looking for your shadow passwords (E84 and more)

[morfi]

I'm working on an open-source shadow password calculator for Delco ECMs, and I'd need your help getting some serial/password pairs to work with.

The first version of the calculator will be for E39/A, E98, E84, and hopefully E78.
I have a pretty good number of test cases for all of them except the E84 (the most wanted E84s are the ones with trailing number >= 1000, ie. 4th last digit not "0"), but I'd appreciate any pairs you have -- the more, the merrier.

current status: 100% working E39, 90% working E98 (need more test cases), 80% working E84, 0% working E78.

If you have any flash dumps lying around in your database, I'd very much appreciate it if you could share the serial/password pairs here.

I don't have any bricked modules myself, but I've already seen so many requests for this, and I loathe the idea of such "features" being behind a paywall. (I could go further into the automotive "PM-me-for-price / password-for-money / I-can-do-it-for-you-but-won't-tell-you-how-I-did-it" community standards, but I don't want to get political here...)

[gmtech825]

You just need the serial number and shadow password combo's?

[morfi]

You just need the serial number and shadow password combo's?

correct, eg.

Code: Select all

8114015842057515 / ED35AC36ABF6AC76 / E98

[gmtech825]

Sorry I dont know the serial number location for the e98

[gmtech825]

also dont know the serial number location for this e78

[morfi]

Sorry I dont know the serial number location for the e98

also dont know the serial number location for this e78

I've got you. Thanks a lot!

Code: Select all

$ strings e98_flash.bin | awk '{$1=$1; if (length($0) == 16) print}' | sort -u
1125017746780722

$ strings e78_flash.bin | awk '{$1=$1; if (length($0) == 16) print}' | sort -u
86AB3XK141343R73

$ xxd -c1000000 -u -p e98_shadow.bin | sed 's/FF//g; s/........$//g'
ED366BF72C37ECB5

$ xxd -c1000000 -u -p e78_shadow.bin | sed 's/FF//g; s/........$//g'
2307D59F5E834A5B

[gmtech825]

E82

I can get some e92's and probably at least one more e78.

[fl0wl0w]

I'll get you a few when i get back to the bench, probably on Sunday. I have 4 or 5 e92s, a couple e38s and just recently an e78.

[morfi]

E82

I can get some e92's and probably at least one more e78.

superb!

Code: Select all

serial: 1A18267182671260 shadow: 794E74784343554E

I'll get you a few when i get back to the bench, probably on Sunday. I have 4 or 5 e92s, a couple e38s and just recently an e78.

I'll appreciate that. As for the e38's, I'm not sure they have shadow region (and thus password). Could someone confirm?

[Tazzi]

E38/E67 do not have a shadow password so they cannot be locked like that

Anything newer such as E90/E93/E99 ect cannot have the passwords read out through conventional methods like a kernel (As done with all older ECUs), all those passwords all run a AES style algo regardless so they cannot be worked out even with multiple confirmed serial and password combos.