Author Topic: Concours 14 Passive FOB replacement from locksmith  (Read 20081 times)

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Concours 14 Passive FOB replacement from locksmith
« on: October 27, 2018, 11:09:09 AM »
I had a local locksmith make me a passive fob, cost was about 60/65 bucks total.
Here is a picture of the key, and a YouTube video of it working.

Owners name is Wayne;
A-Anykind of Lock & Safe - (281) 338-9100
421 East Nasa Road 1, Webster, TX 77598
http://www.anykindlockandsafe.com/

https://www.youtube.com/watch?v=5RVK2VgROXA


« Last Edit: October 28, 2018, 03:01:18 PM by Gabriel »

Offline jimmymac

  • Arena
  • Full Member
  • ***
  • Posts: 1076
  • Country: us
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #1 on: October 27, 2018, 11:18:38 AM »
I can do that with an Oreo cookie, if the fob's in my pocket.
The grass isn't always greener.

Offline jwh20

  • Full Member
  • ***
  • Posts: 364
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #2 on: October 28, 2018, 04:27:49 AM »
Good information and this is going to be a CLONE of the existing passive (i.e. "credit card") FOB.  This "HOND 31P" key blank has a cloneable TPX3 transponder in it which is the same type of transponder used in the Concours.

By the way, if you are one of those C14 owners who have ONLY the active FOB, keep in mind that this also contains a passive, or KEY IMMOBILIZER, function and this part could be "cloned" using this same technique and keep you from the unfortunate scenario where you have NO keys if you lose your FOB.  It seems there have been a couple of those recently.

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #3 on: October 28, 2018, 06:10:27 AM »
Good information and this is going to be a CLONE of the existing passive (i.e. "credit card") FOB.  This "HOND 31P" key blank has a cloneable TPX3 transponder in it which is the same type of transponder used in the Concours.

By the way, if you are one of those C14 owners who have ONLY the active FOB, keep in mind that this also contains a passive, or KEY IMMOBILIZER, function and this part could be "cloned" using this same technique and keep you from the unfortunate scenario where you have NO keys if you lose your FOB.  It seems there have been a couple of those recently.

He cloned the passive RFID chip in my only "active" fob and it's a XXX4 version of something I don't exactly remember but he said it was old technology.
He also said he thinks he can clone the active fob, I'm going to check back next week to see. Now that would be great to make an exact clone.
This guy has thousands of dollars worth of equipment and software, of which I saw him use at least three readers when doing this. 

Offline jwh20

  • Full Member
  • ***
  • Posts: 364
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #4 on: October 28, 2018, 11:34:35 AM »
He probably cannot clone the active FOB.  It's a proprietary Kawasaki system and, to my knowledge, it not used in any other vehicle.

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #5 on: October 28, 2018, 11:44:40 AM »
He opened the fob and named every component on the circuit board. he said there is nothing special about it.
I will find out soon.
One advantage to cloning is that it won't use space in the memory of the keepass system.
It would probably cost less than 100 bucks if he can do it, I asked...

Offline VirginiaJim

  • Administrator
  • Elite Member
  • *****
  • Posts: 11333
  • Country: england
  • I've forgotten more than I'll ever know...
    • Kawasaki 1400GTR
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #6 on: October 28, 2018, 12:21:47 PM »
I would like to see how this pans out... :popcorn:
"LOCTITE®"  The original thread locker...  #11  2020 Indian Roadmaster, ABS, Cruise control, heated grips and seats/w/AC 46 Monitoring with cutting edge technology U.N.I.T is Back! Member in good standing with the Knights of MEH.

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #7 on: October 28, 2018, 12:39:53 PM »
I would like to see how this pans out... :popcorn:
I will post back here.


Offline gPink

  • Arena
  • Hero Member
  • *****
  • Posts: 5686
  • Country: cn
  • MMVIII C XIV
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #8 on: October 28, 2018, 01:29:52 PM »
Please do. Sounds like a money maker if he's able to do it for a reasonable cost.

