Pandora starts everything!

Security systems are connected to modern cars through digital bus interfaces. This allows to read information and to take over control of car electronics at the right moment and it should be undetectable for original car components and diagnostic equipment. The task is very complex, especially if take into account how many car types, models and modifications we can control (more than 5000 base modifications!). Although a lot of cars have cryptographic protection against third-party components.

In addition, there are a lot of such sophisticated elements in our modern security systems. Moreover, some of them are distributed, for example, part of them are located in our applications for smartphones and PCs and the other part are on our remote servers and databases or are connected with our high-performance computing servers. In a word, just an “alarm system” is not about us.

Another important feature of our modern security-service systems is an integrated algorithmic bypass of original immobilisers. In fact, it is difficult to find a car without “chip” key protection of the unauthorized engine start for more than 20 years. In other words, today you will not able to hot-wire even the cheapest car like it is in the movies.

Our algorithmic bypass of original immobilisers allows starting the engines without having to sacrifice a key. The remote engine start is very useful to heat up (or cool down) your car before driving or to charge the battery when your car is parked for a long time.

Frankly speaking, more than 70% of our systems are bought to have a possibility to remotely and automatically start the engine, but security and other service functions are considered as an additional free bonus of the systems. It is especially popular in the northern countries. Although, many people from the central regions used to not sit in a frozen and barely alive car in the winter. The remote engine start has ceased to be a luxury for the elite.

Today our company is among the very few world leader in the field of high quality algorithmic bypass of original immobilisers. We see only five such companies in the world market and only two of them are Russian. We are sure that our place is closer to the top of this rating.

Furthermore, our solution usually are much more profitable if we compare the cost of real implementation on a car. You will need only our system and it will not require anything else in most cases. We start 90% of cars without a key and any additional modules. All you need is inside our system! Everything is produced by one company. What can be more reliable? Especially if talk about a company that has never given any reason to doubt its responsibilities.

Now let’s talk about the technology. We will try to demonstrate the possibilities and simplicity of implementing this complicated technical task on the example of modern popular cars and our security-service systems of different price groups. You will see how we can implement safe, reliable and inexpensive remote (by a mobile phone, remote control, etc.) and automatic (by temperature, by time, by low battery voltage, etc.) engine start.

Security system with built-in algorithmic bypass.

The first algorithms of immobiliser bypass were quite simple algorithmic principles, which were easy to implement directly on the hardware of the alarm systems. The systems usually operate in the middle between car internal modules that use simple encryption. This allows to bypass the complex cryptology of the chip keys. We can bypass KIA, Hyundai, most of Toyota and Mitsubishi cars this way.

For some cars, a learning procedure and the following calculations are required in this case. For others, the algorithms starts working immediately. However, the core principles are same – a microcontroller of the systems performs all calculations.

Algorithmic bypass with calculations on the Pandora Clone servers

We use another method to bypass immobilisers in more difficult cases for cars where strong internal encryption between electronic modules is used or there is no possibility to connect between the modules. We have to work with encryption of a “chip” key itself in most cases. Of course, computing power of a microcontroller of a car security system is not enough for this task, even if we have thousands of years for the calculations and we mean a microcontroller of Pandora security systems, you know that we use ones with more than 10 times greater performance than any other solution of our competitors.

Therefore, our security systems collect all necessary data from digital buses of a car and ask for help in the calculation from our computing cluster of the Pandora Clone servers. The cluster is able to calculate  a key in a few seconds or 15-20 minutes in the most difficult cases or when it is loaded by a queue of difficult tasks. The cluster has a high-performance architecture similar to a cryptocurrency mining farm. We will not give performance data, especially as it is continuously growing. Nevertheless, we use air conditioners with a total power of more than 10 kW only for cooling this cluster.

