1. Attachments are working again! Check out this thread for more details and to report any other bugs.

3 Smartkeys

Discussion in 'Gen 4 Prius Technical Discussion' started by 155, Jul 19, 2017.

  1. 155

    155 Member

    Joined:
    Oct 23, 2007
    56
    30
    0
    Vehicle:
    2016 Prius
    Model:
    Four Touring
    I was wondering if I purchased another Smartkey, if I could have 3 activated on the vehicle at the same time?
     
  2. Trollbait

    Trollbait It's a D&D thing

    Joined:
    Feb 7, 2006
    21,590
    11,212
    0
    Location:
    eastern Pennsylvania
    Vehicle:
    Other Non-Hybrid
    Check the owner's manual, but I'm believe it is possible.
     
  3. bisco

    bisco cookie crumbler

    Joined:
    May 11, 2005
    107,571
    48,862
    0
    Location:
    boston
    Vehicle:
    2012 Prius Plug-in
    Model:
    Plug-in Base
    wait until you see what they cost.:cool:
     
    kithmo likes this.
  4. wrprice

    wrprice Active Member

    Joined:
    Jul 11, 2005
    415
    308
    0
    Location:
    Houston, TX
    Vehicle:
    2016 Prius
    Model:
    Four Touring
    It was possible in previous generations, though I don't recall the exact limit on number of programmed keys. I'd be very surprised if they reduced it.
     
  5. alanclarkeau

    alanclarkeau Senior Member

    Joined:
    Feb 24, 2016
    7,041
    7,580
    0
    Location:
    near Brisbane, Australia
    Vehicle:
    2016 Prius
    Model:
    N/A
    They're expensive - probably why nobody has tried.
     
  6. Elektroingenieur

    Elektroingenieur Senior Member

    Joined:
    Jan 8, 2017
    2,515
    3,253
    9
    Location:
    California
    Vehicle:
    2016 Prius
    Model:
    Three Touring
    Yes. In the Repair Manual (available by subscription to techinfo.toyota.com), Toyota writes, “A maximum of 7 electrical key transmitter sub-assemblies can be registered (this includes any electrical key transmitter sub-assemblies registered when the vehicle was purchased).”
     
    RCO and wrprice like this.
  7. Transp Professor

    Transp Professor New Member

    Joined:
    Aug 3, 2016
    3
    1
    0
    Location:
    Austin, Tx
    Vehicle:
    2016 Prius
    Model:
    Two
    Anyone know how to DETECT the Gen4 SKS keys in one's home? I read about frequencies on the Gen2 Forum (see below), but see nothing here yet. (Replacement fob is $330! Ugh...)

    FROM GEN2 FORUM ON THIS TOPIC: "The car transmits on 134.2 KHz. When the fob recognizes the car signal, it replys on 315 MHz. I don't know if the car transmission is encrypted and/or varying. It may not be, in which case you just record the car signal and replay it. The normal range of the car transmission is about 3 feet. I suspect that a long piece of single conductor wire strung from one of the door oscillators would have a longer range, perhaps enough to trigger the keyfob reply from maybe 10 or 20 feet away.
    The keyfob signal is certainly encrypted and varying. If you press the same button multiple times, it sends a different sequence each time. But you don't care what the keyfob says, only that it is saying something. So if you can get the keyfob triggered, then you'll need a 315 MHz receiver with a signal strength indicator. A directional antenna would be a real plus. So you need a 315 MHz receiver with at least a signal level meter. Then an antenna extender from an oscillator on the car. Maybe use a 100 foot long single wire (or an ordinary extension cord), and take several loops of it around the oscillator at one end."
     
  8. Elektroingenieur

    Elektroingenieur Senior Member

    Joined:
    Jan 8, 2017
    2,515
    3,253
    9
    Location:
    California
    Vehicle:
    2016 Prius
    Model:
    Three Touring
    I typically detect my keys by reflected visible light, but if you prefer an active RF approach, as I posted in another thread, I believe the frequencies are the same as the previous generation. My sources for that posting were Toyota’s Repair Manual and New Car Features book and the attachments in the FCC OET database for the key (FCC ID HYQ14FBC) and Smart Key system (FCC ID NI4TMLF15-1).
     
    #8 Elektroingenieur, Jul 20, 2017
    Last edited: Jul 20, 2017
    kithmo and wrprice like this.
  9. wrprice

    wrprice Active Member

    Joined:
    Jul 11, 2005
    415
    308
    0
    Location:
    Houston, TX
    Vehicle:
    2016 Prius
    Model:
    Four Touring
    I wish you had posted earlier. I had to resort to other means:

    1. Set fire to house.
    2. Wait.
    3. Rent front end loader, conveyor, and industrial sifter.
    4. Feed conveyor bucketfuls of ash and debris to dump into the sifter.

    By the time I finished, I remembered they were still in the car.
     
