Situation:
2005 Chrysler Crossfire (base convertible)
Owner lost keys. Has no spare money to spend on car. Dealer of course wants $1-2K to get her going again.
Owner is a friend of mine. Looks to me for help since I have fixed her car numerous times before.
Did a bunch of research. Decided to try to bypass security.
After talking to a dealer mechanic, he said the security disables fuel pump, starter, and spark power.
I'm fairly handy with cars and electronics, so I removed the ignition cylinder assembly, disabling the steering lock and shift lock in the process.
I then wired up toggle switches and a push start button. I now have power to the car, a lead to the starter that bypasses the car's built in starter lead, and a +12v lead to a hidden switch that was intended to go to a relay to power the fuel pump and ignition coils.
However, in running temporary test leads I discovered the guy was full of crap and the ignition coils are NOT disabled at the 12 volt power source (they are disabled at the level of firing sequence). The car turns over but will not fire even with the fuel pump manually turned on (no spark). So I've wasted time and money on my cool wiring project.

Question: Is there a way to bypass the security module entirely? Get rid of it. Nobody cares any more.
Barring that, is there a CHEAP way to obtain and program any RFID chip that I can glue / tape to the transponder ring?
OR does anyone know what signal the SKREEM sends to the computer and whether it can be reproduced?

We don't care whether it's secure or not. We just want the damned thing to start and run to get her to college.

I refuse to think a 2005 car is going to be a paperweight because the security system is TOO good

Thanks in advance for your time,
-Mike

 

Mike,
Welcome to the SKREEM jungle.
Type "SKREEM" in the "Search Forums" box and you will find a plethora of information from other members on this subject.
Cheers,

 

Hi wombrat

There's no way to bypass the SKREEM. Your mechanic friend was way off the mark, the ECU will not start or run the engine without a matched up SKREEM. I'm afraid that the easiest and most cost effective solution for you is to buy a new key. It is possible to read the key codes from the existing SKREEM module and make chips for new keys, but you'd need some specialist equipment to do it (and it would cost more than a new key) Keys are approx $660 from Needswings. It's worth spending the money. The alternatives are way too much effort.

 

there are a couple ways to get around this, one is to buy the key,skreem and all needed parts from a junk yd car,,, Matt did one a few months ago, he got the car at auction after the storm (i think it was also flooded) but with no keys, or skeerm ,some computers and half the dash was missing,, he fixed it ,i will see if i can find out how and what he did.

 

And another thread here has been created

 

He's been a member here for four years and never read any of these threads BEFORE taking the "mechanic"'s words as gospel.
Too late for that now.

 

My time costs money. IF, that is a BIG IF, I can emulate the SKREEM with a plug-in module that eliminates the RFID function (meaning you can start the car simply by rotating the ignition switch), my module's cost will be $500. How does that price grab you?

Perhaps by next June I will be there, Iv'e got a LOT to learn first. But if you don't hang out here and read threads, you will never know how things stand. Stop by once in a while -hopefully, there will not be 400 threads on the topic by then.......

Right, Gary?

 

If she just lost the key, and the skreem and antenna was working just fine up to that point, all you need to do is contact needs wings with her vin number and she provides him with some basic ownership proof, and in a week she will be back on the road after he sends her a new key already programmed to start and run her car. A 30 second programming procedure will enable her to open the doors. Cost......$680 or so. If the skreem or antenna goes, she might eventually need that too, same price and purchase procedure. Don 't wait too long, Mercedes and Chrysler are no longer providing these last time I checked, needs wings can still get them , but could be discontinued at any time. Meanwhile, the race to find an alternative solution continues. Thank you , Gary, for being understanding.

 

 

Working on A, looks like will cost about $50 for a programmer and chips but need to copy an RFID chip BEFORE it is lost.

Mentioned the "valet" key that is just a key with RFID chip, no remote capability.

Programmer is scheduled to be here on 8th, will know more then.

 

That was what my I was attempting to curtail by my reply as first respondent.

 

It would be great if this works out well. Very hopeful. In the meantime, having a spare set of both might be wise. Expensive but car can 't be run without them, for now.

 

I have been a member here for a while. I HAVE read a TON of posts related to SKREEM.
Let's take the above post's list for example:

SKREEM Options
Discussion on bad skreem module / skreem cloning, no real resolution or information on bypassing / proceeding with an actual missing key.... pizzaguy being salty.

Possible SKREEM?
Discussion on possible bad skreem (the ol' start 3 times and die immediately bit). Suggestions on payin >$600 for parts from needswings. Wrapped up with owner "finding the chip." Does not qualify as "cheap" or "bypassing."

