Title: Seed Key algorithms Post by: obdhacker on January 04, 2020, 05:54:24 AM Hi,
I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request Title: Re: Seed Key algorithms Post by: ninjato on March 25, 2020, 03:37:02 PM Hi, hello I'm looking to bypass the seed key on my ecu bosch med9.1 seat leonpouez car you help me I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request thank you Title: Re: Seed Key algorithms Post by: obdhacker on March 26, 2020, 07:34:37 AM What means to bypass? Explain with details please
Title: Re: Re: Seed Key algorithms Post by: Davethaboss on April 03, 2020, 12:11:27 AM Hi, Do you have security codes too for a 2017 Audi S3?I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request Sent from my LM-G710VM using Tapatalk Title: Re: Seed Key algorithms Post by: obdhacker on April 03, 2020, 12:28:33 AM 2017 Audi S3. Which controller? Which security level?
Title: Re: Seed Key algorithms Post by: Ndr on December 15, 2020, 10:33:28 PM Hi; I recently try to find Bosch ME 7.9.7 (china) seed key algorithm with IDA pro. So i send different seed to device (with simulator) for reading different keys, And i saw results that show in below. Seed:01 01 01 01 Key: A5 92 1F 33 Sedd:00 00 00 01 Key: 65 19 8c 23 Is it possible help me for find seed keys algorithm?? Title: Re: Seed Key algorithms Post by: istom on March 24, 2021, 10:14:15 AM Hi, I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request Hey! I would like to know if there is an algorithm for calculating Mercedes seed keys for ic204 block with access level 09 and 0D? Title: Re: Seed Key algorithms Post by: obdhacker on March 24, 2021, 01:43:29 PM Hey! Hi mate. YesI would like to know if there is an algorithm for calculating Mercedes seed keys for ic204 block with access level 09 and 0D? Title: Re: Seed Key algorithms Post by: ngochoangimsat on April 01, 2021, 03:27:48 PM hello I'm looking to bypass the seed key on my ecu bosch med9.1 seat leonpouez car you help me thank you Hello, i need algorithm seed-key for cluster instrument Mazda security level 3 Title: Re: Seed Key algorithms Post by: Yoon on April 06, 2021, 07:14:18 AM I am just wondering is there any solutions to find Hyundai and Kia seed key algorithm?
Title: Re: Seed Key algorithms Post by: Yoon on April 06, 2021, 07:17:34 AM hello I'm looking to bypass the seed key on my ecu bosch med9.1 seat leonpouez car you help me thank you Do you know to find Hyundai and Kia 2020 models seedkey algorithms? Title: Re: Seed Key algorithms Post by: crystal_imprezav on April 11, 2021, 08:24:38 AM Do you know to find Hyundai and Kia 2020 models seedkey algorithms? Post a full boot/bench read and an obd2 sniff or seed key combo and I as well as other reverse engineers could probably solve it. Basic steps are to find the UDS SID #27 handler and from there find the algorithm. Another route would be to find the diagnostic software and find the library that performs the seed key calc and extract the algorithm Title: Re: Seed Key algorithms Post by: J2thev on May 08, 2021, 01:25:57 AM Any chance you have BMW algorithmes for f-series? :-)
Title: Re: Seed Key algorithms Post by: dkfreestyle on October 28, 2021, 06:43:04 AM Any seed key algorithms for Dodge Clusters? 2005 Dodge ram?
Title: Re: Seed Key algorithms Post by: obdhacker on October 28, 2021, 06:45:11 AM Any seed key algorithms for Dodge Clusters? 2005 Dodge ram? Sure, send me details Title: Re: Seed Key algorithms Post by: TheDECODER on December 22, 2021, 02:39:52 PM tried replying to you via PM but it is not going thought. I could use a couple seedkeys, can you message me back?
Title: Re: Seed Key algorithms Post by: jam on January 15, 2022, 08:14:21 PM Hello , do you have algorithm for BMW modules?
Title: Re: Seed Key algorithms Post by: obdhacker on January 15, 2022, 11:25:18 PM Hello , do you have algorithm for BMW modules? Yes, tell me what you need Title: Re: Seed Key algorithms Post by: jam on January 16, 2022, 05:55:20 AM Title: Re: Seed Key algorithms Post by: datshah on January 23, 2022, 01:24:03 AM Can someone please help me find the Algorithm for this Seed-key pair:
27 03 (level 3) Seed- A9 05 64 69, Key- 76 D4 63 BE seed- 5F F7 4B 5F, key- 6A D7 93 88 seed- 90 34 EC EF, key- C5 A7 EE 98 Title: Re: Seed Key algorithms Post by: Vahid on February 04, 2022, 05:44:21 AM Hi, I've been working on the Volvo D13. I already know that it uses the RSA algorithm.
