Hello, i'm trying to unlock a module on LandRover Ranger Rover Sport L494 2020, the module is BECM (Battery Energy Control Module) - address 0x17e4 on DoIP (or 0x7e4 on can bus).
what ive done so far is read some identifiers, and change session to programming session (10 02) and it responds positive (i saw that this is how Pathfinder does it - which is JLR software for DoIP vehicles.
But now i'm stuck at security access.
From the logs i got of a successful flashing session (with pathfinder) the device sends sid 0x27 0x01  (request seed- level 01) and ecu responds with seed, then device sends a key (0x6701 ...key).
i got  4 samples, but can't get a clue of how the seed is transformed into a key.
Any help is much appreciated.

level 0x01:
seed: 2c f3 5d
key: be 57 a1

seed: e8 be 7c
key: 68 09 31

seed: 4a db 91
key: 72 04 a8

seed: e3 80 1d
key: a5 b0 23