Hi,
I'm researching mg1 ecu and now stuck on security access, actually on two.
I can talk with ecu on bench and read mcu id, boot and security versions using 0x21 command. I believe it's sboot.
First security access request is done by sending 0x27 0x7F and getting 14 random bytes + one static byte, response to that is 0x27 0x80 with 128 bytes payload, where only last 20 are different each time.
Second security access is done by 0x27 0x01 and getting 4 random bytes, where response is 0x27 0x02 + 4 bytes answer.

Need help

I'm looking for an algo and keys for security access in this unit.
@prj, do you have such information ? I started reverse but it's not something that could be done in a minute.
Service section seems to be dead, so if anyone have something to offer - dm me.

Please send your ecu dump file to do a preliminary check. This can be very helpful.
So, according to the your message you could figure out first seed/key algo. do you want the second one now?
Do you have a sample for verification?

I'm not sure but I think the algo is related to the processor's model.

Any progress on this?

I'm not sure what the point is of posting a random dll which relies on the official method.
The official method is clear, you need a smartcard, which can do the private/public key crypto.