Also, I have the secret key for level 7 and above and I was able to unlock the ECU on those levels. But in order to reprogram the ECU I need the level 1 access, is there any chance you have the key for security access level 1? MSW is 23036507 Part number is 21900553 The data I've got from spying the CAN (I'm sure the security level for this data is 1): Seed (length=116): 0xdd, 0xc7, 0xe7, 0x2f, 0xe6, 0x0c, 0xff, 0x64, 0xf2, 0xb8, 0xb0, 0x15, 0x5a, 0xa3, 0xa7, 0x12, 0x0e, 0xf5, 0x17, 0xeb, 0x79, 0x26, 0x80, 0xf0, 0x5b, 0xfe, 0xac, 0x31, 0x1f, 0x95, 0xbc, 0x7e, 0x00, 0x53, 0xd6, 0x67, 0xa8, 0xf0, 0xb5, 0x3c, 0xcf, 0x74, 0x3c, 0x0d, 0x7d, 0x37, 0xd2, 0xaa, 0xb9, 0xe1, 0x1e, 0xa3, 0x61, 0x6a, 0x68, 0x48, 0xfd, 0x1a, 0xbb, 0xa9, 0x87, 0x89, 0x95, 0x96, 0x13, 0x9f, 0xac, 0x9f, 0x5e, 0x94, 0x26, 0x14, 0x64, 0xf0, 0x47, 0x05, 0x22, 0x8b, 0x71, 0x42, 0xb5, 0x8d, 0xfc, 0x5b, 0x2c, 0x6e, 0x3a, 0xa0, 0x56, 0xf6, 0xba, 0x21, 0x02, 0x3d, 0x91, 0xae, 0x17, 0xab, 0x49, 0xd7, 0x26, 0xf8, 0xb1, 0xec, 0xf3, 0x2c, 0xb0, 0xfd, 0xaa, 0x9f, 0xe2, 0xda, 0x81, 0xf9, 0x91, 0x13 Signed key using the RSA algorithm (length=128): 0x98, 0xe0, 0xa1, 0xf8, 0x1f, 0x5d, 0xd0, 0x81, 0xd3, 0x87, 0x8f, 0x5e, 0xb7, 0x89, 0x79, 0xc9, 0x45, 0x8c, 0xe4, 0x6f, 0x38, 0x9a, 0xe4, 0xe1, 0x8c, 0x2a, 0xc9, 0xf4, 0x00, 0xa3, 0xe3, 0x74, 0x9d, 0xdd, 0x51, 0xd6, 0x9d, 0xff, 0x5d, 0x2e, 0x66, 0x9f, 0xc5, 0x8f, 0x32, 0xb3, 0x23, 0x07, 0xae, 0x7f, 0x9d, 0x45, 0x00, 0x1e, 0x01, 0xd7, 0x3f, 0x2c, 0xe7, 0x7a, 0xf2, 0x97, 0x1c, 0xae, 0x38, 0x0d, 0x44, 0x0f, 0xe2, 0x51, 0x3d, 0x51, 0x2a, 0x46, 0x7b, 0xfe, 0x3f, 0x40, 0x2e, 0x31, 0xde, 0xfb, 0x0a, 0x7d, 0x8e, 0xe9, 0x0f, 0xe0, 0x4e, 0x4d, 0xeb, 0xa5, 0x42, 0xf5, 0x31, 0x9b, 0xcb, 0x6b, 0x31, 0xcc, 0x94, 0x0e, 0x99, 0xc2, 0xdc, 0x12, 0x1a, 0xb8, 0x24, 0x03, 0x50, 0x8d, 0x11, 0xfc, 0x59, 0xc3, 0x9a, 0xcd, 0x49, 0xf8, 0x51, 0xca, 0x5b, 0x73, 0x99, 0x35, 0xec, 0xc1 Title: Re: Seed Key algorithms Post by: prj on February 04, 2022, 05:48:51 AM Why do you think that posting seed key responses is going to do anything?
