A Smart Car Key - What's Inside?

RE: A Smart Car Key - What's Inside?

sukrame1975 — Tue, 02 Jul 2024 08:40:15 GMT

Is there a chance that someone can measure the two marked coils? Would be grateful for values. Thanks.

RE: A Smart Car Key - What's Inside?

apronxy — Sun, 12 Mar 2023 09:44:23 GMT

Hello Jan,

Thank you very much for sharing the information with us. I hope you can view this message after 2 years of this topic being posted.

My key fob is out of order and one of the capacitors is detached and visibly broken. Finally, it was lost during trying to re-soldering it back to see if the fob functioned again.
I'm going to buy a new capacitor for repair. But the newly bought multi-functional meter doesn't give me a solid figure about the capacitance value of the same size capacitor on the board. Furthermore, I have no idea what the voltage of the capacitor should be.

Do you have any idea what capacitor is inside the blue circle? Thank you.

RE: A Smart Car Key - What's Inside?

genebren — Tue, 05 Jan 2021 19:44:25 GMT

Very interesting. I hope that you are able to identify more of the parts and hopefully post more updates.

RE: A Smart Car Key - What's Inside?

Jan Cumps — Mon, 04 Jan 2021 18:45:25 GMT

I knew I had seen the unmarked SMDs before, but wrongly remembered it as a fuse.

[View:/resized-image/__size/331x306/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-421f0d88-f665-48fb-b0d4-f68419cdadfc/contentimage_5F00_193520.png:331:306]

It's a TVS: https://www.element14.com/community/community/applications/automotive/blog/2020/09/04/the-blinker-in-a-side-view-mirror-…

RE: A Smart Car Key - What's Inside?

14rhb — Tue, 29 Dec 2020 12:02:02 GMT

You mention the SPI flash memory. This is another source of functional insight that could be exploited: capture the SPI activity in several scenarios (power up, buttons pressed etc) and pass it through some tools. Inspect the data using Wireshark to see if a known protocol is flagged up, look for some unique codes that you may already have...maybe the car's VIN plate ID?. Is the data the same on each power up and no activity when the keys are pressed - indicating it only stores the same FPGA bitstream or MCU code. Does some data change on each keypress - maybe the bytes around stay fixed, indicating this is something to do with the encryption key/rolling code? Indeed often you'd find some readable ASCII in the dataset to better realise what that SPI flash is doing.

You could also try a disassembler if you thought it was MCU program code; would be hard work though !

RE: A Smart Car Key - What's Inside?

phoenixcomm — Mon, 28 Dec 2020 23:16:59 GMT

[mention:acaf6a9338de4eef8f6717d5561ed01d:e9ed411860ed4f2ba0265705b8793d05] verry cool, thanks.

RE: A Smart Car Key - What's Inside?

kmikemoo — Mon, 28 Dec 2020 22:51:02 GMT

[mention:acaf6a9338de4eef8f6717d5561ed01d:e9ed411860ed4f2ba0265705b8793d05] Very cool! Of chips 1 & 2, would one be a transceiver and the other be a security chip of some sort?

RE: A Smart Car Key - What's Inside?

DAB — Mon, 28 Dec 2020 19:41:10 GMT

Nice tear down Jan.

DAB

RE: A Smart Car Key - What's Inside?

dubbie — Mon, 28 Dec 2020 18:40:06 GMT

Jan,

That was very interesting. More components than you might expect.

Dubbie

RE: A Smart Car Key - What's Inside?

14rhb — Mon, 28 Dec 2020 10:21:14 GMT

Hi Jan,

Very interesting and good luck. I love a challenge and spent my 'morning hour catchup' doing some delving and found virtually nothing. A website for a Chinese clone was interesting though as the tree theme (PALME = palm in German) and similar format part number crops up:

[View:/resized-image/__size/500x500/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-421f0d88-f665-48fb-b0d4-f68419cdadfc/contentimage_5F00_193519.jpg:500:500]

My suggestion prior to this was that IC2 was a MCU based solely on the positioning of the SPI flash memory. The clone above used Atmel, you've already checked out the flash as Microchip and perhaps your IC2 is also an Atmel MCU? Some probing with a scope to find fixed pins might help match up against a datasheet for QFN packages - noting many MCU can configure pins to many functions, so clock, voltage and ground are the best bets.

My other thoughts are SPI flash...IC2 could be an FPGA and the flash loads up on boot. The SPI flash contains an encrypted bitstream, once loaded they may instance a softcore MCU and that gets the program code from the SPI flash also. The flaw in this idea is that there is a second important looking IC. If the FPGA were employed then it would be likely whatever IC1 does would also be brought into that FPGA.

IC1 I would guess is something like the Microchip Keeloq - a rolling code generator that can accept the next N in the sequence but shuts out all previous codes once a valid one is accepted. This would stop a thief inserting a simple repeater unit that could have already stolen your code e.g. by powering up the keys days earlier on a chance meeting.

As as I was about to click send and do my chores for the day I notice your 'deep dive' link....so the fun will continue tonight [View:/resized-image/__size/16x16/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-421f0d88-f665-48fb-b0d4-f68419cdadfc/contentimage_5F00_938.png:16:16]

RE: A Smart Car Key - What's Inside?

baldengineer — Mon, 28 Dec 2020 05:19:24 GMT

Heads up [mention:acaf6a9338de4eef8f6717d5561ed01d:e9ed411860ed4f2ba0265705b8793d05], your "Deep Dive" link at the beginning has an extra http in it...