Based off of share-and-enjoy's and Rez's guide on Discord.

This is a WIKI, press Edit on this page to edit and save.

The instructions can change and are volatile. Please report and discuss any issues in the #toyota-security channel on the comma.ai Discord. The invite to that discord is at https://discord.comma.ai. Once joined, make sure to answer any prompts you see in the Discord to gain full access. Once that is answered, this link will work to get you to #toyota-security: https://discord.com/channels/469524606043160576/905950538816978974

INSTRUCTIONS STATUS: WIP 🚧

1. Start off with the installation guide here:

   https://comma.ai/setup/comma-3x

2. Then once you get your Comma powered up, you'll connect it to your Wi-Fi network.

3. Then when it asks you to enter a URL for "Custom Software", enter https://installer.comma.ai/pd0wm/rav4-prime

4. Get SSH setup on the device:

   • Before you start (Both): https://github.com/commaai/openpilot/wiki/SSH#before-you-start
   • macOS: https://github.com/commaai/openpilot/wiki/SSH#option-2mac---pre-installed-openssh-client-on-macos
   • Windows: https://github.com/commaai/openpilot/wiki/SSH#option-2---pre-installed-openssh-client-on-windows-10-and-up

Now, you need to download Willem's secoc github folder to be able to extract your key. SSH back into your Comma

ssh comma@"your Comma IP"

git clone https://github.com/I-CAN-hack/secoc

Once this has downloaded, you are ready to extract your key.

The first thing to do is to kill openpilot, as the script will not run with openpilot running. Do this by entering

pkill -f openpilot

This will then make the Comma go to just the splash screen with the Comma logo on it.

Next, you will need to put the car into "Ignition on" mode. You do this by pressing the "Power" button twice WITHOUT pushing the break pedal. If you push the break pedal this will put the car into "Ready" mode, and you can not extract the key.

Now run the extract_keys.py from within the directory where it is located, as it will be looking for payload.bin within the directory that you ran the script from. So, you will need to enter

cd secoc

This should put you in /data/openpilot/secoc Once there, you are ready to run the script. Just enter

./extract_keys.py

Now, if you are doing this with a 2021 or 2022 RAV4 PRIME, you should not need to edit the script at all, and you should see a "SecOC key written to param successfully!" message if everything went well.

However, for me, I got an "Unexpected application version!" error. So, I had to edit the script. To do this, enter

nano -l /data/openpilot/secoc/extract_keys.py

Then you want to comment out lines 75-77 and lines 90-92. Where it says

if app_version not in APPLICATION_VERSIONS:
        print("Unexpected application version!", app_version)
        exit(1)

and

if bl_version != APPLICATION_VERSIONS[app_version]:
        print("Unexpected bootloader version!", bl_version)
        exit(1)

Just type a # at the begining of all 6 of those lines. Then hit Ctrl+X to exit. It will then ask you "Save modified buffer?" type y Then just hit Enter to overwrite the file with the edited version. Now, just run the script again, and it should work.

Willem has updated the script to automatically add the key to params, but if you have multiple cars that you are switching between, you can use the following to manually change the keys.

echo -n "your key here" > /data/params/d/SecOCKey

Then, once I got the key, the car was not recongnized. So, I had to do some fingerprinting. I did this by following this guide.

https://github.com/commaai/openpilot/wiki/Fingerprinting GitHub Fingerprinting openpilot is an open source driver assistance system. openpilot performs the functions of Automated Lane Centering and Adaptive Cruise Control for 250+ supported car makes and models. - commaai/ope... Fingerprinting Using this guide, I was able to locate my engine, abs, eps, fwdRadar, and fwdCamera ECU codes that were needed. I then just needed to add them to the fingerprints.py by using nano /data/openpilot/selfdrive/car/toyota/fingerprints.py

Then arrow down until you see

  },
  CAR.TOYOTA_RAV4_PRIME: {

Then enter your corresponding ECU codes and do the same Ctrl+X, y, and Enter to overwrite the file. Here is what mine looks like

  },
  CAR.TOYOTA_RAV4_PRIME: {
    (Ecu.engine, 0x700, None): [
      b'\x01896634AJ7000\x00\x00\x00\x00',
      b'\x018966342S7000\x00\x00\x00\x00',
    ],
    (Ecu.abs, 0x7b0, None): [
      b'\x01F15264284100\x00\x00\x00\x00',
      b'\x01F15264228300\x00\x00\x00\x00',
    ],
    (Ecu.eps, 0x7a1, None): [
      b'\x018965B4233100\x00\x00\x00\x00',
      b'\x018965B4209000\x00\x00\x00\x00',
    ],
    (Ecu.fwdRadar, 0x750, 0xf): [
      b'\x018821F6201300\x00\x00\x00\x00',
      b'\x018821F3301400\x00\x00\x00\x00',
    ],
    (Ecu.fwdCamera, 0x750, 0x6d): [
      b'\x028646F4210100\x00\x00\x00\x008646G3305000\x00\x00\x00\x00',
      b'\x028646F4205200\x00\x00\x00\x008646G4202000\x00\x00\x00\x00',
    ],

Then

sudo reboot

and you should be ready to go!!!