First off thanks to @dpodo for the inspiration and starting point for the Gen 3 window up with factory remote mod. The Gen 3 and Gen 4 harnesses are a little different, but I got my voltmeter and schematics out, figured out what wires did what, and made it happen. Herse a link to his Gen 4 write up:
Back Window Up Hack with Factory Key Fob - Toyota 4Runner Forum - Largest 4Runner Forum

If you want this for your 3rd gen, please read on.



As the title says, this mod will allow you to use a factory keyless entry remote on a 3rd gen 96-02 to roll up the rear window. I feel this is the most less obtrusive way to add to the back door ecu, and requires t-splicing into 4 wires coming out of the B18 wire harness of the back door ecu. I used T-splices for this mod as they do not require cutting and can be taken off easily if you want to remove this mod. You can tap into the wires however you see fit.

My mod includes 6 items. Few feet of 18 or 20-gauge wire (speaker wire is fine), "normally open" magnet switch, PAC TR7, T-splices with quick disconnects, 5 pin relay, insulated spade connectors. I had a few of these items laying around but here are links to the items. Its best if you buy the simple "normally open" or "no" magnet switch with the permanent wires as linked below because if you get "normally closed" or "nc" this mod will not work with these instructions. There are also magnet switches that do both "normally open" AND "normally closed" and you choose which circuit it is based on attaching your wires leads to 2 of 3 available poles. If you choose that magnet switch, wire it to be "normally open" and you’ll be fine.

NTE Electronics 54-630 Magnetic Alarm Reed Switch, SPST-NO Circuit, NO for Closed Loop System Action, Magnet Actuator, White
http://a.co/8tAHWv6

PAC TR-7 Universal Trigger Output Module for Video Bypass
http://a.co/fWEJ1NY

Ginsco 120 Pcs/60 Pairs Quick Splice Wire Terminals T-Tap Self-stripping with Nylon Fully Insulated Male Quick Disconnects Kit
http://a.co/iOqfme5

Audiopipe 12 VOLT DC 40 AMP SPTD AUTOMOTIVE RELAY 5 PIN WITH MOUNTING TAB
http://a.co/bvGBEt7

Ginsco 300pcs 22-18 / 16-14 / 12-10 Gauge Nylon Fully Insulated Female Spade Wire Crimp Quick Disconnects Wire Terminals Connector Set Red Blue Yellow
http://a.co/7potNgd




Explanation:

The back window can be rolled up and down by a key switch on the back door. When you use the key switch to roll down the window, the switch sends a grounded signal an internal relay of the back Door ecu, which sends positive and negative current to the window motor rolling it down. When you use the switch to roll up the window the same happens just with the polarity reversed, making the motor roll the window up. This mod just mimics the switch being used to roll up the window.

When programming your PAC TR7 you can choose 2, 3, 4, or 5 clicks as the trigger. I used a double click of the rear window button on the remote to roll up the window. When you double press the window button of the remote, the PAC TR7 detects this double press and activates the 5-pin relay causing it to close. The TR7 will only receives this double press signal if the window is rolled all the way down which closes a magnet switch in the back door. This prevents the TR7 from activating while the window is not fully down and trying to roll the window up at the same time. So, when the TR7 receives the double press, and the window is down, it closes the 5-pin relay. When the relay closes, it sends the ground signal to the back door ecu making it think the key window switch is in the window up position. I programmed the TR7 to keep the relay closed for 6 seconds, which is all the time needed to roll the window up.









Installation (connections made in no particular order, might be good idea to disconnect the battery during install to prevent damage if accidental short and potential damage to back door ecu):

Wires t-spliced into of the B18 harness of the Back door ecu are Blue #1 wire (main power), Green with red stripes #9 wire (Window roll up signal from window switch), Green #12 wire (signal of double press from the magnet switch), #26 White with black stripe (ground). The Blue #1 will be connected to the Red of the TR7, the Green with red stripes #9 will be connected to the #30 of the relays, the green #12 will be connected to one of the magnet switch wires, and the white with black stripe will be connected to the relay #86, #87, and the black wire of the TR7. Any of this making sense? good! After making these connections, you only have 2 more to make. These 2 connections are on the TR7 and they are the TR7 green wire connects to the second wire of the magnet switch and the TR7 blue wire goes to the relay #85. that’s it! simple!

For those that are hesitant about programming a PAC TR7, its simple. Mine came with great instructions, I just had to practice the procedure a few times to make sure I got it right. Patience is key, it make take a minute or 2 but it’s worth it. Disclaimer for the TR7, the TR7 has a 4 to 5 second window for detecting the double click, and since it is triggered off the positive current of the window rolling down, if you press the remote button as soon as you window has rolled down, it will detect that click as the second click and roll it back up. It's not a problem in my book, just dont be surprised when youre messing with it when you install it, and "single click" as soon as the window is finish rolling down and it rolls back up. Here’s a link to the instructions I had, I found the flow chart to be very helpful.

https://pac-audio.com/index.php?cont..._attachment=68


Also I made a movie of how to program the PAC






Here is where I try to explain it with pictures…



This is your back door...




