I read the thread started by PhoneBoy about the alarm PIN hack, and I have an update to the procedure.
The update requires 1 working fob, and removes the lockout wait time from the original procedure, shortening the hack from ~2 hours to about 10 minutes, depending on how fast you can work.
Original thread: https://www.lotustalk.com/forums/f32...in-hack-62608/
This applies to the 05-07 Cobra alarm vehicles
Background: I had one working fob, 1 non working fob that wouldn't sync (Presumably never programmed) and no PIN. The PIN from Lotus did not work. I followed PhoneBoy's procedure until I got locked out of code entry. I am impatient, so I immediately set to work on seeing if you could skip the lockout time, and as it happens, you can.
1. Start with the immobilizer OFF (tell tale not flashing)
2. Turn the ignition on and off 3 times within 7 seconds to begin the PIN procedure.
2a. If the tell tale comes on steady for 3 seconds, turn the key back to ON and proceed normally with PIN entry
2b. If the tell tale remains OFF after the 3rd key cycle, you are locked out. Proceed to step 3.
3. Lock the car and arm the alarm with the fob.
4. Unlock the car with the fob, start the engine.
5. After several seconds, stop the engine.
6. Go to step 2, you should be able to continue hacking
NOTE: Updated procedure for finding PIN digits:
PhoneBoy's procedure describes the procedure for determining PIN digits with the immobilizer enabled
. Use the following procedure to determine digits with the immobilizer DISABLED:
1. Turn the ignition on and off 3 times within 7 seconds; the security tell tale in the tachometer will light for 3 seconds.
2. Immediately after the tell tale goes out, switch ON the ignition. After 1 to 9 tell tale flashes, turn the ignition off.
3. Turn the ignition back ON
3a. If the tell tale stays OFF, your digit was wrong, start over.
3b. If the tell tale begins flashing, your digit was correct. Note it. Congratulations, you are now on the next digit.
If you started with a 4x9 matrix on paper, and you're fast, you should be able to start the next digit on the same attempt; If done correctly, the alarm should be hacked in a maximum of 33 attempts (9,8,8,8). Lockout occurs every 6. I'd tell you how many tries it took me, but that would basically give away my PIN... because math.
Occasionally, when starting over, the tell tale will start flashing with the key OFF. Your immobilizer has automatically armed. Disarm it with the big button and keep going.
OFF means all the way off
ON means the RUN position (all the way on)
I now have a PIN and 2 working fobs. It was not even close to the dealer PIN (no common digits)