Reversing Seed & Key Exchange Harley Davidson

[jakka]

I am making a flash tool for Harley Davidson ECU's (tricore TC265), and have been looking for the algorithm and secret keys online with no success. So it looks like I am going to have to reverse them out of a binary file with Ghidra. Any pointers for a Ghidra n00bie?

So far I have:
- Sniffed the Security Access Seed and Key exchange
- Read a binary file from the ECU
- Opened the binary in the ghidra code explorer, setting language to Tricore
- Started to disassemble the binary.

Note that the seed and key appear to be static, so you always get the exact same 8 byte seed in response to a security access request, to which with the same key you get a positive response and unlock the controller. My concern is that while this may be excellent in terms of unlocking the controller, I fear that other ECU'S of the same make each have their own individual seed and key, which would require the algorithm and secret keys to figure out, as this seed and key pair is only good for unlocking this particular ECU.

Code: Select all

	
		Seed: 69 4A CB 35 5B 18 50 2A
		Key:  94 0E 61 53 aC 5F E6 F1

Any advice would be much appreciated Thanks.

[antus]

Generally speaking its different per manufacturer. Thus even if its a Delphi PCM, the algo will be completely different to anything Delphi GM for Delphi Harley Davidson. 8 byte seed and key to start with, is quite different.

[Gatecrasher]

If there's no actual calculation on the ECU, then I wouldn't even waste my time with the code. I'd try to find a copy of the diagnostic software and start picking that apart.

The only other thing I could suggest is trying to figure out if there's any sort of correlation between the S/K data and some other unique variable like the ECU serial number or traceability code or something.

[Deuce]

The codes are on key fobs and the ECU can be programmed to accept 2 different (16-digit) key codes.
I've programmed dozens of them before with Harley digital technician.
Also, the number inside the fob has no relationship (that I can see) to the 16 digit code.

[Tazzi]

Would have to look into reverse engineering the dealership files to understand the algorithm. Thats how most companies figure it out if the seed/keys are static.