How I went from 1 sub/valet key to 3 master keys for about $100 (you can do it cheaper)

Let me apologize in advance, this is a wall of text. I'm old, I digest info best with just words... so no photos or video to aid those with short attention span issues, sorry.

This has been a long road, I've seen a lot of bad information, a good bit of confusion in the forums and met with a TON of dumbfound/confused looks/awkward pauses on the phone. So I'm going to try and break this down, all in one thread to Maybe help someone in the future have a better head start on getting whatever their issue my be, resolved. 3 basic sections and I'm going to hit them in order...

Keys

This Should be simple, but there's still confusion out there... even in these forums. There are 2 different keys for the 3rd Gen, all metal which Should be 1996~1998 for all, and (maybe, some) 1999~2000 for the non-Limited ~ basically the vehicles without the Immobilizers. And the metal/plastic transponder keys which made their appearance in 1999. The dealer can cut your keys from VIN, mine even did it for free (even with outside purchased key blanks). The VIN code will work in all locks, unlike the "Valet" key which won't work in some locks like the glovebox. "Valet" has also taken on a different meaning with the Immobilizer, as a substitute for a "sub" key, but I'll get into that later....

I have a '99 Limited, so that's the info I looked up regarding keys:
Toyota Transponder Key TOY43AT4 692062 89785-26020 which has a 4C transponder chip.

They're $30 through the dealer and down to about $5 for a Chinesium knock-off. The OEM's have a nice "soft" rubber feel and some heft, the knock-offs are really light and have that obnoxious hard plastic. I managed to find One ebay seller with an OEM-feel key for $10/shipped. Out of 4 keys bought, one of the cheapest has a bad transponder chip and won't work, so buyer beware (but I also paid the same for 4 as the dealer wanted for 1).

Remotes (aka fobs)

Again, there are 2 options here with 1999 being the first of the "factory" installed vs dealer installed. There are already a LOT of good posts on this, including how to determine which you have, here are just a couple:

1996~1998 only had the "dealer" installed RS3000 which would only lock/unlock doors (no rear window action), info here: http://www.97supraturbo.com/Tech%20s...0Reprogram.pdf

A Toyota TSB on identifying the different systems (pictures of the remotes, FCC info, etc): http://ww2.justanswer.com/uploads/sn...27_remotes.pdf

Programming instructions : Programming Instructions for keyless entry remote? (NOTE: the 4runner has notorious weak lock actuators, they work better when cold so do it in the early morning and some have had luck using a key to physically assist)

You can change the volume of the "Chirp" ~ keyless entry beep volume

Immobolizer

This is where most of the headaches appear. I mentioned above about "Valet" being used to describe a immobilizer function known as a "sub" key. This is important, because if you have only a "sub" key and you want more keys, you have no great options. How do you know what kind of key you have? Watch the Security light when you put the key in the ignition. If it stays lit for a few seconds, then goes off.. you have a Sub key. If it goes off Immediately, you have a Master key. If it doesn't go off, but your vehicle starts....

There are 2 prevailing myths that I busted. The first is that the dealer can reprogram, and even the techs swear up and down that it's possible... until they try. I spent a few hours at a couple different dealers in the area, letting the techs give it their best and no one could do it. I was pretty confident it wasn't possible since I have their main diagnostic device (Techstream) myself. And the second is that you can just jumper 2 pins on the OBDII port, but this relates to a Later version of the Toyta Immobilizer system. Their first go had them include the immobilizer in with the main ECM (our vehicles), but it was costly to fix the 'all keys lost' issue. So Toyota divorced the 2, gave the immobilizer it's own unit in later models and THAT can be reset with specific voltage changes (I assume with Techstream as well). In any case, these 2 methods do not work on the 3rd gen 4runner.


The fastest is to fork over $100 to an auto locksmith to "clone" your sub key (writing the identifier number from the OEM onto the replacement, vehicle thinks it's the same key ~ they are like Siamese twins). Good if you just want one key and don't care about being able to quickly/cheaply/easily make more. This will take maybe 5 minutes (process time).

Coming in at about $300 and in second place for speed with time estimates from a couple hours to "all day" (with "about a week" for mail order options), you can have a auto locksmith reflash, or 'virgin', your ECM. This will make it act like new and register up to 2 master keys and 1 sub key. I found this service available locally and mail order, but it was too rich for my blood.

And the most expensive option is to buy a brand new unit directly from Toyota at around $1000 (ECM only, no labor). It will also register 2 new Master keys and 1 sub once installed. Up until 2014 Toyota had a program to offer a "free" replacement if you paid the dealers labor to install and program, but it has been canceled. I found the actual reference information, but have lost it again ~ I'll edit if I can find it again.

