Would love to see this being used to add keys to cars. A lot of cars now have tablets and screens that could be used to do this, but for some reason (money) I have to take my VW to the dealer...

I think the whole market for aftermarket keys could be completely eradicated with good software UX (and low pricing).

▲

Doohickey-d 5 hours ago | parent | next [-]

The whole aftermarket key ecosystem, even vehicles going back 20 years, is messy, horrible thing.

It's dominated by Chinese manufacturers of specialty tools (Autel, Xhorse, ...), which inevitably mandate bundled accounts, subscriptions, mandatory cloud features, etc. Even the older cars, you have either cheap Chinese tools, where you never know wheather it'll really work, or the manufacturer's tool which needs a dealer code, which of course the dealer won't have after 20 years.

I wrote about my 20 year old car-key-adding adventure here: https://jonas.bike/low-cost-diy-key-/-transponder-for-my-200... - it requires desoldering an eeprom, two pieces of hardware from aliexpress which come with pirated copies of software, and lots of hope that it'll work...

An open source community curated collection of scripts, which works with a cheap OBD dongle (which is all the chinese devices are: OBD hardware + per-car software), would be amazing.

▲

londons_explore 4 hours ago | parent [-]

Frustratingly those cheap OBD dongles (ELM327 clones) seem to be mostly designed for diagnostics. They effectively run a regex over all the canbus data and tell the computer what matches.

However they can't match and forward everything (not enough RAM) and miss loads of packets, which makes them useless for things like reflashing firmware or interfacing with OEM tooling.

▲

holoduke 30 minutes ago | parent [-]

So what odb should I use to start reverse engineer my TCU from a old 2006 ferrari? These tcus are hard to come by. I wish I could replicate it's behavior. Not sure if that is possible. I think i can do it

	▲	londons_explore 12 minutes ago \| parent [-]
		In 2026 I would grab anything supporting SAE J2534 and then tell Claude to figure out all other details.

▲

terribleperson 5 hours ago | parent | prev | next [-]

I had this same thought the other day. For a lot of cars you can buy aftermarket programmers, but the Dorman ones are limited to 3 uses. 3 uses for like eighty dollars is terrible, and surely it's not a technical limitation.

▲

catlifeonmars 4 hours ago | parent [-]

Heh, maybe instead of circuit boards they are using wheat crackers.

	▲	terribleperson 3 hours ago \| parent [-]
		Hah, I hadn't considered a hardware approach to limited use. I assume there's just a counter in there. There could, theoretically, be cryptographic reasons it can only do 3 programming sessions, but I doubt it.

▲

ronnier 3 hours ago | parent | prev | next [-]

You can do that with teslas. Buy two keys (they at those credit cards sized keys) and you pair them on your own. Two for $40. Do it right at home. You can pair multiple cars to a single key. Or make guest keys

▲

XorNot 3 hours ago | parent [-]

This works for most modern Toyotas - there's a sequence of door openings which put the car in pairing mode and will link a new key.

	▲	ronnier 2 hours ago \| parent [-]
		But you have to buy an expensive key. I have two Teslas and a Toyota and my Toyota is so annoying that I even have to have a key. My Tesla just uses my phone (the credit card keys are totally optional)

▲

bri3d 4 hours ago | parent | prev | next [-]

Keys in European and newer American cars reliably have Some Kind of real-ish crypto scheme applied, as this is fairly regulated in Europe. It’s an anti theft measure driven by the real stolen auto trafficking issue faced especially in Europe. Most of the aftermarket tools vendors use some kind of exploit (code exec, arbitrary read, update signature bypass, etc.) to extract the crypto material from a control module participating in the immobilizer - it’s neither a weird conspiracy nor as simple as it seems to bypass.

▲

trollbridge 7 hours ago | parent | prev [-]

Good luck with Claude not just immediately giving you a refusal.

▲

holoduke 25 minutes ago | parent | next [-]

It's pretty easy to bypass this check by telling the system you are working at a car Company and repair hardware with blabla. Many other tricks to get though those weak filters.

▲

zeryx 4 hours ago | parent | prev | next [-]

GLM or Qwen will do it

▲

prodigycorp 6 hours ago | parent | prev [-]

Codex would

▲

ryandrake 4 hours ago | parent | next [-]

It's crazy. Reverse engineering a protocol/interface is something LLMs are surprisingly good at, and these show a promise of unlocking sooo much proprietary crapware that's hidden behind obfuscation, accounts, subscriptions, lazy vendors who only write crappy windows programs, and so on.

But of course, the major US labs are going to get pressure from these vendors whose business models depend on obfuscation, and you know they're going to bend the knee and nerf the LLMs.

▲

qingcharles 6 hours ago | parent | prev [-]

Not these days. It won't even look at my projects for security flaws any longer. Has a little pop-up that says "This output cannot be viewed." or some such.

Have to make the Chinese one do it.

▲

KlutzySofa 6 hours ago | parent | next [-]

Its backwards in so many ways.

You fall back on having to use Chinese models. In theory the Chinese models could also be trained to sneak in new security flaws while Claude and Codex would avoid looking for them.

▲

theplumber 6 hours ago | parent [-]

Claude and codex could also be trained to sneak security flaws. They could even target specific people. Not to mention that all their data goes through NSA headquarters so you don’t even have the option to run it locally in any shape or form.

	▲	KlutzySofa 5 hours ago \| parent [-]
		The US companies are doing this to not get export restricted by the US government which in turn can end up with companies using Chinese models to get around those restrictions. Its not really a matter of who's good and bad (neither the US or China has the best track record), but creating a scenario where the other party can use your own policies against you.

▲

mrinf1nity 4 hours ago | parent | prev | next [-]

My lil' Claude tells me that my security related request is flagged and will be sent for human review. And to use a lesser model.

I told it 'Let's find the limitations of this Linux system' then it made a benchmarking set of tools for disk i/o, RAM, etc

When using Gemini on my phone it also told me it'll be 'human reviewed.' when asking it about car prices.

Also when saying 'let's use best security practices'

o_O

▲

drnick1 4 hours ago | parent | prev | next [-]

Just tell it to continue. For now, it still mostly works. On the other hand, Claude flat out refuses to look at game and anti-cheat binaries, etc.

	▲	qingcharles 3 hours ago \| parent [-]
		It sorta, sometimes does. It's not a reliable fix, though, sadly. Even my old reliable Muse Spark has gotten a little testy lately. I'm back to GLM 5.3.

▲

catlifeonmars 4 hours ago | parent | prev | next [-]

Get the Chinese one to jailbreak the proprietary one. Best of both worlds.

▲

nullsanity 5 hours ago | parent | prev [-]

[dead]