As a result of immo malfunctions or its conflict with the installed alarm, the car engine may be blocked. To bypass the immobilizer in this case, you can use a ready-made blocker crawler or make it yourself.

[ Hide ]

Device and principle of operation

The blocker crawler is made in the form of two antenna adapters that operate through a special switch. In the role of the latter, a relay is used. One antenna is designed to read the pulse from the key, which provides the possibility of keyless entry, and the second - transmits a signal to the ignition switch. The relay is used to communicate directly with the circuit breaker. With this connection, a pulse signal from the key chip is fed to the antenna in the lock, after which it is sent to the immo unit, as a result, the power plant is started.

User Xilvlik, using the example of a device from the manufacturer Starline, spoke about the principle of operation.

Kinds

Four options can be used to bypass the blocker circuit and get the engine running:

1. Application of the module with the original key-label. The element is installed in a special plastic or metal case designed to read the pulse and transfer it to the ignition switch. This block must be connected to the blocker and installed in a place inaccessible to the criminal. For example, behind the control panel. This option will affect the security of the vehicle, as the hijacker can reveal the spare key and steal the car.
2. Connecting the control module using only a chip. This option is safer for the vehicle, since a copy of the label from the key is not equipped with a barbed part. However, the car's engine will still be unlocked, so it's possible to steal it.
3. Experts recommend giving preference to a method that requires the installation of a programmable bypass unit. This module can emulate packet data transmitted by the original key to the immo.
4. You can completely disable the blocking of the internal combustion engine. The implementation of this option is easier in the case of vehicle models on which immobilizers have just begun to be installed. In modern cars, it is impossible to completely disable the blocker.

User Kirill Kolomna spoke about the varieties of branded devices from the manufacturer Starline.

How to connect crawler?

Before you bypass the immobilizer, you need to decide on the scheme. Regardless of the type of start of the power unit, the use of both key and keyless access is allowed. It is necessary to know exactly the type of lock that is installed on the machine; for this, you should familiarize yourself with the key bits. If there is a contact resistance element on this part, then the vehicle is equipped with a VATS system.

If the car is equipped with a Start / Stop button, then when installing the immo crawler, you must definitely find the blocker antenna, it is mounted inside the steering column.

When choosing and connecting a crawler, you need to take into account the nuances:

• the bypass module is controlled by an anti-theft installation;
• the regular blocker of the power unit remains active and is used when the engine starts, it cannot be turned off;
• the bypass system control module must be universal or support the maximum number of machine models for installation;
• to start the engine, only regular keys are used.

RFID

To implement the task, you need a block inside which a label or key is set. It houses the pulse signal transmitter, which plays the main role in the bypass. The complete set of the device includes a transceiver mounted next to the ignition switch. The connection procedure is carried out according to the scheme, and the distance between the antenna adapter and the blocker module will be minimal. When the bypass system is activated, an impulse is sent through the security installation to the lock, which helps to recognize the tag and start the internal combustion engine.

Scheme of installation and connection of the RFID device Detailed wiring diagram for connecting contacts on this model

VATS

When using the VATS crawler, it is required to measure the characteristics of a resistor device, the procedure is as follows:

1. A search is made for conductors that come from the contact elements in the circuit breaker metering unit.
2. One of the cables is cut, the tester contacts are connected to this place. You will need a multimeter set to ohmmeter mode.
3. The original key is installed in the lock, the ignition is activated.
4. The resulting resistance parameter, which will be displayed on the display, must be written down with an accuracy of the second character after the dot.

In accordance with the obtained value, a separate resistor device is selected. When choosing, it is allowed to use parts whose nominal error is not more than 5%. The resistor must be connected to the electrical circuit of the anti-theft system through a relay. Contact element number 30 is connected to outputs 87 and 87A. This makes it possible to install a resistor component in a bypass circuit or in a switch.

VATS device connection diagram

Chipless Crawler

To make such a connection, a small control module is required. It will be built into the regular electrical network of the machine. Small dimensions are needed so that the device is problematic to detect.

The principle of operation during installation is as follows:

1. The control module is mounted on the machine. For connection and installation, use the instructions that are included in the package. Depending on the model, the installation and wiring procedure may differ.
2. The ignition is activated for ten seconds. During this time, the module must determine the vehicle model.
3. The power unit of the machine starts for a few seconds, then the ignition is turned off. When performing this task, the bypass module must read the tag code set in the key and store it in memory.
4. Then the negative contact of the crawler, which is used when training the device, is disconnected.

