Immo off trionic 7

The immobilizer number is listed on the Twice unit. if you don't have a tech 2, and don't mind removing the seat you can simply read it from there!
Starter relay is activated by TWICE, grounding relay pin 85. If you make permanent connection between relay pin 85 and ground, Car will start if IMMO is disabled in ECU software

Below Mirrored from TrionicTuning so it never gets lost

As some of you know, we have been fiddling around a bit with removing the immobilizer check function from T7. After some testing, i have managed to figure out where and how to "disable" the immobilizer code check in the T7 binary, bellow is a small writeup of how.

What does this do?

This "Hack" will remove the immobilizer code check completly from the binary. However, the twice functionallity will still be intact so you still have to have the appropriate key to start the car, therefor this should NOT affect the cars "security features". You can after theese changes, upload a bin with either your correct immobilizer code or a bin with a faulty immobilizer code and it will still start and should not give any errors what so ever.

How is this tested?

First of all, this was done to help White_Estate here on the forum to be able to run a closed bin with tipin/out maps in is Saastra (Vauxhall astra with T7 engine+ECU). This was tested and confirmed firstly in his car, after that i asked Aeroride to do the same in his 9-5 with twice and everything - Both tests where a success!

Base binary used was from a 9-5 B205 MY2005 (EG03Y5OC.46E)

How to do it

First of all, you will have to find the immobilizer instructions in the code, the ones you want to look for in the dissasembler is theese (example addresses below is from the binary we used for this test):

00030538: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
0003053E: 6762				BEQ	000305A2

00030A98: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00030A9E: 6724				BEQ	00030AC4

00030AA0: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00030AA6: 671C			BEQ	00030AC4

00030AE8: 4879 00F0 63F2		PEA	(ROM_obdImmobilizerStatus)
00030AEE: 4878 0001			PEA	(0001).W

00030BCC: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00030BD2: 6714				BEQ	00030BE8

00037DA8: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00037DAE: 6730				BEQ	00037DE0

00037DB0: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00037DB6: 6608				BNE	00037DC0

0004186A: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00041870: 6710				BEQ	00041882

00041872: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00041878: 661C				BNE	00041896

Once you found all the addresses, open up the binary you are working with in a hex editor, "search" for the address and you should find the value (underlined) What you want to do here is to change the "BNE"'s and "BEQ"'s into "BRA"'s. Also, you will have to change the value of 'ROM_obdImmobilizerStatus' to 0000.

Short list of what is what in hex:

BNE = 66 BEQ = 67 BRA = 60

Verify your changes:

Once you have made all the changes needed for this, doublecheck your binary. You can do this easy with the following steps:

1: Rename your edited binary so it does NOT have the same name as when you did the complete dissasembly the last time in T7 suite. 2: Open the binary in T7 suite and VERIFY CHECKSUM <---- YOU HAVE TO DO THIS BEFORE YOU PROGRAM YOUR ECU WITH THIS BINARY! 3: Run a complete dissassembly on the "hacked" bin and verify so that the output this time is as the one bellow

00030538: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
0003053E: 6062				BRA	000305A2

00030A98: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00030A9E: 6024				BRA	00030AC4

00030AA0: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00030AA6: 601C			BRA	00030AC4

00030AE8: 4879 00F0 63F2		PEA	(ROM_obdImmobilizerStatus)
00030AEE: 4878 0000		PEA	(0000).W

00030BCC: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00030BD2: 6014				BRA	00030BE8

00037DA8: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00037DAE: 6030				BRA	00037DE0

00037DB0: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00037DB6: 6008				BRA	00037DC0

0004186A: 4A39 00F0 3A24		TST.B	(ROM_Immo.killInjection)
00041870: 6010				BRA	00041882

00041872: 4A39 00F0 773C		TST.B	(ROM_Immobilizer_Enable)
00041878: 601C				BRA	00041896

Once you have checked so that everything is looking as above, go ahead and upload it to your ECU with what ever immobilzer code you want :)