It's useless. Anything but simple xor or addition is not possible to deduce from a seed key pair - that's the whole idea about it. Certainly not RSA signatures. Get the ASW (or bootloader) and start reversing it. Posting these pointless rows of hex is a waste of time. In case the seed-key is actually RSA, then you're not getting in without some sort of RCE exploit, unless you can locate the private key in the tool that is generating the response. Title: Re: Seed Key algorithms Post by: obdhacker on February 04, 2022, 07:06:44 AM Hi, I've been working on the Volvo D13. I already know that it uses the RSA algorithm. Also, I have the secret key for level 7 and above and I was able to unlock the ECU on those levels. But in order to reprogram the ECU I need the level 1 access, is there any chance you have the key for security access level 1? MSW is 23036507 Part number is 21900553 The data I've got from spying the CAN (I'm sure the security level for this data is 1): Seed (length=116): 0xdd, 0xc7, 0xe7, 0x2f, 0xe6, 0x0c, 0xff, 0x64, 0xf2, 0xb8, 0xb0, 0x15, 0x5a, 0xa3, 0xa7, 0x12, 0x0e, 0xf5, 0x17, 0xeb, 0x79, 0x26, 0x80, 0xf0, 0x5b, 0xfe, 0xac, 0x31, 0x1f, 0x95, 0xbc, 0x7e, 0x00, 0x53, 0xd6, 0x67, 0xa8, 0xf0, 0xb5, 0x3c, 0xcf, 0x74, 0x3c, 0x0d, 0x7d, 0x37, 0xd2, 0xaa, 0xb9, 0xe1, 0x1e, 0xa3, 0x61, 0x6a, 0x68, 0x48, 0xfd, 0x1a, 0xbb, 0xa9, 0x87, 0x89, 0x95, 0x96, 0x13, 0x9f, 0xac, 0x9f, 0x5e, 0x94, 0x26, 0x14, 0x64, 0xf0, 0x47, 0x05, 0x22, 0x8b, 0x71, 0x42, 0xb5, 0x8d, 0xfc, 0x5b, 0x2c, 0x6e, 0x3a, 0xa0, 0x56, 0xf6, 0xba, 0x21, 0x02, 0x3d, 0x91, 0xae, 0x17, 0xab, 0x49, 0xd7, 0x26, 0xf8, 0xb1, 0xec, 0xf3, 0x2c, 0xb0, 0xfd, 0xaa, 0x9f, 0xe2, 0xda, 0x81, 0xf9, 0x91, 0x13 Signed key using the RSA algorithm (length=128): 0x98, 0xe0, 0xa1, 0xf8, 0x1f, 0x5d, 0xd0, 0x81, 0xd3, 0x87, 0x8f, 0x5e, 0xb7, 0x89, 0x79, 0xc9, 0x45, 0x8c, 0xe4, 0x6f, 0x38, 0x9a, 0xe4, 0xe1, 0x8c, 0x2a, 0xc9, 0xf4, 0x00, 0xa3, 0xe3, 0x74, 0x9d, 0xdd, 0x51, 0xd6, 0x9d, 0xff, 0x5d, 0x2e, 0x66, 0x9f, 0xc5, 0x8f, 0x32, 0xb3, 0x23, 0x07, 0xae, 0x7f, 0x9d, 0x45, 0x00, 0x1e, 0x01, 0xd7, 0x3f, 0x2c, 0xe7, 0x7a, 0xf2, 0x97, 0x1c, 0xae, 0x38, 0x0d, 0x44, 0x0f, 0xe2, 0x51, 0x3d, 0x51, 0x2a, 0x46, 0x7b, 0xfe, 0x3f, 0x40, 0x2e, 0x31, 0xde, 0xfb, 0x0a, 0x7d, 0x8e, 0xe9, 0x0f, 0xe0, 0x4e, 0x4d, 0xeb, 0xa5, 0x42, 0xf5, 0x31, 0x9b, 0xcb, 0x6b, 0x31, 0xcc, 0x94, 0x0e, 0x99, 0xc2, 0xdc, 0x12, 0x1a, 0xb8, 0x24, 0x03, 0x50, 0x8d, 0x11, 0xfc, 0x59, 0xc3, 0x9a, 0xcd, 0x49, 0xf8, 0x51, 0xca, 0x5b, 0x73, 0x99, 0x35, 0xec, 0xc1 Hi. Yes, I know this algorithm. Title: Re: Seed Key algorithms Post by: d3irb on February 04, 2022, 08:30:01 AM In case the seed-key is actually RSA, then you're not getting in without some sort of RCE exploit, unless you can locate the private key in the tool that is generating the response. I agree with you overall, I really don't like this thread, it's just people posting useless garbage and then salesmen looking at the garbage to see if it matches something in their sales database, not really a community collaboration or useful to anyone reading. But, with respect to RSA, many RSA seed/keys use E=3 and don't check the padding correctly, meaning they are vulnerable to https://words.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ . No RCE or private keys necessary, just some clever math. Title: Re: Seed Key algorithms Post by: Vahid on February 04, 2022, 08:38:14 AM Thank you for answering guys, as I said I've found the algorithm via reverse engineering and I've already unlocked the ECU in level 7 and 11 on the extended session, which means the algorithm is correct and working fine. But, in order to be able to reprogram ECU, I need level 1 access in the programming session.
