pcmhacking.net

Here's a few, I have a lot more that I gathered on the net. These are one's I personally sucked out with my moates j3 adapter. I sort of remember the actual description of the .bin file is at the bottom of the file in ascii. Let me know if I can help further.

kur4o wrote:I looked at the dll, and figured which code is used for each algo. EECV have legacy and normal mode, also normal mode have 2 subtypes. I will need some valid seed/key pairs to start testing the algo.

Tazzi I think your test pcm uses the legacy algo, if it gives zero as first byte.

In-tech do you have some full bins floating around we can use for disassembly.

I think you are right on that. Ill try use the legacy ago calc I was going through on my ECU and see if it unlocks. The only thing I am a little unsure of is the shift right 0x1F (31) bits, not sure if this is a rotating shift or absolute. I would assume rotating otherwise the XOR would almost always be against 1.
Using 003E as the seed example:

var2 = (003E*2 - FD) * 003E = FFFF E0C2 (Since var2 is an int, it can be negative)
var1 = FFFF E0C2 >> 1F = FFFFC185 (Assuming rotating bits).
keys = E0C2 XOR C185 = 2147

Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

Deleted

In-Tech wrote:Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

EEC-V Seed_key.zip

Spicy

In-Tech wrote:Here's something I found in my notes from a couple years ago. If it's protected info, please delete.

EEC-V Seed_key.zip

I think.. this might be whats needed. Ill run it on your seed/keys shortly.

It looks like it takes a 3byte seed and returns a 2byte key which is whats needed for your EECV.

In-Tech wrote: C4 F1 10 67 01 0F 11 55 8B<<<<<<<<<<<<<Received Seed 0F 11 55
64 10 F1 27 02 C5 6D D5<<<<<<<<<<<<<<<<Send Key C5 6D

Seed/Key calc works, can confirm it successfully calculated this key correctly!

Alright!!! 1 (giant) step closer to actually attempting highspeed PWM!!!

Intech, Ill see if I can't make a very basic app to just unlock the ECU and then maybe attempt the highspeed request? I believe it requires a second unlock before it can go into highspeed, but it appears this is the correct algorithm to do so.

Thanks Tazzi,
I'll post a couple more seed/key combos in a few hours too.

In-Tech wrote:Thanks Tazzi,
I'll post a couple more seed/key combos in a few hours too.

Brilliant!
I am assuming that the next unlock (level 2) to allow going into highspeed mode will likely require doing 27 03 request ( I think?). This is all guess work without seeing a tool actually going into high speed mode.

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 09 0A DC 67
64 10 F1 27 02 BD D6 07
C4 F1 10 67 02 34 A3

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 78 79 0B F4
64 10 F1 27 02 87 41 BC
C4 F1 10 67 02 34 A3

On these EecV's I have here, HpT doesn't seem to ever request high speed mode. The scanner doesn't either, seems 10 byte packets is it

In-Tech wrote:64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 09 0A DC 67
64 10 F1 27 02 BD D6 07
C4 F1 10 67 02 34 A3

64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 78 79 0B F4
64 10 F1 27 02 87 41 BC
C4 F1 10 67 02 34 A3

On these EecV's I have here, HpT doesn't seem to ever request high speed mode. The scanner doesn't either, seems 10 byte packets is it

Looks like we are onto a winner here. Intech, what do you have in the way of J2534 tools which supports PWM?