pcmhacking.net

so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.

gmtech825 wrote:so with rolling seed/key, does the seed roll as well or just the key? On the E 41 I have, After programming it, the seed did not change, I haven't been able to test to see if the key changed after.

also, don't some ECU's lock out after multiple failed key attempts, causing the auto generate method to take even longer?

Thanks for the discussion, I find this stuff all very interesting. I have no real plans to try and do anything with the info.

Both seed/key are rolling. Meaning the calculation is taking place inside the ECUs firmware. So attacking the ECU firmware SHOULD be the go to, but because the microcontrollers are locked down, you cant get into the juicy stuff to even reverse them.

ECUs like E41 use the single 5byte seed/key.

Ve Series 2
EHU:
GM_Other
ALGO: 0B

Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??

I meant
If you want to put a Series 2 IQ EHU In
Unlock with Algo 0b from GM_Other
Then write lower 8 VIN with ID 28

GMLAN

E77
ALGO: 0B

VE BCM
ALGO: 7C

ironduke wrote:Seed: 1234
Algorithm: 0b

GM other selected

Step : tempseed1 = seed << 0x2
Step : tempseed2 = seed >> 0xE
Step : seed = (tempseed1 | tempseed2)
Step : seed += 0xB6B6
Step : Byte Swap Seed
Step : seed-= 0xFDDA

Seed: 0x1234 Key: 0x8925 Algorithm: 0xB


This look good to anyone else??? Do we have known good seed/key combos to test with??

This is from a Barina XC or Corsa C with E55 type ecu if it helps. Class 2 algo B

60 36 seed
41 78 key

94 60
95 E0

E86
Gm_other
Algo 02

I don't really do much of this stuff now days but perhaps someone will find a use for it. I got bored over my holidays and ticked it off my "I'll do that one day" list:

https://github.com/jezzab/GMSeedKey

I've seen some similar things but they were outdated and with the current tables, missing opcodes and did some very wild bitshifting that wasn't necessary.

Does anyone know what the EFI-Live COS3 key should be for an LS1 controller with seed of 5FC0 it's not D2EE