Member Since: 30 Apr 2019
Location: Nice
Posts: 94
KVM dead?
Hi Guys,
Need your help again around KVM.
Following earlier thread https://www.disco4.com/forum/key-fobs-nort...light=kvm, VIN based new fob and blade was ordered via local non-authorized LR specialist - the best in area LR authorized channel. (all good).
This didn't fix the issue and based on feedback provided by specialist, there might be a problem with KVM in the car, as he says "someone maybe tried to do something and locked KVM". Since I'm not an expert in LR KVMs, am asking you guys for help/thoughts on next steps. At the same time he mentioned that communication with KVM was ok - which really suggests me the KVM being locked down to the two previous keys, none of them I have now, only the freshly provided by LR.
This is MY14 LR4 (NA spec) - purchased recently on auction (provided key never worked).
After some reading - it looks like maybe this KVM had upgraded software to lock it down to not allow add new keys (latest security patch to block theft attempts)? Could it be the case? If yes, based on other reading, it sounds like the only way is to replace KVM and do it at LR authorized dealer or could it be done with SDD/anything else? Seems like GAP IID won't be helpful here.
If not above, should there be a way to reset KVM without replacing it?
If KVM needs to be replaced, a used one would be good? (how to check if it doesn't have that software version which locks number of programmed keys? - maybe not worth trying to save here).
If buying via LR dealership because current KVM is the locked one - having one key purchased from them - there was tech buletin that they then cover cost of KVM/labour (car is outside of warranty, but if I read correctly it doesn't matter). Is this really the case? Is D4 KVM getting really locked? Should this be the case, seems like GAP IID would not be able to program new keys at later stage? Then it drives me to need to buy second key before they replace KVM (grrr.. this gets expensive).
Sorry for lots of "ifs" as wanted to express all doubts and thought process. I want to keep it cost effective and easy.
What intrigues me is that it has been said that the emergency start putting that new key fob under steering column didn't work neither - so maybe indeed KVM is dead?
I've a little bit of feeling that maybe non-authorized LR specialist who is helping me with this is not that experienced with KVMs and keys whilst is excellent in other areas.
Since car is not driveable at the moment I'm trying to find the most cost effective way to get it running as "shipping" car to nearest dealership will cost unnecessary x00 EUR.
Member Since: 23 Jun 2009
Location: Gone
Posts: 1087
Talk to a good main dealer. The keyless module was updated at some point around the last couple of years of D4 build. The update was designed to make it harder to program new keys and it limits the amount of times this can be done.
A friend of mine (65 plate) had her car keys stolen a while back. The insurance company insisted on replacing the key AND having the stolen key unprogrammed from the car. She had to have a new keyless module and both keys had to be programmed at the same time. The new module had to be special ordered from the factory and the VIN is needed to do this. The cost was about £800.
As I said, talk to a good dealer, the Master Tech if you can. Late cars are more secure than earlier ones and it is a different process now.
6th Jun 2019 5:34 am
dgardel
Member Since: 03 Nov 2009
Location: Greater Venice
Posts: 2025
I have also a MY2014 and I re-flashed the KWM by an update given me by GAP to be able to program new keysDiscovery 5 tdv6 HSE Corris Gray Outback Engineering Limited Edition IID Pro MV License
6th Jun 2019 8:15 am
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Thanks guys.
If I'm reading it correctly, with IID, I might be able to get it working.
Where the best is to read on procedure?
Isn't it a problem that I have no working keys at the moment?
Thanks.
UPDATE: going through workshop manual I've noticed mention of PATS (Passive Anti-Theft System) - what is this and how is it related to KVM? Sorry for more questions - I'm of the type of trying to avoid RTFM, though can't always find answers.
6th Jun 2019 2:07 pm
dgardel
Member Since: 03 Nov 2009
Location: Greater Venice
Posts: 2025
Best way is to mail to Patrick @ GAP.
Have you the IIDTool?Discovery 5 tdv6 HSE Corris Gray Outback Engineering Limited Edition IID Pro MV License
6th Jun 2019 7:35 pm
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Yeah, received my IID just 2 days ago. It proved to be essential element of LR ownership.
