Scribd
Upload
253 views2 pages

Nissan NATS 6 Emulator Guide

This document provides instructions for using an emulator for the NATS 6 immobilizer system in Nissan vehicles. It describes how to connect and configure the emulator, including updating the PIN and MAC bytes to match what is stored in the ECU using either a diagnostic tool or CAN logger. The emulator uses these bytes to mimic the authentic NATS 6 unit and allow engine starts. LED patterns indicate authorization status.

Uploaded by

ecupro checo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
253 views2 pages

Nissan NATS 6 Emulator Guide

This document provides instructions for using an emulator for the NATS 6 immobilizer system in Nissan vehicles. It describes how to connect and configure the emulator, including updating the PIN and MAC bytes to match what is stored in the ECU using either a diagnostic tool or CAN logger. The emulator uses these bytes to mimic the authentic NATS 6 unit and allow engine starts. LED patterns indicate authorization status.

Uploaded by

ecupro checo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

NISSAN

immo emulator, for

NATS 6 system

Description:
For Nissan cars equipped with NATS 6 system. Supports 500 kb CAN speed.

Installation:

Connect device directly to CAN, attach ground wire and power supply (terminal ”15”, hot when
ignition switched on).

Alignment with ECU:

 Common method – re-learn ECU using


diagnostic tool, use PIN code 5523.
 Another method is to write synchro bytes
(MAC) into ECU, default MAC is 3A4F.
 You can update emulator with data you
wish. MAC must match one already stored
into ECU, PIN is up to you – any numeric
value is good enough.

How to update PIN / MAC into emulator using CAN logger:

 emulator must be in configuration mode - JMP 1 shorted.


 Request actually stored PIN and MAC - 770 5 AA 00 00 00 00 , emulator must
respond with 771 5 AC pp pp mm mm , where pp are 2 bytes of PIN, mm are 2 bytes of
MAC...
 Store PIN and MAC into emulator - 770 5 AB pp pp mm mm , emulator must respond
as previously, with actual PIN and MAC: 771 5 AC pp pp mm mm - response must
match the request.
 Remove solder joint - JMP 1 must be open for normal operation.
How to use configurator ( using MBcan ):

Read or Write emulator:


• emulator must be in configuration mode - JMP 1 shorted.
• on success, background will change color to green. If no success it goes red (must repeat
procedure). Emulator must be in configuration mode!
• Remove solder joint - JMP 1 must be open for normal operation.

Some additional notes:

 If NATS-6 unit and emulator both are connected to ECU and their MAC bytes are
different, collision possible. Emulator is designed to be as fast as possible (to be faster
than NATS-6), theoretically it must answer first (before NATS-6), but anyway.
 If MAC stored into emulator is the same as in NATS-6, everything must be ok. It is
reasonable to use this method when need to solve intermittent problems related with
wrong or no authorization.

LED on emulator:

 One short blink – 1) on power-up 2) message received.


 Series of short blinks: ECU not authorized (wrong MAC ?).
 Long blink (LED is ON for 1 second): MAC is accepted by ECU, engine start is allowed.

(c) RobinDAB '2017

You might also like