Finding Lost Toyota Keyless Ignition Fob (and all the critical keys on the keychain with it)

[kevin_goodwin]

I had my keys with me when I started a half day of grading roads on our ranch. I did not have the keys with me when I finished. I have walked every inch and done all I can to find the lost keys. I tried a metal detector, but there is so much old metal that it was worthless. I thought about using a pick-up magnet, but most keys are brass and not magnetic. One of the keys in the group is a 2010 Toyota Highlander remote keyless entry and and ignition key. I already replaced the car remote, what I am having trouble replacing are the other keys on they keychain -- locks I don't have back-up keys to and which are not "pickable."

I am not an EE guy, but it seems to me that it would be possible to build an antenna that would be able to locate the car remote (and thus recover the critical keys attached to the same keychain as the car remote), kind of a metal detector but for the remote. Can anyone help? Thank you.

 

[Pommie]

What is the range of the remote? Could you tow the Highlander slowly along the road until it detects the remote key?

Mike.

 

[KeepItSimpleStupid]

One technology that can work is GPR (Ground penetrating radar). See http://www.geophysical.com/whatisgpr

I have no idea: http://www.ptsmobile.com/FGE-LRU1002-KIT.html

See of you can locate any information with the FCC ID of the keyfob like frequency used.

This http://www.popalock.com/franchise/c...h-blog/understanding-transponder-key-systems/ has a very brief description on the Toyota system.

Something: http://www.aliexpress.com/item/32825595288.html

I'm going to throw this http://gaorfid.com/product/dual-frequency-proximity-and-contactless-card-reader/ out, but I have no idea if it will work..

So, 125 kHz and 13.56 MHz are common frequencies used. It likely is a passive tag. I actually have no idea whats used in a car, but the detection range is <10 cm.

Interesting: http://www.locksmithjournal.co.uk/understanding-cloning-and-how-it-can-work-for-you

Reading for fun: http://media.digikey.com/pdf/Data Sheets/NXP PDFs/PCF7x41ATJ.pdf



Back in the 1980's, we had a very early RFID system. The cards were bulky and initially set off the theft prevention systems in stores.
As far as we could tell, the reader swept a narrow range of frequencies or modulated a frequency and re-transmitted it back to the reader. The reader could detect dips in the received amplitude and these were physically encoded on the card.

The RFID technology has matured a lot since then. Ez-pass uses a powered device thus it has a long range. the transponder key use din my Toyota is just a key with something embedded in the housing. This is detected by a coil by the ignition key.

I drove an Altima and Prius with the keyfob you place in your pocket, That MIGHT be able to be detected.

i recently had a few lost key issues:

Usually, I find them in the door or car door or trunk or in my bed.

I had a keyfob attached to a single key and I didn;t have the key when I left the doctor's office. I had another set, so I could drive home. The next day, I put my feet in my shoe and low and behold, the key and fob were in my shoe. I put a carabiner on the keys and added two more keys, well lost them too. i went to a few stores etc over a span of 4-5 days and I sat down in a chair and low and behold, the keys fell out of the inside of by pants. The carabiner was attached to the belt loop. No more carabiners. I upgraded to a better hook.

Then more fun. A keyfob died, so I ordered two. They would not program. I could make my OEM FOB go away though When programming, there is a fixed time to program up to 4 Fobs and it deletes the ones that were programmed. The instructions said you would get a confirmation chirp - nope. had to order OEM Fobs for the programming to take.

Then a neighbor said the car was blaring it's alarm at 4am in the morning and the cops showed up. All it has is a panic button. The broken remote was stored next to a working remote, so I took the battery out of the broken fob. Hopefully, the problem will go away.

 

[Nigel Goodwin]

What is the range of the remote? Could you tow the Highlander slowly along the road until it detects the remote key?

Certainly on my keyless fob the range is FAR too short to do that - it's based on the premise that you have the key about your person when you try and open the door.

 

[Pommie]

I've heard stories (from the UK) of thiefs (arggggg) steeling cars by using two aerials to link fob to car. Is there any truth in this or just another Internet rumour?

Mike.

 

[Nigel Goodwin]

I've heard stories (from the UK) of thiefs steeling cars by using two aerials to link fob to car. Is there any truth in this or just another Internet rumour?

Mike.

There's been suggestions in the press and news that thieves can use specially designed 'devices' (not just a pair of aerials) to extend the range from the fob (inside the house) in order to open the car doors. However, I don't see how that would allow starting the car?, unless they use a similar device to do the same with the RFID chip for the immobiliser?.

From what I've read, it's generally a fairly small range of specific vehicles that have been targeted.

 

[narkeleptk]

My best advice is to just call a reputable locksmith. You immobilizer will need to be reset and then a new transponder key added. A 2010 Highlander is an easy job.

 

[Diver300]

What is the range of the remote? Could you tow the Highlander slowly along the road until it detects the remote key?

Mike.

I think that this is the best suggestion. You may need a trailer.

Put the Highlander on a trailer, locked. Put the other key elsewhere. Tow the car very slowly down the road with someone on the trailer, trying the door every couple of metres. When the doors open, you're close.

You could test if that will work with the key you have and a bit of string and a cardboard box. Put the key in the box and attach the string to the box. Put the box with the key about 10 m behind the vehicle with the vehicle locked. Get someone to slowly pull the box with the key past the vehicle by pulling on the string while you try the doors every few seconds. If you can't get the doors to open as the key is pulled past, give up with the trailer idea.

The cardboard box is optional. It's only there to stop scratching the key by pulling it along the road.

