NefMoto

Hi,

I've got a lot of different Seed/Key algorythms for several Diagmodes

Manufacturers:
Mercedes
MAN
Opel
Honda
PSA
Porsche
JLR
SCANIA
Smart
DAF
Renault
Renault Trucks
Volvo
IVECO
Ford
Fiat
Jeep
Chrysler
Dodge
and many more....

If you need one or more please send Manufacturer, ECU, Mode and some Seed/Key pairs to validate if i've got the right one for you.
I can deliver the codes in C# (Code or DLL), JAVA Code, C (Code or DLL)

Feel free to send your request

hello I'm looking to bypass the seed key on my ecu bosch med9.1 seat leonpouez car you help me
thank you

What means to bypass? Explain with details please

Do you have security codes too for a 2017 Audi S3?

Sent from my LM-G710VM using Tapatalk

2017 Audi S3. Which controller? Which security level?

Hi;
I recently try to find Bosch ME 7.9.7 (china) seed key algorithm with IDA pro.
So i send different seed to device (with simulator) for reading different keys, And i saw results that show in below. 

Seed:01 01 01 01
Key:  A5 92 1F 33
 
Sedd:00 00 00 01
Key:  65 19 8c 23

Is it possible help me for find seed keys algorithm??

Hey!
I would like to know if there is an algorithm for calculating Mercedes seed keys for ic204 block with access level 09 and 0D?

Hi mate. Yes

Hello, i need algorithm seed-key for cluster instrument Mazda
security level 3

I am just wondering is there any solutions to find Hyundai and Kia seed key algorithm?

Do you know to find Hyundai and Kia 2020 models seedkey algorithms?

Post a full boot/bench read and an obd2 sniff or seed key combo and I as well as other reverse engineers could probably solve it. Basic steps are to find the UDS SID #27 handler and from there find the algorithm. Another route would be to find the diagnostic software and find the library that performs the seed key calc and extract the algorithm

Any chance you have BMW algorithmes for f-series? :-)

Any seed key algorithms for Dodge Clusters?  2005 Dodge ram?

Sure, send me details

tried replying to you via PM but it is not going thought. I could use a couple seedkeys, can you message me back?

Hello ,  do you have algorithm for BMW modules?

Yes, tell me what you need

i sent PM

Can someone please help me find the Algorithm for this Seed-key pair:

27 03 (level 3)

Seed- A9 05 64 69,  Key- 76 D4 63 BE
seed- 5F F7 4B 5F,  key- 6A D7 93 88
seed- 90 34 EC EF,  key- C5 A7 EE 98

Hi, I've been working on the Volvo D13. I already know that it uses the RSA algorithm.
Also, I have the secret key for level 7 and above and I was able to unlock the ECU on those levels.
But in order to reprogram the ECU I need the level 1 access, is there any chance you have the key for security access level 1?
MSW is 23036507
Part number is 21900553
The data I've got from spying the CAN (I'm sure the security level for this data is 1):
Seed (length=116):
0xdd, 0xc7, 0xe7, 0x2f, 0xe6, 0x0c, 0xff, 0x64, 0xf2, 0xb8, 0xb0, 0x15, 0x5a, 0xa3,
0xa7, 0x12, 0x0e, 0xf5, 0x17, 0xeb, 0x79, 0x26, 0x80, 0xf0, 0x5b, 0xfe, 0xac, 0x31,
0x1f, 0x95, 0xbc, 0x7e, 0x00, 0x53, 0xd6, 0x67, 0xa8, 0xf0, 0xb5, 0x3c, 0xcf, 0x74,
0x3c, 0x0d, 0x7d, 0x37, 0xd2, 0xaa, 0xb9, 0xe1, 0x1e, 0xa3, 0x61, 0x6a, 0x68, 0x48,
0xfd, 0x1a, 0xbb, 0xa9, 0x87, 0x89, 0x95, 0x96, 0x13, 0x9f, 0xac, 0x9f, 0x5e, 0x94,
0x26, 0x14, 0x64, 0xf0, 0x47, 0x05, 0x22, 0x8b, 0x71, 0x42, 0xb5, 0x8d, 0xfc, 0x5b,
0x2c, 0x6e, 0x3a, 0xa0, 0x56, 0xf6, 0xba, 0x21, 0x02, 0x3d, 0x91, 0xae, 0x17, 0xab,
0x49, 0xd7, 0x26, 0xf8, 0xb1, 0xec, 0xf3, 0x2c, 0xb0, 0xfd, 0xaa, 0x9f, 0xe2, 0xda,
0x81, 0xf9, 0x91, 0x13

