OBDX Development - Developer Tools and Suggestions

[In-Tech]

Here's a few, I have a lot more that I gathered on the net. These are one's I personally sucked out with my moates j3 adapter. I sort of remember the actual description of the .bin file is at the bottom of the file in ascii. Let me know if I can help further.

EecV_256k_Bins.zip

(676.73 KiB) Downloaded 96 times

[Tazzi]

I looked at the dll, and figured which code is used for each algo. EECV have legacy and normal mode, also normal mode have 2 subtypes. I will need some valid seed/key pairs to start testing the algo.

Tazzi I think your test pcm uses the legacy algo, if it gives zero as first byte.

In-tech do you have some full bins floating around we can use for disassembly.

I think you are right on that. Ill try use the legacy ago calc I was going through on my ECU and see if it unlocks. The only thing I am a little unsure of is the shift right 0x1F (31) bits, not sure if this is a rotating shift or absolute. I would assume rotating otherwise the XOR would almost always be against 1.
Using 003E as the seed example:

var2 = (003E*2 - FD) * 003E = FFFF E0C2 (Since var2 is an int, it can be negative)
var1 = FFFF E0C2 >> 1F = FFFFC185 (Assuming rotating bits).
keys = E0C2 XOR C185 = 2147

[In-Tech]

Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

Deleted

[Whiteford]

Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

EEC-V Seed_key.zip

Spicy

[Tazzi]

Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

EEC-V Seed_key.zip

I think.. this might be whats needed. Ill run it on your seed/keys shortly.

It looks like it takes a 3byte seed and returns a 2byte key which is whats needed for your EECV.

[Tazzi]

C4 F1 10 67 01 0F 11 55 8B<<<<<<<<<<<<<Received Seed 0F 11 55
64 10 F1 27 02 C5 6D D5<<<<<<<<<<<<<<<<Send Key C5 6D

Seed/Key calc works, can confirm it successfully calculated this key correctly!

Alright!!! 1 (giant) step closer to actually attempting highspeed PWM!!!

Intech, Ill see if I can't make a very basic app to just unlock the ECU and then maybe attempt the highspeed request? I believe it requires a second unlock before it can go into highspeed, but it appears this is the correct algorithm to do so.

[In-Tech]

Thanks Tazzi,
I'll post a couple more seed/key combos in a few hours too.

[Tazzi]

Thanks Tazzi,
I'll post a couple more seed/key combos in a few hours too.

Brilliant!
I am assuming that the next unlock (level 2) to allow going into highspeed mode will likely require doing 27 03 request ( I think?). This is all guess work without seeing a tool actually going into high speed mode.

[In-Tech]

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 09 0A DC 67
64 10 F1 27 02 BD D6 07
C4 F1 10 67 02 34 A3

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 78 79 0B F4
64 10 F1 27 02 87 41 BC
C4 F1 10 67 02 34 A3

On these EecV's I have here, HpT doesn't seem to ever request high speed mode. The scanner doesn't either, seems 10 byte packets is it

[Tazzi]

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 09 0A DC 67
64 10 F1 27 02 BD D6 07
C4 F1 10 67 02 34 A3

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 78 79 0B F4
64 10 F1 27 02 87 41 BC
C4 F1 10 67 02 34 A3

On these EecV's I have here, HpT doesn't seem to ever request high speed mode. The scanner doesn't either, seems 10 byte packets is it

Looks like we are onto a winner here. Intech, what do you have in the way of J2534 tools which supports PWM?