Pages: 1 2 [3]
Author Topic: Tricore GPT protocol for Bosch ME17.9  (Read 33225 times)
jam
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #30 on: January 14, 2022, 10:37:39 PM »

Thanks. I was encouraged to learn Simos18.  Grin
I change this thread name, and It does not matter what the result. It is Important that how I have to do it. I'm looking for a way that help me to solve this challenge.
So, I try to trace commands in dump and get some result then write here in details.


Hello unicornux ,  any progress?
Logged
MpowerE36
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 1


« Reply #31 on: October 10, 2024, 12:03:54 AM »

I sniffed data that there was on K-line  and in 0x27 CMD saw this:

TOOL: 0x00,0x02,0x27,0x7F,0xA8
ECU:   0x00,0x0D,0x67,0x7F,0xA3,0x27,0xFE,0x33,0x01,0xA1,0x96,0x97,0xCF,0x3B,0x34,0xFB   Seeds are red
TOOL: 0x00,0x82,0x27,0x80,0x00, .. .Up to 85. .. ,
          0x01,0x42,0x8A,0x2F,0x98,0xD7,0x28,0xAE,0x22,0x08,0x19,0x04,0x7C,0x44,0xF3,0x9A,0xB1,0x15,0x4A,0x53,0xE1,0x37,0xA4,
0xF1,0xE4,0xA1,0xF9,0x50,0xA3,0xA7,0x3A,0x9C,0xE2,0x69,0x89,0x7A,0x05,0x94,0x39,0x3F,0x6E,0xEA,0xA9,0x5C     Keys are red

So, As you see, seed is 10 byte and key 21 bytes. What am I facing? Can the RSA algorithm convert one byte to two bytes?

Hi,

I try to do a bootstrap loader on my Bosch MEVD17.2.G (TC1797 mcu) in bench mode without opening the ecu as my PCMflash tool does but I am stuck at the security access before transfering the bootloader. I think it is a sort of seed key : ecu sends 10 kind of random bytes and the host must answer with 20 bytes. I was sure the algorithm was in the BootRom (0x8FFFC000-0x8FFFFFFF) but after successfully dumped and disassembled it I haven’t found the algorithm in the code (only 16kb). Maybe someone know where is located this algorithm in the code ?
« Last Edit: October 12, 2024, 04:41:37 AM by MpowerE36 » Logged
Pages: 1 2 [3]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.012 seconds with 16 queries. (Pretty URLs adds 0s, 0q)