Shaming post:
Griping on price gouging. More talk of reprogramming / cloning, which I don't need (my SKREEM is fine). One buried post related to my issue by pizzaguy (who just a few posts away said he wasn't the expert) saying the bypass "just isn't that easy." There's no solution here, hence my explanation of my own attempts at bypassing with +12v to hopefully provide another perspective.

SKREEM unit part number:
Discussion on part numbers. Not related to my issue, as I know my part numbers and am not looking for replacement parts yet.

Bypassing, deactivate "Safety" parts/functions-
Yay a "Bypass" thread... Nope, just a discussion on disabling traction control, etc.

SKREEM Module replacement video for the Crossfire:
GREAT video on replacing the SKREEM module, which is exactly one of the things I was trying to avoid since it did not go bad.


So I did my due diligence, and asked what I believed to be a different question. At least different enough to warrant another thread. Others here have been nice enough to offer suggestions without immediately jumping on the "Why dontchu read jerk" bandwagon.

I am not just another dumb schmuck who has no respect for forum etiquette. I am a 45 yr old network security architect who happens to be good with cars who is giving his own time over the holidays to help a family friend in their time of need. I am doing so without griping or animosity. Perhaps you could consider reading more thoroughly before passing judgement and throwing attitude.

 

​​​​​​​This is what I was thinking. Do we know if just replacing the 4 "interlinked" parts (ECU, SKREEM, transponder ring, key/fob/chip with a matching set from the junkyard will work? Or is there another VIN-specific entity missing from the equation or additional programming needed?

 

 

Hah, funny!
No, no chip at all. I truly appreciate forums and their awesome users. I just don't like being yelled at for "not reading" when I read a TON and had a significantly different question.
Nothing ruined. I did the work myself and everything plugs up to the factory wiring which is all still intact.
I understand that the expensive option may be the only option. I was just seeing if maybe someone had figured out the last piece of my puzzle (the spark firing bypass) so I could save her some money.

 

You certainly worked hard at it, Wombat - but you didn't work as smart as you did hard.
Your only real mistake was listening to a 'mechanic' who gave you an opinion and sold it as reality.

If you had posted here and told us of your plan, MANY of us could and would have told you what the outcome was going to be.

 

I tend to just reply to the latest one.

When I ordered the programmer on the 27th they said "Jan 8th" and seem to be doing their best to accomplish that. Seem the label has been created but not actually shipped..

Once received I will know a lot more right now can just confirm 315 MHz.. Sometime between 2007 and 2011 Chrysler switched to 455ish MHz but the shape of the fob changed also.

That be as it may I think many would just like an emergency key that did not have the remote capability. That is pretty simple just does require a locksmith that can cut the square keys (is more a milling operation than a traditional cut).

So we really have four elements here:
Skreem
Key
RFID chip
Remote Keyless Entry (RKE)

Should each have a separate thread ? (well, maybe not the key)...

The other issue is one of a failed SKREEM module and is more complex but known. Unfortunately it is probably not difficult but Those Who Know are charging $300 to reprogram a good used SKREEM so information on how is closely held. Reverse engineering will require more equipment and knowledge than I have at the moment, it is no longer my job, but cannot be very complicated. Know I have a Tek storage scope and an HP Logic Analyzer here somewhere but have not used in a decade.

 

Everybody,

Please read the description of all the stuff the SKREEM module is responsible for. One is the termination resistor for the CAN C buss for all of the modules to communicate. No termination no data between modules. It is the storage for DRBIII diagnostic codes. Etc., etc.

OPERATION
VEHICLE LOCKING / UNLOCKING

To unlock, the SKREEM module sends a signal to the Body Control Module. The Body Control Module then sends a signal to the Central Locking Pump/Security System Module (CLP/SSM) via the Controller Area Network (CAN) Bus. The CLP/SSM pump motor starts running and supplies air pressure. The door lock actuators are pressurized. When a pressure threshold is reached in the system, the pump is switched off by an internal pressure switch. The pressure in the system is then released by the CLP/SSM and the unlocking operation is completed. The locking procedure is accomplished in a fashion opposite to the unlocking operation. However, the next time the remote control button is pressed, the CLP/SSM is also actuated by connecting it to ground by the second control lead on the SKREEM module. The direction of rotation for the CLP/SSM pump motor is reversed, thereby providing the vacuum required to lock. In order to avoid unlocking the vehicle unintentionally, the vehicle is relocked by the CLP/ SSM via the SKREEM module. After unlocking with the remote control, the locks will be relocked if either door is not opened within 40 seconds, the key is not inserted into the ignition switch, or the interior power door lock switch is not actuated. The CLP/SSM reads the signals (door contacts, liftgate/decklid, interior power door lock switch) and actuates the power door lock actuators. The vehicle security alarm is also activated by the relocking function.

