Pages: [1] 2
Author Topic: VAG AES KEYS  (Read 21614 times)
obdflasher
Newbie
*

Karma: +0/-6
Offline Offline

Posts: 8


« on: March 16, 2018, 12:20:41 AM »

Hi.

Who has experience with AES keys ?

Logged

Chiptuning Agri
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257


« Reply #1 on: September 19, 2018, 01:07:41 AM »

I guess I have ...
Logged
obdhacker
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 18


« Reply #2 on: January 04, 2020, 07:50:11 AM »

Me too  Wink
Logged
crystal_imprezav
Newbie
*

Karma: +5/-0
Offline Offline

Posts: 12


« Reply #3 on: March 02, 2020, 03:15:51 PM »

What would you like to know?

Typically 16 byte key and iv. AES CBC Zero Padding. LZ compress/decompress
Logged
d3irb
Full Member
***

Karma: +134/-1
Offline Offline

Posts: 195


« Reply #4 on: March 02, 2020, 03:23:50 PM »

Sure, what do you need? http://nefariousmotorsports.com/forum/index.php?topic=10364.msg122889#msg122889

Logged
gremlin
Hero Member
*****

Karma: +196/-9
Offline Offline

Posts: 652


« Reply #5 on: March 04, 2020, 09:41:14 AM »

Looking for key/iv for AES packed MED17.1.61 and 0DL/0DW/OGC TCM frf/odx
Can exchange for many other aes pairs used in MED/EDC/MG1/MD1/Simos/TCM
Logged
crystal_imprezav
Newbie
*

Karma: +5/-0
Offline Offline

Posts: 12


« Reply #6 on: March 17, 2020, 01:06:19 PM »

Looking for key/iv for AES packed MED17.1.61 and 0DL/0DW/OGC TCM frf/odx
Can exchange for many other aes pairs used in MED/EDC/MG1/MD1/Simos/TCM
Only old DSG's use AES (DQ500 & DQ381). I have those keys. I also have MED17 AES keys, but some MED17's use and xor encrypt and not AES. You could PM some files and I can see if I can decode them and trade from there if you interested.
Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257


« Reply #7 on: March 18, 2020, 01:27:06 AM »

If you're talking about immo regarding MED17 then there's no AES involved, but a simple XOR generated by unique Tricore CHIPID.
Logged
gremlin
Hero Member
*****

Karma: +196/-9
Offline Offline

Posts: 652


« Reply #8 on: March 19, 2020, 10:58:40 AM »

You could PM some files and I can see if I can decode them and trade from there if you interested.

crystal_imprezav, below some examples of frf-s using AES keys/iv i looking for.

Med17
FL_04E906022B_4032__V001.frf
FL_03H906026A_6872__V001.frf

DQ500/DQ381
FL_0DL300012M_2106_ilBL_sw.frf
FL_0DW300040A_2303_coBK_sw.frf
FL_0GC300011G_1420_roUJ_sw.frf

DL382
FL_4K0927153M__0005.frf








 
Logged
crystal_imprezav
Newbie
*

Karma: +5/-0
Offline Offline

Posts: 12


« Reply #9 on: March 19, 2020, 04:07:38 PM »

crystal_imprezav, below some examples of frf-s using AES keys/iv i looking for.

Med17
FL_04E906022B_4032__V001.frf
FL_03H906026A_6872__V001.frf

DQ500/DQ381
FL_0DL300012M_2106_ilBL_sw.frf
FL_0DW300040A_2303_coBK_sw.frf
FL_0GC300011G_1420_roUJ_sw.frf

DL382
FL_4K0927153M__0005.frf








 

DQ500/381 I have.

DL382 uses a decryption table completely different from any other VAG algo.

I’ll check in the those MED17 files. Do you have a bench read of either you can send or upload?
Logged
gremlin
Hero Member
*****

Karma: +196/-9
Offline Offline

Posts: 652


« Reply #10 on: March 20, 2020, 01:45:00 PM »

DQ500/381 I have.

DL382 uses a decryption table completely different from any other VAG algo.

I’ll check in the those MED17 files. Do you have a bench read of either you can send or upload?

There is no problem with old style (table crypted) DL382 frf files.
I spoke about new version DL382 using Aurix TC27x CPU inside and AES-decryption.
See screenshoot comparison.

What about MED17 files.... if i had full dump read of ecus mentioning above i would not ask about AES-keys ;-)

DQ500/381 keys are very interesting for me and i can exchange it for some info of your interest. If any...
Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035


« Reply #11 on: March 20, 2020, 02:36:34 PM »

You have RSA workaround for newer DL382?
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
crystal_imprezav
Newbie
*

Karma: +5/-0
Offline Offline

Posts: 12


« Reply #12 on: March 20, 2020, 04:09:39 PM »

There is no problem with old style (table crypted) DL382 frf files.
I spoke about new version DL382 using Aurix TC27x CPU inside and AES-decryption.
See screenshoot comparison.

What about MED17 files.... if i had full dump read of ecus mentioning above i would not ask about AES-keys ;-)

DQ500/381 keys are very interesting for me and i can exchange it for some info of your interest. If any...

Shoot me an email. Crystalimprezav@gmail.com and I’m sure we can work something out. I really like your application format to test and there is one thing I need you probably have.

As for the newer dl382 the Haldex uses that chip. As well as some others. I’ll see what I got on those. Got an frf you can send?
Logged
Teitek
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 21


« Reply #13 on: March 31, 2020, 03:41:07 AM »

There is no problem with old style (table crypted) DL382 frf files.
I spoke about new version DL382 using Aurix TC27x CPU inside and AES-decryption.
See screenshoot comparison.

What about MED17 files.... if i had full dump read of ecus mentioning above i would not ask about AES-keys ;-)

DQ500/381 keys are very interesting for me and i can exchange it for some info of your interest. If any...

A question, how you get the pseudocode from the ODX?

<SECURITY-METHOD TYPE="A_ASCIISTRING">SA2</SECURITY-METHOD>
                  <FW-SIGNATURE TYPE="A_BYTEFIELD">6809872602201493270320154A03826B068193280420168429052017494C</FW-SIGNATURE>

¿?

Thank you!
Logged
IamwhoIam
Hero Member
*****

Karma: +52/-114
Offline Offline

Posts: 1070


« Reply #14 on: March 31, 2020, 03:44:35 AM »

A question, how you get the pseudocode from the ODX?

<SECURITY-METHOD TYPE="A_ASCIISTRING">SA2</SECURITY-METHOD>
                  <FW-SIGNATURE TYPE="A_BYTEFIELD">6809872602201493270320154A03826B068193280420168429052017494C</FW-SIGNATURE>

¿?

Thank you!



LOLWUT? That "pseudocode" IS IN the ODX itself LOL
Logged

I have no logs because I have a boost gauge (makes things easier)
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.038 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)