Signed key using the RSA algorithm (length=128):
0x98, 0xe0, 0xa1, 0xf8, 0x1f, 0x5d, 0xd0, 0x81, 0xd3, 0x87, 0x8f, 0x5e, 0xb7, 0x89,
0x79, 0xc9, 0x45, 0x8c, 0xe4, 0x6f, 0x38, 0x9a, 0xe4, 0xe1, 0x8c, 0x2a, 0xc9, 0xf4,
0x00, 0xa3, 0xe3, 0x74, 0x9d, 0xdd, 0x51, 0xd6, 0x9d, 0xff, 0x5d, 0x2e, 0x66, 0x9f,
0xc5, 0x8f, 0x32, 0xb3, 0x23, 0x07, 0xae, 0x7f, 0x9d, 0x45, 0x00, 0x1e, 0x01, 0xd7,
0x3f, 0x2c, 0xe7, 0x7a, 0xf2, 0x97, 0x1c, 0xae, 0x38, 0x0d, 0x44, 0x0f, 0xe2, 0x51,
0x3d, 0x51, 0x2a, 0x46, 0x7b, 0xfe, 0x3f, 0x40, 0x2e, 0x31, 0xde, 0xfb, 0x0a, 0x7d,
0x8e, 0xe9, 0x0f, 0xe0, 0x4e, 0x4d, 0xeb, 0xa5, 0x42, 0xf5, 0x31, 0x9b, 0xcb, 0x6b,
0x31, 0xcc, 0x94, 0x0e, 0x99, 0xc2, 0xdc, 0x12, 0x1a, 0xb8, 0x24, 0x03, 0x50, 0x8d,
0x11, 0xfc, 0x59, 0xc3, 0x9a, 0xcd, 0x49, 0xf8, 0x51, 0xca, 0x5b, 0x73, 0x99, 0x35,
0xec, 0xc1

Why do you think that posting seed key responses is going to do anything?
It's useless. Anything but simple xor or addition is not possible to deduce from a seed key pair - that's the whole idea about it.

Certainly not RSA signatures.

Get the ASW (or bootloader) and start reversing it. Posting these pointless rows of hex is a waste of time.

In case the seed-key is actually RSA, then you're not getting in without some sort of RCE exploit, unless you can locate the private key in the tool that is generating the response.

Hi. Yes, I know this algorithm.

I agree with you overall, I really don't like this thread, it's just people posting useless garbage and then salesmen looking at the garbage to see if it matches something in their sales database, not really a community collaboration or useful to anyone reading.

But, with respect to RSA, many RSA seed/keys use E=3 and don't check the padding correctly, meaning they are vulnerable to https://words.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ . No RCE or private keys necessary, just some clever math.

Thank you for answering guys, as I said I've found the algorithm via reverse engineering and I've already unlocked the ECU in level 7 and 11 on the extended session, which means the algorithm is correct and working fine. But, in order to be able to reprogram ECU, I need level 1 access in the programming session.
The reason I've mentioned RSA is because of the code I have, it's using a built-in dotnet class called "RSACryptoServiceProvider". These hexadecimal values are prerequisites to test the secret key and the algorithm. The input of the algorithm is a RsaKey which contains exponent and modulus (both have a length of 128 bytes) and the seed, so every time we give the same seed and the correct key we will get the same output. So these hexadecimal values can confirm the input and the output of the algorithm, the missing part of the puzzle here is the secret key for level 1 security access. by the way, the protocol we are using is ISO15765 (UDS). I'm only interested in level 1 security access exponent and modulus for the MSW I've mentioned here.
It will be a great help to me if anyone is willing to share that key.

The ECU tests key, the tester generates the key based on seed.
Last I checked ECU's are not written in .NET, so there's a lot that does not match in this story.

If it is RSA, the ECU will contain only the public key, the private key will be known to the application generating key from seed.
To test whether an RSA signature is valid, you do not need the private key, this is the whole point of cyptography.