The reason I've mentioned RSA is because of the code I have, it's using a built-in dotnet class called "RSACryptoServiceProvider". These hexadecimal values are prerequisites to test the secret key and the algorithm. The input of the algorithm is a RsaKey which contains exponent and modulus (both have a length of 128 bytes) and the seed, so every time we give the same seed and the correct key we will get the same output. So these hexadecimal values can confirm the input and the output of the algorithm, the missing part of the puzzle here is the secret key for level 1 security access. by the way, the protocol we are using is ISO15765 (UDS). I'm only interested in level 1 security access exponent and modulus for the MSW I've mentioned here. It will be a great help to me if anyone is willing to share that key. Title: Re: Seed Key algorithms Post by: prj on February 04, 2022, 08:53:55 AM Thank you for answering guys, as I said I've found the algorithm via reverse engineering and I've already unlocked the ECU in level 7 and 11 on the extended session, which means the algorithm is correct and working fine. But, in order to be able to reprogram ECU, I need level 1 access in the programming session. The ECU tests key, the tester generates the key based on seed.The reason I've mentioned RSA is because of the code I have, it's using a built-in dotnet class called "RSACryptoServiceProvider". These hexadecimal values are prerequisites to test the secret key and the algorithm. The input of the algorithm is a RsaKey which contains exponent and modulus (both have a length of 128 bytes) and the seed, so every time we give the same seed and the correct key we will get the same output. So these hexadecimal values can confirm the input and the output of the algorithm, the missing part of the puzzle here is the secret key for level 1 security access. by the way, the protocol we are using is ISO15765 (UDS). I'm only interested in level 1 security access exponent and modulus for the MSW I've mentioned here. It will be a great help to me if anyone is willing to share that key. Last I checked ECU's are not written in .NET, so there's a lot that does not match in this story. If it is RSA, the ECU will contain only the public key, the private key will be known to the application generating key from seed. To test whether an RSA signature is valid, you do not need the private key, this is the whole point of cyptography. So, find the OEM tool that generates the key from seed, reverse it, find the relevant values (private key). Alternatively exploit it, if not properly implemented or find an RCE exploit in the UDS stack. Title: Re: Seed Key algorithms Post by: damino on February 04, 2022, 01:04:05 PM The ECU tests key, the tester generates the key based on seed. Last I checked ECU's are not written in .NET, so there's a lot that does not match in this story. If it is RSA, the ECU will contain only the public key, the private key will be known to the application generating key from seed. To test whether an RSA signature is valid, you do not need the private key, this is the whole point of cyptography. So, find the OEM tool that generates the key from seed, reverse it, find the relevant values (private key). Alternatively exploit it, if not properly implemented or find an RCE exploit in the UDS stack. Hi We are in the same team, and we are stuck with this problem. Any help from your side will be much appreciated. Also we can pay for the services and helps if you have experience in the field. Looking forward for your recommendations. Title: Re: Seed Key algorithms Post by: jackylooo.tw on June 12, 2022, 07:42:20 PM Hi,
Do you have algorithms for BMW , the captured working example as below: 54 07 17 B8 22 7F 23 21 ---> SEED 00 00 00 40 47 1E 43 88 ---> KEY Thanks in advance!! Title: Re: Seed Key algorithms Post by: obdhacker on June 12, 2022, 09:17:06 PM Hi, Do you have algorithms for BMW , the captured working example as below: 54 07 17 B8 22 7F 23 21 ---> SEED 00 00 00 40 47 1E 43 88 ---> KEY Thanks in advance!! Hi! Which ecu? Which years? Without details it would be difficult to find out. Title: Re: Seed Key algorithms Post by: jackylooo.tw on June 13, 2022, 12:51:25 AM It's for NBTEVO ecu manufactured after 2016, Thanks!
Title: Re: Seed Key algorithms Post by: changbom on October 16, 2022, 02:32:51 AM Hi. i need 16 Byte seed Key Algorithms for New Ford car. Do you have
Title: Re: Seed Key algorithms Post by: Keigoon on June 22, 2023, 03:17:15 AM Hi, I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request Do you have VW MAN Worker PTM EM D08 Engine logic?? Input output 10 10 10 10 10 47 DD DE 1A A2 20 20 20 20 20 BF A9 F4 DF 97 30 30 30 30 30 37 AA C5 FE 40 40 40 40 40 40 B1 96 9A 68 B5 50 50 50 50 50 3C E4 93 0A E4 Title: Re: Seed Key algorithms Post by: obdhacker on June 22, 2023, 05:09:50 AM Do you have VW MAN Worker PTM EM D08 Engine logic?? Input output 10 10 10 10 10 47 DD DE 1A A2 20 20 20 20 20 BF A9 F4 DF 97 30 30 30 30 30 37 AA C5 FE 40 40 40 40 40 40 B1 96 9A 68 B5 50 50 50 50 50 3C E4 93 0A E4 I sent you a message Title: Re: Seed Key algorithms Post by: yt on June 28, 2023, 08:36:31 AM Hi, do you have algorithm for 2023 Porsche Taycan BCM2?
