I saw a $200 J2534 MyGenius tool recently and I got inspired. It claims it can read + write from the latest and greatest Mercedes ECUs (Bosch MED17.7.5)

http://www.dimsport.it/en/my-genius/

Pretty much everything else online I see contradicts that. From $5k master/slave setups, buying an hour of time for access through Mercedes, etc.

Where does it fall apart in terms of simplicity:

1. Connect PINs to CAN high/low in OBD-II port
2. Send/receive CAN messages following UDS

I've read about Seed/Key algorithms and I get how without the dump of the ECU firmware it'd be near impossible to brute force these days. What other modern protection methods are at play? I've heard about 1024-bit keys for BMW. TPROT, etc. When are all of those encountered through the process?

Is it just... start a UDS diagnostic session, request a seed, send back a key, and you can read/write to whatever region of memory you want? No, right? So, is it different for every manufacturer?

There is VERY little openly available information about this, every manufacturer does it differently, and every model year they do something different...

Compressed version for sw engineer and talking OBD access: UDS on CAN is ubiquitous on late models, but there are some others like KWP on CAN and TP2.0 on some earlier MED17. Reading with UDS commands is often not implemented or has restricted address ranges and session permissions protected by seed key challenges. When you can write, you often have private public key based signature checks of a hash of the flashed segments before the ECU will run them.