OEM Fob with Remote start solved!

[mav2287]

Yea I read that one too a long time ago.

When I read the signals I did it with an octocouple and a Arduino since I was going to be using that to read the signal and then issue commands to the rest of the system. That said it might give different more precise timing with a oscilloscope, but since I was going to reading it with an Arduino with an octocouple for electric isolation from the circuit I wanted to record it on that too. Below is the table of data.

I can confirm that regardless of key state these signals are always send the body ECU so my plan was to have an arduino read them and key state. Then take actions accordingly.

The way you read this is that low means no voltage, high means voltage and since the line sits at no voltage when no message is sent all of them start at 0. The zero can be interpreted as a clear line. The signals all send once if you click it SUPER fast and then repeat over and over indefinately if you hold down the button. The chart below shows a key at the top that identities the set that represents each button type and then has a reading from the RDA line I took below it. Here is the signal break down:

4Runner RDA MAP

LOCK SIGNAL

L H
0 12
3 3
6 6

Received
30 pairsReceived:

Low High
0.0000000000 mili, 12.0080003738 mili
2.9760000228 mili, 3.0200002193 mili
5.9760003089 mili, 6.0080003738 mili
2.9840002059 mili, 12.0120010375 mili
2.9800003051 mili, 3.0080001354 mili
5.9840002059 mili, 6.0080003738 mili
2.9800003051 mili, 12.0120010375 mili
2.9760000228 mili, 3.0080001354 mili
5.9800004959 mili, 6.0160002708 mili
2.9760000228 mili, 12.0160007476 mili
2.9760000228 mili, 3.0080001354 mili
5.9720001220 mili, 6.0160002708 mili
2.9680002212 mili, 12.0160007476 mili
2.9800003051 mili, 3.0040001869 mili
5.9840002059 mili, 6.0120000839 mili
2.9800003051 mili, 12.0120010375 mili
2.9840002059 mili, 3.0160000324 mili
5.9760003089 mili, 6.0160002708 mili
2.9760000228 mili, 12.0200004577 mili
2.9760000228 mili, 3.0120000839 mili
5.9800004959 mili, 6.0160002708 mili
2.9760000228 mili, 12.0160007476 mili
2.9720001220 mili, 3.0120000839 mili
5.9840002059 mili, 6.0120000839 mili
2.9800003051 mili, 12.0120010375 mili
2.9840002059 mili, 3.0080001354 mili
5.9840002059 mili, 6.0080003738 mili
2.9800003051 mili, 12.0120010375 mili
2.9840002059 mili, 3.0120000839 mili
5.9760003089 mili, 6.0080003738 mili



UNLOCK SIGNAL

L H
0 12
6 3
3 6

Received
45 pairsReceived:

Low High
0 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili
3 mili, 12 mili
6 mili, 3 mili
3 mili, 6 mili



BACK DOOR SIGNAL

L H
0 12
3 6
3 3

Received
42 pairsReceived:

Low High
0 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili
6 mili, 12 mili
3 mili, 6 mili
3 mili, 3 mili



PANIC SIGNAL

L H
0 12
9 9

Received
30 pairsReceived:

Low High
0 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili
3 mili, 12 mili
9 mili, 9 mili

 

[pjbrownva]

That's really awesome!!!! I love it! I'm considering using an arduino as well to detect the pulse.

My thinking (I think gshadow suggested this), is that the arduino board only needs to listen when the truck is running because of the remote start, so I would somehow make it so that board is only powered on when the 4Runner is runner because of a remote start condition.

Then, the Arduino can look for lock and unlock pulses, and trigger the door lock and unlock accordingly. I guess, as you have done, I could get fancy and add other features based on a button press, but I don't think that I'd want the arduino powered when the truck is off -- I don't want the parasitic drain (even though I haven't calculated what effect it might have in terms of how long it would take to run down the battery).

I'm sure you know that you can burn your arduino code to a single chip that costs only a few bucks, so once you have something working, you can deploy it fairly cheaply.

Thanks for share this info! I think I'll play with it when I have some free time!

-Phil

BTW, for the first line of the unlock code, I think you meant to write "3 12" instead of "0 12".

My next step is to look into opto-couplers... digikey, mouser & adafruit, here I come.

P.S. -- I'm not interested in selling anything. If I do create something useful, I'll happily share it with you, and if you like it you may use it any way you choose. :hatsoff:

 

[mav2287]

As far as selling goes there is no money to be made here and that is no my goal. The only reason I would sell anything is that typically when you have a prototype board made it costs you about the same to make 10 production style prototypes as it does 1 and I wouldn't want the other 9 so I am happy to share the info.