Some example seed-key: Seed Key DBC6DAD8 75C0D929 87A90140 294CEA44 C89836DD 76CF7EE1 41B02125 AFE93120 74E8458F EEE540B8 Thanks Title: Re: Seed Key algorithms Post by: PeterPan on August 10, 2023, 01:05:55 AM Hi obdhacker,
do you have algorithm for 2023 KIA Sorrento OBD? Some example seed-key: Seed: Key: 10 0A 67 11 C7 CE A9 F5 10 0A 27 12 B4 06 83 9A 10 0A 67 11 6C E8 CB 74 10 0A 27 12 98 0F CB 84 10 0A 67 11 66 FC 93 CC 10 0A 27 12 59 2D C7 61 10 0A 67 11 79 13 40 F9 10 0A 27 12 02 D8 93 6F Please help me solve this problem! Title: Re: Seed Key algorithms Post by: obdhacker on August 10, 2023, 01:27:16 AM Hi obdhacker, do you have algorithm for 2023 KIA Sorrento OBD? Some example seed-key: Seed: Key: 10 0A 67 11 C7 CE A9 F5 10 0A 27 12 B4 06 83 9A 10 0A 67 11 6C E8 CB 74 10 0A 27 12 98 0F CB 84 10 0A 67 11 66 FC 93 CC 10 0A 27 12 59 2D C7 61 10 0A 67 11 79 13 40 F9 10 0A 27 12 02 D8 93 6F Please help me solve this problem! Hello, I think so, but your example seeds are incomplete. Send me full seed and key requests and I'll check Title: Re: Seed Key algorithms Post by: PeterPan on August 10, 2023, 07:42:48 PM Hello, I think so, but your example seeds are incomplete. Send me full seed and key requests and I'll check After I send a CAN code(ID: 0x7C6 || Data: 02 27 11 ) ECU request: ID: 7CE and data: 10 0A 67 11 XX XX XX XX (4 byte seed) To unlock the ECU I send: ID: 7C6 and data: 10 0A 27 12 XX XX XX XX (4 byte key) All CAN data are described below: 0x7CE 10 0A 67 11 43 24 55 B1 0x7C6 10 0A 27 12 8F A9 0F 5E 0x7CE 10 0A 67 11 50 09 C0 FB 0x7C6 10 0A 27 12 C5 8B EB 78 0x7CE 10 0A 67 11 46 CF 36 03 0x7C6 10 0A 27 12 24 46 DE B0 0x7CE 10 0A 67 11 8E 75 05 06 0x7C6 10 0A 27 12 EC 4E 53 71 0x7CE 10 0A 67 11 91 DA 4A B5 0x7C6 10 0A 27 12 10 E5 47 C6 0x7CE 10 0A 67 11 BC 30 75 3B 0x7C6 10 0A 27 12 CD 54 56 79 0x7CE 10 0A 67 11 A6 17 09 29 0x7C6 10 0A 27 12 BD E6 4C 7F 0x7CE 10 0A 67 11 16 B9 43 E7 0x7C6 10 0A 27 12 30 D5 D0 E2 0x7CE 10 0A 67 11 47 04 1C 01 0x7C6 10 0A 27 12 15 4D B8 3D 0x7CE 10 0A 67 11 69 DE 99 F6 0x7C6 10 0A 27 12 48 3B 11 E5 0x7CE 10 0A 67 11 18 69 1F 90 0x7C6 10 0A 27 12 8E 50 72 AF 0x7CE 10 0A 67 11 20 A1 40 90 0x7C6 10 0A 27 12 17 E8 0F 77 0x7CE 10 0A 67 11 26 BB 43 6C 0x7C6 10 0A 27 12 68 CE 7E BA 0x7CE 10 0A 67 11 C2 F2 AE 5E 0x7C6 10 0A 27 12 A5 3E F1 FF 0x7CE 10 0A 67 11 2D EB 16 59 0x7C6 10 0A 27 12 84 CD DA EC 0x7CE 10 0A 67 11 6F 4C 54 E6 0x7C6 10 0A 27 12 60 BF 03 59 0x7CE 10 0A 67 11 29 88 33 F7 0x7C6 10 0A 27 12 CB AE DD D6 0x7CE 10 0A 67 11 C9 F8 DB 0B 0x7C6 10 0A 27 12 18 25 C0 35 0x7CE 10 0A 67 11 6D 58 B2 FA 0x7C6 10 0A 27 12 E6 21 2E 76 0x7CE 10 0A 67 11 EF 6B 05 9F 0x7C6 10 0A 27 12 62 EC A2 22 0x7CE 10 0A 67 11 64 F6 9D 83 0x7C6 10 0A 27 12 83 EB 51 C2 