Immo/key – a universal immobiliser bypass port

It was an additional technical problem to make a universal hardware interface for dozens of digital, analog and hybrid automobile buses. Today, we have created the most flexible analog digital software and hardware port IMMO/KEY. All our modern systems from the cheapest Pandora Light to the top-range Pandora Professional have this port. The IMMO/KEY provides reading and broadcasting of any logical levels  and protocols used in immobiliser data buses of modern cars.

Bypass modules with an original key inside

If we try to analyze the cars on the market and the availability of immobiliser bypass algorithms from Pandora or from our colleagues, we can conclude that there is no algorithmic solution for some cars today. From our side, we can say that a brief analysis of cryptographic strength of the possible ways shows that there are no prospects and solutions in the nearest feature.

However, this is not a big problem for Pandora, since we have technical solutions for immobiliser bypass that use duplicate or additional original keys. It is not so beautiful solution as algorithmic bypass, but it is a proven possibility to start the engines with a minimum risk of damage original electronics of these expensive cars.

You just place the second key or the chip removed from the key in a special bypass module that will provide all necessary switching of the key and Pandora system for reliable remote engine start.

Today we have 3 bypass modules:

• Pandora DI-02 is used for inductive bypass of an original immobiliser.
• Pandora DI-03 is also an inductive bypass module, but it has an integrated 3.3V voltage regulator to provide power to a key instead of its battery. Moreover, the control line of the module uses code messages to exclude a possibility of an unauthorized engine start by a thief.
• Pandora DI-04BT is a slightly different device. It is the newest, most complex, small-sized and perfect, equipped with Bluetooth 4.2 and unique product on the market that can solve the task of bypassing immobilisers of such cars as new Audi, VW, Skoda, Mercedes, BMW (F and G series), Volvo and so on. Yes, a partial disassembly of a key is required, but there are is any other solution. Moreover, there is no alternative to our DI-04BT in most cases. Even if an algorithmic bypass appears, it will not able to control an original security system, close windows, lock trunks, fold mirrors, etc. Our module is able to do it!

Special cases and exclusive solutions from Pandora

There are several options among all our solutions of algorithmic immobiliser bypass, which stand out for its unique algorithm or special module designed to solve the problem of difficult connection to some very complex cars. However, all our solutions are cheaper, more reliable and more functional than existing analogues in the global market.

Last year we presented a solution to bypass Mercedes immobilisers with the FBS III authorization system. It is a very popular group of cars that is widespread in the used car market. Some of new Mercedes cars also have the FBS III system, but most of them have the next generation FBS IV system. Neither we nor any other company in the world has an algorithmic solution for the FBS IV today.

Our solution for the FBS III uses the Pandora Clone technology and works with the following systems: Pandora Smart v2, Pandora Smart Pro v2, Pandora Professional v2.

We decided to implement this algorithm only on our top-range systems. Please be respective to this decision and to the Mercedes brand. This brand is an icon of the automotive market and the world’s first car make. Well, we think cheap systems created for a completely different class of cars are not intended for these cars.

The immobiliser bypass and remote engine start for Mercedes cars are fundamentally different from other cars. These cars have, perhaps, the most difficult onboard electronics and a unique key authorization and engine start system. Moreover, most importantly, it quite different from model to model. Therefore, it requires to research each model with appropriate testing. Otherwise, errors cannot be avoided.

Before the Pandora CLONE, car owners had to buy expensive interface modules in order to have a possibility to remotely start the Mercedes cars. And the problem is not solved by installing the second key in an inductive bypass module, the Mercedes cars work absolutely differently!

There are a lot of such interface modules of Bulgarian, Canadian, Russian, Ukrainian and Chinese production. They are united not only by the high price, but also by simplified algorithms based on a “synchronization window” principle in a dynamic sending of a key. The modules record a real key message and substitute it during the “synchronization window”. This algorithm is simple to implement, but has a lot of disadvantages.

