Mod chips xmit codes when power on allowing copied CDs to be booted on a Sny Playstation with these chips installed. If hackers can do this to get passed a game system copyright security, someone can do the same to simulate the code to the system to ride us of the SKREEM/RFID. I wish I was a hacker or pirate or went futher in programmimg school. Just a thought I had since the code is readable just not easily understood.

 

and what about these? SKREEM/SKIM Immobilizer Module - 68209837AA: Auto Tech Electronic - Having problems starting or turning on your vehicle? We can help!
are they fit for our xf's?
if so, how they managed to break the code?
already programmed?

 

We need to find a exploit in hardware to do this. This allows us to read and change the data before it read

 

This modules don't work on the Crossfire. But this Britain Company says, that the can manupulate the Skreem and ECU so that you don't need a matching transponder and you can use any Key. I wanted to send one of my trial sets to those I've already read out and after modifying it read everything again to understand how they did it. But they want 442.80 gbp > 550 USD for their service, this is too much for me just for a test.

 

the thing is, that there are ways to do this.
i think its just a matter of time that some1 like you finds how to break that code and make it available to the world. free (or at least a reasonable amount)

 

It won't be free.

It may happen, but it won't be free.

 

Mark, what do you know about the Josh cloning? Is it still an option if you have a working SKREEM?

 

perhaps if we make a poll and send you money (paypal) so the individual investment is not much for each 1, you could do that? for instance $20 each until covers the expense?
i imagine there are enough interested and willing to do so. that could make us sort of partners so when you solve the problem and get the solution we get a refund when we order?
just an idea, but considering the possibility, why not? or any other idea?
and if it does not work, we dont loose much money after all.

 

I'll play!

 

I am not sure. I sent Josh a Facebook message just now.

 

$550. If twenty of us donate $27.50, we can give this a try. IF it works, we all know we have a way out.
Now, there are two people on Facebook with 'dead' SKREEMS, maybe they'd risk a bit more to try it....

I will put the word out on FB to both of them. Problem is, for ANY ONE person to pay $550 to an overseas company for such an endeavor seems risky to me. Still, right now, we have at least tow cars sidelined until at least January, plus the one car HERE on the forum that is sidelined.

I tihnk it's time we, somehow, gave this a try. I guess.

 

Isn't the real core of the solution in the PCM (ECU)? I get it that the immobilizer is in the path but a failed ECU still spells the end of the powertrain regardless of the skreem or key RFID. I'd love to jumper past that little box and have an ECU that is only looking for a circuit to be completed from an ignition switch - like the good old days. I acknowledge that I'm ignorant here.

In any event, I'm interested in contributing $$ if there is some evidence of hope.

 

NO, the SKREEM has failed a lot of times. Only ECU failures I can remember were from water damage or connecting the battery backwards.

The ECM WILL NOT start the car unless the hand shake with the SKREEM is complete. It is a weird multistep process and is poorly described in the poorly written "student manual"....

 

Ok there are 3 bad SKREEMS that we know of. Two on Facebook and one on the forum.
There is another thread here talking about 600 units on backorder. The thread also has a video of a possible fix. I think until it is tried on a vehicle in North America we don't know.
The gentleman on this forum is not willing to try the offer from Toolman to solder the SKREEM as in the video. A very generous offer from a member with the skills to do it properly.
I do not do Facebook but I wonder if someone here that does can show the video to the people with bad SKREEMS on Facebook.
I would think someone with a bad SKREEM would want to try this. I understand if they do not want to try it on their own. I do believe if they asked for help someone with experience soldering would offer to do it.
If it works great if not it eliminates the solder points as cause of problem.

 

A kind of croudfunding would of course be an option.
But I live in Germany, so I have several concerns when repairing or reprogramming Skreem modules from the USA.
1. the customs, in the worst case you have to pay 2x customs fees 1x to Germany and 1x back to the USA.
2. the time which the shipping takes there and back.
3. the shipping costs, from Germany to USA costs e.g. nearly 40 USD and you have to pay also from USA to Germany.

Then I wonder why they need a key besides the Skreem and the PCM.
Then of course it should be clear to everyone that in the worst case there can be no result.
If nevertheless you are ready to support such a project, I would e.g. set up a PayPal Moneypool and ask also our German forum for participation.
Our forum is unfortunately not big enough that I expect to collect such a sum only there.
But with the support of the users of crossfireforum.org it is much more likely that this will work.

What I promise is:
1. if the required sum does not come together to give all your money back.
2. I will document everything exactly and publish it in this forum.
3. I publish my results of the analysis after the mod here.

So if there are users who want to support such a project please write it in this post, so you can see if there is a general interest.

 

1-thank you very much for the bright, detailed analisis.
2-as the module is the most important part, if fails, the car becomes a beautiful museum piece or art deco.
3-the british firm seems to have already found a solution, but if yours is way cheaper then it will be more sought after.
4-i guess that the costs of shipping and customs are about the same with them or with you, so what will make the difference will be your fees for doing what it takes from your part.
so, what this will be?
5-i believe that with this clarified, it will be way more encouraging for all of us to bring our contributions.
6-which could be a certain fixed amount, or whatever any1 wants to do (with perhaps a minimum of $10?).
considering the thousands of users, i think many will be willing to send their moneys-especially being such small amounts.
again, many thanks for your great effort to solve this challenge in a way less expensive i hope.

 

I heard from Josh, he is willing to try:

I don’t have any way to test changes. I thought I had someone to send back and forth but they didn’t understand it would take more than once. It’s not a bad solder joint anywhere. It could be a regulator. I’ve had a theory it might be the acoustic driver. But the tests have to be done with me here on my bench. The memory can’t be read directly from the microwire eeprom. Idk why. It’s almost like every one I’ve tested has been wiped.

If someone with a down car is willing to pay shipping back and forth we can get it done.

Too many people expect magic the first round.



So, if someone with a car down wants to try, Josh will try. You need to send him your bad SKREEM and a used SKREEM from, say, a junked car.

 

to 1) thank you
to 2) you are right, the Skreem can bring you and your xf in real trouble
to 3) today I don't have a real solution, I can repair a modul if the prozessor is OK
to 4) if you mean the shipping to britain or to germany you are right. The prozess of desolder the prozessor from the skreem, solder it to the adapte pcb, read out the prozessor, write the prozessor, desolder it from the adapter PCB and solder it back to the skreem is risky and costs a lot of time.
Also the skreem modul from usa and europe used different radio frequencies for the keyfob so i have to by spare parts in the USA. Therefore I can advise anyone not to send a working set (Skreem + PCM + keyfob) for modification.
If it is defective I can repair it or it remains defective so there is no risk for you and me that something will be destroyed.
I always work on a success basis, so if I can't repair it you only have to pay the shipping costs and customs.
For a repaired Skreem module I would take 200 USD and if someone supported the planned croudfunding campaign with a payment I would subtract this amount.
to 5) thats right
to 6) I wouldn't set a minimum, every dollar counts. But so I don't have to refund hundreds if we don't reach the target of $550, I would only refund amounts over $10. The remaining money I will then of course put into my further research.

 

so really you are charging usd$350 less-that sounds as a great savings. lets hope you get enough contributions and you get this solved.

 

sounds a great alternative. now, could you provide details on how to contact him? link? how much he charges?
thanks