Spoofing a motorcycle magnetic speed sensor.

Before anybody asks of course it is because California-stan. 

My new bike is supposed to have 7550 miles on it, the seller misread the Speedo and it has 7250 miles on it. It has a out of state title so it has to have 7500 miles at least to entre the state. Never mind that it has been in the state for the last 4 years with Ohio plates with somebody from the military. Tags are completely out of data and out of the system so riding the bike 300 miles without getting pulled over is a fools errand.  

So how do you spoof a magnetic signal from the transmission. I assume it just checks for the field collapse of the steel as it goes by on the tone ring. Is there something I can use to simulate the tone signal or the tone ring itself off the bike. 

Wow, that's annoying. How much is the ticket for not having a plate vs. how much will you spend in parts and time trying to fake it?

I'm thankful that I've never had this problem, but I would be real tempted to take a nice long early morning ride with no plate.

Do you have any friends with access to dealer tags? Or can the seller get you a temp tag from their home state?

Without knowing details... odds are its just a simple magnetic hall effect sensor which will read either a tone ring or the teeth on the output shaft and send a square wave signal to the ECM, which it will then translate into  "usable" data. 

Spoofing it, is relatively easy. Many ways.  Depends on if it's a 1 or 2 wire speed sensor and how many pulses per mile its looking for. But if all you care about is making the odometer readings increase, that's a slightly easier thing than trying to get say a trans VSS signal to play correctly with OE gauges in a car that setup was never installed in. 

Where I would start... is probably something like this. I imagine it's setup one of two ways... newer E36 M3 will be looking for a 0-5V reference signal and older stuff is typically a 12v signal.  Being said, it will be outputting say a 4,000-16,000 pulse per mile signal (could be more, could be less...again. it all depends) which you can spoof by using something like this square wave signal generator.

Kits are avail on Amazon and numerous other places. Odds are something like that will work and you'll prob be in the 100-120hz range for about a 100mph output.  

Again. It's not hard, but you do need a basic background knowledge to understand what you are doing and how things work.  But the short of it is you use a signal generator to feed the ECM the inputs its looking for, and it'll register as you are doing X mph. Let it run for whatever amount of time it takes to get there at the mph you have it at. 

Being said, some ECM'S allow you to release mileage with the more legit programmers. That may be an easier route.  

Edit.. here's an easier to use cheap E36 M3 square wave generator. 

https://www.amazon.com/Generator-DROK-1Hz-150kHz-Adjustable-Frequency/dp/B07P848DYQ/ref=asc_df_B07P848DYQ/?tag=hyprod-20&linkCode=df0&hvadid=642146280909&hvpos=&hvnetw=g&hvrand=302344089224716225&hvpone=&hvptwo=&hvqmt=&hvdev=m&hvdvcmdl=&hvlocint=&hvlocphy=9016224&hvtargid=pla-1649667465822&psc=1&gclid=CjwKCAiAlp2fBhBPEiwA2Q10D_AiPrmv4KR6QiaNqkqrRtO3K9ifUo4UqKf6WvhbU-d9xvpnwJJ2rhoCePcQAvD_BwE

But again, you need to know what signal it's looking for, so you can spoof it. Once you know that, it's a cake walk. 

Find an old treadmill at a thrift store and then strap the back of the bike on it?  (Assuming it is an XR1200)

Older bikes with the front wheel sensor are much easier.

 

Like this, but forward.

...but more seriously, trip permit?

If trip permit requires the same mileage limits, I'd be pondering whether something like this function generator (link below) could work. Though I'd also be half-wondering how much fuss will be involved in making sure the bike is ready to believe this input. Like in terms of "it looks like we're doing 120MPH but we're in neutral, so something's not right." Though I suppose the speedo and odo probably work just fine coasting, so maybe it's as simple as ignition on, try out waveforms 'til the speedo shows life? Maybe see if you can sanity-check things a little just to make sure you don't try out any inputs that'll hurt anything...

https://www.amazon.com/1HZ-500KHZ-Functional-Generator-Seesii-Frequency/dp/B08NSR5GYR/

Depending on if it's a Hall effect or variable reflector sensor, the output is going to be a square wave from 0 to 5 or 12 volts, or a sine wave of a few volts amplitude. There's a lot of ways to get these signals. You may even be able to play a single music note and run the speaker output into the wires for the sensor.

I like the square wave generator idea for brutal simplicity, the musical tone idea for sheer awesomeness.

You know the grassroots oscilloscopesports thread?  A $200 Pico can generate any signal you want, as one of its functions.

Sounds like you need to trailer it up to Sonoma and do 120 laps at Sears Point :)

Put it on a stand and let it idle in high gear for a few hours? Annoying and time consuming but doesn't require messing around with electronics or spending any money other than a few gallons of gas.

In reply to dps214 :

Aw shoot I'm a don't sweat the small stuff  guy.  I'd throw a license plate from another motorcycle on it and ride.  If on the one in a million chance I get stopped while obeying traffic laws. ( remember those license plate readers can't tell a Honda from a Yamaha , all they do is tell if the plate is current or there is a warrant out for that plate) I'd admit what I did and  pay the ticket.  Chances are honesty like that rather than BS  he'll let you ride it home.  
    My pickup somebody backed  into my front bumper and the plastic?  Yeh plastic license mount was knocked off  back in September.  It's sitting on my front seat  waiting for Ford to get me a new one.   ( which reminds me I should try to remember to order one). 

In reply to frenchyd :

I've got my doubts as to whether "honesty" is the first word that will spring to the officer's mind while hearing the story of why you've got the plate from a different bike on.

But I'm a worrywart like that.

Ignore my idiocy. Found the carb California legal sticker covered up by years of gunk and partially by the steering stabilizer we have plates. California does not let bikes in with less then 7500 miles of used unless they have California smog equipment originally installed. Fixing the mistake on the paperwork was easy after I found out that. 
 

I have been brapping around on the world largest paint shaker / Supermoto for the last hour. 
 

codrus (Forum Supporter) said:

Sounds like you need to trailer it up to Sonoma and do 120 laps at Sears Point :)

 

 

I see nothing wrong with this solution.

I don't know CA's specific laws. But a friend and I learned the hard way via a very angry cop and a nearly impounded trailer that, at least in ohio, "wrong registration' is a much bigger crime than "no registration". I'd probably be more inclined to ride it with no plate or an expired plate than with a "stolen" plate, but neither is super appealing.

In reply to Jesse Ransom :

Maybe I have a honest face?   I was returning to the base in San Diego  traveling as fast as my Vega GT would go  (105) because I was late. A police office stopped me and asked me why.  
   I admitted it  and 20 minutes went by.  He returned with my drivers license and military ID  explained that I was cleared to the California border  but to slow back down to the speed limit at a certain mile marker where he couldn't clear me.  
  I did and as I entered the California inspection station Someone motioned me outta line and gave me  the put your foot into it sign and motioned me over to an empty gate.  
 I made it back on time.