One of the main disadvantages of this method is a functional limitation. Such modules can to start the engine only few times (no more than 3-4 times) during an armed period. This is not enough, especially in case of long parking. An owner will not be able to start a car the fifth or sixth time. It will be required to go to the car and start it manually, this will allow the “bypass module” to record a new message from a key. Some modules allow starting up to 10 times, but this type of start turns out to be very risky for the car authorization system. This is another disadvantage. The authorization system may be blocked if the number of starts is exceeded. To use the car, an unlock procedure from a dealer will be required.

In addition, the FBS III system has a limited numbers of key authorizations. This number “ends” tens or hundred times faster when you use these modules. The situation can be getting worse due to firmware bugs in these modules.

The Pandora algorithm works differently. It completely reproduces the operation of an original key considering the configuration of the onboard equipment of a particular car. It doesn’t use any non-original algorithms and simple ways that can cause errors and problems with a car. The Pandora CLONE for Mercedes has no restrictions on the number of starts during an armed period, has no risks of blocking or losing original keys!

This is the only right way for these cars. It is much more complicated task that requires special researches of each car model and we have successfully solve it.

Another example of our work is an immobiliser bypass module for BMW E-series. There was no bypass solution for these cars for a long time. The solutions that appeared are required considerable skills of an installer. It is very difficult even to simulate the presence of a key in a keyslot. So, only few specialists are able to implement the remote start even with the second key in a bypass module. It takes a lot of hard, painstaking and dangerous work and the cost of an error can be hundreds of euros for a “specialist”. It is the cost of a new CAS authorization module with a new and key recording procedures.

Our solution not only allows starting the engine without a key inside a bypass module, but also eliminates the difficult, risky work. Our pin-to-pin solution is very reliable and easy to install. Our product is several times cheaper than the Canadian modules. You can save up to several hundreds of euros with the Pandora BMW module!

The price is not the only and not the main feature of our solution (it is just a nice bonus for all car owners). Another thing is unique – no any existing solution has ever had that depth of integration with on-board electronics of these complex cars. It was our engineers who managed to fully understand the key authorization algorithms and the operation of the entire engine start system. Moreover, we were able “to improve” it with the functionality that was previously impossible to implement on BMW cars with a slot and a “Start/Stop” button.

These are some of the most requested features, such as “takeover” (it means a car will not shut down when you disarm it), ignition maintenance and turbotimer. We are the first company in the world who has implemented all of these functions! Moreover, we have implemented it so correct and beautiful, as BMW engineers would do it, probably. Our system determines the moment and gives the command to the engine start system to allow removing a key from the slot, accepting it, switching on the desired mode and so on. And it looks like it is a factory option for an owner.

By the way, only our solution is able to correctly implement reservation mode (“Program neutral”). It means you can start cars with a manual transmission safely and reliably.

This is what we call Pandora style.

The only thing is that our BMW bypass module works only with Pandora security systems. We don’t want our solution to work with other car alarms and there is no reason to harm BMW cars by immature products because we are real fans of these cars. However, if we calculate the cost of a Pandora BMW bypass module and a Pandora security system, it will be cheaper than a Canadian module. And functionality of our system is so much higher that it is ridiculous to compare them.

Our team of engineers who continues to work in all directions of immobiliser bypass. This is optimization and acceleration of the current algorithms and expanding the list of supported cars. One of the latest news is support for KIA and Hyundai 2002-2011 cars, including such bestsellers as Hyundai Accent, Getz, Tuscan, Elantra, Kia Sportage 2, Sorento I gen. and Rio. Thus, our systems support immobiliser bypass for all cars of these Korean brands, which can be found on the roads today. The same situation is with the Honda brand. At the end of August, we included all Honda cars from 1996 production year, including those models that are not supported by any other manufacturer.

Autumn is coming and real winter begins in many countries after it. And a lot of people who drive cars suddenly remember that it is possible to brighten up the inconvenience of using a car in winter by a security system with the remote engine start function. You don’t need a lot of time to make a decision what to choose. Modern car security and service systems Pandora are the best, most profitable and flexible solution today that can “start everything!”