The rest of this will talk about getting it done DIY, for those of us who will squeeze a penny into a 18 mile long, nanometer diameter thick thread... Credit where it's due, nearly all of the information came from this Instructables post: DIY: Immobilizer Hacking for Lost Keys or Swapped ECU: 9 Steps (with Pictures) (And an alternate link incase the first one vanishes https://www.toyotanation.com/forum/1...apped-ecu.html )

Where I deviated was by not having a computer with serial/RS-232 available so I bought a $20 EZP2010 programmer. And after Much frustration, begging for help and generally struggling to get it to work I stumbled upon a post talking about how some chips do not play well when in place (on board programming). Once I removed the chip, it simply worked without any fuss. I did this on a spare ECM I bought specifically for this reason, to use as a test unit. I am a hack when it comes to electronics and component level replacement, but managed to make it work with a basic soldering iron. When I do this again, because I plan on installing my Original ECM back in the vehicle (salvage unit doesn't look as clean, me being picky), I'm going to hire a pro with the right tools... found at Any phone/laptop/tablet repair store (tool needed is a hot air solder reflow gun/station/tool, it's designed for just this kind of work).

Knowing what I now know, and my advice for anyone who wants to tackle this, is to buy a programmer like the EZP2010, though there are other options. Take your ECM into a repair sop and ask them to desolder the chip from the board. Then read (save), virgin, and flash the chip. Hand it back and ask them to reattach it to the board. You could Also just buy a replacement chip, they're about $5 shipped, and have it swapped ~ use the zero information on the linked page (at least it worked for me since I didn't have any data to work with). All in, you should be out $50 or less for the cheap keys.

That brings us to programming, and I'm going to again link:

Lost keys with engine imobilizer

I didn't do the part with the door lock and had trouble. Thankfully I got one Master key to program. This allowed me to use Techstream, which was another $15 for a cable and software, to add more keys. Actually, I had to use the software to end the "auto registration", which is where the security light just keeps flashing. I've since added and deleted keys from Techstream a dozen times while futzing with my one key with the bad chip. It's worth pointing out that ANY key can be made a master or a sub, and then swapped, and swapped back again. All the immobilizer does is record the transponder number and flag it as Master/Sub, nothing happens to the key itself. So, if you only have 1 key, a Sub, and virgin the ECM, you can make that key a Master. Even if it's an Actual Valet key (won't open glovebox), it can be a Master key and used to program other keys.

For the sake of being complete, if you have a Master key, you can program more keys with a little song and dance on the throttle and brake pedals: Programming instructions for blank Transponder keys/chip keys for OEM toyota ignition


If any of you reading this, and in need, are in Georgia or eastern Alabama, I'll gladly help, let you use my programmer, and/or Techstream setup. I'm about half-way between Atlanta and Auburn just off I85. If anyone wants a "virgin" chip, I'll do it for no cost (you get me the chip and pay shipping back to you).

Ugh, I'm just so Happy to finally have more than 1 very worn, dog-chewed key.

I just went through this today actually. I swapped my automatic transmission on my ‘99 Limited to a 5-speed a couple of weeks ago, but when I tried the new manual transmission ECU, it would not start. After some quick diagnosing I found it to be my immobilizer.

I researched for about a week on how to get the new ECU to work with my keys. I called a local locksmith, explained the situation to him, and he claimed he could get my new ECU to work.

I met with him today. He took my Auto ECU first, clipped the EEPROM reader onto my IC900 chip, and then he was able to find the immobilizer codes after ~5 minutes of experimenting with different EEPROM scanner protocols. Honestly I’m glad I didn’t try doing this myself because it seemed very complicated just to be able to read the values stored on the chip. He copied the values on my chip, and pasted those values on my manual ECU IC900 chip, so all my keys work with the new manual ECU without needing to program any keys. He charged $160 which I thought was a fair price.

Props to you OP for figuring this out yourself! I think this is some pretty complex stuff and I’m an engineer so that’s saying something.

Damn, that's a heck of a good price. I was consistently between $300~500 for every locksmith I called within about 2 hours drive (lots as it included all of Atlanta). Even explaining that *I* would pull the module and put it back...

Funny how Cheap and Lazy are great motivators. I flunked out of college because skiing was more fun. Kinda forced me into "if you want something done, you have to do it yourself" mode, which led to being a motorcycle mechanic... cause riding motorcycles, while otherwise fun and inexpensive, requires a lot more maintenance than driving cars. But thanks for the kind words... best I can take credit for is an obnoxious number of hours spent searching, taking info that already existed and applying it to my situation. No different than reading a service manual, except the info is spread out in more places.

Well lets talk about bad information. I stopped reading at your 1st "Keys" paragraph. I have a 99 Base model, manual trans with the plastic transponder key. So it's not only Limited models that had them. Any model (Base, SR5) with a factory or dealer installed alarm will have them.

News to me. But the whole point of posting "facts" on the internet is to get other people to offer up their proof otherwise. Kinda that "you don't get answers to questions, you only get answers to wrong statements" tactic.

Edit inbound...

Good info. Kinda happy mine is non-immobilizer. I had a hard enough time getting the keyless entry to work again on my truck.

@Brian. I'm looking for some help, and I'm really hoping you're the guy for the job.

I bought my 2000 4Runner early this year with only 1 key and that was only for the ignition. That was when I had a pretty good feeling that my 4Runner had the ignition cylinder replaced. I went to my toyota dealership and got a new key cut off the vin and the new key worked in the doors, but would not work in the ignition at all. Compared the keys side by side and it was obvious that the 2 were different.