A chipless immo crawler from one machine can be installed on another, you will need to clear the memory - for this, the negative cable is connected twice with the ignition on.

Advanced lineman models for premium vehicles require dual mounting. During the initial installation, the device records information into memory, after which it is dismantled from the machine and programmed. Then the module is mounted back and used for its intended purpose.

The Autopulse channel talked about Fortin devices for bypassing regular ICE blockers.

How to make a crawler yourself?

For self-production of the module you will need:

1. Copper cable. The diameter of its section should be up to 0.25 mm, but not less than 0.2 mm. The outer sheath of the conductor is made of transparent varnish.
2. Relay operating from a 12 volt network. You will need a device with normally open contact elements.
3. Spare key with label. You can use a chip programmed for a specific car model.

The cable is wound directly on the label, this is how the coil is made. The number of turns is selected taking into account the model of the immobilizer, it will be up to 50. From above, the winding should be insulated with electrical tape.

Further steps for assembling the crawler:

1. The cable going to the standard immo antenna is cut.
2. The positive contact is applied to element number 86 on the relay. And the negative connects to output 85.
3. A safety diode device is inserted between elements 85 and 86. Its anode contact must be soldered to output 85. The installation of a diode element is required to protect the control module of the anti-theft system from reverse voltage.
4. Then, one of the cables of the cut antenna circuit is connected to the contact component 87 A of the relay, soldering is performed. A wire from a self-made bypass module is connected to the same contact.
5. A second crawler cable is installed on the open output 87. It is being soldered.
6. The second wire from the electrical circuit of the antenna adapter is connected to pin 30.

Video "Developing a bypass module with your own hands"

The Disable Immobilizer channel spoke about the features of creating a block and showed the procedure for implementing this task.

Self-made immobilizer crawler Most modern cars use an immobilizer with a radio frequency tag (RFID - Radio Frequency ID) in the key. Its code is read using a frame located around the ignition socket. Labels are usually passive. Those. power is obtained from a "pump" magnetic field induced in the tag's antenna. The frequency used is 125 kHz. In some cases, a frequency of 13.56 MHz is used. Unlike the transceiver antenna, which is a frame, the tag uses ferrite antennas (a thin wire wound on a rod made of a material with high magnetic permeability) for reasons of compactness.

When connecting a remote engine start system, it is necessary to bypass the standard immobilizer system. To do this, you need a key registered in the car (tag, chip) and a properly connected crawler, in which the key is embedded. The bypasser is disabled in normal mode, it is connected only for the period of remote start (or autostart). Usually the crawler is a box with an antenna frame and a relay. And if there is no purchased, then it is easy to make it yourself. In some cases, this is even preferable, because. it will be possible to make a much more compact design, which is much easier to hide very deep.

1. We make a frame for the ignition lock. To do this, we make a mandrel (for example, from cardboard) of the desired diameter, under the ignition lock. We need our frame to fit exactly there. We wind a coil of electrical tape or adhesive tape (it is thinner) on the mandrel with the sticky side up.

We wind the winding wire, 20-30 turns with a diameter of 0.1-0.3 mm. The wire can be taken from the coil of an automobile relay. One relay can be sacrificed, one coil is enough for several crawlers. We wind carefully, we need compactness. Having cut the edge of the electrical tape, we roll it onto our winding.

Carefully cut off the excess tape with scissors. It turns out a ring frame, quite thin.

Then we tin the wire and solder the leads. We fix them with tape. The frame is ready.

2. We wind on a key or a chip with the same wire, a frame of 20-30 turns, solder the leads, close with electrical tape.

3. Installation We install the first antenna in the ignition lock cover, and subsequently the key with the frame will need to be hidden somewhere in the car so that a potential attacker spends as much time as possible searching, if he succeeds at all.

4. Connection We connect the frames and the relay built into to bypass the immobilizer as shown in the diagram.

Our key will be shown to the car only during the remote start. The wires that connect our additional frames must be inserted as carefully as possible into the standard wiring. They should be as difficult to identify as possible.