Offline MAN OF BLUES

  • Arena
  • Sr. Member
  • ****
  • Posts: 2898
  • Country: 00
  • WHISKEY.Tango.Foxtrot.
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #9 on: October 28, 2018, 02:43:23 PM »
after spending prtetty much the last month, explaining and researching, and supplying how "chips" can be cloned, the chip sets, the equipment, and the Kawasaki system (developed by Mitsubishi...propriatary to Kawasaki)...

http://www.zggtr.org/index.php?topic=23739.msg296683#msg296683

all I can say is:
Yes, passive chips can be cloned.

Active FOBS CANNOT, that is why each one has a "slot" in the program, and each is delivered sending a different "code sequence"...

You must have a paired, fob, either active, or passive, to turn ignition "ON", to even begin programming anything to the bike.

so, programming an ACTIVE FOB, in a CLONE scenario, is not an option... because you CAN'T CLONE the FOB...   i.e., you can't "program" the FOB.... just the receiver...


46 YEARS OF KAW.....  47 years of DEVO..

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #10 on: October 28, 2018, 02:55:40 PM »
after spending prtetty much the last month, explaining and researching, and supplying how "chips" can be cloned, the chip sets, the equipment, and the Kawasaki system (developed by Mitsubishi...propriatary to Kawasaki)...

all I can say is:
Yes, passive chips can be cloned.

Active FOBS CANNOT, that is why each one has a "slot" in the program, and each is delivered sending a different "code sequence"...

You must have a paired, fob, either active, or passive, to turn ignition "ON", to even begin programming anything to the bike.

so, programming an ACTIVE FOB, in a CLONE scenario, is not an option... because you CAN'T CLONE the FOB...   i.e., you can't "program" the FOB.... just the receiver...

Well this is true that the control unit has to programed to the fob which means if you can duplicate the fob it's a home run.
This locksmith tells me that these devices do not communicate back and forth, that the fob sends a signal that the control unit can relate to. (ad-libbed)
I will find out for sure

Offline MAN OF BLUES

  • Arena
  • Sr. Member
  • ****
  • Posts: 2898
  • Country: 00
  • WHISKEY.Tango.Foxtrot.
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #11 on: October 28, 2018, 03:32:02 PM »
Well this is true that the control unit has to programed to the fob which means if you can duplicate the fob it's a home run.
This locksmith tells me that these devices do not communicate back and forth, that the fob sends a signal that the control unit can relate to. (ad-libbed)
I will find out for sure

I pretty much understand that, that's why I spent so much time researching this, and providing it....
now, even though I explained exactly what you just said... go back and read what you said the locksmith told you.....
, just to make it simple.... the part about the FOB 'SENDS' a signal, but doesn't "RECEIVE' a signal... it's a one way flow... so this is why I state, you can't program the FOB.... it does not receive a signal. nor can it be sent a signal to 'reprogram it' to anything... it's a stored code, and cannot be 'changed' like a blank chip.... once that code is burned in, it is the only contents occupying the space, and cannot be changed...or written over.

hey, please take the time, and supply the locksmith, I'd suggest you buy a new Active fob tho, and have it paired, along with the RFID chip, to your bike, By  someone with a KDS3 device.... prior to letting him "experiment" with your active FOB....... simply because he has no liabilities, as it's not his bike... and if he 'tries' to crack the mystery of the signal generation, and can actually pull the data, he needs to send that data to another device, an active device, that does what the Kaw Active FOB does... sends a signal... and lotsa 'awwwshytzz' can occur...

the secure protocols developed for this system have been in place for 10+ years, the first person that even says 'oh, that's old tech, I can do that', ought to be working for Kaw, for 4x his yearly salary... if he is that smart.

let us know how it pans out. I am seriously curious, as I try to be on top of this tech thing...
and thanks for being our crash test volunteer..

46 YEARS OF KAW.....  47 years of DEVO..

Offline PH14

  • Sr. Member
  • ****
  • Posts: 1254
  • Country: 00
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #12 on: October 28, 2018, 03:37:39 PM »
after spending prtetty much the last month, explaining and researching, and supplying how "chips" can be cloned, the chip sets, the equipment, and the Kawasaki system (developed by Mitsubishi...propriatary to Kawasaki)...

http://www.zggtr.org/index.php?topic=23739.msg296683#msg296683

all I can say is:
Yes, passive chips can be cloned.

