digitalfiend
Expert Overthinker
I think I'm going to try to find a way to do this long-term because eventually the TPMS sensors will die.
I haven't seen a way to do this with HPTuners. Do you know of a way to turn it off with any tuner?
Attempt To Silence TPMS Complaints
- Thread starter digitalfiend
- Start date
Disclaimer: Links on this page pointing to Amazon, eBay and other sites may include affiliate code. If you click them and make a purchase, we may earn a small commission.
I think I'm going to try to find a way to do this long-term because eventually the TPMS sensors will die.
I haven't seen a way to do this with HPTuners. Do you know of a way to turn it off with any tuner?
No and I have never heard of it, although it has to be possible. The computer that controls it on the 06 model I was looking at was the Passenger Door Module.
All the modules are connected on a data circuit. So it is not just a wire you can cut or jump or manipulate physically. You would have to turn off the functions in multiple modules.
digitalfiend
Expert Overthinker
I was googling around for a way to spoof the signal or modify my existing adapters. I found that some security researchers have begun looking at the wireless TPMS receiver as an attack vector since it sometimes is the same receiver for the wireless lock/unlock/security: Defcon: Hacking Tire Pressure Monitors Remotely
I had resigned myself to just installing the sensors in my aftermarket rims until your posts got me to thinking this over more. Eventually the sensors are going to fail...whether it's their power source or some other component of the TPMS sensors. The approach I'm considering now is that I'd like to alter the TPMS sensor circuitry so that they send a signal all the time that their pressure check is within acceptable limits. I'd wire them into the Tahoe's ignition power once I accomplished this and wouldn't bother installing them inside the rims. First off though, I'd have to get under the black epoxy that the manufacturer used to secure and protect their circuitry.
I can tell you how it works.
When you turn the key on, it checks for signals and gets a reading.
Im not sure how it determines which wheel is which, but a tpms reset tool can read the pressure, so whatever signal is being sent prob has code for both the pressure and an ID for what ever wheel you have it programmed to . All that is if it will tell you which wheel is low. If the system wont do that then it is prob just one signal for pressure.
Ok so you turn the key on it gets the signals and a pressure reading and if it sees low pressure it turns on the tpms light. If it does not see a signal at all (not just a low pressure signal) from one or more sensors then it turns on the tpms light and some other tell tale for a problem with the system. This is monitered every so often ( cant rem the time frame).
Built into the sensors is an acceleromter, as soon as the wheels start to turn they send a signal and the system starts to monitor the pressure every 30 seconds. If you were to try and trick the system with a pressure tank, this is where it would fail. The bcm would detect a wheel speed signal from the pcm or other modules and not get the we are moving signal from the pdm (passenger door module). It would then activate all the tell tales.
So in order to trick this your pressure tank would have to rotate. You would also prob have to have only one sensor in one tank. So that when you set them up with the tpms tool they would be for just one sensor.
So to fool this system with a pressure tank you would have to:
Make four tanks, one sensor for each.
Rig them to rotate
Use a tpms tool to calibrate them apart from each other.
If the rotation part was not there you could put them all in the spare tire and tape them equally apart and air it up and then calibrate them. Might work On older systems without the rotation check.
The easiest way to beat this system, is not beating it at all and just getting them in the wheel somehow. Even if you had to duct tape going around the wheel. Or make some kind or retaining clip that would allow you to attach it to a big hose clamp. Older Vettes and other oems used these and you can buy just the clamp if need be. IF it were me, this is what I would do. As just about any other option is gonna cost more to bypass the system than just work with it. Even if you are buying sensors every 7 years.
Another way would be to get something that can read the signals. Then build a programble board that will transmit these signals. Tap into a wheel speed signal off of the truck and program the board to go into rotation mode. If you did this you probably couldnt build enough to keep up with people buying them. That is if it were not illegal.
Another way is to find a programmer that can flash all of the needed modules to just turn it off. Im sure it can be done, but all of the equipment needed to flash a module not named pcm is gonna be hard to find in the aftermarket. Even if you had a buddy that worked at a dealership, with all the right stuff, there still might not be an option to disable tpms. Any module that is on the vehicle has to flashed to rest of the modules. But when you do this with factory or aftermarket service equipment you dont have many options of the parameters. Speedometer is about the only one I can think of.
So while it is absolutely possible in the theory of any module that is flash programmable and these modules are, does not mean anybody has anything you can buy to do this yourself. When you buy a programmer for your engine, some one has hacked the pcm code and changed the values to whatever need be. Has anybody hacked a bcm? What about the PDM? That is the problem with that method. Cant be a lot of demand for that.
