Reading E2PROM with loader by OBD

Pages: [1]

« previous next »

Author

Topic: Reading E2PROM with loader by OBD (Read 5184 times)

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Reading E2PROM with loader by OBD « on: March 08, 2021, 12:25:09 AM »

Hi guys,
Recently I wrote my own loader for reading E2PROM (In C166 Arch).
But no matter how hard I tried, I couldn't.

How I can write this loader into ram area that it can read EEPROM?
I tried 0x3D and 0x36 cmd, but it doesn't work.

Basically I wanna to know that what I should look for?

P.S: EEPROM: M95320

Thanks.


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: Reading E2PROM with loader by OBD « Reply #1 on: March 08, 2021, 02:27:52 AM »

So let's say you succeed to write to memory.
WriteMemoryByAddress needs development session btw.
How are you going to get the ECU to execute this code?

If you really want to read the eeprom you need to write a bootstrap loader and do it in boot mode.

Otherwise you can use ReadMemoryByAddress to read the mirror.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Re: Reading E2PROM with loader by OBD « Reply #2 on: March 08, 2021, 03:37:41 AM »

I try to write my loader into RAM area (0xE000 - 0xE7FF). I have done this before for another ECU by SID 0x3D. But, here I can't write my bootstrap loader.

According to your reply:
1 - Do you explain me in nutshell that how can I calculate the correct address in RAM area?
2 - How can I calculate the correct address of mirror area? (For Plan B)

I prefer to use the bootstrap loader way.


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: Reading E2PROM with loader by OBD « Reply #3 on: March 08, 2021, 04:47:51 AM »

I don't understand anything you are saying.

You are talking about KWP2000 SID's then you are talking about bootstrap loading.
Two completely different things, what does one have to do with the other?

Bootstrap is bootmode, with bootpin to ground. There are no SID's there, there is no service stack. Just low level communication:
http://alt.ife.tugraz.at/datashts/Siemens/ap160701.pdf
You write your own communication logic.

WTF do KWP2000 SID's have to do with it?


« Last Edit: March 08, 2021, 04:49:24 AM by prj »	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Re: Reading E2PROM with loader by OBD « Reply #4 on: March 08, 2021, 05:10:12 AM »

Quote from: prj on March 08, 2021, 04:47:51 AM

Oh, Ok. Misunderstood.
I have a bootloader file for an ECU(Bosch ME7.4.4 with c166 arch). I write this bootloader on RAM area with KWP protocol. (with SID 0x3D).
After write the bootloader I sent the command that shown in below:
0x81 0x11 0xF1 0xFF 0x82

After this E2PROM reading goes to start. And the operation ended successfully.

All of these operations done with OBD.
Now, I want to do these Operations with another ECU. But when I sent the 0x3D SID to ECU it returns 0x7f 0x31 to me.

Is it possible that an ECU cannot write to RAM?


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: Reading E2PROM with loader by OBD « Reply #5 on: March 08, 2021, 05:17:57 AM »

You are not writing a bootloader.
Nothing you do has anything to do with bootloading.
Use the correct words to describe what you are doing.

No idea what command you are sending to other ECU, it is not part of KWP2000 protocol.

Also call services by their names instead of hex ID's.
3D is writeMemoryByAddress, I already told you, you need a development session, not the default session.

Also I am not aware of a such blatant remote code execution on VAG ME7. You can probably force one, by trashing some ram executed routine, but uploading a payload to RAM and executing it while the ECU is running? Nope.

Sounds to me like you copypasted some tool, and not done any of this yourself.
You seem to not understand the very basics.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Re: Reading E2PROM with loader by OBD « Reply #6 on: March 08, 2021, 05:57:10 AM »

Quote from: prj on March 08, 2021, 05:17:57 AM

You are not writing a bootloader.
Nothing you do has anything to do with bootloading.
Use the correct words to describe what you are doing.

No idea what command you are sending to other ECU, it is not part of KWP2000 protocol.

Also call services by their names instead of hex ID's.
3D is writeMemoryByAddress, I already told you, you need a development session, not the default session.

Also, I am not aware of a such blatant remote code execution on VAG ME7. You can probably force one, by trashing some ram executed routine, but uploading a payload to RAM and executing it while the ECU is running? Nope.

Sounds to me like you copypasted some tool, and not done any of this yourself.
You seem to not understand the very basics.

Thanks for your generous reply.
So, yes, I copy a file(or bootloader or etc.… ) and I sniffed an operating that done this operation. Actually, I have a file that can read EEPROM and send to me by OBD , but I change some point of this file and now, I want to write that on another ECU. It seem it's not complicated.

Change the file is my job and I try to learn other stuff from you.

BTW, I heard you said before that I should use the development session. Right?
But I use the standard session For the previous ECU. How did it work for that ECU? I have shown that below:

Tool:0x81 0x11 0xF1 0x81 0x04
ECU:0x83 0xF1 0x11 0xC1 0xEF 0x8F 0xC4

Tool:0x82 0x11 0xF1 0x10 0x86 0x1A
ECU:0x82 0xF1 0x11 0x50 0x86 0x5A


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: Reading E2PROM with loader by OBD « Reply #7 on: March 08, 2021, 06:37:19 AM »

Once you understand what you are actually sending to ECU, and then what the hex means that you're getting back, then we can talk.
Until then there is no sense for me to continue this discussion, because you do not understand anything of what I am saying.

Also super duper assumption that comms stacks and open services across different makes are the same.
That's not even close to being the case. Especially when you are using some custom undocumented SID's.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

woj

Hero Member

Karma: +43/-3
Offline

Offline

Posts: 500

	Re: Reading E2PROM with loader by OBD « Reply #8 on: March 08, 2021, 02:03:52 PM »

Quote from: prj on March 08, 2021, 02:27:52 AM

Otherwise you can use ReadMemoryByAddress to read the mirror.

Not sure about VAG ME-s, but on my ECU the EEPROM mirror area is read-protected. Read-protection can be switched off by setting one of the CW-s in the Flash, so OBD re-flash first, then read the mirror. Perhaps there is a special diagnostics session (the development one, never knew it has this name, is necessary to do any ReadMemoryByAddress on my ECU IIRC) that bypasses the read-protection, but I never figured it out.

What the OP is on about - sounds like an undocumented monitor capability of some sort, can be an interesting thing from the ECU exploitation point of view Wink


	Logged

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Re: Reading E2PROM with loader by OBD « Reply #9 on: March 09, 2021, 12:29:19 AM »

While we were dealing with the names here, I was able to solve the problem.
I could read a mirror of EEPROM with SID 0x23. Only the correctness of the addresses was important and I successfully to calculate the correct address from ECU dump file.
Very simple.
Fortunately, the EEPROM mirror was not read protected, so I get EEPROM data clear.
Thanks.


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: Reading E2PROM with loader by OBD « Reply #10 on: March 09, 2021, 02:12:32 AM »

I told you to do that in the first post. Duh.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

unicornux

Full Member

Karma: +2/-6
Offline

Offline

Posts: 83

	Re: Reading E2PROM with loader by OBD « Reply #11 on: March 09, 2021, 03:50:56 AM »

I obeyed your orders, Sir.
Thanks a lot <3


	Logged

Pages: [1]

« previous next »

Jump to:

Navigation

Personal Tools

November 22, 2024, 10:41:01 PM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search