AUTOMATIC LOCKING / UNLOCKING

Upon reaching a speed of 15 km/h (9 MPH), the vehicle doors are locked automatically. The fuel tank flap remains unlocked. If, after automatic locking, the vehicle is unlocked with the interior power door lock switch, this state is maintained until a door is opened or until the ignition is switched off. Automatic locking is accomplished again only upon reaching the specified speed. The logic circuitry for this function is integrated into the CLP/SSM. The auto- matic locking function can be activated or deactivated with the DRB III��. An alternative is to use the interior power door lock switch with the ignition switched on by pressing and holding the door lock switch for more than 5 seconds in either the lock (auto locking switched on) or unlock (auto locking switched off) position. The alternative of enabling/disabling the auto locking system by using the interior power door lock switch can also be inhibited with the DRB III��.

EMERGENCY UNLOCKING

In the event of a vehicle collision, the doors are unlocked automatically by a crash sensor integrated into the CLP/ SSM. The doors are unlocked after a delay time of 8 to 11 seconds. The emergency unlocking function interrupts all functions performed by the CLP/SSM, which are reactivated only after interrupting the ignition. The emergency unlocking function is only active when the vehicle is unlocked from the outside.

VEHICLE RELOCKING

In order to avoid unlocking the vehicle unintentionally, the vehicle is relocked by the CLP/SSM via the SKREEM module. Relocking is accomplished after unlocking with the remote control when: a door is not opened within 40 seconds, the key is not inserted into the ignition lock, or the interior power door lock switch is not actuated. The CLP/SSM reads the signals (door contacts, interior power door lock switch) and actuates the power door lock actua- tors. The vehicle security alarm is also activated by the relocking function.

OPERATION

The Sentry Key Remote Entry Module (SKREEM) has the following functions: receiving and evaluating the Radio Frequency (RF) keyless entry remote signal, actuation of door locks in conjunction with the Central Locking Pump/ Security System Module, and enabling the vehicle theft security alarm with confirmation via the turn signals. When the RKE transmitter is operated, an RF signal is transmitted. If the SKREEM recognizes the RF signal as valid, it actuates the Central Locking Pump/Security System Module through the Body Control Module. The vehicle is then locked or unlocked through the power locks system. Connected to the SKREEM is a Sentry Key Antenna Ring which surrounds the ignition lock cylinder. When the ignition is switched on, the Sentry Key Antenna Ring is sup- plied with power. A data block is transmitted inductively via the Sentry Key Antenna Ring to the SKREEM and then on to the Powertrain Control Module. If the antenna ring data block content is invalid or if vehicle battery power is too low to build up enough power for the antenna ring, the Powertrain Control Module will not receive the proper signal. This is displayed with the message “Start Error” in the Instrument Cluster.

The SKREEM contains an RF transceiver and a microprocessor. The SKREEM transmits RF signals to and receives RF signals from the ignition key transponder through a tuned Sentry Key Antenna Ring that is wired to the SKREEM. If the Sentry Key Antenna Ring is not mounted properly around the ignition lock cylinder housing, com- munication problems between the SKREEM and the ignition key may arise. These communication problems will result in ignition key transponder-related faults. The SKREEM also communicates over the Controller Area Network (CAN) data bus with the Powertrain Control Module (PCM), the Instrument Cluster, the Body Control Module (BCM), and/or the DRB III�� scan tool.

The SKREEM retains in memory the ID numbers of any ignition key transponder that is programmed into it. For added system security each SKREEM is programmed with a unique secret key code. This code is stored in mem- ory, sent over the CAN data bus to the PCM, and is encoded to the transponder of every ignition key that is pro- grammed into the SKREEM.

In the event that a SKREEM replacement is required, the secret key code can be transferred to the new SKREEM from the PCM using the DRB III�� scan tool and the ignition key system replacement programming procedure. Proper completion of the ignition key system initialization will allow the existing ignition keys to be programmed into the new SKREEM so that new keys will not be required. In the event that the original secret key code cannot be recovered, SKREEM replacement will also require new ignition keys. The DRB III�� scan tool will alert the technician during the key reprogramming procedure if new ignition keys are required.

The sentry key system performs a self-test each time the ignition switch is turned to the ON/RUN position and will store fault information in the form of Diagnostic Trouble Codes (DTCs) in SKREEM memory if a system malfunction is detected. The SKREEM can be diagnosed and any stored DTCs can be retrieved using a DRB III�� scan tool. Refer to the appropriate diagnostic information.

 

Additionally this is why cars of today won't ever be restoration capable like a '57 chevy or a '65 Mustang are. If you want to preserve the breed so to speak you also have to preserve all of the test equipment to talk to the car's computers AND the software to do so. Fast forward to 2060, unfortunately gone are the days of restoring a 50 year old car unless you have access to all of the electronics. Can you even imagine trying to restore a Bugatti Veyron 50 years from now?