EDC16C39 different levels. seed-key

Bosch Motronic etc ECUs and PCMs
User avatar
Posts: 4
Joined: Thu Sep 13, 2018 3:35 pm
Location: Sweden

EDC16C39 different levels. seed-key

Postby chriva » Fri Oct 05, 2018 11:37 pm

Code: Select all
private static byte[] SecArr =
{ 0x7E,0x49, 0xBD, 0xF1 };

for (byte b = 0; b < 0x23; b++)
{
    bool oldtmp = false;
   
    for (int e = 4; e > 0; e--)
    {
        bool tmp = (buf[e - 1] & 0x80) > 0 ? true : false;
        buf[e - 1] += buf[e - 1];
        buf[e - 1] += oldtmp ? (byte)1 : (byte)0;
        oldtmp = tmp;
    }
   
    if (oldtmp)
    {
        for (byte i = 0; i < 4; i++)
        {
            buf[i] ^= SecArr[i];
        }
    }
}


I've also managed to crack some of the checksums of the boot partition (0x0 - 0x3FFFF) if you have use for it?

Have fun :)
Last edited by chriva on Mon Oct 08, 2018 11:34 pm, edited 1 time in total.

User avatar
Posts: 4
Joined: Thu Sep 13, 2018 3:35 pm
Location: Sweden

Re: EDC16C39 Level 5 key-seed algorithm.

Postby chriva » Mon Oct 08, 2018 11:33 pm

Above routine is used on more ECU's btw :)

Here's a bunch more arays.
0x0A, 0x24, 0xC4, 0xC1: SAAB 9-3. Level 5 (Write)
0x56, 0x21, 0xBD, 0xEF: SAAB 9-3 and 9-5. Level 7 (Read)

Return to Bosch ECUs

Who is online

Users browsing this forum: No registered users and 1 guest