0x7CE 10 0A 67 11 02 E2 F7 7E 0x7C6 10 0A 27 12 EC 8E 17 BD 0x7CE 10 0A 67 11 5A 18 41 29 0x7C6 10 0A 27 12 DD CF 78 FA 0x7CE 10 0A 67 11 64 F6 9D 83 0x7C6 10 0A 27 12 83 EB 51 C2 0x7CE 10 0A 67 11 02 E2 F7 7E 0x7C6 10 0A 27 12 EC 8E 17 BD 0x7CE 10 0A 67 11 AE AE C5 34 0x7C6 10 0A 27 12 51 44 43 D9 0x7CE 10 0A 67 11 F6 CF CD D8 0x7C6 10 0A 27 12 D5 DD 64 E8 0x7CE 10 0A 67 11 C9 69 2F 15 0x7C6 10 0A 27 12 90 16 EE AF Title: Re: Seed Key algorithms Post by: obdhacker on August 10, 2023, 10:37:57 PM After I send a CAN code(ID: 0x7C6 || Data: 02 27 11 ) ECU request: ID: 7CE and data: 10 0A 67 11 XX XX XX XX (4 byte seed) To unlock the ECU I send: ID: 7C6 and data: 10 0A 27 12 XX XX XX XX (4 byte key) All CAN data are described below: 0x7CE 10 0A 67 11 43 24 55 B1 0x7C6 10 0A 27 12 8F A9 0F 5E 0x7CE 10 0A 67 11 50 09 C0 FB 0x7C6 10 0A 27 12 C5 8B EB 78 0x7CE 10 0A 67 11 46 CF 36 03 0x7C6 10 0A 27 12 24 46 DE B0 0x7CE 10 0A 67 11 8E 75 05 06 0x7C6 10 0A 27 12 EC 4E 53 71 0x7CE 10 0A 67 11 91 DA 4A B5 0x7C6 10 0A 27 12 10 E5 47 C6 0x7CE 10 0A 67 11 BC 30 75 3B 0x7C6 10 0A 27 12 CD 54 56 79 0x7CE 10 0A 67 11 A6 17 09 29 0x7C6 10 0A 27 12 BD E6 4C 7F 0x7CE 10 0A 67 11 16 B9 43 E7 0x7C6 10 0A 27 12 30 D5 D0 E2 0x7CE 10 0A 67 11 47 04 1C 01 0x7C6 10 0A 27 12 15 4D B8 3D 0x7CE 10 0A 67 11 69 DE 99 F6 0x7C6 10 0A 27 12 48 3B 11 E5 0x7CE 10 0A 67 11 18 69 1F 90 0x7C6 10 0A 27 12 8E 50 72 AF 0x7CE 10 0A 67 11 20 A1 40 90 0x7C6 10 0A 27 12 17 E8 0F 77 0x7CE 10 0A 67 11 26 BB 43 6C 0x7C6 10 0A 27 12 68 CE 7E BA 0x7CE 10 0A 67 11 C2 F2 AE 5E 0x7C6 10 0A 27 12 A5 3E F1 FF 0x7CE 10 0A 67 11 2D EB 16 59 0x7C6 10 0A 27 12 84 CD DA EC 0x7CE 10 0A 67 11 6F 4C 54 E6 0x7C6 10 0A 27 12 60 BF 03 59 0x7CE 10 0A 67 11 29 88 33 F7 0x7C6 10 0A 27 12 CB AE DD D6 0x7CE 10 0A 67 11 C9 F8 DB 0B 0x7C6 10 0A 27 12 18 25 C0 35 0x7CE 10 0A 67 11 6D 58 B2 FA 0x7C6 10 0A 27 12 E6 21 2E 76 0x7CE 10 0A 67 11 EF 6B 05 9F 0x7C6 10 0A 27 12 62 EC A2 22 0x7CE 10 0A 67 11 64 F6 9D 83 0x7C6 10 0A 27 12 83 EB 51 C2 0x7CE 10 0A 67 11 02 E2 F7 7E 0x7C6 10 0A 27 12 EC 8E 17 BD 0x7CE 10 0A 67 11 5A 18 41 29 0x7C6 10 0A 27 12 DD CF 78 FA 0x7CE 10 0A 67 11 64 F6 9D 83 0x7C6 10 0A 27 12 83 EB 51 C2 0x7CE 10 0A 67 11 02 E2 F7 7E 0x7C6 10 0A 27 12 EC 8E 17 BD 0x7CE 10 0A 67 11 AE AE C5 34 0x7C6 10 0A 27 12 51 44 43 D9 0x7CE 10 0A 67 11 F6 CF CD D8 0x7C6 10 0A 27 12 D5 DD 64 E8 0x7CE 10 0A 67 11 C9 69 2F 15 0x7C6 10 0A 27 12 90 16 EE AF The first byte "10" means that the message is bigger than 8 bytes. The second byte "0A" means that the message is 0x0A (10 in decimal) bytes long. I will explain to you by email. Title: Re: Seed Key algorithms Post by: tjshadyluver on August 24, 2023, 07:59:10 AM I'm looking for FORD IPC 3 byte security algorithm.
