control Module (BCM) will interpret this start as a vehicle theft and disable the fuel injectors.
CORRECTION A minor wiring modification may be made to allow the vehicle to be started remotely. This modification includes adding a switch to allow the customer to select “ON” to disable Passlock or “OFF” for normal Passlock operation.
CAUTION: When this modification is performed and the switch is set to the ON position, the theft deterrent feature will be disabled. When the theft deterrent is disabled the SECURITY or THEFT telltale will light up indicating that the theft deterrent system is NOT functioning.
PASSLOCK MODIFICATION Refer to appropriate GM service manuals and/or SVMQP Electrical Guideline Manual for instruction on splicing and electrical connections. 1. Select a suitable on-off switch (see note below) which will be used to disable/ enable the Passlock System. Mount the switch in a location such that it is accessible to the driver and will not interfere with normal vehicle operation.
NOTE: This is an extremely low current circuit (approx. 7mA), it is therefore very important that a high quality, low energy, fast acting switch be utilized for this application. 2. Turn the ignition switch to the OFF position. 3. Locate the Main Ignition Switch Harness in the Column. GM's Passlock System wires exit the Ignition Switch Tumbler together and then join with the Main Ignition Switch Harness. (See http://www.bulldogsecurity.com/ or http://64.85.6.118/diagrams/diagrams.asp and select your Make, Model and Year for wire colors and clues on the quickest way to access these wires.) 4. Locate the Yellow Passlock Data Wire which is included in a bundle of three tiny (20 GA) wires wrapped in friction tape. Cut this wire and splice a 0.5mm2 (20 GA) yellow wire to each end of the cut wire. Keep wire length to a minimum. Route modification wires clear of moving parts.
Connect the yellow wires to the switch such that the contacts are OPEN when the switch is in the ON position. 5. Turn modification switch to the OFF postion (contacts closed). 6. Start vehicle to verify normal operation. If engine “cranks but will not start" recheck the switch position (contacts should be closed), wire connectors and modification wiring.
SWITCH OPERATION
To enable remote start: Start the engine with the ignition key (modification switch must be in the OFF position). Turn modification switch to the ON position (contacts open). The SECURITY or THEFT telltale will light up indicating that the Passlock System is inoperative. Once the SECURITY or THEFT telltale has been on for at least 5 seconds the vehicle can be turned off and then remotely started.
To disable remote start: The Passlock System can be reactivated by turning the modification switch OFF (contacts closed). Vehicle can either be running or off when this is done.
Please note that the VCM/PCM will record Diagnostic Trouble Codes (DTCs) related to the security system when the modification switch is in the ON position (circuit open). This is due to the way that the VCM/PCM interprets this condition.
NOTICE Any condition which removes battery power from the Vehicle Control Module/Powertrain Control Module (VCM/PCM) (e.g. dead battery, disconnected harness connectors, etc.) will prevent the vehicle from being restarted. If the engine exhibits a “cranks but will not start” symptom, place the modification switch in the OFF (contacts closed) position. This will reactivate the Passlock System and allow the vehicle to be started with the ignition key.
Dog
|
|
|