Range Rovers Forum banner
1 - 20 of 40 Posts

Registered
1995-2002 Range Rover P38A
Joined
1,431 Posts
Discussion Starter · #1 ·
Aloha all,
I don't post here much anymore, however this is a really important development........

Recently, I was directed by KCR (Thank you!) to a bloke named Simon.....
He has come up with a nifty postage stamp sized board which, when inserted into the Bosch engine ECU will send the mobilisation
code needed for the fueling and ignition to function. There are 3 wires to solder on to the board and one pin lead to clip.
Install takes about 15 min start to finish. He needs to know the mobilisation code as it is pre programmed into the chip.
He can provide the chip preinstalled into an appropriate ECU which just needs to be swapped in. No soldering skills needed.
There is also a jumper to install at the Becm to disallow it having a say as to cranking, which it does indeed
disallow in an alarmed and immobilised state.
With this device installed, I proceeded to annoy the Becm by locking with the fob, and unlocking with the key in the door.
Normally, this will trigger the alarm and immobilisation mode will be activated needing either the EKA or a push of the button on a working fob.
To my utter delight, I found that the engine started just fine and there were no notices on the dash. All systems worked fine as well.
Of note, the dashboard alarm Led does continue to flash as if the alarm is going off. As I have unplugged the sounder,
this is the only indication I have that there is anything going on. I believe sounder can also be disabled in Becm with Nano....
I then locked the car with the key, and waited 2 minutes.....The Becm goes to sleep, so no unwanted battery drain.
I got 2 of these and will install in the Borrego tomorrow.
The peace of mind this will bring to me with regard to wife and friends using the trucks is priceless! No worries about the dreaded
"Engine immobilised, enter EKA or press fob" message to them when far from me and the Nano (Also, always seems to happen on a dark and stormy night) :)
I believe this little board could keep a good number of very nice P-38s out of the Knackers yards!
Especially considering the difficulty / expense involved in getting replacement fobs now.
This is a must have for anyone without a fob, and wanting some peace of mind!
Oh, yes, I do not work for or with Simon. Please contact him if you have questions. He is now registered on this forum, so should respond.....He is "PsiDOC"
I shall continue to report on performance as needed, but so far? FLAMING BRILLIANT!!!!!
Cheers, Simon!!
Tom
 

Registered
Joined
21 Posts
Good morning all.
I am the Simon mentioned above and yes the immobiliser on the P38 THOR, GEMS and DSE can be bypassed by emulation.
By emulation I mean I have designed a small (22mm x 22mm)electronic board that can be fitted inside the ECU and connected via 3 wires that will send the correct encrypted code to the ECU so the ECU is happy and will run without the need for interaction with the BECM.
The project mentioned by Bolt above was actually done for an off road competition vehicle that the owner wanted to fit a P38 4.6 Thor engine into, so I was thrown the challenge to make it standalone.
I already had the D2 Thor and GEMS ECU standalone solution in place so we could have gone down that route using a D2 ECU from the USA Spec 4.6 D2 or swapping over to a GEMS unit, but neither of those were ideal, so I looked into the P38 THOR ECU to see how it ticked.
A lot of people say the D2 Thor and the P38 THOR ECUS are identical. They are not. There's a lot of changes in software and some in hardware between the 2 and even across different revisions of the same ECU there are differences.
This little project took over 12 months to crack with the difficult bit being finding the first crack in the armour. After that first in road on the encryption, it took a week to get a finished solution out for initial testing, which went well and is still out there competing to this day..
After unveiling the project to the public on social media with a bench test video demonstrating the ECU being happy, I was immediately messaged by 3 people saying "That's impossible! It can't be done!" Errr... Ok... I guess I have done the impossible then 馃ぃ馃ぃ.
Well I guess the proof of the pudding is in the eating and I now have ECUS in the USA , Europe and Malaysia all working standalone on my humble little boards.
It was only when I was talking to one of the P38 specialists here in the U.K. that I realised that the BECM can be somewhat of an Achilles heel on the P38 that can leave you stranded for numerous reasons and I daresay you know a lot more than I do on that subject. Well this little board (and a wiring mod for the starter motor engage request) will mean the BECM is not involved with the running of the engine at all so irrespective of the BECM status, you'll always get the car to start and drive, which may give some a bit of peace of mind.


Other projects I have done are the L322 BMW 2926cc Diesel and the L322 BMW 4.4 petrol ECU both standalone as well as the TD5.

Any questions as all about what I can do, please post here or drop me a message and I'll be happy to explain further.
You can also see the P38 and others being demonstrated on my youtube thingy.

Cheers.
Simon
 

Registered
1995-2002 Range Rover P38A
Joined
611 Posts
Well the obvious question is if I send you my engine ECU what is the cost for installation of the board? The other question that comes to mind is can I send you any Thor ECU or does it have to be from my car (as I have 2 from parts cars)?
Thanks
 

Registered
Joined
21 Posts
Provided the THOR ecu is a known working ECU and the correct one for the engine IE: a 4.6 one for a 4.6 engine, then you can use any.
I don't know if I am allowed to put up prices yet. I am sure one of the admin team will clarify that.
Will drop you a P.M. gordo.
 