This is the back door ECU...




The white harness coming out of the bottom of the back door ecu is the B18 harness...




This is a pin guide taken from the field service manual of the B18 harness, showing which wires need to be located and spliced into.




Here is a picture of the T-splices on the wires of the B18 harness...




Here is what it looks like with the spade connectors connected...




Here is a shot of the magnet switch base placed on the bottom of the back door. I clean the door real well with laquer thinner and used the supplied double sided sticky to attach it. I found where it needed to be placed by rolling the window all the way down and marking a spot where would work but be out of the way of all moving parts of the window.




Here is a shot of the magnet double stickied to the bottom of the window track, i cleaned this as well with laquer thinner to make sure its stuck on good. And making sure it lines up with the base magnet and is out of the way of all moving parts.




The next 2 shots are of both magnets in their sequence.

&




This is the bundle of the TR7 and 5-pin relay with corresponding connections.




Here is the whole setup before I cleaned it up…




And this last one is the finished install before putting the cover back on.




I’m ready for the critics and haters, but if you want something else because you don’t want to splice wires or it needs to be easier; ill be happy to hear your solution. If you can hook up your surround sound, you can do this, it’s simple.

Nice work! Not sure I'll ever go through with it, but good to know there's something out there.

Well, I'm impressed . Well done .

Impressive!! Been looking for something like this for a while and was probably going to put some time into doing it myself. Great write-up!!

This is great! Definitely going to add this to my to do list. Thanks!

Fantastic!

On my remote all I have is door lock and unlock. I have an aftermarket key fob :-(

Incredible write up sir!
Kudos to you.

Damn. That TR7 module is cool.
So, would you need another module to have another 3-click function? 2 clicks for back window up, 3 clicks for all windows down, 4- clicks for all windows up...
Too far?

Probably it's possible to adopt TR7 to roll up/down all side windows. Should it works connected to main windows switch ( driver door) thru 4 or 8 relays ( 4 up, 4 down).
It shouldn't be to complicated, maybe needs to be use 2 TR7 ? 1 for roll up and 1 for roll down.
anybody have time to figure out it ? ;)

Not sure you could use the same button for multiple tr7, cuz if one tr7 is set to 2 click, and the other is set to 3 click, my guess is the one 2 click would trigger as you are trying to 3 click. Make sense?

I bet you could set a tr7 on like a 4 press of ur lock button, and another on a 4 press of you unlock. So essentially if you have a 3 button remote you can have up to 6 functions that way. Dont think I'd do it tho cuz sometimes I click the lock or unlock button a whole bunch at once to make sure its locked or unlocked.

You could get crazy with tr7s and make it where you clicked a sequence of buttons it performed functions as well. You could have all windows up tr7 set to 3 lock clicks, and an all down set to 3 unlocks clicks. You would have a third tr7 set to 4 clicks, but attach the trigger wire to each of the triggers for the other 3 click tr7s. SOOOO.... if you 2 click the lock, then 2 click the unlock, the 4 click will be triggered. It would also be triggered by 4 clicks of lock or unlock, but in getting to 4 click you will run the 3 click function too. That's just my theory for keeping a stock remote without a new keyless entry remote and module.

I installed an 8 function clicker and module on a classic car build, had each window up and down as well as my locks and a few other functions I added since I could sequence the clicks better with a 4 key remote; think I ended with 12 total functions.
Keyless Entry Systems « autoloc.com

sooo much YESSSSS!

this weekend I just finish this MOD on my truck and I have 2 "findings".
All works perfect now and huge thanks to YourUncleFats for sharing it.

my findings is:
1. description of B18 plug is "mirrored", correct wire position: 1 ->13, 9 ->5, 12 ->2 and 26 ->14.
2. instead T-split connectors I suggest solder all wires. my connectors lose connection after couple up/down cycle. soldering solve problem.

Thanks again.

ps. this mod give me idea how to use aftermarket starter/alarm (s/a) fob to control back window. You'll need another relay controlled by s/a to make connection between wire 12(2) and 26(14) (window down signal) and set-up aux output from s/a module for constant (-) when TRUNK button is pressed. This way you can control open back window
(simulation back door key control) and when you want to close it just roll all down and then press it twice to activate PAC TR-7. it'll be my next weekend project.

I'm impressed. I'd break it something terrible, but still impressed.

So is there a way that I can roll the back window up and down but just putting my key into the back door lock, my dad had a 4Runner and his did that but he doesn’t remember how he did it.

My thoughts exactly.. I try to stay away from messing with electrical as much as possible.