OEM Fob with Remote start solved!

[mav2287]

A Toyota factory style remote start for the 4th gen has been talked about tons, but no ones seems to have cracked it. The problem always seems to be that once you start the car you can't use the remote to unlock the car and you have to use the key.

GOOD NEWS! I have a working prototype with my 08 4runner that solves this and does several other things...

1. you can do a Toyota factory style start click lock then click lock again then hold lock and it will start the car.
2. with the car running under remote start lock and unlock buttons work
3. you can hold down the lock button and turn the car off when it's running under remote start

I am currently working on having the air con turn itself on based on the weather I.E. when it's cold full defrost front/rear and when it's hot full ac.

This is something I have been working on for over a year, but I have finally figured out how to do it and wanted to see if there was any interest in it.

 

[rossiski]

I'll bite. How did you do it?

 

[mav2287]

The wireless receiver for the remote is in the back and connected to the body ecu by an rda wire. The wireless unit is connected to 12+ all the time so it always gets the signal from the remote. It also always tells to body ecu about it with a message on the rad line, however when the car is running the message is ignored.

It took me a while, but I cracked all the messages sent on that RDA line and how they work.

So I made a board that connects to the same rda line, the remote start and the ignition. When the car is turned off it looks for the pattern to tell the remote start to turn on the car. When the car is running via the remote start it connects to the doors and when it sees a lock or unlock it does just that. Then when it sees the car running and not under remote start it goes to sleep.

So it took a custom circuit board, coding to run the board and cracking the messages.

 

[rossiski]

Any pics? Did you put in some kind of interface to read the signals?

 

[mav2287]

the "interface" if you will is a custom board that I designed and build from scratch using an Arduino micro as the base. Right now I have it all on a bread board and still haven't done a permanent installation so there really isn't anything to take a picture of. I am in the final stages of putting together a design to have an actually circuit board and case made.

The reason I was making this post was to see the level of interest so I could decide if I needed to do a detailed write up.

 

[4rcybr]

Hell, I'm interested. Not sure how much money I'd be willing to spend, but congratulations on a great hack.

 

[mav2287]

Thank you it has been a few years in the making. the total cost of the part that I made should be about ~100 bucks when I am done. Then you just hook it up to something like an avital 4003 and xk05 then your good. You could even use a 4113 and have a spare remote for just the remote start if you want.

 

[wkeryder4]

So this is an addition to an aftermarket remote start system?

 

[damnthemansam]

I'd be very interested!

 

[riceandpho]

most aftermarket alarm remote start brain supports oem remote, just additional wiring is needed, for example, compustar brains, you can have oem remote send 3 pulse that can trigger remote start, also its programable, so it can be 1, 2, or 3 pulses and that will trigger remote start. but with that money invested to install remote start to a vehicle, why bother using the oem remote when there is no range? the aftermarket now has 1000 + feet, plus most system can give you up a certain range, for unlimited range, theres the drone service, but you pay yearly for the basic service.

 

[mav2287]

You are correct you can start the car with the factory remote on a lot of systems, but you can't do a toyota OEM style 2 press then hold. ( my sister in law has just 3 clicks and starts her car by accident ALL the time a hold on the 3rd lock would prevent it) Then once the car starts so do the problems...

the fob no longer works so your locked out unless you use the key. Then you can't turn it off with the OEM remote because the car would be running and the fob wouldn't work. The board I made allows you to do all of that by reading what the wireless module is saying instead of what the locks are doing. The problem with the aftermarket ones that have triggers is they just watch what the locks are doing.

To answer the second part is bit more complex. To me there is a certain appeal and beauty in doing thing in such a way that when someone else sees it they just think... wow didn't know it came with that... I enjoy it. To make something work in a way to where they don't realize it is a mod just makes me feel all warm and fuzzy inside. I don't want it to look like a mod I want it to look like it just came that way.

 

[mav2287]

So this is an addition to an aftermarket remote start system?

Yes you would connect it to the buzzer, parking lights, locks, wireless module signal wire ( RDA line red/blue wire under the dash ) and then to your alarm.

Or if you just want it to unlock doors the alarm, locks and wireless module

although I have considered just making it into it's own remote start module... but then it still has to talk to a key bypass.

 

[acronin2]

I am definitely interested...currently I have the Avitol 4003 installed w/ the factory remote activating the remote start on three pulses of the lock button. I do occasionally start the vehicle accidentally.

I had the remote start installed by a local shop so I am not sure exactly how hard it would be to incorporate your mod to an already installed system. At the time I didn't feel comfortable attempting the install by myself but have since completed several mods and may be up for this one. I'd be interested in seeing more details or a write up when ever you have it finalized.

:ranger:

 

[Silverlmtd]

Definitely interested

 

[mav2287]

I am definitely interested...currently I have the Avitol 4003 installed w/ the factory remote activating the remote start on three pulses of the lock button. I do occasionally start the vehicle accidentally.