Active FOBS CANNOT, that is why each one has a "slot" in the program, and each is delivered sending a different "code sequence"...

You must have a paired, fob, either active, or passive, to turn ignition "ON", to even begin programming anything to the bike.

so, programming an ACTIVE FOB, in a CLONE scenario, is not an option... because you CAN'T CLONE the FOB...   i.e., you can't "program" the FOB.... just the receiver...



I really think people should go back to basics, and read the manual before posting sometimes. The fob can be used as a passive fob when the battery is dead. Just to test this before I posted, I read the manual, and then removed the battery, and used it to start the bike. It activated the system just fine and I was able to turn the key and start the bike.

Offline MAN OF BLUES

  • Arena
  • Sr. Member
  • ****
  • Posts: 2898
  • Country: 00
  • WHISKEY.Tango.Foxtrot.
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #13 on: October 28, 2018, 04:00:46 PM »
I really think people should go back to basics, and read the manual before posting sometimes. The fob can be used as a passive fob when the battery is dead. Just to test this before I posted, I read the manual, and then removed the battery, and used it to start the bike. It activated the system just fine and I was able to turn the key and start the bike.

yep... that works....
reading all the reponses in a post, before posting... does a lot also, as I never disputed the passive portion of an active fob...(if it was also programmed, like when you buy a NEW active fob, and pair it to the system, and you also have to pair the passive chip, in the new fob also... it's part of the KDS process...)

you would have to read the KDS3 manual to understand that process... so I can cut people slack, as most don't have that book...

but saying that, I am waiting to see if a new ACTIVE fob, can be re-programmed.. I know it can't, but still waiting...for that reply...

Oh, passive chip works, but if you loose the Active fob, that has the chip for the passive immobilizer, it doesn't matter if the battery is in or out... because it was LOST.......
 I'll listen to the song, and watch the pigs fly until I hear an active FOB can be re-programmed/cloned to an existing active fob...

http://youtu.be/QWLBtMz5OuY

46 YEARS OF KAW.....  47 years of DEVO..

Offline jwh20

  • Full Member
  • ***
  • Posts: 364
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #14 on: October 28, 2018, 04:08:19 PM »
Quote
This locksmith tells me that these devices do not communicate back and forth

Actually not true at all and it's easy to demonstrate with a 915 MHz radio receiver.  When you press the stove knob the bike emits a "is any FOB around" message.  If a FOB is in range it says "hey, I'm here".  Then the KiPass ECU on the bike sends a message that the FOB then encrypts using it's ID, this is checked by the bike and if it's a correctly formed reply, the bike will unlock.

By the way, the Kawasaki documentation also describes this in somewhat general terms.

Why can't you clone the active FOB?  Because it has a "secret" that the locksmith can't determine.  That secret is the ID that is unique to that FOB and if you purchased a new one will be printed on the bag it came in.  That ID cannot be recovered by any means that anyone has determined to date.

While it's not fully documented, my theory is that the FOB hashes (using a cryptographic hash) the message sent from the ECU using its ID, which the ECU also knows, and so the reply from the FOB can be validated since only a FOB that knows that ID can reply properly.

But if he's willing to try, I'd say go for it!

Offline MAN OF BLUES

  • Arena
  • Sr. Member
  • ****
  • Posts: 2898
  • Country: 00
  • WHISKEY.Tango.Foxtrot.
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #15 on: October 28, 2018, 04:52:49 PM »
I agree, let him try it...
as for the "splaination..."

pressing knob with fob in pocket, signals Kipass to querry available signals, and that ECU sends them to main ECU, which either recognizes, or doesn't (fob not paired), and sends signal (via hard wires) back to Kipass in lockset to say "ok, continue" or "nope"... it never sends back to the FOB.
 nor does it continue to querry the fob, even tho it's (the fob) continually broadcasting.