Unfortunately, Patrick replied that due to the fact that there needs to be one working key to start engine.
What I'm not clear on yet, is that I've ordered VIN based key from LR, is it pre programmed? If yes, then I'm home, if not.... what's the purpose of ordering key from LR?
How about emergency engine start procedure with key under steering wheel, which skips LVM and enables CJB to start engine?
I've heard earlier that for that there needs to be external power supply to trick computer into workshop mode.
I've heard earlier that for that there needs to be external power supply
I'll try and have a look but that scenario seems unlikely ... the fob-under-steering wheel is, i thought, for the issue of a dead fob battery and you need to access car using the key blade. Why would you have an external power supply if you were in car park at e.g. base of Ben Nevis ???.
Dean
====================================
2011 D4 XS - OBD port protection, RLD spare wheel protector, All LED interiors lights, Timed Climate enabled, iiD tool paired.
2011 D4 Landmark - Stolen from same dealer before I paid for it
2011 D4 GS - Stolen whilst at dealer ... All LED interiors lights, DRLs, Spare Wheel protector.
1996 300Tdi - Eaten by tin worms
however ... it implies this is the procedure if car was locked using the key-blade. is that what has happened ??
6th Jun 2019 8:12 pm
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Car opens without an issue using the new blade purchased from authorized LR channel. I've been asked for proof of ownership. Opening with blade, unlocks central lock in all doors.
The logic I follow (potentially missing key blocker).
to program KVM, engine started is required. To start engine using emergency procedure, skips KVM, as CJB is involved directly. There might be a register in KVM allowing to program keys only of disarmed by existing key, but this is not described anywhere.
What intrigues me is what that LR specialist said that KVM is locked.
Since I'm newbie in this and what is the inner works of this KVM, I've so many questions.
By craft, I'm in IT security, hence have an idea about how systems are designed and that things should be kept relatively simple for maintenant purposes. What is missing is lack of documentation as we deal with security by obscurity designed by LR.
6th Jun 2019 8:18 pm
Avalon
Member Since: 01 Apr 2013
Location: Bavaria
Posts: 83
In case no additional security devices are present, that might be the easier road to take.Disco4 V6 SC HSE (MY2014)
7th Jun 2019 11:42 am
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Avalon many thanks for help - very good tips.
How to verify if other tools were not installed? It is freshly purchased second hand car and I have no history on it. Guess is LR specialist or a good locksmith should be able to find it.
On second part - KVM and all keys lost - thanks for the tip on devices too - it got me thinking out of the box.
Unfortunately some of these devices are for prices ~7.5k EUR (sic!).
With that said, there are also cheaper options - more on this below.
Land Rover head a flaw in KVM design allowing to add any key without authorization (KVM firmware versions named DLPA).
Around 2015 fix has been introduced and all cars going through dealership actions were to be upgraded to newer firmware version FK72 HPLA. This effectively switches KVM to be read-only module after first time key programming (dealership only - though other options exist).
Having KVM FK72 HPLA for quite some time meant that if someone tried to add keys with some third party tools KVM could be "blocked" and refuse to further cooperate. Some stories were put also that BCM was getting locked.
The "dealership" approach is to replace KVM (sub 1k EUR) and if required BCM too (some prices in $ quoted online were ~4k$ including KVM, keys and labor).
Luckily for some time there seem to be solutions:
a) latest Lonsdor (some say possible, some say not really),
b) JLR Doctor - seems to do magic - price unkown and probably not that easy to find local locksmith to own this - does not require disassemble of KVM/BCM,
c) latest solution - Mart tool together with VVDI2 or x-horse - allows to prep dealer key though requires to disassemble KVM and some welding + programming of the chip.
?) Avdi abrites - some says it does the job other that not.
Warrning - previously a good tool, now the one which brings more trouble than anything is SKP-900
Mart tool reasonably priced. I now need to find local locksmith to get it done and the one who has idea about it to not brick BCM if it is not bricked yet.