The only other way that would work in theory would be to program all the modules to a year model that does not have the system or a model that does not have it. You might even have to have different modules (more to buy) . This is gonna be highly unlikely that you lose tpms and not other stuff as well.
Or you stroll by your local dealership and ask them if they can turn it off and if they can, pay them to do it. There could be the option to turn it off with their flash programming systems. You never know.
When you turn the key on, it checks for signals and gets a reading.
Im not sure how it determines which wheel is which, but a tpms reset tool can read the pressure, so whatever signal is being sent prob has code for both the pressure and an ID for what ever wheel you have it programmed to . All that is if it will tell you which wheel is low. If the system wont do that then it is prob just one signal for pressure.
Ok so you turn the key on it gets the signals and a pressure reading and if it sees low pressure it turns on the tpms light. If it does not see a signal at all (not just a low pressure signal) from one or more sensors then it turns on the tpms light and some other tell tale for a problem with the system. This is monitered every so often ( cant rem the time frame).
Built into the sensors is an acceleromter, as soon as the wheels start to turn they send a signal and the system starts to monitor the pressure every 30 seconds. If you were to try and trick the system with a pressure tank, this is where it would fail. The bcm would detect a wheel speed signal from the pcm or other modules and not get the we are moving signal from the pdm (passenger door module). It would then activate all the tell tales.
So in order to trick this your pressure tank would have to rotate. You would also prob have to have only one sensor in one tank. So that when you set them up with the tpms tool they would be for just one sensor.
So to fool this system with a pressure tank you would have to:
Make four tanks, one sensor for each.
Rig them to rotate
Use a tpms tool to calibrate them apart from each other.
If the rotation part was not there you could put them all in the spare tire and tape them equally apart and air it up and then calibrate them. Might work
On older systems without the rotation check. The easiest way to beat this system, is not beating it at all and just getting them in the wheel somehow. Even if you had to duct tape going around the wheel. Or make some kind or retaining clip that would allow you to attach it to a big hose clamp. Older Vettes and other oems used these and you can buy just the clamp if need be. IF it were me, this is what I would do. As just about any other option is gonna cost more to bypass the system than just work with it. Even if you are buying sensors every 7 years.
Another way would be to get something that can read the signals. Then build a programble board that will transmit these signals. Tap into a wheel speed signal off of the truck and program the board to go into rotation mode. If you did this you probably couldnt build enough to keep up with people buying them. That is if it were not illegal.
Another way is to find a programmer that can flash all of the needed modules to just turn it off. Im sure it can be done, but all of the equipment needed to flash a module not named pcm is gonna be hard to find in the aftermarket. Even if you had a buddy that worked at a dealership, with all the right stuff, there still might not be an option to disable tpms. Any module that is on the vehicle has to flashed to rest of the modules. But when you do this with factory or aftermarket service equipment you dont have many options of the parameters. Speedometer is about the only one I can think of.
So while it is absolutely possible in the theory of any module that is flash programmable and these modules are, does not mean anybody has anything you can buy to do this yourself. When you buy a programmer for your engine, some one has hacked the pcm code and changed the values to whatever need be. Has anybody hacked a bcm? What about the PDM? That is the problem with that method. Cant be a lot of demand for that.
The only other way that would work in theory would be to program all the modules to a year model that does not have the system or a model that does not have it. You might even have to have different modules (more to buy) . This is gonna be highly unlikely that you lose tpms and not other stuff as well.
Or you stroll by your local dealership and ask them if they can turn it off and if they can, pay them to do it. There could be the option to turn it off with their flash programming systems. You never know.
Last edited:
digitalfiend
Expert Overthinker
This has got to be the single most thorough and informative post I've ever seen on here...well done, sir!
Your post got me thinking and googling some more. I went and read up the paper detailing the hacking of TPMS...it makes me more interested in reverse engineering the system that's on my Tahoe. I also hit up my favorite electronics site. I think it's time to pull the oscilloscope out of storage.
I only have three other things to mention:- "TPMS data transmissions commonly use the 315 MHz or 433 MHz bands" [1]
- 315 MHz transmitter and receiver boards are readily available and cheap:
- 315 MHz transmitter
- 315 MHz receiver - 434 MHz transmitter and receiver boards are readily available and cheap:
- 434 MHz transmitter
- 434 MHz receiver
[1] http://www.winlab.rutgers.edu/~Gruteser/papers/xu_tpms10.pdf