As for your comment on the 3 the answer is yes and no. If you are reading the first signal then you don't know when to start counting so it is impossible to tell how long the line stayed low since it was already low. If it is a repeat then yes you are correct. I am always catching them from start so since I am looking at it from start I can't catch the first low.

As for the key position there are a few things you can do. If you get a VERY efficient power converter for the Arduino you can run it all the time with very little to no risk of a flat battery. It will pull a fraction of 1 amp. My testing and planning was build around an Arduino micro and a then stepping down the voltage as efficiently as possible.

I can then watch the key position and take actions accordingly for example I can trigger the start OEM Toyota style by watching for a double lock and a hold. I can then tell it that when the car is running I want it to lock and unlock doors. I could even tell it that if I hold the lock button to stop the remote start. My personal plans also call for a small thermistor that will be connected to the arduino. Based on the ambient temperature it will either heat the car internally or cool it. Then within a nominal range it won't do anything.

At this point I just haven't really had the time to put it all together and finish writing the code in C++ ( what the Arduino uses ) to make it work. Once I do that and get it all working then I will most likely have a custom circuit board and case made for it.

Since I just had another kiddo a couple weeks ago this may not be done till next late summer early next winter.

 

[pjbrownva]

As far as selling goes there is no money to be made here and that is no my goal. The only reason I would sell anything is that typically when you have a prototype board made it costs you about the same to make 10 production style prototypes as it does 1 and I wouldn't want the other 9 so I am happy to share the info.

As for your comment on the 3 the answer is yes and no. If you are reading the first signal then you don't know when to start counting so it is impossible to tell how long the line stayed low since it was already low. If it is a repeat then yes you are correct. I am always catching them from start so since I am looking at it from start I can't catch the first low.

As for the key position there are a few things you can do. If you get a VERY efficient power converter for the Arduino you can run it all the time with very little to no risk of a flat battery. It will pull a fraction of 1 amp. My testing and planning was build around an Arduino micro and a then stepping down the voltage as efficiently as possible.

I can then watch the key position and take actions accordingly for example I can trigger the start OEM Toyota style by watching for a double lock and a hold. I can then tell it that when the car is running I want it to lock and unlock doors. I could even tell it that if I hold the lock button to stop the remote start. My personal plans also call for a small thermistor that will be connected to the arduino. Based on the ambient temperature it will either heat the car internally or cool it. Then within a nominal range it won't do anything.

At this point I just haven't really had the time to put it all together and finish writing the code in C++ ( what the Arduino uses ) to make it work. Once I do that and get it all working then I will most likely have a custom circuit board and case made for it.

Since I just had another kiddo a couple weeks ago this may not be done till next late summer early next winter.

Thanks for sharing this, and for clarifying. I just wanted to make sure that you realized that my intentions are simply to see what can be done -- I'm not trying to eclipse your work or steal your thunder.

As for the temp settings... at least on my limited, you can set an desired internal temp for the HVAC and leave it on "auto", and the truck will handle everything else. That's what I plan to do... although a thermistor could be useful to turn on the rear defroster if the temp is below a certain threshold... Just my thoughts.

Congratulations on the new little one!

-Phil

 

[ExCabSwap]

Maybe there's a way that you could also integrated a way to roll UP the rear window with the remote too? Like holding the lock button or maybe triple tapping the window button?

I'd be willing to invest. Feel free to contact me on Instagram [MENTION=148323]ExCabSwap[/MENTION] or if you want, I'll send you my cell number. Hopefully I remember to check back in on this!

I think this is really awesome! I work for Fastenal, so if you want to make a little connector/fastener kit to go with this, I'd be happy to help out! We make custom kits for everything we sell!

Sent from my LM-G710 using Tapatalk

 

[Jazz30-06]

fyi 05/06 started hi speed canbus so this can work

anything prior probably wont work for what you are thinking.
seems like a lot of work for saving the factory remote when i can just install a aftermaket and have phone control, 3 mile range on the remote fobs that are waterproof and rechargable via usb. yes it can be wired to roll the rear window UP and DOWN.

nice to know you figured out how the RDA works. probably easier just to transmit the door lock commands when the remote starter is activated.

or install a new aftermarket unit and tag the physical lock and unlock wires in the driver kick panel. this is part of a aftermarket unit.

a 45 minute to 1 hour job seems like it would get drawn out to days of tinkering.

Back from the dead again... Do you know which kits specifically support all of this?

 

[gshadow325]

Yeah nothing lol

Everything is analog. So much more gain from anything aftermarket

 

[mav2287]

Yeah nothing lol

Everything is analog. So much more gain from anything aftermarket

The point was always to have that factory feel. Just like the feeling you get when you pull up next to someone in something that looks bone stock and you blow their doors off when the light turns green.

Plus it cool when your buddy with a 4R say, "WTF?! they did that from the factory and I didn't get it!" and you just smile ear to ear.