Registered
Joined
274 Posts
Provided the THOR ecu is a known working ECU and the correct one for the engine IE: a 4.6 one for a 4.6 engine, then you can use any.
I don't know if I am allowed to put up prices yet. I am sure one of the admin team will clarify that.
Will drop you a P.M. gordo.
I would also like to know the price.

Sent from my MAR-LX1M using Tapatalk
 

Registered
P38 DSE 1999 my
Joined
2 Posts
So glad people like you are hacking these annoying systems Simon. As they get older there's going to be more call to bypass terminally old/sick bits of the electronics. I purchased a Nanocom to solve the enging ecu sync problem as well as to help keep everything going but your solution hard wired in is brilliant.
I'm interested.
 

Registered
1996 P38A 4.0l P Auto GEMS
Joined
31 Posts
Ah, I think I understand now having read some of the Sync-Mate discussions... so the Sync-Mate interrogates the ECM, gets the code then reprogrammes the BECM, on the assumption that the BECM EEPROM code is corrupted? (have I got it right?). I suppose the limitations are that it could happen repeatedly.

Simon's solution seems an excellent one!

I am definitely interested.
 

Registered
Joined
1 Posts
Good morning all.
I am the Simon mentioned above and yes the immobiliser on the P38 THOR, GEMS and DSE can be bypassed by emulation.
By emulation I mean I have designed a small (22mm x 22mm)electronic board that can be fitted inside the ECU and connected via 3 wires that will send the correct encrypted code to the ECU so the ECU is happy and will run without the need for interaction with the BECM.
The project mentioned by Bolt above was actually done for an off road competition vehicle that the owner wanted to fit a P38 4.6 Thor engine into, so I was thrown the challenge to make it standalone.
I already had the D2 Thor and GEMS ECU standalone solution in place so we could have gone down that route using a D2 ECU from the USA Spec 4.6 D2 or swapping over to a GEMS unit, but neither of those were ideal, so I looked into the P38 THOR ECU to see how it ticked.
A lot of people say the D2 Thor and the P38 THOR ECUS are identical. They are not. There's a lot of changes in software and some in hardware between the 2 and even across different revisions of the same ECU there are differences.
This little project took over 12 months to crack with the difficult bit being finding the first crack in the armour. After that first in road on the encryption, it took a week to get a finished solution out for initial testing, which went well and is still out there competing to this day..
After unveiling the project to the public on social media with a bench test video demonstrating the ECU being happy, I was immediately messaged by 3 people saying "That's impossible! It can't be done!" Errr... Ok... I guess I have done the impossible then 馃ぃ馃ぃ.
Well I guess the proof of the pudding is in the eating and I now have ECUS in the USA , Europe and Malaysia all working standalone on my humble little boards.
It was only when I was talking to one of the P38 specialists here in the U.K. that I realised that the BECM can be somewhat of an Achilles heel on the P38 that can leave you stranded for numerous reasons and I daresay you know a lot more than I do on that subject. Well this little board (and a wiring mod for the starter motor engage request) will mean the BECM is not involved with the running of the engine at all so irrespective of the BECM status, you'll always get the car to start and drive, which may give some a bit of peace of mind.


Other projects I have done are the L322 BMW 2926cc Diesel and the L322 BMW 4.4 petrol ECU both standalone as well as the TD5.

Any questions as all about what I can do, please post here or drop me a message and I'll be happy to explain further.
You can also see the P38 and others being demonstrated on my youtube thingy.

Cheers.
Simon
Good morning all.
I am the Simon mentioned above and yes the immobiliser on the P38 THOR, GEMS and DSE can be bypassed by emulation.
By emulation I mean I have designed a small (22mm x 22mm)electronic board that can be fitted inside the ECU and connected via 3 wires that will send the correct encrypted code to the ECU so the ECU is happy and will run without the need for interaction with the BECM.
The project mentioned by Bolt above was actually done for an off road competition vehicle that the owner wanted to fit a P38 4.6 Thor engine into, so I was thrown the challenge to make it standalone.
I already had the D2 Thor and GEMS ECU standalone solution in place so we could have gone down that route using a D2 ECU from the USA Spec 4.6 D2 or swapping over to a GEMS unit, but neither of those were ideal, so I looked into the P38 THOR ECU to see how it ticked.
A lot of people say the D2 Thor and the P38 THOR ECUS are identical. They are not. There's a lot of changes in software and some in hardware between the 2 and even across different revisions of the same ECU there are differences.
This little project took over 12 months to crack with the difficult bit being finding the first crack in the armour. After that first in road on the encryption, it took a week to get a finished solution out for initial testing, which went well and is still out there competing to this day..
After unveiling the project to the public on social media with a bench test video demonstrating the ECU being happy, I was immediately messaged by 3 people saying "That's impossible! It can't be done!" Errr... Ok... I guess I have done the impossible then 馃ぃ馃ぃ.
Well I guess the proof of the pudding is in the eating and I now have ECUS in the USA , Europe and Malaysia all working standalone on my humble little boards.
It was only when I was talking to one of the P38 specialists here in the U.K. that I realised that the BECM can be somewhat of an Achilles heel on the P38 that can leave you stranded for numerous reasons and I daresay you know a lot more than I do on that subject. Well this little board (and a wiring mod for the starter motor engage request) will mean the BECM is not involved with the running of the engine at all so irrespective of the BECM status, you'll always get the car to start and drive, which may give some a bit of peace of mind.


