Keyless Open for Polo 6R (POC) for Armrests ;)

Hello,

I would like to develop a Proof of Concept (POC) for my Polo 6R to explore how to open this car keylessly.

Ingredients:
- OBD adapter + Wi-Fi
- Microcontroller + Relay

My idea:

- Send command to MC via Wi-Fi.
- The microcontroller switches the ignition power supply using a relay.
- The microcontroller sends a command via USB, Bluetooth, or Wi-Fi to the OBD dongle.
- OBD sends the command "Unlock driver's door".

Restrictions:
- The immobilizer or alarm system should not be modified, and the correct key should be in the vehicle.
- Similar to how car rental apps work, where the vehicle can be unlocked and the key remains inside.

Question:
- In the Polo 6R, I can tap into the ignition power at the high-pressure sensor, but it's not ideal if you bridge it directly to the car battery, because that will likely blow the small 5A fuse.
Okay, so: Does anyone have a suggestion on how to better achieve a "ignition on" state?
- Can you use Ross Tech to sniff network traffic? To be able to intercept and then send the driver's door unlock command?

Goal:
- Keyless entry *for those with disabilities*, allowing unlocking via an Android app, and driving the car with the traditional key.

Best regards.
Alexander.

Hello Alexander,

"Regarding sniffing on the CAN bus(es):"
http://shop.dieselschrauber.de/can-usb-interface-kit-mit-rks-can-p-313.php

Technically, your project is certainly feasible, but I would like to point out the following points that, in my opinion, speak against it:
- Ignition switch: How is it prevented from locking up while driving if there is no key inserted?
- Requires tinkering with the ignition switch.
- Legal aspects

Best regards, Rainer.

Hello Rainer,

So, it should only be responsible for opening the door. Perhaps it didn't come across clearly.

The ride, of course, was only possible with a key.

That's all it does, just unlocks the car.

I can see the possibility of observing the state of the driver's door and determining when it changes from LOCKED to UNLOCKED by pressing the corresponding unlock button on the driver's door.

But can the value be set via VCDS, or is that only possible at the driver level?

Using VCDS won't fix it...

Best regards, Rainer.

Rainer, do you know of any interface that can do that?

As I've now discovered, it might be possible to simply replace the lock.

I've noticed that when I only unlock the driver's door with the key, the alarm system activates after 15-30 seconds.

alexandererlangen wrote:

Rainer, do you know of any interface that could do that?

See my previous post regarding the RKS+CAN system with KCANMonitor software. You need to figure out which CAN messages are necessary.

Best regards, Rainer.

Now I can finally get back to work...


"On my 2010 Polo 1.6 TDI with engine code CAYB, the wiring is such that the green/yellow cable (from the body control module J519 T73a/24) arrives at the driver's side door as a gray/black cable at the connector (T8f/1) inside the door."



If I connect the gray/black wire to ground and then to one of the screws on the door, the central locking system locks. ==> great!



Allegedly, using a 180 Ohm resistor and connecting it to ground should unlock the safety valve, but it doesn't work.





gray/black ==> mass --> locked.

gray/black ==> 180 Ohms ==> ground ==> does not unlock.



Hopefully, someone can help me. What am I doing wrong?



Sure, here's the translation:

"Sidenote:"

I didn't have a 180 Ohm resistor, so I connected a 1000 Ohm (exactly: 989 Ohm) resistor and a 220 Ohm (exactly: 218.6 Ohm) resistor in parallel. When measured separately from the circuit at the voltmeter, the resulting resistance was exactly 179.1 Ohms.



Best regards.

Alexander.

"Back in the days of the Golf 3, the central locking systems used different signals to lock and unlock. One signal was sent to ground, and the other to battery voltage. I have no idea how it works on a 2010 model." I would have assumed that there wouldn't be any discrete wiring left at all, but only CAN or LIN buses.

Basically, with that approach, you'll likely only be able to open the driver's side door. The alarm system cannot be deactivated like this.

PS: Are you aware of the power consumption of your other projects? Especially Wi-Fi isn't necessarily optimized for energy saving, so your vehicle's battery could drain quickly. You should also consider whether the additional option for opening might be relevant for the partial comprehensive insurance you may have.

Greetings.
Guste.

Hi,

Thank you for your good advice. You seem to know what you're talking about .

