Hacking Jetskis - from Sea-Don't to Sea-Doo

A friend bought a 2000 Sea-Doo jetski without its key, and the official dealer tooling cost more than the machine itself. With no public documentation, the speaker began by reverse-engineering the diagnostic software's CAN protocol, which uses KWP2000 with authenticated security levels. Checking the adapter path, the speaker wrote a compatible adapter DLL for cheap CAN hardware. The bus turned out not to be the route for this model, though. The real programming access is a one-wire interface on the key post, handled by a separate electronic module.

Logic analysis of the key handshake showed a one-wire token protocol. The speaker found firmware for the programmer inside the software bundle, which targets a Motorola HC08 microcontroller. A download command in the adapter firmware dumped the module's EEPROM without writing anything, and a checksum brute force over the dump located the key IDs. The data also exposed the VIN, engine hours and the number of enrolled keys. Using this, the team built a key that got the engine running on the bench, and later a Flipper Zero app that reads the module and emulates saved keys.

For a portable solution, the speaker designed a small ATtiny circuit that charges capacitors from the one-wire signal alone, with cycle-precise handwritten assembly. It was mounted on a small PCB in a printed enclosure. The main takeaway is how a proprietary immobilizer can be understood from its wire-level behavior, and how a cheap programmable replacement becomes possible without the paid tools.