You might be able to start the vehicle with the key you have and then take the key away. If there is a dashboard warning of the missing key, you might be able to use that warning to spot a key. However that dashboard warning could only work with the key inside the vehicle, so if you do try that, test it by driving past the key that you do have first.

 

[Pommie]

My best advice is to just call a reputable locksmith. You immobilizer will need to be reset and then a new transponder key added. A 2010 Highlander is an easy job.

I thought the problem was the other keys that are irreplaceable?

Mike.

 

[narkeleptk]

I thought the problem was the other keys that are irreplaceable?

Mike.

your not calling the right person then

 

[narkeleptk]

Put the Highlander on a trailer, locked. Put the other key elsewhere. Tow the car very slowly down the road with someone on the trailer, trying the door every couple of metres. When the doors open, you're close.

This would only work if the truck has proximity key WITH smart access (small black square on door handle). Even then this is a bit silly as the range for smart access is not very far. May not work even if you where on top of the key.

You might be able to start the vehicle with the key you have and then take the key away. If there is a dashboard warning of the missing key, you might be able to use that warning to spot a key. However that dashboard warning could only work with the key inside the vehicle, so if you do try that, test it by driving past the key that you do have first.

The detection system will only detect for inside the cab. Same for starting.

 

[KeepItSimpleStupid]

Ground Penetrating Radar, but there's evidently a lot of debris too.

We don't know too much about the system used in the TS's vehicle.

 

[unclejed613]

I've heard stories (from the UK) of thiefs (arggggg) steeling cars by using two aerials to link fob to car. Is there any truth in this or just another Internet rumour?

Mike.

it depends WHEN it was made. i'm not sure of what year(mid 1990s according to wikipedia) they introduced rolling codes into the keyfobs, but before that time, a "replay attack" could be used to spoof the receiver in the car. how a replay attack works is, the thief waits nearby with a receiver and a laptop. when the car owner presses the button on the keyfob, the receiver and laptop record the signal. then they follow the car , and the next time the car owner stops somewhere where they have to go in for more than a minute or two, the signal is played back on a transmitter, unlocking the car. with rolling codes, the code to unlock the car comes from a pseudorandom number generator (how the car and fob keep the PRNGs synced isn't clear to me), which prevents a replay attack.

as for finding the keyfob, that sounds difficult. first, if the keyfob is buried, it's possible the button is depressed by the weight of dirt, in which case the battery is probably already dead. one possibility is, if you can find out what frequency the fob uses, you could use a gate-dip oscillator to look for the tuned antenna circuit.

 

[Pommie]

The rolling code can be defeated by replaying a previous code. When the owner subsequently returns the first code is out of sequence so the fob transmits the next code and the thief can capture both codes.

Mike.

 

[narkeleptk]

Most makers do not use rolling codes. 2010 toyota uses a basic fixed code with 40 (older models) or 80bit (newer models) encryption . A key id or its "password" is only changed on a immobilizer reset, typicallybdone when all keys are lost and are being replaced.


Pommie, rolled over codes no longer work thats the point of the system. The "password" shared by key and immobilizer changes each time the switch is turned on. Future or past codes will Not work, only the present one.

 

[Diver300]

I've heard stories (from the UK) of thiefs (arggggg) steeling cars by using two aerials to link fob to car. Is there any truth in this or just another Internet rumour?

Mike.

It can be done. The latest cars have a challenge / response, so there is a challenge from the car, and a response from the key. There also has to be something to trigger the challenge, but often that is just triggered by someone approaching the door handle.

The challenge is often on 125 kHz or 132 kHz, and is picked up by one of three coils at right angles in the key. That kicks the electronics into life and the challenge is sent by modulating the 125 kHz or 132 kHz. The low frequency means that the range is limited so that the keys need to be close for the car to unlock.

The response comes back at 433 MHz or 315 MHz (I think), the same frequency as ordinary car keys or garage door openers etc.

With any decent random number generation, the challenge isn't possible to predict, so it's not possible to harvest enough challenge / response pairs to have any reasonable chance of getting into a car.

However, if the challenge from the car can be relayed to the keys, then the keys can reply when they are much further from the car than the system should work at. The response has a much longer range anyhow, as it's the same as the owner pressing the button, so it can be 50m or more. Of course the response can be relayed back to the car as well.

Thieves use sets of electronics to capture and relay the challenge. The systems may also relay the response, I don't know. The success of that relies on the keys being reasonably close to somewhere accessible, like a front door. The range from the thieves' electronics to the keys can be greater what would be needed to open the car normally, as the thieves' electronics can transmit with more power on the low frequency than the car transmits at.

A good defence is making the keys stop working unless they have been moved recently. I have even seen a modified battery for a car key that disables when left stationary. I don't know why that's not standard on car keys.

 

[KeepItSimpleStupid]

I have even seen a modified battery for a car key that disables when left stationary. I don't know why that's not standard on car keys.

Neat idea.

 

[narkeleptk]

I have even seen a modified battery for a car key that disables when left stationary. I don't know why that's not standard on car keys.

GM had some remotes back in the 90's with tilt switches in them. Pretty much the first version of "smart access" where the doors would unlock when you got close to it.

 

[jbeng]

While I won't discount all the hi-tech solutions others have offered, the first thing I would do (if you haven't already) is thoroughly inspect the grader/tractor and all the little cracks & crevices around where the operator sits, as the keys could have fallen down and gotten lodged in there somewhere.

I wouldn't abandon the pick-up magnet idea you mentioned. While you're right that the keys are brass & non-magnetic, the split rings that connect the keys to the fob are magnetic. I would at least give it a try. If you have a four-wheeler as most ranchers/farmers do, tow the magnet slowly behind it, mainly in the areas where you might have gotten off the machine. Hope you have some luck finding them.