I see it that way...
It's important that someone first knows that there's a Wi-Fi network available and that it can be used to unlock the vehicle.

I will use OpenID Connect 2.0 to access the REST service that opens and closes.
And OpenID Connect 2.0 is the standard that Google and the Facebook login use.

otherwise, the car is practically worthless... 7.5 years old, a "scandal" diesel engine... so, it's definitely worth trying.


Power consumption is a good question. That's why I would choose the Raspberry Pi Zero W, because it consumes 130mA at approximately 5.5V in standby mode.
It also supports Bluetooth Low Energy. If the onboard Wi-Fi consumes too much power, I would switch to Bluetooth as a backup.

Is there a way to feed the anti-theft system (DWA) with appropriate signals?

I would like to simply emulate turning the key.

alexandererlangen wrote:

(...) because 130mA at approximately 5.5V is the current draw in idle mode

So, at best, 0.7W. That's 60mA at 12V, plus converter losses. That's probably too much current for your battery (the total vehicle current draw is usually less than 25mA).

alexandererlangen wrote:

Is there a way to feed the anti-theft system (DWA) with appropriate signals?

Check out Rainer's comments. This is being communicated via the CAN bus. You need to intercept the CAN messages, filter them, and extract the ones that are relevant to your purpose.

alexandererlangen wrote:

I would like to simply emulate turning the key

However, if you're already leaving a key in the vehicle, then you can definitely opt for the complete, hardcore version.
1) Unlock the key. Extract WFS and FB.
2) Attach the WFS transponder to the WFS coil.
3) Control the "Up" button on the remote control using an optocoupler connected to your Raspberry Pi.
4) Control the ignition switch via a relay or optocoupler connected to the Raspberry Pi. (The end of the starting process depends on the alternator or engine speed, or can be set to a fixed duration, e.g., 3 seconds).

Of course, this requires an electronic steering lock, as found in the Passat 3C, among others. Otherwise, you might need to adjust something there.

It's definitely a makeshift solution in my opinion, but that's your decision.

Greetings.
Guste.

Hey Guste,

you really know your stuff

Okay, I don't want it to be *that* extreme... Not yet.

Stage 1:
I just want the convenience of being able to walk up to the car with my stuff, and the car is already unlocked, so I don't have to fumble around trying to hold a key with my thumb on the unlock button.

Stage 2: would have been a sensor at the rear that, in conjunction with modified dampers, opens the tailgate.

[Electricity]
It's crazy that 130mA is still too much. I guess I'll need to add an intermediate battery that charges during operation and is then available when the device is idle.

[Sidenote: User report: Devices connected to Dauerplus]
Okay, so I've had a Samsung S6 phone and a headset charger for about 1.5 years. The charger itself has a small battery that connects to USB and charges the headset (the manufacturer's intention is that the headset can be charged on the go without being connected to USB). I also have a Webasto T100 receiver module in my car.

That means all of this is also drawing a lot of power, right? But so far, everything has been okay. And I can also run a Webasto cooler, even when the vehicle is stationary, which is why it also has a battery protection device installed.

But probably it all works because the phone and headset have a battery, and the Webasto receiver doesn't draw much power...


I've managed to put the door back together for now...

I think I'm going to use the CAN bus.

Unfortunately, my Polo 6R doesn't seem to want to communicate with the RKS+CAN interface via the diagnostic port. According to the wiring diagram, the speedometer, the engine, and the vehicle's onboard network CAN are all connected to the U31 diagnostic module...

I'm going to order a CAN bus transceiver, which I'll either connect to a Raspberry Pi or an Arduino. I still have an Arduino UNO and a Bluetooth board. It might be more energy-efficient than the Raspberry Pi. It's just that achieving true end-to-end encryption is a more complex undertaking.


Question:
I need to connect to the J519 body control module via the CAN bus. What's the best way to access it? Actually, the diagnostic connector U31 is connected to it...

U31 T16b/11 it T73b/18 J519
U31 T16b/3 it T73b/19 J519

Page 46 of the P0050380500-1_2-l gasoline engine manual, model CGPB, starting May 2009.
Starting on page 12, you will find information about the 1.6-liter diesel engine, models CAYA, CAYB, and CAYC.
Starting in May 2009.