Toyota Prius Key Fob discussion

Toyota Prius Key Fob discussion:
I bought a 2006 Prius late last week, and have had quite the confusing time understanding the Prius key fobs, probably because my forehead is a bit too thick.
So, I wanted to jot down my notes so far, to help the next newbie understand what is going on with their key fobs.
There is a LOT of useful information on this site and on the web in general, but it takes some digging to find the right info.
So I want to create a description of my experience so far. I am breaking up my running commentary and posting this into smaller, digestible chunks.
Please comment and please keep me honest!

Prius Key Fob Overview. The systems are:

1) Mechanical key. This is a double-sided key, that fits in the driver's door to lock or unlock the door. This is not confusing. If you twist the key to unlock twice, it unlocks all the doors. I call this the "key". It stores snugly inside the key fob.

2) Key fob that fits into the slot in the dash and allows starting the car to "ON" and/or "Ready". You drive the car in state Ready. I'm old-school, so I call this the "ignition". Toyota calls this function the "immobilizer", because it prevents the car from starting.

3) Three Buttons on the key fob that lock/unlock/panic the Prius, which I will call "buttons".

4) Nearby functionality that can unlock the Prius without pressing a button (I think?), and go to On or Ready state without requiring the key fob to be inserted in the dashboard slot. The fob must be close to the Prius. I call this function "proximity", Toyota calls it "Smart Key". It allows you to keep the key fob in your pocket. I have never used this mode.

Prius with the 4) proximity functionality have a small round push-in toggle button marked "KEY" under the steering wheel, and black buttons on the door handles. Key fobs with a black Toyota logo do not have 4) proximity, while key fobs with a silver logo can have this functionality enabled.

There are many articles about mating the key to the car. I am going to post what works for me.
There is a lot of postings about used key fobs not working for programming, that you need to start with a fresh key. I think that this is probably true, although there is are reported workarounds involving some form of master key reset, which requires a special super-secret password, to mate the car and a previously used keyfob. All key fobs must have working/fresh batteries to be programmed or mated to the car.

My Prius has the "KEY" button and the door handle black buttons, so it has the Smart Key system, which enables 4) proximity.
Unfortunately, my Prius ONE key only, which allows only 1) key and 2) ignition. The 3) buttons and the 4) proximity do not work. My key has the silver logo, so it probably worked at one time. In particular, my key does NOT flash a red LED when the buttons are pressed, even after a fresh battery change. I have not torn it apart completely yet, to see if it is something simple like a broken wire. The contacts to the battery are not corroded.

Purchases:

I bought 2x Smart Keys from Amazon, named "Genuine Toyota 89994-47061 Electrical Transmitter", at the cost of a holy BenFranklin ($105) each.

I also bought an OBD-to-USB cable called "Fotga Newest V8.00.034 MINI VCI for TOYOTA TIS Techstream Diagnostic Cable & Software Model: ZB031 Car/Vehicle Accessories/Parts". It cost $23.
The included copy of Toyota Techstream software is well-known to only work on a Windows 32-bit operating system. It is written in Java, so I suspect that the Java version must be 32-bit, and not the whole operating system, but I will never find out because I used a Windows7 32-bit virtual machine on my Mac and it installed just fine. I installed the usb driver and Techstream Version 9.30.02.
I changed one line in the file C:\Program Files\Toyota Diagnostics\Techstream\Env\IT3System.ini to read "TISFunction=0" to remove the online TIS part.
I filled in insincere values for name and company and was able to connect OK to the car.

Regarding 1) Keys, I took the two uncut key blanks from the two key fobs to a locksmith and he charged me 6 bucks each to cut them, or $13 total with tax. They are double-sided, and took him 5-10 minutes to cut them by hand, and I don't have access to a key machine, so this was OK. The keys work.

2) ignition
I connected the MINI VCI to the connector under the dash. I ran the Techstream software and navigated to the "Immobilizer" section. I am paraphrasing here. It led me through a start with power on + take out key + put in key + power on sequence. At one point the software said to remove the key, which required me to turn off power to get the key out of the slot, because it was locked. Next, the software told me to NOT turn off power in big red letters, which was impossible, because it was already off. This frustrated me quite a lot, until I just ignored the big red letters, with the power off, and then the ignition programming worked fine. So this completes 2) ignition for the two new keys.

I have read other programming guides here with insert/remove a working key 5 times and opening/closing the driver door 6 times, which would not need the Mini Vci to program the 2) ignition, at the cost of some repetitive movements. Finally! How to program a non-SKS key/fob. Detailed! | PriusChat

So I now have three keys. They all work for 1) key and 2) ignition, but none of them work for 3) buttons or 4) proximity.
The next problem that I face is that the original key that I have, does NOT have a functional set of buttons. The programming procedure for "Smart Keys" in the Techstream software requires that you push a master button or two, before you press the new key. So it doesn't work, and I am stuck for now. I will be looking into either the "chicken dance" involving lots of 2-times key in-out and door open-close squawk-squawk-squawk, and if that fails, probably the immobilizer reset and/or master key reset sequence that requires a super-secret "magic decoder ring" Toyota password and may accidentally lock up my car forever.