Using the same input sense from the remote you could easily detect a triple click or something similar on the back door button and then trigger the auto up feature, but you may need to power the backdoor ECU to do it not sure. That said the reason they never did it was that it is a MASSIVE safety concern so use at your own risk.

If I remember right I was looking at the following setup
- Avital 4003
- PKALL or XK05 ( wasn't sure which would be better )
- My custom board ( driven by ardunio Micro 5V Arduino Micro) - ( This would connect to HVAC and have an onboard temp sensor to activate Full Cold AC or Full Heat, Heated seats, front/rear defrost and heater )

However, at one point I was thinking I may just ditch the 4003 and have my board do everything and just have the PKALL or XK05 for the key validation.

I did put together some C++ Arduino code for the board and did a lot of testing I just never had the time to put it all together into something usable. If anyone wants to pickup the torch PM me and I am happy to send over the code as long as if they get it figured out they share how to make one with me too.

 

[gshadow325]

Your post reiterates, so much more gain from aftermarket remotes. What ever floats your boat man. Knock yourself or. I already know you're going to run into other issues already. It's destined to fail before it even starts. Use my negativity as fuel for your fire. I'll just install an aftermarket unit without a shit ton more features range and flexibility in 45 minutes while your project takes months to complete and work out the bugs. Just to impress that one person that may think it is cool that you may never meet except on here in the deep dark web.

 

[mav2287]

Your post reiterates, so much more gain from aftermarket remotes. What ever floats your boat man. Knock yourself or. I already know you're going to run into other issues already. It's destined to fail before it even starts. Use my negativity as fuel for your fire. I'll just install an aftermarket unit without a shit ton more features range and flexibility in 45 minutes while your project takes months to complete and work out the bugs. Just to impress that one person that may think it is cool that you may never meet except on here in the deep dark web.

You don't ever do anything for your own satisfaction do you?

You don't and most likely won't get it and that is, OK. You do you.

 

[gshadow325]

Obviously you didn't click on my build thread. I have done more electronics in my truck and many many many others than I can remember. I have installed over 1200 ft7200s remote start units personally. That's just one SKU not counting the countless other models over the years.

Again go prove me wrong and get it done. I'll install a aftermarket in 45 minutes. You have fun for months on your project. I had my system in my truck long before this thread and still long after this thread.

The factory fob is just plain useless.

 

[underscorepatrick]

Your post reiterates, so much more gain from aftermarket remotes. What ever floats your boat man. Knock yourself or. I already know you're going to run into other issues already. It's destined to fail before it even starts. Use my negativity as fuel for your fire. I'll just install an aftermarket unit without a shit ton more features range and flexibility in 45 minutes while your project takes months to complete and work out the bugs. Just to impress that one person that may think it is cool that you may never meet except on here in the deep dark web.

I literally signed in to tell you you’re an asshat lol. Go rain on your own parade my friend. Even your signature puts you off as a jerk. I wonder how people deal with you face to face...

Anyways. I like the OP’s idea. Glad someone has the balls to fab things up & not install ‘kits’ lol


Keep me updated. I wanna use my shitty factory fob.

 

[JoeToyota]

The point was always to have that factory feel.

That's what's up.

If it's what you like to do then who cares about the trolls. Yes it's a very small market, but if you can make a few bucks off it then sweet.

The idea is very intriguing, but I won't be installing any aftermarket alarms or starters.

 

[gshadow325]

I literally signed in to tell you you’re an asshat lol. Go rain on your own parade my friend. Even your signature puts you off as a jerk. I wonder how people deal with you face to face...

Anyways. I like the OP’s idea. Glad someone has the balls to fab things up & not install ‘kits’ lol


Keep me updated. I wanna use my shitty factory fob.

This is what makes America wonderful. We are all allowed our opinions. I also signed in to thank you for your opinion.

I have looked into this in depth. I know what the problems op will run into. We all know the limitations on the factory system. Ok, maybe some of us do.

There is going to be so many hours in development put into this for a platform that is going on 16 years old. That has technology in it that changed halfway they the model run.

It's a project that is a great one that should be shelved before you get balls deep into it.

 

[Countryboytx]

Hello,

I know this post is old, but I am new to the group, and I was wondering if you ever completed this and if they are for sale? I want to add remote start to my 07, but want to use OEM remote. Thanks

 

[AuSeeker]

Hello,

I know this post is old, but I am new to the group, and I was wondering if you ever completed this and if they are for sale? I want to add remote start to my 07, but want to use OEM remote. Thanks

Sorry but you won't get a reply from the OP, he hasn't been back on the forum since his last post almost 2 years ago...#30 in this topic.

 

[iamBazzy]

My solution was the EasyGuard EC002-T2 kit. The key fob is identical to the LandCruiser smart key