In the GM world you can code most lock cylinders off of the original vehicle key code so when you replace the ignition you don't need new keys. While I could get another key traced for the ignition the problem with that is my current ignition key is quite worn and has to be inserted in just the right spot to work. Anyways, the only way to get a new ignition cylinder from toyota is pre built (it also comes with 2 immobilizer keys) which means I'll have to program the new keys to the immobilizer.

What do I need to do so that I can replace my ignition cylinder and program the included new keys?

I don't believe you actually need to turn the ignition switch at any point to program new keys, so even though these new keys will be cut differently, I believe you can use your old master key in the new ignition to program the new keys. If your current key is not a master key and only a valet key, then you need to re-flash your ECU. If you don't have an immobilizer system (you don't have a red blinking security light) then you don't have to do anything else.

Check the FSM though, it'll show you the steps to program new master keys.

@Bad Luck

Honestly, I'd have a locksmith just rekey the ignition cylinder to the keys that fit your VIN. It's standard stuff that anyone can do (including yourself if you're willing to spend a few hours learning and a few bucks getting the right wafers). Going to be cheaper than buying a new cylinder from Toyota AND you'll have just 1 key for everything.

The issue that I know about is dealing with the ECU when you only have a 'sub' or 'valet' key for the immobilizer. Toyota wants north of $1000 for a new "virgin" ECU. Locksmiths wanted $400-ish to flash or "virgin" the existing ECU. There are a couple auctions on Ebay offering to do it for in the $150-ish range if you ship them your ECU (though we have DENSO units and there were exclusions for those as I recall). I bought all the tools to DIY for about $50 (plus a spare ECU to test on for another $80).

If you have a 'master' key, it does not need to turn in the ignition to program others: Programming instructions for blank Transponder keys/chip keys for OEM toyota ignition

And once you have ONE 'master' key that works in the ignition, you can use Techstream to erase all but the one, create others, create 'sub' keys (I have one, the one I use daily so any copies would have the be "clones", which are harder to do), etc... but you have to be able to turn to ACC for Techstream.

@Team_Jake Unfortunately it's not a master key.

@Brian. There's only one competent locksmith in my area that was willing to try it quoted me around $400 it rekey my lock cylinder and program a couple keys. If I could get a hold of the different tumblers that toyota uses in our ignition I could rekey it myself but I or my local toyota part's guy doesn't have any part numbers for anything like that. It's only $120 for a new ignition cylinder with 2 keys. I have chinese techstream that works, but I don't have the knowledge or equipment to flash it clean.

Edit: I found these repin kits, but for that price I might as well get the whole ignition cylinder since I'll have to figure out how to reflash the ECM anyways.
Toyota TR47 Pinning Kit (A-30-108) – CLK SUPPLIES, LLC
Toyota Wide Tumbler Replacement Kit for Split Tumblers (A-30-117) – CLK SUPPLIES, LLC

So you do, absolutely, positively, have an Immo system? No doubt at all.

How are you with soldering? I can point you to the Exact equipment needed to 'virgin' your ECU yourself, though it requires removing the chip to flash, and then soldering it back. Heck, I could send you a 'virgin' chip to just solder on and go (have to see what they cost, probably $50 or less shipped to you ready to install).

If you want to DIY the flashing, find out what the locksmith charges for Just rekeying the cylinder. Last time I had that done it was $40-ish.... I can't imagine how much it would suck to have 2 keys after sorting this issue. I know I couldn't deal with it.

I guess the 3rd option would be to buy a master key set from someone parking a vehicle that has all of the cylinders. You're still flashing, but at least you'd have 1 key. And the very last option that I don't know would work, but I'd made work on other vehicles, is to have a unique key cut where it has the door lock on one side and ignition on the other (then you just have to make sure the orientation is right). I couldn't deal with this either, but people tolerate things differently than me all the time. I guess you wouldn't Really need to carry a door key on you if the keyless fob worked, just leave it in a hide-a-key somewhere on the truck.

100% have an immo system. It was about $200 just to rekey the cylinder to the original, and he said he would have to have the vehicle for a few days to do it. I already have 2 keys and it doesn't really bother me any more. I got used to it lol where exactly is the immobilizer? Is it part of the ECM? I can solder wires, but I've never tried circuitry. I'd probably have to get a better soldering iron to do it.

Okay, you have the Immo... does the security light stay on for ~3 seconds when you put the key in the ignition or does it go out right away? That's important, you may not need to do any soldering.

The module is behind the glovebox, Tommy has a video:

@Brian. Security light goes off as soon as I put the key in. Does this mean it's a master?

Yup, you have a master. Programming is easy enough:

Programming instructions for blank Transponder keys/chip keys for OEM toyota ignition

Make one with the tap-dance, change the ignition cylinder, then use Techstream to erase all (who knows how many are currently stored, the one that's in the ignition will be retained) and add the 2nd. I have 3, 2 Master that live in the safe, and 1 Sub that I use daily. I'm one of those weirdos who doesn't think 2 are enough... mostly because I've been burned with just 2 in the past.

Anyway, you have it easy since you have a master.