5. Nuances Rarely, but there are times when even the thinnest manufactured frame does not fit into the ignition lock casing. Then we will have to turn on our additional antenna with the key in the gap. In this case, the second antenna in the ignition lock cover is not needed at all - we turn on our winding around the key instead of the regular one for the duration of the remote start, switching it with relay contacts.

Many cars are equipped with immobilizers. In order to understand how the immobilizer bypass module is used, it is necessary to understand the principle of operation of the device itself. As a rule, RFID systems are used (on cars of European and Asian manufacturers), as well as VATS (American cars). The essence of the work of these devices is that you can start the car engine only with the help of a special key.

If the car is equipped with an RFID system, the unique characteristics of the key are stored in the electronic filling of the car. But in the case of using VATS technology, the key must have special parameters. In other words, you definitely cannot start the engine with a simple piece of iron.

In most cases, the Starline immobilizer crawler (and other models too) are used by those car owners who plan to equip their iron friend with an auto-start alarm. It is in such situations that a person begins to think about how to bypass the regular immobilizer.

These systems use ignition keys with integrated chips to transmit a weak RF signal. It is transmitted to the car's immobilizer antenna installed in the area of ​​the ignition lock. The simplest solution is to remove the electronic element from the key and attach it to the antenna. But in this case, unauthorized persons can easily start the car with an ordinary blank. That is why the immobilizer bypass block is used. It should be noted that all crawlers work on a similar principle. In our article, the connection of the Sherkhan immobilizer crawler (BP-2) will be written in detail.

This is a compact box with an additional ignition key inside (if it is missing, you will have to make a duplicate). The module also consists of a reading antenna and a relay. Connecting the immobilizer bypass module does not cause any difficulties.

1. The second key is to put the chips inside the antenna.
2. Install the external antenna of the immobilizer bypass unit on the ignition lock cylinder. It must be remembered that the distance between the immobilizer crawler antenna and the RFID antenna should be minimal. Check where the RFID antenna is located before using the device.
3. The red wire in the Scher-Khan BP-2 crawler must be connected to +12 Volts. But we cling to black to any "minus". Prior to installing a remote start, these wires should not have "+" and "-" at the same time.
4. Verify that the auto start alarm is working. If there are no problems and the engine can be started without using a key, we advise you to hide the standard immobilizer bypass module from unauthorized persons.

Note that sometimes immobilizer crawlers may not fit a particular car. Since we are already talking about the products of the manufacturer Scher-Khan, it is worth mentioning that the developers recommend using the BP-2 module on Asian cars, but on European models, bypass the immobilizer using the BP-3 unit.

On sale there are also universal devices. For example, the 556U immobilizer bypass module is suitable. You can connect this immobilizer crawler in different ways. The device has 9 wires, as well as a special jumper for a couple of positions. Sometimes only this block can help bypass the immobilizer. It is worth mentioning that such systems cost several times more compared to the aforementioned Sherkhan crawlers.

In some cases, the size of the module antenna loop is not enough to place it at the location of the standard antenna. The solution is also to use another module. Very often, the AME immobilizer bypass block can be a good choice. Its advantage in such situations is the large loop. In addition, it can easily be wrapped around the standard RFID immobilizer antenna several times.

Understanding what principle the immobilizer crawler works on is quite simple. When the power unit is started remotely, the relay is turned on (its winding is powered by the red and black wires of the Sherkhan BP-2 unit), located in the standard car immobilizer bypass module. After that, the antenna in the immobilizer crawler reads the signal and transmits it to the external antenna of the module. After that, the signal is transmitted to the standard antenna of the RFID system.

It is quite realistic to make an immobilizer crawler with your own hands. To do this, you need an electronic chip or a second key, some wire and a relay. True, you have to guess the number of turns, and this can take a lot of time. You can find more detailed recommendations on the pages of the worldwide web.

How to bypass VATS type immobilizer

Owners of cars equipped with VATS immobilizers have an ignition key with a resistor inside. In order to start the engine, the VATS device must detect a predetermined resistance. Otherwise, the operation of the fuel pump and starter will be blocked.

• You need to know the characteristics of the resistor used. As a rule, its resistance is from 390 to 11800 ohms. You will need a similar resistor (maximum error - 5%).
• Find VATS immobilizer wires. These are two wires with a small cross section that come out somewhere from the steering column. Often the wires are enclosed in a heat shrink tube in black, orange or white.
• Use the diagram below to bypass the VATS immobilizer.
• To connect, you can cut any wire.