Given Mart tool relies on other solution like VVDI2 or x-horse which is much wider available than dedicated JLR Doctor - seems like this might be the only way to go for me - find a guy who can do that.
FYI. Seems like Land Rover issued service bulletin that if customer purchases key due to that security issue with KVM fixed by limiting the ability to add new keys, Land Rover replaces KVM and covers labor within price of the key. I've seen this bulletin once and it was for some Range Rover and whilst forgot to store it, didn't find similar for Discovery 4/LR4 and am not sure if it is applicable.
Maybe a proper way to approach is to talk with dealership on the basis of this service bulletin and fact that key was purchased through authorized channel. The worry is that they might refuse it stating that it is "all keys lost" situation or any other excuse.
Happy to hear any thoughts from your side guys.
9th Jun 2019 11:58 pm
Avalon
Member Since: 01 Apr 2013
Location: Bavaria
Posts: 83
Quote:
How to verify if other tools were not installed?
That is not so easy as there are multiple locations where the devices can be inserted into the CAN-Bus. Looking at the looms under the steering column and near the CJB is probably the first place to start searching.
The device from OEM-Plus will flash the hazard lights if fully wired in when someone tries to program a key and also locks access from the ODB port.
A user on the German forum lost both keys and the dealership also wanted to replace the KVM at his expense. He then found a locksmith in posession of one of the nasty devices I mentioned, but found one of his keys a day before his apointment with the locksmith so did not test the alternate solution. I can see if he will pass the contact information on if you wish.
From what I know the KVM replacement as part of a key purchase is also valid for the Discovery.Disco4 V6 SC HSE (MY2014)
Last edited by Avalon on 11th Jun 2019 7:54 am. Edited 1 time in total
10th Jun 2019 8:54 pm
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Thanks for all the tips. Until recently thought was that first it is more difficult to steal car (silly me) secondly that it is not that complicates to get spare key. BMW has the process that one can order key programmed based on vin. Key arrives ready to operate car, no tricks, no hidden costs. Maybe there is a flaw allowing an easy steal, but still better thought thorough.
Re locksmith, I'd be keen to have it as plan c, as plan a is to get KVM out (done) and get it reprogrammed.
Btw. I've checked with other dealer and statement was that (this gets funny), because my car is imported from US, LR Europe washes their hands of and would charge for KVM. If it would be European model, it would be free of charge. Interestingly enough he coughed out that same applies for all keys lost.
With that said, I've got confirmed that it is known to work that locksmith can do better job.
Thanks.
10th Jun 2019 11:50 pm
lrovy
Member Since: 30 Apr 2019
Location: Nice
Posts: 94
Small update on progress.
Locksmith managed to find KVM, on the right side on the trunk Aaron's radio tuner and managed to reprogram it with keys, the virgin one and the one I had earlier. Remotes work now and ignition can be set to on when holding start button.
Engine however does not crank.
Checking with IID tool, it shows "No connection with high speed CAN ".
the suspicion is that because when he was looking for KVM, some other modules where disconnected and to make it potentially worse , he didn't disconnect battery.
Could it kill some other modules or maybe it is more of he didn't connect correctly all the modules back?
Or maybe whilst programming KVM, as it requires temporary soldering, he killed KVM connection?
Could diagnosis with SDD help to isolate and find the fault? Or is it down to checking or wiring?
If it would come down to sending car to LR dealership and ordering new KVM, should they be able to program the two existing keys? Is there anything what gets programmed to keys when pairing with KVM, or are they passive and just registered with KVM?
I've feeling that I'm digging out of one hole to fall into another one.
Your help guys is so appreciated that you can't imagine. Hope one day I can shared my knowledge and help you.
13th Jun 2019 11:59 pm
M3bobby
Member Since: 21 May 2018
Location: Sleaford, LINCS.
Posts: 857
What’s telling you that there is no connection to HS can? Is that the tool which can’t talk to the CAN or the CAN Can’t talk to the KVM?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
... All LED interiors lights, DRLs, Spare Wheel protector.
