looking for your shadow passwords (E84 and more)

[fl0wl0w]

E78
Serial: 86AB7RK15282CMQZ
Shadow: A8FD4F808CCE1B96

E92
Serial: 11141570131173RE
Shadow: 0D5F779698C75177

[antus]

I am interested in the E92 since mine just bricked attempting to use a modified and experimental bin. If anyone has more samples to share please do so, here or in private.

[morfi]

The E92's pairs are hard to get..

[gmtech825]

The E92's pairs are hard to get..

Hard to get the values or hard to figure out the algo?

[antus]

I bricked my first E92 before I learned the need to have the shadow password for JTAG access or bootloader recovery. Now I believe you can just read them out of RAM if the PCM is booted and running. I have another E92 on the way, and I know another forum member does too. So I'll experiment with this and see if I can get pcmhammer to read it out of RAM and display it after unlock. If so, that'll mean we have 2 more samples. But it takes a few weeks to get them from the states to this part of the world.

[morfi]

The E92's pairs are hard to get..

Hard to get the values or hard to figure out the algo?

both. When I was creating the calculator, most of my pairs I got from YT videos, but E92 is almost non-existent there.

The only 3 pairs I have though look as if they are one way functions (similar to E82) and thus it may be impossible to derive the algorithm without sample of hundreds of pairs.

[fl0wl0w]

Here is another E78

Serial: 86ACFJK28017E5XV
Shadow: 97AD7D1A8D14929D

[kur4o]

I got on hand 2 e78, will need some instructions how to read the shadow area.

[fl0wl0w]

I got on hand 2 e78, will need some instructions how to read the shadow area.

What flashing tools do you have available. I am using IOTerminal which has a handy Read Shadow Flash button that reads out the password. I think antus is working on adding the read shadow password function to PCMHammer, but I think he is focused on E92 at the moment.

[kur4o]

I have some custom modified programs, that can read e78 using 4 bytes address, should be good for dumping ram and any other addresses, if code doesn`t crash. No IO terminal, just need to know the address of shadow and if it is locked or unlocked for reading, If it is stored somewhere in RAM that might help too.