Remember that there are different types of immobilizers in stores. For example, there are also keyless immobilizer crawlers. An immobilizer crawler without a key is a really interesting thing, but, unfortunately, we cannot describe in detail all such systems. Autopub reviewed the most common immobilizer bypass modules. Now you know how to bypass the immobilizer. Installing the bypass module or not is up to you.

Nowadays, cars with built-in immobilizers are becoming more and more common. The most common vehicles are equipped with RFID (Radio Frequency Identification) and VATS (Vehicle Anti-Theft System). The meaning of immobilizers is that the car can only be started with the "native" key. That is, a key that is registered in the "brains" of the car (if the car is equipped with an RFID immobilizer) or a key that has the characteristics necessary to start the engine (for cars equipped with VATS). Simply put, you can't start a car with a simple blank.

The first type of immobilizers (RFID) is found in most Asian and European cars. The second type of immobilizers (VATS) - almost all American-made cars.

What to do if you want to install a car alarm with auto start in your car, and the car has a built-in immobilizer!? We will not consider the option of installing Webasto or Hydronic liquid heaters - we don’t have 40-55 thousand rubles. Although, in fact, it is the installation of these heaters that I would recommend first of all to owners of expensive new cars.

So, you need to somehow bypass the regular immobilizer.

RFID immobilizer bypass

This type of immobilizer is characterized by the fact that inside the ignition key there is a small "chip" called a transpoder, which transmits a low power RF signal. This signal is read by the standard immobilizer antenna, which is located on the ignition switch. You can, of course, pull the "chip" out of the key and tape it to the antenna on the ignition switch. But then immobilizer is automatically deactivated and the car can already be started with a simple blank. This is where bypass modules come to the rescue. immobilizers. All crawlers are very similar in composition and connection. Consider, for example, the Scher-Khan BP-2 immobilizer crawler.

The module is a box where an additional key is placed (in Figure 3) (if you do not have a second key, then you need to make it, in Krasnoyarsk the production of such a key costs 1500-10500 depending on the car). In the same box there are more relays (in Figure 1) and a reading antenna (in Figure 2).

Connecting the immobilizer bypass module is simple.

Put an additional key with a chip inside the reading antenna in the immobilizer crawler module.

The external antenna of the immobilizer bypass module must be mounted on the ignition lock cylinder. It is very important that the distance between the standard RFID antenna and the crawler antenna is kept as short as possible. Literally a few millimeters of difference - and autorun does not work! By the way, the standard RFID antenna may not be on the ignition switch. An example of this is Toyota Prius.

One wire, in BP-2 is red, we connect to +12 Volts. The second is black, to some kind of "minus". The point is that there is no "plus" and "minus" on these two wires at the same time until the car is started remotely. When trying to automatically or remotely start the engine, it is necessary that signals appear on both of the above wires. What chains you will hook up to - it already depends on the car and your ingenuity. For example, red is a “plus” constant, black is a “ground” that appears at the output of an additional car alarm channel when trying to autostart. Or, black is a “ground” that appears at the output of an additional channel of the car alarm when trying to autostart, red is a “plus” that appears at the output of the power wire of the starter (ignition) of the car alarm when trying to remotely start. In short, there are many options. More often, of course, the first connection option is used.

Now check the operation of the remote autostart, and if everything works - the engine starts without a key in the ignition from the car alarm key fob, then you can hide the immobilizer crawler away from your eyes. When assembling the steering column cover, do not move the crawler antenna! You know how disappointing it is when you put everything together, changed clothes, got ready to go home, you start doing a control check, but the car won’t start! And again, change clothes, disassemble the casing, move the lineman's antenna back and forth on the ignition switch ... bad, in short.

It may also happen that everything seems to be connected correctly and the crawler's antenna is close to the antenna of the standard immobilizer, but autostart does not occur. In this case, most likely (if you are sure that everything is in order with the immobilizer crawler module), you need to replace the crawler with another one.

The fact is that not all immobilizer crawlers are suitable for all cars. For example, manufacturers of Scher-Khan immobilizer crawlers recommend using Scher-Khan BP-2 for Asian vehicles, and Scher-Khan BP-3 for European vehicles.

