Pages: [1]
Author Topic: BMW DME seed key need help  (Read 950 times)
deutsch1988
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 12


« on: April 11, 2025, 01:12:46 PM »

Hello guys, im working on one project.
I have one problem on BMW DME seed key!
I try find the algo type buth unsucces.

example of one.
I send UDS command:
00 00 00 08 00 01 F4 12 27 11 FF FF FF FF

Response:
00 00 00 07 00 02 F4 12 27 11 FF FF FF 00 00 00 0C 00 01 12 F4 67 11 64 6E 40 00 46 85 15 85

Seed key are:
64 6E 40 00 46 85 15 85

calculated response for this seed key are:

00 00 00 88 00 01 F4 12 27 12 00 00 00 20 C4 BD B2 62 B5 A4 BB 42 97 DD B9 DE 51 71 90 CE E0 E5 01 B2 A2 BC C9 D1 A3 1E E8 32 E6 8B 0B 21 BE 91 81 31 E4 2B 17 FC 1C B3 BE 45 25 D9 CE 79 F9 EF 0A CC 27 1E 21 6E C3 37 BA 26 B8 BE 39 E2 BF 79 4E F8 21 B2 45 38 D2 A6 DA 38 51 DC 08 12 F0 8A CA 4C 47 2D 40 64 01 A7 AC 6F DF 0E A3 B2 0A 28 54 46 3D 83 E2 0C 9B 14 03 2F 2C 33 1C 0E 4E 38 B1 BE A1 32 DB 8E 5F 2B 52 D0 AF DC 41 43

also key to send to ECU its:
C4 BD B2 62 B5 A4 BB 42 97 DD B9 DE 51 71 90 CE E0 E5 01 B2 A2 BC C9 D1 A3 1E E8 32 E6 8B 0B 21 BE 91 81 31 E4 2B 17 FC 1C B3 BE 45 25 D9 CE 79 F9 EF 0A CC 27 1E 21 6E C3 37 BA 26 B8 BE 39 E2 BF 79 4E F8 21 B2 45 38 D2 A6 DA 38 51 DC 08 12 F0 8A CA 4C 47 2D 40 64 01 A7 AC 6F DF 0E A3 B2 0A 28 54 46 3D 83 E2 0C 9B 14 03 2F 2C 33 1C 0E 4E 38 B1 BE A1 32 DB 8E 5F 2B 52 D0 AF DC 41 43

I try bootloader id+ seed key combinited send to md5 hash, and calculate response, buth unsucces.

I get bootloader d from command:
22 F1 01

in my case its BMW MEVD172G ecu, the boorloader id are : 000019DC

I know its use RSA>NONE>NoPadding algot type. Before i do that way with anorher ecu type all work. in this case its dont work.
esys security folder...keys...

Any help will be appreciated!
Logged
deutsch1988
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 12


« Reply #1 on: April 11, 2025, 09:59:11 PM »

Guys theme closed!
i found it my self!
For 000019DC i share here key's:

88e5e7fc153783c655946610a2e118acb3c95ed4a440ea900e985982eb64dfbfc2aee90172963f89b3eff22f76ff175d7acf8e0b9dd1d29fa2d5c25e0f6ff2d02540805dcc232723ae98bf10b9855d900000203bee5607f91237f78fb0ce87bd489b025e5357e81076bd99ab8d030c051d2ad4b55b4a8bfa1287df86810a424b

cd58dbfa1fd345a9805e9918f451a5030dae0e3ef6615fd815e4864461174f9fa4065d822be15f4e8de7eb47327ea30c383755116cbabbef7440a38d1727ec3a02de25b3a15b4cbc53976f44be354a60f0f6e916c34d28f2d240dbc7e4dfe29337295a2cb30f4d53388799d78ad6db9fd5f2371e247162a91ebc6cdfeba91527

extra i will add , this not onyl accept by 000019DC BTLD and accept in 000020D5,000017D3,000020D5,000017D3
Basicly algo type for calc , in C#

         
byte[] BOOT = new byte[4] {0x00, 0x00, 0x19, 0xDC};
string strFIRST = "FIRST;
string strSECOND  = "SECOND";
byte[] KeyBytes = CalcKeyBtld_MD5(SeedBytes, BOOT, strFIRST, strSECOND);
txtKey.Text = ByteArrayToString(KeyBytes, KeyBytes.Length, "-");


if any body need seed key for any ecu i can provide, include MGD1 ecus and all ecus!!!
« Last Edit: April 11, 2025, 11:00:48 PM by deutsch1988 » Logged
deutsch1988
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 12


« Reply #2 on: April 11, 2025, 11:36:49 PM »

Exampe another
BMW F 6HP BTLD-0000643

6ac0dbb060cdf1e1763603e097090a299836aac3c35dc09fb1c22e63b5d3a03b3cbfb367f3cd19a7b270019a816d547321707891533e704d9391162f3bd6817b

a02149889134ead2315105d0e28d8f3e64520025a50ca0ef8aa3459590bd705a719069534c807e58ed30a7d0818ce5ad572788e79abfbfdef804bbad45308973
Logged
deutsch1988
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 12


« Reply #3 on: April 12, 2025, 12:45:21 AM »

BMW G30 MD1CS001

BTLD-000040C4

9689ef0764d6ee5c0e032f481f99cb6fbdff6555c4a51ec262d1d6ea41f715eb225862d7a24629baee8aacf4317871c5601092d2017864452b58f9755a34574a39f148fa5e403c639f547da7ec4d3df4c7178ef313f434b7870aa09d0aeb142ddde21f1ebb1548f64804025070027964558f89ce55ae503345fdc15ef2d99463


e1cee68b1742658a1504c6ec2f66b1279cff1800a6f7ae23943ac25f62f2a0e0b384944373693e9865d0036e4a34aaa81018dc3b02349667c1057630074e82f1386560378ebe04585a5afe1a21db2cb65ac1bd040fbe8a14228dd1880adf6b369e39ea833301fcf06db1ac09f955df1504768616c6b769988161bfaa54abf821
Logged
deutsch1988
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 12


« Reply #4 on: April 13, 2025, 07:00:32 PM »

Share another DME from BMW MEVD

BTLD:
00000ABD
00001243
000013E5
00001400
000018FF
00001901
000019A7
00001BD5
00001CA3

all this BTLD use same key:

8197d68bd36544f97b6b30a322a81b040343c1edeecd8e46c850e7ff4b9b43a17b72185f9aabe37b5f00c72e30b661913f8e69275a4fe695fdf8974abe1670b77f04da5e34702c8cc02d9bc4c2786ed7ceec725551bca8d35a647d520f859029b54fdd4e09672842e83264b81bcc9e6dfeb9ec4548fe83980ad0b243826fc073

c263c1d1bd17e7763920c8f4b3fc288604e5a2e4e634556a2c795bfef168e572392b248f6801d5390e812ac549119259df559dbb0777d9e0fcf4e2f01d21a914fcaf5839c2baa5f21e25fb4a0a906485e5fa03b479205a338694bac743937f399052b7fcfaa704aedf100f87e530e54be414a7ffaa41e5bc3d7c5380d4bb76a5

I hope this all will help to another!
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.037 seconds with 18 queries. (Pretty URLs adds 0.001s, 0q)