So I think what you are seeing, as the Kipass ECU signal you pick up on the radio receiver, is just the fact it is being "turned on, to read available signals.."  not the actual transmission of any signals other than that...

it's like "turning on the OPEN" sign on a store window... :rotflmao: and not unlocking the door until someone shows you the money...

when messing with the radio thing, what happens if no fob is near, and you press the stove knob? do you get a 'ping'?

stick a passive immobilizer chip next to the lock, press the key, and see what the "radio receiver" shows you then, with no Active fob within range... and tell us if there is a difference in what shows on the radio receiver, compared to normal Active fob activation....
I'm thinking you will see the same "ping".

46 YEARS OF KAW.....  47 years of DEVO..

Offline Gabriel

  • Full Member
  • ***
  • Posts: 105
  • Country: 00
  • Near Galveston
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #16 on: October 28, 2018, 04:56:38 PM »
Yeah it would help if you read the whole thread (now i understand the popcorn)
The locksmith is not going to use a factory fob!
The locksmith stated that this fob (the oem fob) does not communicate back and forth to the control unit.

Offline MAN OF BLUES

  • Arena
  • Sr. Member
  • ****
  • Posts: 2898
  • Country: 00
  • WHISKEY.Tango.Foxtrot.
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #17 on: October 28, 2018, 05:06:12 PM »
Yeah it would help if you read the whole thread (now i understand the popcorn)
The locksmith is not going to use a factory fob!
The locksmith stated that this fob (the oem fob) does not communicate back and forth to the control unit.

if that was aimed towards me, show me where you mentioned any of that.
i.e. what is he going to program....?

if not aimed towards me, I'm fine with that.

anyway, best of luck, tell us all the outcome, and what he did, and used.
over and out. :popcorn:

46 YEARS OF KAW.....  47 years of DEVO..

Offline jwh20

  • Full Member
  • ***
  • Posts: 364
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #18 on: October 28, 2018, 05:07:53 PM »
The FOB does not actively send out any signals until it "hears" the KiPass ECU.  That happens under two scenarios:

1) User presses the stove knob.
2) The bike was started using the FOB and the bike is underway.  (This checks every so often for the FOB and displays a warning that the FOB is missing if it doesn't get a reply.)

If you sit a radio next to the FOB without doing anything with the bike you will never hear it "chirp".  If you press the stove knob with no FOB around, you'll hear the bike ping several times before it activates the Key Immobilizer reader (i.e. the passive FOB reader).  If a FOB is in the area there is additional traffic as the negotiation happens.  The entire process takes much less than 1 sec.

So regardless of preconceived notions about what it does, it's quite easy to examine its behavior.

Offline just gone

  • Sr. Member
  • ****
  • Posts: 1655
  • Country: us
  • COG#9712 '10 ABS
Re: Concours 14 Passive FOB replacement from locksmith
« Reply #19 on: October 28, 2018, 05:22:34 PM »
......even tho it's (the fob) continually broadcasting.

Do you have a documented source (document title with page numbers etc.) for this info???

I find it hard to believe that the fob is constantly ("continually") broadcasting. I've heard this several times from different posts going back to the days where someone said that if you keep your FOB on the bike you need to wrap it up in aluminum foil etc.....I left my FOB on the bike without foil or battery life effect for months. I just don't think it does that, (either thing: continually broadcasts; or run down it's coin battery if left near the bike.) but I'll believe it if a Kawasaki or Mitsubishi document says so.

edit:
The FOB does not actively send out any signals until it "hears" the KiPass ECU.  That happens under two scenarios:

1) User presses the stove knob.
2) The bike was started using the FOB and the bike is underway.  (This checks every so often for the FOB and displays a warning that the FOB is missing if it doesn't get a reply.)

If you sit a radio next to the FOB without doing anything with the bike you will never hear it "chirp".  If you press the stove knob with no FOB around, you'll hear the bike ping several times before it activates the Key Immobilizer reader (i.e. the passive FOB reader).  If a FOB is in the area there is additional traffic as the negotiation happens.  The entire process takes much less than 1 sec.

So regardless of preconceived notions about what it does, it's quite easy to examine its behavior.
Ok I was typing slower than you, but I'm in agreement. However, MOB types it with such authority ...that I was hoping he had some documentation to back it up.