Gm Seed key algorithms

[gmtech825 Profile]

so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.

[Tazzi]

so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.

Both seed/key are rolling. Meaning the calculation is taking place inside the ECUs firmware. So attacking the ECU firmware SHOULD be the go to, but because the microcontrollers are locked down, you cant get into the juicy stuff to even reverse them.

ECUs like E41 use the single 5byte seed/key.

[mattyjf01 Profile]

Ve Series 2
EHU:
GM_Other
ALGO: 0B

[ironduke Profile]

Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??

[mattyjf01 Profile]

I meant
If you want to put a Series 2 IQ EHU In
Unlock with Algo 0b from GM_Other
Then write lower 8 VIN with ID 28

[mattyjf01 Profile]

GMLAN

E77
ALGO: 0B

VE BCM
ALGO: 7C

[The1]

Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??

This is from a Barina XC or Corsa C with E55 type ecu if it helps. Class 2 algo B

60 36 seed
41 78 key

94 60
95 E0

[mattyjf01 Profile]

E86
Gm_other
Algo 02

[jezzab Profile]

I don't really do much of this stuff now days but perhaps someone will find a use for it. I got bored over my holidays and ticked it off my "I'll do that one day" list:

https://github.com/jezzab/GMSeedKey

I've seen some similar things but they were outdated and with the current tables, missing opcodes and did some very wild bitshifting that wasn't necessary.

[VX L67 Getrag Profile Website]

Does anyone know what the EFI-Live COS3 key should be for an LS1 controller with seed of 5FC0 it's not D2EE