If you are not sure which immobilizer bypass will fit your car, take the so-called "universal" immobilizer bypass module. For example, 556U. This immobilizer crawler has several connection methods. It has 9 wires for connection (6 power and 3 antenna) and inside there is a jumper for two positions. Only with the help of such a lineman was it possible to defeat Skoda (I don’t remember which one), some kind of BMW. Well, simple cars, he clicks like nuts. Its cost, however, is 2-3 times higher than the same Scher-Khan.

It happens that the crawler antenna loop is too small to be put on the ignition switch or where the standard immobilizer antenna is located. Then, again, you will have to select another immobilizer bypass module. For such cases, I recommend the AME crawler. He has the advantage that his antenna is simply a huge loop. This loop can be worn anywhere. Another plus of this immobilizer crawler is that its loop can be wrapped several times around the standard antenna, thereby increasing the likelihood of bypassing the standard immobilizer. By the way, it was with the help of the AME crawler that they managed to defeat the Toyota Prius. Here it took its huge loop and the ability to wrap it around a standard RFID antenna several times.

I hope you understand the principle of the immobilizer crawler. During the remote start of the engine, a relay is activated (remember the black and red wires of the Scher-Khan BP-2 are nothing more than wires that feed the bypass relay winding), located in the immobilizer bypass module. Through the normally open contacts of the relay, the signal read by the antenna in the immobilizer crawler from the additional key is transmitted to the crawler's external antenna. From the external antenna of the immobilizer crawler, the signal is already read by the antenna of the standard immobilizer, located on the ignition switch. And there, already through the standard wiring, the signal went to the “brains” of automobiles, etc.

Another way to bypass the regular immobilizer- to do something like a lineman yourself. All you need is a "chip" or native second key, relay, wire and patience. Patience because it is so easy to guess the number of turns, especially if you did not have skills in this type of activity before. The Internet is full of such advice, so I will not dwell on it.

In conclusion, I want to say that the immobilizer bypass modules mentioned above are not a panacea. It's just that these are the crawlers with whom I had to work most often.

VATS immobilizer bypass

Vehicles with VATS are equipped with an ignition key with a resistor built into it. If the VATS decoder does not detect the required resistance when starting the engine, the starter and fuel pump circuits may be blocked.

Determine the key resistor value. Typically, the resistor has a resistance of 390-11800 ohms. Choose a resistor with an error of no more than 5%.

Locate the VATS wires. VATS wires - two small gauge wires coming out of the steering column area. Their color can vary, but they are often enclosed in orange, white or black cambric - either two white wires or one purple/white and the other white/black.

When connecting to VATS wires, it does not matter which wire is cut.

As you can see, nothing complicated.

Lastly, advice.

It is advisable, if you install a crawler, to put at least some kind of cunning. I advise my clients to retrofit their car with an immobilizer that allows the engine to be started remotely, but blocks its operation when the car is moving.

P.S. Of course, not all types of immobilizers are considered here. But I did not set out to talk about the types of immobilizers. Moreover, most cars are equipped with exactly the immobilizer systems I have considered or the like.

Having connected the alarm according to the scheme proposed by the equipment manufacturer, owners often face a problem - all functions work except for autorun. The voltage at the starter appears, the motor shaft starts to rotate, but after a certain time it stops. In fact, this is how a regular immobilizer works, which protects the car from theft. Therefore, not only the ignition wires, but also the immobilizer bypass module must be connected to the main alarm unit. Then autostart can be carried out in the set mode, without fear of stopping the starter. Next, we consider how to make an immobilizer crawler ourselves.

What will be implemented

Any crawler of a regular immobilizer, both purchased and home-made, is simple:

A coil consisting of 50-100 turns is wound around the electronic chip of the key.
Another inductor, also containing 50-100 turns, is located near the ignition switch.
At the time of autostart, the coils are combined into a closed circuit. Due to this, the immobilizer behaves in the same way as if there is a key near the regular lock.
All crawlers, except Fortin, do not work without a key module placed in the car at all times. Because of what, insurers increase the cost of CASCO. A typical crawler circuit is shown below.

Schematic diagram of a homemade crawler

Factory-made devices in their circuit repeat what is shown in the first figure.

