I sniffed data that there was on K-line and in 0x27 CMD saw this:
TOOL: 0x00,0x02,0x27,0x7F,0xA8
ECU: 0x00,0x0D,0x67,0x7F,0xA3,0x27,0xFE,0x33,0x01,0xA1,0x96,0x97,0xCF,0x3B,0x34,0xFB Seeds are red
TOOL: 0x00,0x82,0x27,0x80,0x00, .. .Up to 85. .. ,
0x01,0x42,0x8A,0x2F,0x98,0xD7,0x28,0xAE,0x22,0x08,0x19,0x04,0x7C,0x44,0xF3,0x9A,0xB1,0x15,0x4A,0x53,0xE1,0x37,0xA4,
0xF1,0xE4,0xA1,0xF9,0x50,0xA3,0xA7,0x3A,0x9C,0xE2,0x69,0x89,0x7A,0x05,0x94,0x39,0x3F,0x6E,0xEA,0xA9,0x5C Keys are red
So, As you see, seed is 10 byte and key 21 bytes. What am I facing? Can the RSA algorithm convert one byte to two bytes?
Hi,
I try to do a bootstrap loader on my Bosch MEVD17.2.G (TC1797 mcu) in bench mode without opening the ecu as my PCMflash tool does but I am stuck at the security access before transfering the bootloader. I think it is a sort of seed key : ecu sends 10 kind of random bytes and the host must answer with 20 bytes. I was sure the algorithm was in the BootRom (0x8FFFC000-0x8FFFFFFF) but after successfully dumped and disassembled it I haven’t found the algorithm in the code (only 16kb). Maybe someone know where is located this algorithm in the code ?
