logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[Solved] BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

glapsson 132804 291
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
| New topic
  • #121 19562996
    glapsson
    Electronics specialist  
    It works for me
  • ADVERTISEMENT
  • #122 19608525
    AyhanYavuz7
    Level 6  
    glapsson wrote:
    Arduino CANbus monitor
    Mini version
    but with handy features.
    Start
    Stop
    cleaning the window
    and most importantly, direct saving to a text file.
    These functions are especially useful as we want to divide the readings and save in one session without combining with copying and pasting.
    For this improved version of the batch for Arduino because the previous ones started with a bad speed and it did not always want to surprise automatically at 500kbps

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    In the attachment - parts of SMEG encodings with a description into containers and bits


    Can we use Arduino for this?
  • #123 19608530
    glapsson
    Electronics specialist  
    you can but with a batch for CAN monitoring
  • #124 19608536
    AyhanYavuz7
    Level 6  
    glapsson wrote:
    Arduino CANbus monitor
    Mini version
    but with handy features.
    Start
    Stop
    cleaning the window
    and most importantly, direct saving to a text file.
    These functions are especially useful as we want to divide the readings and save in one session without combining with copying and pasting.
    For this improved version of the batch for Arduino because the previous ones started with a bad speed and it did not always want to surprise automatically at 500kbps

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    In the attachment - parts of SMEG encodings with a description into containers and bits


    can i encode nsc with it?
  • #125 19608546
    glapsson
    Electronics specialist  
    to canbus monitor ..... is not for coding only for viewing CAN communication
  • #126 19608557
    agreje
    Level 3  
    Hi, I am writing with Google Glapsson translation. Sorry for the mistakes. Thank you, a very useful page. My first question is that your BSI program will not be made available, is that true? 2. My question is, you've arrived at the diagbox menu.
    Thank you.
  • #127 19608678
    AyhanYavuz7
    Level 6  
    glapsson wrote:
    Another version of the BSI program
    I have now improved my mileage customization.
    It is also possible to enter VIN and PIN into the cleared BSI via OBD.
    Soon I will add taking options on VIRGIN and I will try to reset history .. but it's complicated ...
    Mileage and Virgin will be "hybrid" operations - available after the batch has been ripped using the programmer.

    You can also download the CRC-16 / CCITT-FALSE checksum calculator
    for earlier work - with coding on a batch with a net.

    [movie: ecc7a21556] https://filmy.elektroda.pl/55_1621635501.mp4 [/movie: ecc7a21556]


    THANKS
  • ADVERTISEMENT
  • #128 19608883
    glapsson
    Electronics specialist  
    The diagbox menu was a work that took a long time.
    It involved changing bytes and reading what had changed - and then putting it into the program.
    Such reverse engineering .....
  • #129 19621741
    magicphone1
    Level 1  
    plz can you share the pinout to read the eprom of Bsi Ei5- CEM00 HD D6
  • #130 19628964
    AyhanYavuz7
    Level 6  
    glapsson wrote:
    As for the blockade, I think I agree, but I will see other options.
    For now, I will be testing the lock options because it's strange that everything will pass and not save.
    the coding area is extended by a dozen or so cells with "switches"
    the whole area of coding and "switches" ends with a -CRC-16 / MODBUS checksum.
    So there will be no problem to fight with "switches", maybe something will be explained ---- such a hobby.

    As for the various keys from the network - a colleague bbmax - asked to test a certain encryption key.
    unfortunately it doesn't work - which is why my decision to look for real codes.

    Because as I wrote ESP, I have already blocked --- I did not make a copy of the batch- a ...

    two movies with the code broken
    and with my code

    everything can be seen in the logs what has passed and what has not.


    FILM WITH CODE BE and here a warning - the code can be seen and not to use it.
    Maybe it works with several SEED codes but it just failed in my test.

    [movie: 7e0f120488] https://filmy.elektroda.pl/35_1621333781.mp4 [/ movie: 7e0f120488]



    FILM WITH CODE OK
    [movie: 7e0f120488] https://filmy.elektroda.pl/69_1621333806.mp4 [/ movie: 7e0f120488]

    I am also throwing logs from txt encoding.

