NefMoto

<DataIdentifier Name="Accelerator position PWM signal" ID="D9A8" Size="2">
	<Sessions>
		<Session Name="ExtendedSession" ID="03" P2ServerMax="50" P4ServerMax="2000"/>
		<Session Name="DefaultSession" ID="01" P2ServerMax="50" P4ServerMax="2000"/>
	</Sessions>
	<ResponseItems>
		<ResponseItem Name="Scm_AccPWM_Pts" InDataType="01" OutDataType="01" Offset="00" Size="02" ResultPrecision="01">
			<Formula>X*0.1</Formula>
			<Unit>%</Unit>
		</ResponseItem>
	</ResponseItems>
</DataIdentifier>

<DataIdentifier Name="Linear AF feedback compensation" ID="D936" Size="4">
	<Sessions>
		<Session Name="ExtendedSession" ID="03" P2ServerMax="50" P4ServerMax="2000"/>
		<Session Name="DefaultSession" ID="01" P2ServerMax="50" P4ServerMax="2000"/>
	</Sessions>
	<ResponseItems>
		<ResponseItem Name="Sfi_LnrAFCmp_bank1" InDataType="03" OutDataType="01" Offset="00" Size="04" ResultPrecision="04">
			<Formula>X*1</Formula>
		</ResponseItem>
	</ResponseItems>
</DataIdentifier>

unsigned int __cdecl GenerateKey(unsigned __int8 *PinArray, unsigned __int8 *SeedArray, _BYTE *KeyArray)
{
  char ShiftsCountForSeed; // bl
  unsigned int PinValue; // edx
  unsigned int SeedValue; // ecx
  unsigned int ProcessedResult; // eax
  char SeedValueOld; // di
  char IsEvenSeed; // di
  char ShiftsCountForPid; // cl
  char PinValueOld; // si
  char IsEvenPid; // si
  unsigned int result; // eax

  ShiftsCountForSeed = 32;
  PinValue = (PinArray[2] << 8) | PinArray[1] | (PinArray[4] << 24) | (PinArray[3] << 16);
  SeedValue = (*PinArray << 24) | *SeedArray | (SeedArray[2] << 16) | (SeedArray[1] << 8);
  ProcessedResult = 0xC541A9;
  do
  {
    SeedValueOld = SeedValue;
    SeedValue >>= 1;
    IsEvenSeed = ProcessedResult ^ SeedValueOld;
    ProcessedResult >>= 1;
    if ( (IsEvenSeed & 1) != 0 )
      ProcessedResult = (ProcessedResult | 0x800000) ^ 0x109028;
    --ShiftsCountForSeed;
  }
  while ( ShiftsCountForSeed );
  ShiftsCountForPid = 32;
  do
  {
    PinValueOld = PinValue;
    PinValue >>= 1;
    IsEvenPid = ProcessedResult ^ PinValueOld;
    ProcessedResult >>= 1;
    if ( (IsEvenPid & 1) != 0 )
      ProcessedResult = (ProcessedResult | 0x800000) ^ 0x109028;
    --ShiftsCountForPid;
  }
  while ( ShiftsCountForPid );
  result = ((ProcessedResult & 0xF00000) >> 12) | ProcessedResult & 0xF000 | (unsigned __int8)(16 * ProcessedResult) | ((ProcessedResult & 0xFF0) << 12) | ((ProcessedResult & 0xF0000) >> 16);
  KeyArray[2] = result;
  *KeyArray = BYTE2(result);
  KeyArray[1] = BYTE1(result);
  return result;
}

uint32_t p3_hash(uint8_t pin[5], uint8_t seed[3])
{
    uint32_t n = 0xc541a9, m = 0x1212050;
    uint64_t k;
    uint8_t* in = (unsigned char*)&k;

    in[0] = seed[0];
    in[1] = seed[1];
    in[2] = seed[2];
    in[3] = pin[0];
    in[4] = pin[1];
    in[5] = pin[2];
    in[6] = pin[3];
    in[7] = pin[4];

    for (size_t i = 0; i < 64; i++, n >>= 1, k >>= 1) {
        if ((n ^ k) & 0x1)
            n ^= m;
    }
    return ((n & 0xF00000) >> 12) | n & 0xF000 | (uint8_t)(16 * n) | ((n & 0xFF0) << 12) | ((n & 0xF0000) >> 16);
}

   // Then you can you this code to send response to ECM:
   const auto hash = p3_hash(pin, seed);
   uint8_t hash_array[4];
   hash_array[0] = hash & 0xFF;
   hash_array[1] = (hash >> 8) & 0xFF;
   hash_array[2] = (hash >> 16) & 0xFF;
   hash_array[3] = (hash >> 24) & 0xFF;
                WriteDataToChannel_402420(
                  ChannelId_40E00C,
                  7,
                  0xE0,
                  5,
                  0x27,
                  2,
                  hash_array[0],
                  hash_array[1],
                  hash_array[2],
                  hash_array[3],
                  0);

ROM:000029C0 pin_29C0:       .byte 0x70, 8, 0, 0x82, 0x47

// This value is passed to check key function:

void __fastcall sub_90D0C(int a1, char **a2)
{
  char *v3; // r3
  int v4; // r5
  int v5; // r29
  int v6; // r29
  int v7; // r3
  char v8; // r31
  unsigned __int8 v9[4]; // [sp+8h] [-10h] BYREF

  if ( byte_800004 )
  {
    v8 = 54;
    goto LABEL_25;
  }
  if ( byte_800005 )
  {
    v8 = 55;
    goto LABEL_25;
  }
  v3 = *a2;
  v4 = (unsigned __int8)**a2;
  if ( (v4 & 1) == 0 )
  {
    if ( v4 == 2 )
    {
      if ( *((_WORD *)a2 + 3) == 4 )
      {
        if ( ((HIBYTE(flt_8076FC) >> 1) & 1) != 0 )
        {
          HIBYTE(flt_8076FC) &= 0xFDu;
          v9[0] = v3[1];
          v9[1] = (*a2)[2];
          v9[2] = (*a2)[3];
[b]          if ( checkKey_9B580(pin_29C0, seed, v9) )
[/b]          {
            sub_967C8(1);
            *((_BYTE *)a2 + 10) = 1;
            *((_WORD *)a2 + 4) = 1;
            return;
          }
          byte_800004 = 1;
          byte_800005 = 100;
          byte_800006 = 100;
          v8 = 53;
        }
        else
        {
          v8 = 36;
        }
      }
      else
      {
        v8 = 19;
      }
      goto LABEL_25;
    }
    goto LABEL_22;
  }
  if ( v4 != 1 )
  {
LABEL_22:
    v8 = 18;
    goto LABEL_25;
  }
  if ( *((_WORD *)a2 + 3) != 1 )
  {
    v8 = 19;
LABEL_25:
    **a2 = v8;
    *((_WORD *)a2 + 4) = 1;
    *((_BYTE *)a2 + 10) = 2;
    return;
  }
  if ( (unsigned __int8)sub_967EC() == 1 )
  {
    v5 = 0;
  }
  else
  {
    v6 = seed;
    do
    {
      do
        v7 = sub_9B55C();
      while ( v6 == v7 );
    }
    while ( (v7 & 0xFFFFFF) == 0 );
    v5 = v7 & 0xFFFFFF;
  }
  seed = v5;
  HIBYTE(flt_8076FC) |= 2u;
  (*a2)[1] = v5;
  (*a2)[2] = BYTE2(v5);
  (*a2)[3] = BYTE1(v5);
  *((_BYTE *)a2 + 10) = 1;
  *((_WORD *)a2 + 4) = 4;
}