Factory made device

For all doubters, here is a view of the board from below.

Factory Device PCB

Installing and connecting a crawler, regardless of its model, always looks the same.

Connecting the lineman to the gap of the standard coil

Features of the practical implementation of the scheme

Let's say you plan to make an immobilizer crawler. Then, without a regular key registered in the control unit, nothing will work. Take the chip of the disassembled key, remove the battery.

Printed circuit board of a regular key fob

The design shown can be placed inside a heat shrink tubing. And on top you need to wind the wire (exactly 50 turns).

The wire is wrapped around the chip

Consider how to make an immobilizer bypass module from easily purchased parts: a 4-pin relay, a 1N4001 diode, a winding wire (d = 0.35-0.5 mm).

When installing the module in a car, take care of the following: the module itself must be hidden, the power cord (1-2 A) must reach it. The assembly of the crawler and its installation is carried out according to the two schemes shown at the beginning.

Making a Crawler Module

The standard immobilizer bypass module, if it is manufactured at the factory, may even contain active elements (transistors, etc.). However, the case of such modules is always made of plastic. This is no coincidence. If the body is made of metal, you will get the equivalent of a short-circuited coil in the main coil - the one wound around the key.

Plastic box and relay

When installing the module, this circumstance must also be taken into account. Do not place the case near metal surfaces (this is desirable).

Let's say you managed to make a box. Now take a 4-pin relay, rated for 12-14 volts, and fix it inside the case. By bypassing the immobilizer, you are switching current less than an ampere. Therefore, the relay can be anything, as long as it can withstand a significant number of operations.

Crawler switching element

It is better to solder the diode "1N4001" to the relay taps. At the same time, remember that the diode is turned on in reverse polarity (“arrow” is directed “from minus”).

4 wires will come out of the case:

Two-wire cable for connecting an external coil. Its installation is usually carried out "in place", removing the casing from the lock.
Negative polarity power wire (will go to the alarm).
Cord "+12 Volts" (power will be supplied to it constantly).
Once again, check with the diagram that was given at the beginning. The immobilizer crawler itself does not contain only a “round” coil. It turns out that four cords come out of the module. They are listed.

The subtleties of making a "deceptive coil"

The inductor placed next to the lock should contain 50 turns of winding wire. Its brand can be any, but a thin winding cable will constantly break. There are two options:

1. A part called a "coil" is made separately and fixed on the lock casing when the system is being installed (mounted);
2. The lock casing itself is dismantled, having previously disconnected the electrical connector, and the cord is wound directly on the casing.

In the first case, you can use a glass cup covered with insulating tape. The winding is fastened at the last stage, for which epoxy resin is used.

Coil separate from the lock

The result of all efforts will look as shown in the photo.

If we talk about "case 2", the result may look even better.

Two coils - "ours" and "regular"

Having screwed heated self-tapping screws into black plastic, their caps are then used as terminals. A thin wire is soldered to the surface of the terminals, having previously cleaned it. We wish you success.

Homemade lineman - questions and answers

A common question sounds like this: if a home-made immobilizer crawler was installed, can it be replaced with a factory one over time? Roughly speaking, they ask whether it is permissible to connect a homemade antenna to serial equipment.

For example, in the circuit of a serial crawler, the antenna circuit contains only a relay. Then the answer will be positive. In other cases, you need to look at the diagram. And if there is even the slightest doubt, do not connect.

The standard immobilizer bypass module may contain a large set of elements, but they often do not belong to the antenna circuit, but to the power circuit. For example, this is done in BP-05 devices (Starline):

It is possible that the key electronics will not work if it is disconnected from the power supply. It is for such key fobs that a stabilizer is provided, which is turned on at the moment the crawler is triggered.

The question remains whether it is possible to use the key in the absence of a battery at all. It will be easy to find the answer: try to start the engine by removing the battery from the key fob.

The review would be incomplete if the following was not said here. Bypassing the standard immobilizer can be done by simply sending codes via the CAN bus. These codes allow you to deactivate protection for a while. Installing crawlers using this principle involves connecting to two wires - conductors of the CAN bus.

The presence of a key, as you understand, is not required in such cases. But they do not recommend the installation of “keyless” crawlers for the following reason: the device can issue error codes that are registered in the engine ECU, and then they have to be deleted.