Hi guys,

I've been working with a scan tool cable based on the ELM chip and trying to write a flashing program with that.  Been through all the documentation on this site and while the general process for write/read is outlined in the kwp2000 protocol I cannot seem to find detailed info on security access.  Specifically wondering if anyone can shed some light on how responses to the seed are calculated.  I've seen speculation that it is a function of the ECU ID but nothing solid that has worked.

Thanks in advance.