NefMoto

Technical => Communication Protocols => Topic started by: zxcv on March 26, 2018, 01:57:50 AM



Title: KWP2000 securityAccess - conditionsNotCorrectOrRequestSequenceError ?
Post by: zxcv on March 26, 2018, 01:57:50 AM

I am trying to unlock the security of an ECU.
Can anyone explain this answers ?

[MAIN] entering command mode
2705 - i send requestSeed
-> [0227727279] ID: 780 - 12 00 02 27 05
[KW2K] KWP2000 cmd sent: 27 05
<- [0005164225] ID: 300 - B3
[KW2K] ACK received
<- [0005164236] ID: 300 - 1B 00 03 7F 27 21
-> [0227727311] ID: 780 - BC
[KW2K] KWP2000 error (0x21 = busy_repeatRequest) - ECU tells me to repeat, cause its doing the seed calc
2705 - i repeat requestSeed
-> [0227740305] ID: 780 - 13 00 02 27 05
[KW2K] KWP2000 cmd sent: 27 05
<- [0005177350] ID: 300 - B4
[KW2K] ACK received
<- [0005177361] ID: 300 - 2C 00 06 67 05 8A 20 C5
<- [0005177370] ID: 300 - 1D B5
-> [0227740337] ID: 780 - BE
[KW2K] KWP2000 positive answer: 67 05 8A 20 C5 B5 - ECU responds with seed
[KW2K] KWP2000 answer (text): . ..
27068A20C5B5 - i send dummy answer for sendKey
-> [0227776888] ID: 780 - 24 00 06 27 06 8A 20 C5
-> [0227776919] ID: 780 - 15 B5
[KW2K] KWP2000 cmd sent: 27 06 8A 20 C5 B5
<- [0005214247] ID: 300 - B6
[KW2K] ACK received
<- [0005214752] ID: 300 - 1E 80 03 7F 27 78
-> [0227777418] ID: 780 - BF
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending) - now i get those a lot
<- [0005215246] ID: 300 - 1F 80 03 7F 27 78
-> [0227777917] ID: 780 - B0
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005215740] ID: 300 - 10 80 03 7F 27 78
-> [0227778401] ID: 780 - B1
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005216233] ID: 300 - 11 80 03 7F 27 78
-> [0227778900] ID: 780 - B2
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005216728] ID: 300 - 12 80 03 7F 27 78
-> [0227779384] ID: 780 - B3
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005217221] ID: 300 - 13 80 03 7F 27 78
-> [0227779867] ID: 780 - B4
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005217715] ID: 300 - 14 80 03 7F 27 78
-> [0227780367] ID: 780 - B5
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005218209] ID: 300 - 15 80 03 7F 27 78
-> [0227780850] ID: 780 - B6
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005218703] ID: 300 - 16 80 03 7F 27 78
-> [0227781349] ID: 780 - B7
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005219197] ID: 300 - 17 80 03 7F 27 78
-> [0227781833] ID: 780 - B8
[KW2K] KWP2000 error (0x78 = reqCorrectlyRcvd_RspPending)
<- [0005219298] ID: 300 - 18 00 03 7F 27 22
-> [0227781927] ID: 780 - B9
[KW2K] KWP2000 error (0x22 = conditionsNotCorrectOrRequestSequenceError) - why am i out of sequence ?
- i would expect invalid key - any clues ?



Title: Re: KWP2000 securityAccess - conditionsNotCorrectOrRequestSequenceError ?
Post by: nubcake on March 26, 2018, 12:42:46 PM
Could be that "Invalid key" response is not implemented in this ECU and it instead just tells you a generic error? Think I've seen some behavior like that in some Porsche ECU. I'm not 100% sure, though.
It kinda appears that it takes some time to do the math after receiving your request.


Title: Re: KWP2000 securityAccess - conditionsNotCorrectOrRequestSequenceError ?
Post by: zxcv on March 26, 2018, 02:24:33 PM
yes - maybe you are right - this is a single convenience ecu 3C0959433, without any other connections (standalone only with 12V)
after this command all 27xx is borken - always the same response. you need to power cycle to send 2705 again

Rgards