Gm Seed key algorithms

gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: Gm Seed key algorithms

Post by gmtech825 »

so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.
User avatar
Tazzi
Posts: 3421
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Gm Seed key algorithms

Post by Tazzi »

gmtech825 wrote:so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.
Both seed/key are rolling. Meaning the calculation is taking place inside the ECUs firmware. So attacking the ECU firmware SHOULD be the go to, but because the microcontrollers are locked down, you cant get into the juicy stuff to even reverse them.

ECUs like E41 use the single 5byte seed/key.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: Gm Seed key algorithms

Post by mattyjf01 »

Ve Series 2
EHU:
GM_Other
ALGO: 0B
ironduke
Posts: 577
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: Gm Seed key algorithms

Post by ironduke »

Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: Gm Seed key algorithms

Post by mattyjf01 »

I meant
If you want to put a Series 2 IQ EHU In
Unlock with Algo 0b from GM_Other
Then write lower 8 VIN with ID 28 :D
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: Gm Seed key algorithms

Post by mattyjf01 »

GMLAN

E77
ALGO: 0B

VE BCM
ALGO: 7C
User avatar
The1
Posts: 4694
Joined: Mon Jan 04, 2010 10:23 am

Re: Gm Seed key algorithms

Post by The1 »

ironduke wrote:Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??
This is from a Barina XC or Corsa C with E55 type ecu if it helps. Class 2 algo B

60 36 seed
41 78 key

94 60
95 E0
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: Gm Seed key algorithms

Post by mattyjf01 »

E86
Gm_other
Algo 02
jezzab
Posts: 18
Joined: Thu Nov 04, 2010 3:18 pm

Re: Gm Seed key algorithms

Post by jezzab »

I don't really do much of this stuff now days but perhaps someone will find a use for it. I got bored over my holidays and ticked it off my "I'll do that one day" list:

https://github.com/jezzab/GMSeedKey

I've seen some similar things but they were outdated and with the current tables, missing opcodes and did some very wild bitshifting that wasn't necessary.
VX L67 Getrag
Posts: 2873
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: Gm Seed key algorithms

Post by VX L67 Getrag »

Does anyone know what the EFI-Live COS3 key should be for an LS1 controller with seed of 5FC0 it's not D2EE
Post Reply