Other projects I have done are the L322 BMW 2926cc Diesel and the L322 BMW 4.4 petrol ECU both standalone as well as the TD5.

Any questions as all about what I can do, please post here or drop me a message and I'll be happy to explain further.
You can also see the P38 and others being demonstrated on my youtube thingy.

Cheers.
Simon
Hello Simon

thank you for this very useful Post. I am interested, and would like to know how to purchase one.

Thanks again.

Keep calm and Rover on.

Tarka
 

Registered
Joined
21 Posts
HI all. Thanks for the kind words. I am awaiting the delivery of the version 2 boards that address some issues I have been having components wise since lockdown. I am hoping they will be here this week.
When they have arrived and gone through Q.C. testing I will be in touch with everyone who wants one.
Sorry I can't give you any more information than that. It's currently dependant on the delivery time and then it takes 4 days to temperature voltage and soak test.

I'm interested.
Chotix, there were initially designed as standalone solutions for cost effective engine transplants. It's only after speaking to P38 owners I realised there would be a need for them actually in the P38.
I am awaiting a new batch of boards in. Will drop you a message when they arrive and have gone through quality control.

Ah, I think I understand now having read some of the Sync-Mate discussions... so the Sync-Mate interrogates the ECM, gets the code then reprogrammes the BECM, on the assumption that the BECM EEPROM code is corrupted? (have I got it right?). I suppose the limitations are that it could happen repeatedly.
Simon's solution seems an excellent one!
I am definitely interested.
Ballots. You are 100% correct it does seem that the BECM is the Achilles heel of the P38 which is a bit of a pity. Take the BECM out of the equation and at least the car will get you home.
I am awaiting a new batch of boards in. Will drop you a message when they arrive and have gone through quality control.

Hello Simon
thank you for this very useful Post. I am interested, and would like to know how to purchase one.
Thanks again.
Keep calm and Rover on.
Tarka
Tarka, you are welcome.
I am awaiting a new batch of boards in as I said above. Will drop you a message when they arrive and have gone through quality control.
 

Registered
Joined
12 Posts
On the Bosch diesel, If you have a basic eeprom programmer, you can edit one of the eeproms to disable mobilisation code completely, so the ecu does not look for any.
 

Registered
1995-2002 Range Rover P38A
Joined
1,627 Posts
On the Bosch diesel, If you have a basic eeprom programmer, you can edit one of the eeproms to disable mobilisation code completely, so the ecu does not look for any.
If you have details of how to do it that would be helpful. I have previously changed the eeprom with the fuel maps. To read it, it has to be removed which is not an easy job in itself. Then a ZIF socket needs to be soldered to the board to hold a new eeprom. It is easy to copy eeproms with a Willem programmer.
I assume the second eeprom is the same. I have had a look at what was in it in the past. There is not a lot. I was looking to raise the turbo boost pressure limit.
 

Registered
Joined
21 Posts
If you have details of how to do it that would be helpful. I have previously changed the eeprom with the fuel maps. To read it, it has to be removed which is not an easy job in itself. Then a ZIF socket needs to be soldered to the board to hold a new eeprom. It is easy to copy eeproms with a Willem programmer.
I assume the second eeprom is the same. I have had a look at what was in it in the past. There is not a lot. I was looking to raise the turbo boost pressure limit.
Not quite Dave.
The EEPROM in question is one of the 93C46 serial eeproms that needs the data changing.
Please note: This does not work on the later ECU with the full sized DIL eeprom, only on the early one with the SOIC-8 eeproms.
Will drop you the information via P.M.
 

Registered
Land Rover Discovery 2. Td5., Range Rover P38 4,6l. 2000., Range Rover Vogue 4,4 TDV8
Joined
3 Posts
Hi Simon!
I'm from Russia. I also want to buy this brilliant thing !I am sure that many members of our club will also need it! How to get it from you?
:love:
 

Registered
Joined
21 Posts
Hi Simon!
I'm from Russia. I also want to buy this brilliant thing !I am sure that many members of our club will also need it! How to get it from you?
:love:
Hello landroverman66_1640
I can supply as a self fit unit (provided you are good with a soldering iron), or I can fit to an ecu you supply, or I can provided an ECU ready done.
Which ever you require.
Cheers.
Simon
 
1 - 20 of 40 Posts
Top