Teardown of the SKS "Smart Key System" key fob:

I tore open the original key fob to look at the circuit board. The plastic is melted or glued together, so this is not recommended.

I think that the big square white plastic component is the transponder used in 2) ignition. It allows the car to start. As a test, I placed the two outer plastic fob pieces around the circuit board (with no battery), inserted it into the slot, and the car started just fine. So the transponder does not need the key fob battery. Also, it looks to be isolated from the rest of the components on the circuit board. I imagine that this generation of electronics can only send a electromagnetic pulse to the key fob, which responds with a predetermined and unchanging code (not a smarter command-response set), and the single fixed code is programmed into the Prius during the 2) ignition mating ritual. This is similar to key-card badge access systems, or the theft-prevention stickies that retail stores use, but with a closer working distance. The transponder may have been chosen due to good reliability, and works-with-no-battery is very helpful for the customers who own their cars too long without buying new ones.

I further imagine that the transponder is too limited to send lock/unlock/panic signals or proximity data, so a new system had to be implemented for the full functionality. This is the 3 buttons, 2 large chips, battery, smaller stuff, and the trace-antenna-around-the-circuitboard-edge.

 

Bisco, thanks for the response. If you touch the handle to unlock the car, then what does the black button on the handle do?

Immobilizer Reset vs. CPU Reset:

There is an immobilizer reset in the Prius that will make the immobilizer system forget all of the existing 2) ignition key fob transponders, and then accept the next key fob that is added or programmed.

There is a separate CPU reset in the 04-09 Prius that will make the RKE (Remote Key Entry) and/or PROX (Proximity / SMS Smart Key System) to forget the existing key fobs, and then accept the next one that is added for 3) keys and 4) proximity.

I have all 3 of my keys working OK with the 2) ignition / immobilizer so I think the immobilizer reset is not required for my use case.
None of the keys have 3) buttons or 4) proximity working correctly so I require a programming method that does NOT require the master key to press a button.

 

Dion and Bisco, thanks for the information.
And for the very polite request that I RTFM (Read The Fu King Manual), that I so completely deserved.
Cheers!

The Chicken Dance:

The next method that I am going to try comes from page 588 of the guide at 18.14_Manual_Toyota-P.535-595.pdf that is created by Advanced Diagnostics, USA, at adusa.us who most likely sells car diagnostic systems. I can't post a real link to the pdf because I have only had 3 posts so far, and I need 4 posts to post a link. One of my posts was deleted and 5-10 were combined, so I apologize at my being at odds with the newbie rules.
The following steps do not specifically require the master key to press a button, so I am trying it first:

Alternative - On-Board Programming for Prox and RKE functions
Included here as a courtesy, Not supported by Tech Support.
Step 1- It's very important to make sure all the doors are closed except the drivers door, that remains open.
Step 2- insert the Prox in and out of the slot twice.
Step 3- close drivers door twice, then leave it open.
Step 4- insert the Prox in slot once and pull it out.
Step 5- close the drivers door twice, then leave it open.
Step 6- insert the Prox in the slot & leave it in.
Step 7- close the drivers door once.
Step 8- turn the ignition on once, then turn it off.
Step 9- take the Prox out of the slot and the door locks should cycle.
Step 10- Next press the lock & unlock buttons together on the Prox for 1 second. Then press the lock button for 3 seconds.
Step 11- locks should cycle.
Step 12-To exit the learning mode open the door & close it. Now open it again.
You are done! Now test your Prox key functions to be sure they work.

This did not work.
Up through Step 9 worked OK, and the door locks cycled once, and it entered a learning mode of sorts.
This is (no doubt) the SAME learning mode that the MINI VCI or other OBD programmer can put the car into.
But during Step 10, the system cycled the locks 3 times after any key press, including a lock+unlock, or lock alone.
After Step 12 when I exited the mode, my new keys continue to NOT work for 3) buttons or 4) proximity.
I verified that the small round KEY button under the steering wheel is in the correct and OUT position.
I think that this missing step in this guide is probably something like:
Step 9B- Press the lock button on the Master key.
Which I can't do because my Master key is broken. Curses!

So now I have exhausted:
a) The MINI VCI Prox/SMS programming did not work because my Master key is broken
b) Tearing the Master key apart did not show anything obviously fixable
c) The Chicken Dance programming (that I tried) did not work because my Master key is broken

The procedure that I haven't tried yet is:
d) Reset the CPU

2015-01-24: Working towards a working reset code:

There is a challenge/response code required to reset the Immobilizer or to reset the CPU for SKS/RKE in Toyota's Techstream software.

