Pages: 1 ... 3 4 [5] 6 7 ... 9
Author Topic: MED 17 , EDC 17 EEPROM CHECKSUM  (Read 103591 times)
kuebk
Jr. Member
**

Karma: +3/-0
Offline Offline

Posts: 47



« Reply #60 on: January 03, 2019, 07:03:09 AM »

Figured out myself what I was doing wrong, nevermind.
« Last Edit: January 05, 2019, 02:21:03 PM by kuebk » Logged

VAG immo solutions (clone, immo off, repair) MEDC17, SIMOS, SDI, BCM2, ELV, DQ/DL/VL gearboxes, INVCON, MED9.x crypto
carservice
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 7


« Reply #61 on: March 07, 2019, 10:13:08 PM »

HI
 crypted CS, PIN, MAC algorithm ,You succeeded in the calculation?I did a lot of research, but it didn't work out.
Logged
carservice
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 7


« Reply #62 on: March 08, 2019, 11:02:29 PM »

You can deduct the XOR with known values.
It is calculated from unique ID from EDC17 from OTP area, so the XOR result is unique for each EDC.
I found the immo data in EEPROM and the encrypted bytes in the OTP area, but failed to compute.
« Last Edit: March 26, 2019, 07:54:33 AM by carservice » Logged
sandor1987
Jr. Member
**

Karma: +5/-4
Offline Offline

Posts: 46


« Reply #63 on: December 22, 2019, 05:13:34 AM »

somebody found out how to calculate cs pin mac etc?
Logged
Matrosek
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 4


« Reply #64 on: April 17, 2020, 05:05:32 AM »

Hi all, i`ve tried every possible combination and nothing seems to work....
For example this block
Code:
08 00 EB 04 94 53 00 00 FF B8 71 E0 EA 30 D0 E4 B1 8E 05 E4 35 AF 3E F2 8E 6A 09 9C A7 EF 80 E7 FC AE AE 56 AA 80 01 00 57 41 55 5A 5A 5A 38 54 37 42 41 30 39 37 36 36 31 48 EF E0 24 BA 6C 05 30 02 B6 6C 7D 43 97 A4 F9 B1 EF BF F7 74 FB 67 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C1 4E 00 00 56 8D F6 1C
Tried with CRC32 with poly 0xEDB88320, initial value 0xC14E0000, bytes from 8 to 7F (119 bytes) and result is D7A854D and it should be 56 8D F6 1C.
With initial value just first 2 bytes (0xC14E), result is F219CCDD, with fist 2 bytes reversed, result is AA79A104 and with initial value 0x4EC10000 (each 2 bytes reversed) result is 418F9500

Here is the C# code used for CRC32:
Code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace FwpCrc
{
    class CRC32
    {
        uint[] table;

        public uint ComputeChecksum(byte[] bytes, uint initialValue) {
            uint crc = initialValue;
        //  uint crc = 0xffffffff;
            for(int i = 0; i < bytes.Length; ++i) {
                byte index = (byte)(((crc) & 0xff) ^ bytes[i]);
                crc = (uint)((crc >> 8) ^ table[index]);
            }
            return ~crc;
        }

        public CRC32() {
            uint poly = 0xEDB88320;
            table = new uint[256];
            uint temp = 0;
            for(uint i = 0; i < table.Length; ++i) {
                temp = i;
                for(int j = 8; j > 0; --j) {
                    if((temp & 1) == 1) {
                        temp = (uint)((temp >> 1) ^ poly);
                    }else {
                        temp >>= 1;
                    }
                }
                table[i] = temp;
            }
        }
    }
}
I`m doing something wrong?

Hi all, I used code from post #39 and CRC from post #38, but I get wrong CRCsum. What I'm doing wrong?
My code:
Code:
using System;
using System.IO;
using System.Text;

namespace TricoreCRC32Calculator
{
    public class Program
    {
        public static void Main(string[] args)
        {
            while (true)
            {
                Console.WriteLine("\nCRC-Calculator...");
                Console.Write("File name: ");
                TricoreCRC32 CRC = new TricoreCRC32(Console.ReadLine());
                Console.WriteLine(CRC);
                uint initValue = 0x00000036;
                uint result = CRC.ComputeChecksum(initValue);
                Console.WriteLine("{0:X}", result);
                Console.Write("Continue or exit: ");
                if (Console.ReadLine() == "exit") break;
            }
        }
    }

    public class TricoreCRC32
    {
        private byte[] block = new byte[124];
        private uint[] table = new uint[256];


        private async void ReadBlock(string nameFile)
        {
            try
            {
                await new FileStream(nameFile, FileMode.Open).ReadAsync(block, 0, block.Length);
            }
            catch (FileNotFoundException)
            {
                Console.WriteLine("Not found file!");
            }
            catch (IOException)
            {
                Console.WriteLine("Another error!");
            }
        }

        public TricoreCRC32(string nameFile)
        {
            ReadBlock(nameFile);
        }

        public override string ToString()
        {
            StringBuilder block = new StringBuilder();
            for (int i = 0; i < 124; i++)
            {
                block.AppendFormat("{0:X}", this.block[i]);
                block.Append(' ');
            }
            return "Block: " + block;
        }

        public uint ComputeChecksum(uint initialValue)
        {
            CreateTable();
            uint crc = initialValue;
            //  uint crc = 0xffffffff;
            for (int i = 0; i < block.Length; ++i)
            {
                byte index = (byte)(((crc) & 0xff) ^ block[i]);
                crc = (uint)((crc >> 8) ^ table[index]);
            }
            return ~crc;
        }

        public uint[] CreateTable()
        {
            table = new uint[256];
            uint poly = 0xEDB88320;
            uint temp;
            for (uint i = 0; i < table.Length; ++i)
            {
                temp = i;
                for (int j = 8; j > 0; --j)
                {
                    if ((temp & 1) == 1)
                    {
                        temp = (uint)((temp >> 1) ^ poly);
                    }
                    else
                    {
                        temp >>= 1;
                    }
                }
                table[i] = temp;
            }
            return table;
        }
    }
}