    I will also put in here the identification readings of the batches that I tested.
    Because in previous posts there was such a request.
    I get coded on all of them, but I can't remember them.
    And that's why something from the blockage may be up.

    cross-section of various cars: c3 III, 3008 II, 208II and probably 508

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F


    TANKS
  • #131 19630155
    glapsson
    Electronics specialist  
    Due to frequent requests for BSI DELPHI HW D6

    here are the pinout for 95128

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    - Copying the eeprom BSI batch to the BSI - will not work if there is a different SW version (because the flash batch determines how the eeprom is written) - only a full flash and eeprom copy makes sense.
    Copying the eeprom itself only makes sense with the same SW version otherwise everything will fall out - you have to code and assign
    - copying the same SW version - it will probably not copy the PIN - because it is hardware-encoded in a specific BSI
    and here - coding can go, VIN too, but the rest will fall out. - unfortunately, I have never been able to purchase two bsi with the same SW, so this is a theory .... but as you can see at the beginning of the topic, the same key in different SW has different data ....
    - ENCODING - You can encode on bytes in a batch, but you have to count checksums on foot - this is somewhere at the beginning of this topic and here the pinout makes sense.
    - BUT - For cheap and simple coding I recommend ARDUINO and what's on the web, and those who have Diagbox probably do not look here because and why.
    - Pinout will also be useful if someone wants to make corrections in the batch (Mileage, PIN, VIN, VIRGIN, history reset)
    As for the history reset - the procedure is quite complicated - clearing itself - kills the history record - it has to be done in a certain way
    cars in which it is impossible to read the history - they are corrected and it is very easy to spot it - if someone buys a car, I recommend looking at the history at BSI ...
    And how to improve the history of BSI when migrating BSI I described it in one of the instructions for bsi DELPHI - of course, it is only about the need to migrate bsi due to defects, other activities related to concealing the facts are illegal.
    - For connecting other ECUs to the BSI:
    IMPORTANT - so-called IGNITION was turned on in bsi
    and here the stairs begin because it will only work with a coded mechanical key -
    someone once said that his communication does not work ... maybe because he has an encoded electronic key.
  • #132 19630625
    bbmax
    Level 15  
    I will add which lines to connect other ecu to bsi (delphi, valeo)

    this below is for delphi
    electronic key and DML
    wife 231B launch
    Change the options here to 00
    0- dcm maintenu
    1-dcm degrade
    2-dml impulsionel
    3-dml maintenu

    Zona 230A version of the key
    Change the 4 options to 00
    0- cle mechanical
    1-cle electronique
    2- cle MainLibre

    I have bsi + nac + cirocco + visiopark2 + airbag (bosch) + lcd with fmux on the table now and everything is connected
  • #134 19636858
    glapsson
    Electronics specialist  
    CAUTION

    If you are using French software and you are using an Arduino terminal.

    And you have a problem logging into the driver, e.g. BSI

    sending commands in this form does not work for you:

    : E4D8: 01: 02

    the driver is most likely blocked from sending SEED

    the software for Arduino from the French does not consider this case and sends the request only once.

    the effect is that you get:

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    to remedy this, you can throw in a patch to execute the code until you get a reply.

    As can be seen on inquiry 27 ..
    we get error 7F 27 ..

    we refuse to accept such errors and we order you to resend your inquiry.
    the key is the delay between queries - it may be different for different drivers.
    for the Valeo BSI it could be delay (1000);

    you should paste or paste the code fragments in the following places:


    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F


    No. 1 - we add a condition

    Code: text Expand Select all Copy to clipboard
      if (canMsgRcv.data[1] == 0x7F&& canMsgRcv.data[2]!= 0x27 || (lastCMDSent > 0 && millis() - lastCMDSent >= 1000)) 



    No. 2 - we add a line of code

    Code: text Expand Select all Copy to clipboard
     if (waitingUnlock && canMsgRcv.data[1] == 0x7F&& canMsgRcv.data[2]== 0x27 )
         {
            sendDiagFrame(UnlockCMD);
            delay(1000);
         }




    At this point it should look like this:

    Code: text Expand Select all Copy to clipboard
    
    if (canMsgRcv.data[1] == 0x7F&& canMsgRcv.data[2]!= 0x27 || (lastCMDSent > 0 && millis() - lastCMDSent >= 1000)) 
    