  10. Prodigyplace

    Prodigyplace Senior Member

    Joined:
    Nov 1, 2016
    11,696
    11,317
    0
    Location:
    Central Virginia
    Vehicle:
    2017 Prius
    Model:
    Two
    I hope you didn't leave your wife in the house. :cry:
     
    RCO likes this.
  11. wrprice

    wrprice Active Member

    Joined:
    Jul 11, 2005
    415
    308
    0
    Location:
    Houston, TX
    Vehicle:
    2016 Prius
    Model:
    Four Touring
    No, she ran out after step one. She was in some sort of mood -- asked what I thought I was doing. After I told her, she asked, "Have you lost your mind?!"

    I replied, "No, I told you, my car keys."

    She ran off saying something about visiting our lawyer friend to see a D-Force. Knowing Hollywood these days, it's probably some action movie reboot.
     
  12. Transp Professor

    Transp Professor New Member

    Joined:
    Aug 3, 2016
    3
    1
    0
    Location:
    Austin, Tx
    Vehicle:
    2016 Prius
    Model:
    Two
    I've spoken to my top colleagues in radio, drone design, cellular, etc., and they say that sensing the presence of a lost fob simply cannot be done w/o very expensive equipment & lots of time (to try & match the changing signal, which helps avoid car thefts, I guess).
    I think we'd almost all rather have risk of car theft than such expensive key replacement. All of us are more likely to lose a fob than to have our car stolen, in almost any U.S. neighborhood, on almost any make & model.
     
    RCO likes this.
  13. RobH

    RobH Senior Member

    Joined:
    Sep 18, 2006
    2,369
    978
    70
    Location:
    Sunnyvale, California
    Vehicle:
    2006 Prius
    I agree that decoding keyfob output requires expensive equipment, but you just want to detect a signal. The receiver in the car can't be that expensive, but talking to it is a black art.
     
    RCO likes this.
  14. Elektroingenieur

    Elektroingenieur Senior Member

    Joined:
    Jan 8, 2017
    2,515
    3,253
    9
    Location:
    California
    Vehicle:
    2016 Prius
    Model:
    Three Touring
    I would respectfully disagree.

    Cost may have been a barrier years ago, when custom RF work often meant using test instruments from companies like Hewlett-Packard, Rohde & Schwarz, or Anritsu, but today, inexpensive software-defined radio (SDR) transceivers can easily be programmed to transmit and receive narrowband LF and VHF signals like those used by the Smart Key system. Whatever security Toyota’s system provides comes from its cryptography, not from the difficulty of intercepting or reproducing the signals exchanged between car and key.

    As explained in the articles I linked in another post, criminals are already exploiting vulnerabilities in keyless entry systems, and sadly, the Prius is no exception.
     
    RCO and RobH like this.
  15. pilotgrrl

    pilotgrrl Senior Member

    Joined:
    Jul 23, 2017
    891
    1,796
    0
    Location:
    Chicagoan in TX
    Vehicle:
    2016 Prius
    Model:
    Three
    Personally, I would be more interested in Toyota stepping up on security since Chris Valasek and Charlie Miller have made all of their CAN BUS car hacking material publicly available free on GitHub. Some of their hacks are dependent upon physical access to the vehicle, but I would rather be safe than sorry.
     
    RCO likes this.
  16. Elektroingenieur

    Elektroingenieur Senior Member

    Joined:
    Jan 8, 2017
    2,515
    3,253
    9
    Location:
    California
    Vehicle:
    2016 Prius
    Model:
    Three Touring
    I imagine Toyota could make some improvements, but I wouldn’t be too concerned about the techniques described in the Valasek and Miller paper, which I linked in another posting. Their main contribution was reverse-engineering some of the communications protocols used by the Toyota Techstream diagnostic software and Calibration Update Wizard utility, but I believe everything they describe requires physical access to the DLC3 (OBD II) diagnostic connector or other CAN bus wiring inside the car or under the hood.

    I don’t see anything inherently wrong with treating the diagnostic connector as a trusted interface; owners and independent workshops need privileged access to vehicle systems for diagnosis and repair, and at least in the United States, vehicles are required by law (42 U.S.C. § 7521(m)) to have a standardized interface for emissions-related diagnostics. If Toyota wanted to alter this interface to add security features, they would first have to get the EPA and CARB regulations changed or waived, which is unlikely to happen if the modified interface wouldn’t work with existing emissions inspection (smog check) equipment.

    As I wrote previously, though, it’s a problem when people misuse the diagnostic connector by attaching poorly-secured devices, like the one used with Metromile insurance, that allow more remote access than intended. It’s also important for built-in gateway devices—such as Toyota’s telematics transceiver, with its own cellular data connection—to have good security, especially if they are connected to multiplex buses, as on the Prius Prime.
     
    RCO likes this.