This is not the exact algorithm used by the cluster but works about 50% of the time so you can usually succeed within 2 or 3 tries and get access to the EEPROM. I reverse engineered it by writing an RB8 simulator that returned specific simple seeds (e.g. 0x00000000, 0x00000001, etc.) and then had VAG K+CAN Commander try to access the simulator while I observed the keys being sent in response to the various seeds. It works fine on the two RB8 1J0920926C clusters that I have. No idea if it works on other RB8 clusters.
static uint CalcRB8Key(uint seed)
{
uint key =
0xFB4ACBBA
+ (seed & 0x07DA06B8)
+ (~seed | 0x07DA06B8)
- 2 * (seed & 0x00004000);
return key;
}
Spent a few more hours on this today, and with the help of the Z3 theorem prover (good info here:
https://www.enigmatos.com/hacking-cars-with-z3/) and some trial and error, came up with the exact algorithm:
static uint CalcRB8Key(uint seed)
{
uint key = 0x03249272 + (seed ^ 0xf8253947);
return key;
}
So far it's worked every time...