02 27 03 SEED 1A 4B 9C KEY A2 0C B0 SEED 00 10 24 KEY 5B 65 73 SEED 00 10 62 KEY 49 F9 1C SEED 00 0E A0 KEY F7 67 31 SEED 00 0C 02 KEY 74 9A 53 SEED 00 0C 48 KEY 7D 33 76 SEED 00 0C 14 KEY DE 2B 06 SEED 00 0D 56 KEY F9 7F 11 SEED 00 0B 51 KEY B3 8D 64 SEED 00 0C E1 KEY 58 EC 32 SEED 00 0E 4E KEY 8E 4A 57 Title: Re: Seed Key algorithms Post by: chiper555 on September 03, 2023, 04:17:32 AM Hi, HI can write by PM more info about seed key. you sell it or something else? I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request Title: Re: Seed Key algorithms Post by: ASTROLIDER on September 04, 2023, 09:10:09 AM I'm looking for FORD IPC 3 byte security algorithm. 02 27 03 SEED 1A 4B 9C KEY A2 0C B0 SEED 00 10 24 KEY 5B 65 73 SEED 00 10 62 KEY 49 F9 1C SEED 00 0E A0 KEY F7 67 31 SEED 00 0C 02 KEY 74 9A 53 SEED 00 0C 48 KEY 7D 33 76 SEED 00 0C 14 KEY DE 2B 06 SEED 00 0D 56 KEY F9 7F 11 SEED 00 0B 51 KEY B3 8D 64 SEED 00 0C E1 KEY 58 EC 32 SEED 00 0E 4E KEY 8E 4A 57 I HAVE IT Title: Re: Seed Key algorithms Post by: alfa-bravo on December 04, 2023, 03:10:01 AM hello, I am currently on a bmw cas2 and secure access, my tool extracts an id then makes a secure access request the box responds with a seed of 8 bytes and the response is 64 bytes, can you help me? THANKS
Title: Re: Seed Key algorithms Post by: ScaniaSPG on December 25, 2023, 05:21:44 PM Hello, I need algorithms for ECU's scania, below is an example of a successful key negotiation, the ecu example is a continental ems s8.
ID: 18DA00F9 / DLC: 8 / DATA: 02 27 01 00 00 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 10 0A 67 01 87 FD 4F BD ID: 18DA00F9 / DLC: 8 / DATA: 30 00 00 00 00 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 21 B5 8A 7D D6 00 00 00 ID: 18DA00F9 / DLC: 8 / DATA: 10 0A 27 02 C9 6D 4A C0 ID: 18DAF900 / DLC: 8 / DATA: 30 00 00 00 00 00 00 00 ID: 18DA00F9 / DLC: 8 / DATA: 21 27 F0 A9 FB 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 03 67 02 34 00 00 00 00 2701: Request Seed 6701: Renpose this seed: 87 FD 4F BD B5 8A 7D D6 2702: Send this Key: C9 6D 4A C0 27 F0 A9 FB 6702: Response acess granted Thank's in advance. ;) Title: Re: Seed Key algorithms Post by: obdhacker on December 26, 2023, 12:01:01 AM Hello, I need algorithms for ECU's scania, below is an example of a successful key negotiation, the ecu example is a continental ems s8. ID: 18DA00F9 / DLC: 8 / DATA: 02 27 01 00 00 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 10 0A 67 01 87 FD 4F BD ID: 18DA00F9 / DLC: 8 / DATA: 30 00 00 00 00 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 21 B5 8A 7D D6 00 00 00 ID: 18DA00F9 / DLC: 8 / DATA: 10 0A 27 02 C9 6D 4A C0 ID: 18DAF900 / DLC: 8 / DATA: 30 00 00 00 00 00 00 00 ID: 18DA00F9 / DLC: 8 / DATA: 21 27 F0 A9 FB 00 00 00 ID: 18DAF900 / DLC: 8 / DATA: 03 67 02 34 00 00 00 00 2701: Request Seed 6701: Renpose this seed: 87 FD 4F BD B5 8A 7D D6 2702: Send this Key: C9 6D 4A C0 27 F0 A9 FB 6702: Response acess granted Thank's in advance. ;) Hello, check PM Title: Re: Seed Key algorithms Post by: p3077371 on January 30, 2024, 02:23:41 PM Hi, I've got a lot of different Seed/Key algorythms for several Diagmodes Manufacturers: Mercedes MAN Opel Honda PSA Porsche JLR SCANIA Smart DAF Renault Renault Trucks Volvo IVECO Ford Fiat Jeep Chrysler Dodge and many more.... If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you. I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL) Feel free to send your request HI, do u have 16bytes ford algorithm? Title: Re: Seed Key algorithms Post by: obdhacker on January 30, 2024, 07:19:13 PM Title: Re: Seed Key algorithms Post by: Piter2004 on March 14, 2024, 10:20:56 AM Title: Re: Seed Key algorithms Post by: RNN on April 25, 2024, 10:22:09 PM Hello OBDhacker,