So, find the OEM tool that generates the key from seed, reverse it, find the relevant values (private key).
Alternatively exploit it, if not properly implemented or find an RCE exploit in the UDS stack.

Hi We are in the same team, and we are stuck with this problem. Any help from your side will be much appreciated. Also we can pay for the services and helps if you have experience in the field. Looking forward for your recommendations.

Hi,

Do you have algorithms for BMW , the captured working example as below:


54 07 17 B8 22 7F 23 21 ---> SEED
00 00 00 40 47 1E 43 88 ---> KEY

Thanks in advance!!

Hi!
Which ecu? Which years? Without details it would be difficult to find out.

It's for NBTEVO ecu manufactured after 2016, Thanks!

Hi. i need 16 Byte seed Key Algorithms for New Ford car. Do you have

Do you have VW MAN Worker PTM EM D08 Engine logic??

Input           output   
10 10 10 10 10   47 DD DE 1A A2   
20 20 20 20 20   BF A9 F4 DF 97   
30 30 30 30 30   37 AA C5 FE 40   
40 40 40 40 40   B1 96 9A 68 B5   
50 50 50 50 50   3C E4 93 0A E4   

I sent you a message

Hi, do you have algorithm for 2023 Porsche Taycan BCM2?

Some example seed-key:
Seed                 Key
DBC6DAD8   75C0D929
87A90140           294CEA44
C89836DD           76CF7EE1
41B02125           AFE93120
74E8458F           EEE540B8

Thanks

Hi obdhacker,
do you have algorithm for 2023 KIA Sorrento OBD?

Some example seed-key:
Seed:                                                   Key:
10 0A 67 11 C7 CE A9 F5                       10 0A 27 12 B4 06 83 9A
10 0A 67 11 6C E8 CB 74                       10 0A 27 12 98 0F CB 84
10 0A 67 11 66 FC 93 CC                       10 0A 27 12 59 2D C7 61
10 0A 67 11 79 13 40 F9                        10 0A 27 12 02 D8 93 6F

Please help me solve this problem!

Hello,
I think so, but your example seeds are incomplete. Send me full seed and key requests and I'll check

After I send a CAN code(ID: 0x7C6 || Data: 02 27 11 )
ECU request: ID: 7CE and data: 10 0A 67 11 XX XX XX XX (4 byte seed)
To unlock the ECU I send: ID: 7C6 and data: 10 0A 27 12 XX XX XX XX (4 byte key)
All CAN data are described below:

