EDC16C39 different levels. seed-key

Bosch Motronic etc ECUs and PCMs
Post Reply
User avatar
chriva
Posts: 4
Joined: Thu Sep 13, 2018 3:35 pm
Location: Sweden
Contact:

EDC16C39 different levels. seed-key

Post by chriva »

Code: Select all

private static byte[] SecArr = 
{ 0x7E,0x49, 0xBD, 0xF1 };

for (byte b = 0; b < 0x23; b++)
{
    bool oldtmp = false;
    
    for (int e = 4; e > 0; e--)
    {
        bool tmp = (buf[e - 1] & 0x80) > 0 ? true : false;
        buf[e - 1] += buf[e - 1];
        buf[e - 1] += oldtmp ? (byte)1 : (byte)0;
        oldtmp = tmp;
    }
    
    if (oldtmp)
    {
        for (byte i = 0; i < 4; i++)
        {
            buf[i] ^= SecArr[i];
        }
    }
}
I've also managed to crack some of the checksums of the boot partition (0x0 - 0x3FFFF) if you have use for it?

Have fun :)
Last edited by chriva on Mon Oct 08, 2018 11:34 pm, edited 1 time in total.
User avatar
chriva
Posts: 4
Joined: Thu Sep 13, 2018 3:35 pm
Location: Sweden
Contact:

Re: EDC16C39 Level 5 key-seed algorithm.

Post by chriva »

Above routine is used on more ECU's btw :)

Here's a bunch more arays.
0x0A, 0x24, 0xC4, 0xC1: SAAB 9-3. Level 5 (Write)
0x56, 0x21, 0xBD, 0xEF: SAAB 9-3 and 9-5. Level 7 (Read)
Post Reply