The software gives you a challenge code, and you have to type in the response code. They use some form of encryption algorithm to transform the input to the output. This was able to be done on computers 10-20 years ago, so this is probably not a modern (hard) encryption system. It is only a lock because the conversion method is a secret. I consider this to be a form of "information tyranny" that prevents me from doing what I need to do with something that I own. Locks are OK when they prevent theft, but I hate locks when they are used against me. Now, I have some acceptance of the system that Toyota put in place, because you don't want petty thieves to steal your car. Exceptional thieves will always win, I think. But my car is 10 years old, so it isn't a big target for theft, and the annoying security system is in my way.

Here are the options that I have discovered so far:

1) The shop. Obviously, the shop owner would prefer you to spend whatever he decides to quote you for help with key programming. If the mechanic is less than reputable or unskilled, you may have a major component that "needs replacing". Reputable and skilled mechanics are a wonderful blessing. Mechanics time is very expensive to me, but this is how they earn a living, and how they pay for their shop, which I respect.

2) The TIS. Toyota licenses the software and TIS web connection for a fee and wants the revenue stream that payments provides. This isn't evil, but it goes against my "religious belief" that most product information about physical products should be freely available. The cost to subscribe to Toyota Techinfo with key access is $55 for a two-day access. You can also download shop manuals from the site, which is a bonus, but they can also be found elsewhere, if you look around. One person in this forum had a relationship with a shop personnel that had access to TIS reset codes, and paid him $10 for each reset code. That sounds like a reasonable relationship.

3) The IMMO. There are third-party software products which have reverse-engineered the major car manufacturer's schemes and will generate "immo" immobilization codes, as they are generically known. The software is typically sold to automotive shops, especially the shops that do not specialize. The carmakers probably don't like the IMMO software makers very much because it hurts their online sales, but I don't have anything for or against them, they are just responding to a need in the market. Independent shops have customers that want keys programmed to their car, and the independent shop can't afford to subscribe to ALL of the car manufacturers' online security portals.
One of them is "ICC Immo Code Calculator", apparently produced by the US commercial website immo-code, that features a red USB security key to make their software more difficult to duplicate. Oddly enough, they sell through distributors, not directly. aliexpress has it for $1599.00, and that is not a typo.

4) The Web. There are code generators available on the web, to create a reset code. One (possibly dodgy) site at weboctopus from The Netherlands charges $25-30 (25 euro) and will create 5 reset codes. They have a video showing that it should work OK, and it is believable that someone hooked up a 3) IMMO software to their website, but treat this as a risk, because you are definitely not getting your money back if it doesn't work.

5) The EEPROM. Finally there are the low-level EEPROM programmers. If you take the car apart enough to where you have access to the chips themselves, then you can attach / capture / change / download a modified program containing whatever keys or new code that you want. These guys are usually the first on the scene, and the first to understand the programs, and you can do ANYTHING that you want including adding more features, and it bypasses the car's security nonsense, but the procedures tend to be really awful. And I don't want to take my car apart that much. Also, my head might be too thick for this method. It probably costs $15 or so to get a programming dongle.

6) The OBD Port. Another option is to use an OBD cable that plugs under the dash, and send the right request/response to the CAN bus to the ECU, without using the Techstream software. This could command the ECU to perform a reset. You have to find a developer platform, and you have to know the right command to send, and finally you have to know the right response to send for a security seed. I read an EETimes post about two people who dug into the 2010 Prius electronics and ECU and found out how to generate internal-to-the-system security-like codes. Fascinating research paper, they were able to make the car do all kinds of strange things. The seed/response codes are 32-bit, 8-digit hexadecimal values, not 6-digit decimal values that the Techstream software uses. Their research paper shows that you only have to take the seed number, exclusive-or the bytes with the well-known secret 0x00606000, and that becomes the response number. For example, 0x12345678 XOR 0x00606000 = 0x12543678.

7) The DIY Code. There is a seventh option that I didn't think was easily possible: Understand how Toyota generates the codes and make your OWN reset code for the ECU. For instance, the Techstream interface gives a 96-digit hexadecimal challenge code, and it wants a six digit (decimal = base 10) code for the 2006 Prius, I think. I can't find any shared data on successful challenge-response pairs. Does anyone have data on this?

 

Dion-
1) I think that you are saying that you installed Techstream software and it crashed your windows computer? BSOD = "Blue screen of death"? Or did you compile or install something else?
2) I think that you are saying that you want to add a used FOB to your Prius? From what I have read, there are problems using a used keyfob in a Prius, although some people have had success programming a used FOB if it is the FIRST fob programmed after both an IMMO and ECU reset. I think that there is a 2-way communication with the SKS (SmartKeySystem) in the fob, and it remembers it's first car. I don't think that anyone tried it immediately after an ECU reset, but without the IMMO reset.

Most of my recent discussion above is about how to generate an ECU reset with a budget of approximately zero dollars. Which I haven't solved completely. The cheapest solution so far is $20-25 for the cable, which I am happy with, and $25-30 for an online reset code, which annoys me.