0x7CE   10 0A 67 11 43 24 55 B1
0x7C6   10 0A 27 12 8F A9 0F 5E

0x7CE   10 0A 67 11 50 09 C0 FB
0x7C6   10 0A 27 12 C5 8B EB 78

0x7CE   10 0A 67 11 46 CF 36 03
0x7C6   10 0A 27 12 24 46 DE B0

0x7CE   10 0A 67 11 8E 75 05 06
0x7C6   10 0A 27 12 EC 4E 53 71

0x7CE   10 0A 67 11 91 DA 4A B5
0x7C6   10 0A 27 12 10 E5 47 C6

0x7CE   10 0A 67 11 BC 30 75 3B
0x7C6   10 0A 27 12 CD 54 56 79

0x7CE   10 0A 67 11 A6 17 09 29
0x7C6   10 0A 27 12 BD E6 4C 7F

0x7CE   10 0A 67 11 16 B9 43 E7
0x7C6   10 0A 27 12 30 D5 D0 E2

0x7CE   10 0A 67 11 47 04 1C 01
0x7C6   10 0A 27 12 15 4D B8 3D

0x7CE   10 0A 67 11 69 DE 99 F6
0x7C6   10 0A 27 12 48 3B 11 E5

0x7CE   10 0A 67 11 18 69 1F 90
0x7C6   10 0A 27 12 8E 50 72 AF

0x7CE   10 0A 67 11 20 A1 40 90
0x7C6   10 0A 27 12 17 E8 0F 77

0x7CE   10 0A 67 11 26 BB 43 6C
0x7C6   10 0A 27 12 68 CE 7E BA

0x7CE   10 0A 67 11 C2 F2 AE 5E
0x7C6   10 0A 27 12 A5 3E F1 FF

0x7CE   10 0A 67 11 2D EB 16 59
0x7C6   10 0A 27 12 84 CD DA EC

0x7CE   10 0A 67 11 6F 4C 54 E6
0x7C6   10 0A 27 12 60 BF 03 59

0x7CE   10 0A 67 11 29 88 33 F7
0x7C6   10 0A 27 12 CB AE DD D6

0x7CE   10 0A 67 11 C9 F8 DB 0B
0x7C6   10 0A 27 12 18 25 C0 35

0x7CE   10 0A 67 11 6D 58 B2 FA
0x7C6   10 0A 27 12 E6 21 2E 76

0x7CE   10 0A 67 11 EF 6B 05 9F
0x7C6   10 0A 27 12 62 EC A2 22

0x7CE   10 0A 67 11 64 F6 9D 83
0x7C6   10 0A 27 12 83 EB 51 C2

0x7CE   10 0A 67 11 02 E2 F7 7E
0x7C6   10 0A 27 12 EC 8E 17 BD

0x7CE   10 0A 67 11 5A 18 41 29
0x7C6   10 0A 27 12 DD CF 78 FA

0x7CE   10 0A 67 11 64 F6 9D 83
0x7C6   10 0A 27 12 83 EB 51 C2

0x7CE   10 0A 67 11 02 E2 F7 7E
0x7C6   10 0A 27 12 EC 8E 17 BD

0x7CE   10 0A 67 11 AE AE C5 34
0x7C6   10 0A 27 12 51 44 43 D9

0x7CE   10 0A 67 11 F6 CF CD D8
0x7C6   10 0A 27 12 D5 DD 64 E8

0x7CE   10 0A 67 11 C9 69 2F 15
0x7C6   10 0A 27 12 90 16 EE AF

The first byte "10" means that the message is bigger than 8 bytes. The second byte "0A" means that the message is 0x0A (10 in decimal) bytes long. I will explain to you by email.

I'm looking for FORD IPC 3 byte security algorithm.
02 27 03

SEED 1A 4B 9C
KEY   A2 0C B0

SEED 00 10 24
KEY   5B 65 73

SEED 00 10 62
KEY   49 F9 1C

SEED 00 0E A0
KEY   F7 67 31

SEED 00 0C 02
KEY   74 9A 53

SEED 00 0C 48
KEY   7D 33 76

SEED 00 0C 14
KEY   DE 2B 06

SEED 00 0D 56
KEY   F9 7F 11

SEED 00 0B 51
KEY   B3 8D 64

SEED 00 0C E1
KEY   58 EC 32

SEED 00 0E 4E
KEY   8E 4A 57

HI can write by PM more info about seed key. you sell it or something else?

I HAVE IT

hello, I am currently on a bmw cas2 and secure access, my tool extracts an id then makes a secure access request the box responds with a seed of 8 bytes and the response is 64 bytes, can you help me? THANKS

Hello, I need algorithms for ECU's scania, below is an example of a successful key negotiation, the ecu example is a continental ems s8.

ID: 18DA00F9       / DLC: 8  / DATA: 02  27  01  00  00  00  00  00

ID: 18DAF900       / DLC: 8  / DATA: 10  0A  67  01  87  FD  4F  BD

ID: 18DA00F9       / DLC: 8  / DATA: 30  00  00  00  00  00  00  00

ID: 18DAF900       / DLC: 8  / DATA: 21  B5  8A  7D  D6  00  00  00

ID: 18DA00F9       / DLC: 8  / DATA: 10  0A  27  02  C9  6D  4A  C0

ID: 18DAF900       / DLC: 8  / DATA: 30  00  00  00  00  00  00  00

ID: 18DA00F9       / DLC: 8  / DATA: 21  27  F0  A9  FB  00  00  00

ID: 18DAF900       / DLC: 8  / DATA: 03  67  02  34  00  00  00  00


2701: Request Seed
6701: Renpose this seed: 87  FD  4F  BD B5  8A  7D  D6
2702: Send this Key: C9  6D  4A  C0 27  F0  A9  FB
6702: Response acess granted

Thank's in advance.  ;)

Hello, check PM

HI, do u have 16bytes ford algorithm?

Yes

How much cost it?