Salutations

So as some of you may know when i got the old girl she was bit of a wreck, been standing alone for a number of years and some one had bodged and hacked away at it. Mainly down to having 1 battery and a piece of foil in the key fob which would then lead on to immobilizer issues and locked doors, ripped out interior and unplugged airbags etc.

The car was some how hacked that it would start via a button drilled in to the dash board.

The key would turn the ignition on, but then you would hold the silver button to start the engine

I found that the button was wired in to two relays in the fuse box.

I can only begin to assume the ecu has also been tampered with.

I have reversed most of this bypass ( re used the button for the fuel flap which had the button cut off also) and she now starts on the key and immobilizer is disarmed using the key fob also.

The problem has raised its head again as i have an ABS fault. Any fault code reader i have tried wont even read the fault. Also need to reset an Airbag Fault as well due to that being unplugged when i got it.

Snap-On, Solus, Cheap and cheerful blue tooth code reader, nothing even shows the faults

Now, when the garage opposite where i work plugged it in for me, it got to accessing the abs and srs parts and then it just kicked it back to the main menu. Wont even show the faults.

Would this be down to the type of test gear, or is this more problems caused by a hacked ecu.

A lot of friends i had from my D2 past said the ecu cant of been hacked like that etc etc. But then i found this video on youtube last night, which is near as damn it, the same as what someone had done to mine.

https://www.youtube.com/watch?v=gnSoWYzPuXA

So to cut the waffle down. Would the hacked ecu stop reading codes for the abs and srs or am i using the wrong kit ?

Is there anything i can look at regarding the ecu to see if i can reverse anything or repair anything ?

Each system has its own module. The ECU shouldn’t interfere with the ABS or air bag module. As the car isn’t OBD compliant, you will need a dedicated reader like a Nanocom.

As for the hacked ECU, you can get a GEMS ECU set up as a stand alone unit. Basically it is reconfigured to accept any code it sees from the BeCM and accept it, as opposed to looking for its own specific code. I thin Tornado charges under 100 quid for the mod.

With a Nanocom you can also sync any ECU to any BECM as well through the security learn menu.

There's a guy in the P38 UK group who does the same standalone Job for the GEMS and the THOR ECU. Simon Doherty ...

Snap-on, Solus, etc are OBD code readers so will only connect to the engine ECU, not the ABS or SRS ECUs. For that you need something intended for use on the P38 such as a Nanocom, Hawkeye, etc.

Thanks for the help guys

If the ECU is not the problem with the communication then I'm happy to leave it alone.

It's obviously down to test gear then.

Time to spend some money I imagine.

Thanks again for the help

Or find someone near you with a Nanocom. Lincs goes a long way North (and they keep moving the boundary), where are you near?

I am literally on the edge of the humber near Immingham

Marshall, for that stand alone ECU do I need to send the unit to Tornado, or do they send me something to install? Also, is this similar to Mobi-lize? I really should do something like this as I have only ever had one Fob (as I understand you can’t get a replacement for NAS) and I’m a bit afraid that when my Fob eventually dies, my P38’s life will be limited. (1997 GEMS).

One thing to bear in mind if you have a problem with the fob. If the car was locked with the fob and unlocked with the key, from then on every time you unlock the car you will need to enter the EKA to turn the immobiliser off (assuming you have an EKA programmed) until it is next unlocked with the fob. However, if the EKA is entered with a Nanocom then you can lock and unlock with the key and the immobiliser will be turned off. Quite how it works on a car with no EKA programmed I've no idea but you can check it easily enough. Lock it with the fob then unlock with the key. If it is still immobilised you have a problem until you next unlock with the fob. The key blade is a BMW blank and you should be able to get a spare cut easily enough.

There's always the guy in Wales that can supply a non-original keyfob.

Thanks for that

It unlocks with the fob once I originally paired it up OK and synced the fob by holding the lock and unlock button.

Iv also had to enter the EKA code if the battery has ever got too weak and lost the settings. But that was only during long periods where I couldn't make the time to do bits.

I didn't know that regarding the BMW blade. I can get a spare cut and then touch wood I guess I can always use the EKA code

My local Timsons didn't have the blank in stock but ordered a couple in and cut me a spare key. If I was to ever lose my fob then having a spare key at home wouldn't be a lot of good to me if I was miles from home so it's carefully waterproofed and secreted under the car. Even my MoT tester didn't spot it when it was up on the ramp but I know where it is.....

Richard thanks as always. I just locked it with the fob then unlocked it with the key and it started, so I suppose no EKA needed (?). Like you, I do have a non-fob key hidden in the vehicle.
This has happened to me twice in the 4 years I’ve had it, I unlocked the car with the key only, then when attempting to start it, the hazards flash and the hooter hoots (immobilized). As soon as I press the fob everything is happy again. My worry is that if the fob ever dies (or I lose it, or forget it in my pocket and go swimming) , the next time it immobilizes the vehicle may be unusable forevermore.

Grizzly wrote:

Marshall, for that stand alone ECU do I need to send the unit to Tornado

I understand they have a container load of them, so no, but they will charge you something for the replacement of course.

?????

Quoted the wrong post!! :)

Harv wrote:

I’m a bit afraid that when my Fob eventually dies, my P38’s life will be limited. (1997 GEMS).

You can get non-immobiliser ECUs, I can't see it being hard to "emulate" the immobiliser part of the BECM, and an unimmobilised GEMS ECU will start and run just fine whatever method you use to spin the engine over. If the ignition is on and the key is synced, jumpering the starter relay won't cause you any problems and it'll just fire right up.

KCR wrote:

There's a guy in the P38 UK group who does the same standalone Job for the GEMS and the THOR ECU. Simon Doherty ...

Is there an contact for Simon aside from Facebook (which I am not on) as I would be interested to learn
he has managed to bypass immobilization for Thor. I know it can be done, and I have had several conversations
with the Mobil-Ize bloke in Oz, who said he was contemplating the hack for Thor.........
As much as I "admire" the P-38 security system, I would install an engine immobilizer bypass in a blink!
Cheers

Gordon and Tom, thanks for the info. I will need to look into some sort of non-immobilized ECU then.

So I got one of these off the magic ebay and cleared all the air bag faults.. marvellous

And the abs fault that returned was this

Simplest fix of them all, hit the ABS sensor with a mallet to knock it in further.