I need security keys and algorithm for cracking UDS service $27 with level one (2701)for KIA selltos model(India). example seed 22308f67232dd293 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 Title: Re: Seed Key algorithms Post by: RNN on April 25, 2024, 10:26:14 PM Hello ,
I need security key algorithm for KIA seltos(India) using service $2701. seed sample are below. seed : 22308f67232dd293 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 can0 7CE [8] 02 7E 00 AA AA AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 27 01 00 00 00 00 00 can0 7CE [8] 10 0A 67 01 22 30 8F 67 can0 7C6 [8] 30 00 00 00 00 00 00 00 can0 7CE [8] 21 23 2D D2 93 AA AA AA can0 7C6 [8] 02 3E 00 00 00 00 00 00 Title: Re: Seed Key algorithms Post by: obdhacker on April 25, 2024, 10:36:18 PM Hello mate,
Yes. Title: Re: Seed Key algorithms Post by: ASTROLIDER on June 02, 2024, 06:47:24 AM SEED KEY mitsubishi, level 5 (27 05).
Dash: micro 70F321 eeprom 93c76. seed key 15 B8 E7 BC 62 E1 C7 05 4F 59 23 C8 3A 0A E9 71 70 69 19 C6 EB 9A 8E 5F valid seed key. I must apply an algorithm that resolves the key based on the input seed, I still don't know which algorithm to apply. At first I used basic summation and I did not obtain positive results. Title: Re: Seed Key algorithms Post by: ASTROLIDER on June 02, 2024, 06:48:54 AM SEED KEY mitsubishi, level 5 (27 05). Dash: micro 70F3421 eeprom 93c76. seed key 15 B8 E7 BC 62 E1 C7 05 4F 59 23 C8 3A 0A E9 71 70 69 19 C6 EB 9A 8E 5F valid seed key. I must apply an algorithm that resolves the key based on the input seed, I still don't know which algorithm to apply. At first I used basic summation and I did not obtain positive results. Title: Re: Seed Key algorithms Post by: van_lorry on July 12, 2024, 09:45:45 PM Hi, obdhacker, how about ford sync4 APIM 16 bytes seed-key algorithm?
seed[16] = {0xAA, 0x10, 0x7B, 0x2C,\ 0x27, 0xDD, 0x96, 0x11,\ 0xF8, 0xC8, 0xDD, 0xEE,\ 0x72, 0x74, 0x1C, 0x87}; key[16] = {0xDA, 0x49, 0x8C, 0x36,\ 0xF3, 0x5A, 0x9E, 0x67,\ 0xFD, 0xB6, 0xE4, 0x89,\ 0x0D, 0x77, 0x3D, 0x41}; Title: Re: Seed Key algorithms Post by: obdhacker on July 13, 2024, 05:48:39 AM Hi, obdhacker, how about ford sync4 APIM 16 bytes seed-key algorithm? seed[16] = {0xAA, 0x10, 0x7B, 0x2C,\ 0x27, 0xDD, 0x96, 0x11,\ 0xF8, 0xC8, 0xDD, 0xEE,\ 0x72, 0x74, 0x1C, 0x87}; key[16] = {0xDA, 0x49, 0x8C, 0x36,\ 0xF3, 0x5A, 0x9E, 0x67,\ 0xFD, 0xB6, 0xE4, 0x89,\ 0x0D, 0x77, 0x3D, 0x41}; You have mail. Title: Re: Seed Key algorithms Post by: peit on August 23, 2024, 12:04:59 PM Hello.
Can anyone help me with this? Mazda 3 BM, in addition to the session, needed access the protocol UDS "Security Access" (0x27)... What algorithm is the generated by user the key? If it helps, I have some example request-response keys. Title: Re: Seed Key algorithms Post by: konrado332211 on September 09, 2024, 06:24:34 AM I need ic204 calc. Have you got?
|