I had the remote start installed by a local shop so I am not sure exactly how hard it would be to incorporate your mod to an already installed system. At the time I didn't feel comfortable attempting the install by myself but have since completed several mods and may be up for this one. I'd be interested in seeing more details or a write up when ever you have it finalized.

:ranger:

It shouldn't be too bad to install it once I have the write up really you would just be connecting your trigger to it, the extra wire for the Avital and the ignition to it. Then connect the RDA line and you would be able to use it.

 

[mav2287]

The next step for me is integration of the factory beep beep. I know it drives alot of people nuts but without tapping into it to use it the illusion of remote start being factory will be broken...

From what I understand that buzzer isn't as simple as just sending a solid pulse to it. My reading and research indicating that you need to send a specific frequency to it in order to get the right tone beep. From what I have read it seems to be about 20khz, but I still need to do some more study work on it before I can be sure. It also looks like you can use a 555 timer to pull it off like this guy did here... https://www.youtube.com/watch?v=9l7WYE_tm_M

Has anyone put in an aftermarket alarm and keep the beep beep? If so how did you do it?

 

[JoShug00]

This is awesome!! The thing I would love to see is all in one and not needing an separate alarm or remote start box. I see this thread is a bit old has there been any updates? Great work on this!!

 

[mav2287]

Progress yes, but I still haven't put it all together. Basically where I left off was I had created a test board that would listen to signals from the fob receiver unit in the back and then if the runner was off and it saw 2 lock pulses and a long hold on the lock it would signal the remote start to do it's thing. It would then listen for a unlock or lock signal while the car was under power from the remote start and lock or unlock the doors. Once the car was running with the key it would just go to sleep until the car turned off.

The project got behind because I started to write code that would also control the climate controls and I wanted a factory beep/light flash on lock and unlock. The whole goal of the project was to do it in such a way that if you didn't know it was custom you would think the car came with it.

Lights are easy the beep beep is a beach beach. It seems that it isn't just something where you can send two pulses of power to the buzzer. You have to send a special wave to buzzer so you can then match the actual tone of the buzzer. I have access to a very nice oscilloscope that will let me record the signal, but it's an hour away and right now I just don't have the time to go grab it. So that will most likely not get done till spring or summer.

As for the climate controls I put a temp sensor on my test board and then based on if the car was hot or cold it would put the climate controls into MAX heat or MAX cool. It would also turn on the heated seats, turn on the defrost etc. The hardest part about this is just going to be wiring it all up to climate control unit.

As far as all one unit... Unless someone wants to pay me couple of grand so I can put it all together it's most likely just a fantasy. The problem is even with my current work with you have at VERY minimum 3 parts you need. The key simulator, the remote start controller ( this part wouldn't be too bad ) and then my custom controller.

Building in the remote start module wouldn't be too bad. The key sim would suck and it would be a lot of R & D. Then you have the issue of market size. There are only a handful of people who want this or someone else would have already done it...

What will most likely happen with this is that I will build a prototype board. Make sure it all works and use it for a while. Once I am positive I have it how I want it I will then have a custom circuit board printed, put it all together, then have a custom enclosure for the board 3D printed and do a final install. At that point if people want them I will most likely sell a limited run of them and post the specs for people who want to build their own.

 

[gshadow325]

fyi 05/06 started hi speed canbus so this can work

anything prior probably wont work for what you are thinking.
seems like a lot of work for saving the factory remote when i can just install a aftermaket and have phone control, 3 mile range on the remote fobs that are waterproof and rechargable via usb. yes it can be wired to roll the rear window UP and DOWN.

nice to know you figured out how the RDA works. probably easier just to transmit the door lock commands when the remote starter is activated.

or install a new aftermarket unit and tag the physical lock and unlock wires in the driver kick panel. this is part of a aftermarket unit.

a 45 minute to 1 hour job seems like it would get drawn out to days of tinkering.

 

[pjbrownva]

Progress yes, but I still haven't put it all together. Basically where I left off was I had created a test board that would listen to signals from the fob receiver unit in the back ...

Hi mav2287, would you be willing to share (preferably in this thread, but if not via a PM) the code that you discovered for the lock and unlock pulses sent out on the RDA wire?

I found a thread here Keys Dont Open Door But Starts Car | Page 2 | Toyota Estima Owners Club that states that a toyota Estima mini-van (not sold in the US) has an unlock code that is " To .. unlock the receiver sends a square wave pulse train to the body ECU. The signal comprises 12mS high-6mS low-9mS high sequence repeated 14 times. High is 8V, low is 0v."

I'm assuming that our 4Runner may have the same code, but there is no guarantee.

I'll probably end up just buying a compustar solution from [MENTION=93434]gshadow325[/MENTION], but right now I'm ultra-tight on cash... plus, I find this type of research and experimentation fun!