Right CRC is F2 78, but I get 42 0D 0B 00. Block file in attachments.
Logged
lgmautoeletronica
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3


« Reply #65 on: November 24, 2020, 12:31:07 PM »

hello boys .my name and leandro i'm new to the forum, but study a little about the vw line and create some solutions for my daily use. i create scripts for the original upa only, i was trying to enter the forum to participate and i was very interested about the subject of edc17 and med17. someone could help create this algorithm in pascal. if you can I thank you and agree price.
my email lgmchaveiro@gmail.com

if i can and personally agree i can send some images of my scripts

 whatsapp 55 54 991062864
 thanks
« Last Edit: November 24, 2020, 02:41:33 PM by lgmautoeletronica » Logged
danyguit2000
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 1


« Reply #66 on: December 02, 2020, 09:32:52 AM »

Next update Smiley


Algorithm for CS1:
data from - 0x04
leight - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}




This code returns double word (64bit) CRC !
If anyone wants to see where this code comes from look at this document, refer to page 5 and 6
In other words it is not applicable to the thread.
https://www.infineon.com/dgdl/ap3208510_tc1766_mchk.pdf?fileId=db3a304412b407950112b409ca48035c
There is some correct, but also misleading information about the eeprom CS.
Logged
arenasaa
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #67 on: August 03, 2021, 01:02:05 AM »

What about TC1793 that doesn't seems to use CS2. Blocks still looks to be same size, but no block ID is used.

Emulated eeprom is 192Kb in size.

At place where normally CS2 is, only something similar to CS1.




who knows what is the init value and the data area in this case?
Logged
lgmautoeletronica
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3


« Reply #68 on: September 13, 2021, 12:40:46 PM »

simple crc16, does not have 2 crc
Logged
lgmautoeletronica
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3


« Reply #69 on: September 13, 2021, 12:46:54 PM »

It's really ; complicated for me to decipher the data , from med17 and edc 17 . to crc 2 words ok I type in pascal delphi , but decypting is very difficult , it is not a simple xor , or it can be you but I really tired looking , unfortunately I don't know how to reverse engineering, but I really like to study and create my applications, who knows someone with a good heart can clear my head more.
 
 
Logged
Auto-elect
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #70 on: January 03, 2022, 11:37:34 AM »

Hello Friends
For those who managed to calculate CRC 1 and 2, please tell me where is the problem? ..
I translated the code from  H2Deetoo:
Code:
unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}


 To pascal here is my code:

Code:
function CRC32T(Initial: LongWord; Data:array of byte; DataSize: LongWord): LongWord;
const poly=$EDB88320;
var j:integer;
tmp1,tmp2,crc,i:longword;
BEGIN
crc:=initial;
i:=0;
while i<=DataSize-1 do begin
tmp1:=0;
tmp2:=crc and poly;
for j:=0 to 31 do tmp1:=tmp1 xor ((tmp2 shr j) and 1);
crc:=Data[i] xor ((crc shl 1) or tmp1);
i:=i+1;
end;
CRC32T:=crc;
END;

my function seems to work perfectly .. I have checked it with the results of the site crccalc.com
the result is 100/100 identical, of course when I choose 0xFFFFFFFF as initial value, and the result is xored with 0xFFFFFFFF.
This allows me to be sure that there is no error in the implementation of the code.

Now the problem is in the choice of the initial value and the data area.
here is an example:
0x4000      01 00 30 30 00 00 00 00  00 00 00 00 00 00 00 00 
0x4010      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4020      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4030      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4040      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4050      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4060      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4070      00 00 00 00 00 00 00 00  2B 00 00 00 C9 B0 BF B2

CRC1 = 3030
CRC2= C9 B0 BF B2

CRC1 Calculation :(From the H2Deetoo document)
Initial value: 00 00 00 01 ; data area from 0x4004 to 0x407F (It seemed strange to me that the crc2 will be included in the data area);
the function return :A1 45 D9 88 which is not correct..
I even wrote an algorithm to permute all the possible cases of the data area..!!
same thing for the choice of the initial value, I made all the permutations you can imagine Cheesy Cheesy

Same thing for CRC2


A charitable soul could tell me where I messed up.??


Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257


« Reply #71 on: January 12, 2022, 11:49:20 PM »

This block doesn't conform to the standard CRC1/CRC2 checksums as described here!
ADDR=000000 BLOCKID=0001,
CS1=3030 -> ERROR, should be 00003071,
CS2=B2BFB0C9 -> ERROR, should be BB1DB377

Maybe this block was modified?
Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257


« Reply #72 on: January 12, 2022, 11:56:33 PM »

Block 0001h normally holds some dates Bosch numbers, so your block really looks handcrafted.
Logged
Auto-elect
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #73 on: January 13, 2022, 07:16:52 AM »

Thank you very much H2Deetoo for all the information posted,
I managed to get the crc1 and crc2 algo to work properly.
for the example I put yes..c was not an original.

my pascal translation is also correct .. it was necessary to read the data in 32bit swaped. Cheesy..

Logged
reproteq
Newbie
*

Karma: +0/-2
Offline Offline

Posts: 8


« Reply #74 on: February 12, 2022, 12:03:16 PM »

Hi alls i am newbie in this forum
I need a litle help for finish mi tool


https://ibb.co/WF3HNCk
Logged
Pages: 1 ... 3 4 [5] 6 7 ... 9
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.029 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)