    { // Error / No answer
      waitingUnlock = false;
      waitingReplySerialCMD = false;
      lastCMDSent = 0;
    } else if (waitingUnlock && canMsgRcv.data[1] == 0x50 && canMsgRcv.data[2] == DiagSess) {
      sendDiagFrame(UnlockCMD);
    }

    
    if (waitingUnlock && canMsgRcv.data[1] == 0x7F&& canMsgRcv.data[2]== 0x27 )
         {
            sendDiagFrame(UnlockCMD);
            delay(100);
         }

         

    if (waitingUnlock && canMsgRcv.data[1] == 0x67 && canMsgRcv.data[2] == UnlockService) {
      char tmp[4];
      char * SeedKey = (char * ) malloc(9);
      char * UnlockCMD = (char * ) malloc(16);


    and here

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F


    after this operation, Arduino asks until it gets a SEED answer
    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    And another note
    You can apply this patch when working directly from the terminal
    If you use the windows frontend and you condition the SEED reception there
    you put the fix in this software, not in arduino.
  • ADVERTISEMENT
  • #135 19658279
    glapsson
    Electronics specialist  
    Another small step
    With Arduino you can read eeprom.

    Please do not pay attention to the form of the program because it was easier and faster for me to attach it to an existing program.
    This is the so-called dirty version.
    So it worked, I will probably start it in the new program.

    In the video shown - VALEO
    Full R / W login procedure

    It took a while to beat the algorithms .....

    The Arduino batch once again had to be converted for myself.

    I tried reading with larger packets but so far it has not worked - either it's the operator's fault - i.e. mine or the hardware.
    I'm an Amateur in these topics ... but I'm getting to know something new all the time.
    It is possible to query larger packets and it goes faster then - but .. I have a problem with receiving such packets - although everything is OK on the CAN analyzer.

    But it is possible to read each frame by polling separately - reading eeprom takes a little longer - about a minute after logging in.

    Of course, the textbox form and the rest - to be changed - I was more concerned with whether the Arduino will handle it.

    Next I'll be testing DELPHI

    [movie: 3495363d50] https://filmy.elektroda.pl/23_1634327562.mp4 [/ movie: 3495363d50]

    In order for no one to say that only the videos are in the attachment a description of the first stage of logging into BSI VALEO.

    And a little comment:
    The data that I indicated are in flash in BSI Valeo, and which need to be sent - it seems to be the same for all BSI VALEO
    so you just need to rewrite them.
    I assume it is.

    And here the question is, maybe someone has a flash batch from BSI DELPHI?
    or flash upload log from some CAN analyzer - BSI DELPHI- and would like to share for analysis?
    Or a login dump of some other BSI DELPHI interface.

    I know for sure that DELHI also has SEED double login
    And I decided that, unlike in VALEO, two different keys are needed to log in.
    And I have already deciphered these keys.
    Attachments:
  • #136 19658518
    melas
    Level 31  
    Our little genius is getting ready for us, mate. Regards
  • #138 19660404
    glapsson
    Electronics specialist  
    To be able to continue logging in, you need to modify the Arduino batch.
    I have the batch prescribed a little differently and if I showed it on my batch it would be a problem for those who start from 0 to understand what is going on, so it will indicate where you can add it.
    And I warn you if some "professional" from this forum for professionals will have comments and will not throw even one screen or link to help or topic or even one line of code as if it could be done differently - this topic will end like the previous one.
    I would like to add that first he should also pay attention to the name of the topic and then refer to the programming method.

    This software that is on Arduino is not my work - it's of French
    Here it just adds something from itself to ... itself - although I already have this batch rearranged in a different way. but these changes here are enough for logging to work. And it works - no one will organize a competition on time.

    In Arduino we add a method

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    In principle, you can copy an already existing method of sending a frame
    and then just apply the changes
    firstly, the name has changed ... because it has to be called differently

    Secondly, we leave the first "char" because we will send the frame marker in it.

    so not from 0 to
    Attachments:
  • #140 19676880
    glapsson
    Electronics specialist  
    Reading FLASH from VALEO mastered.
    BUT:

    While reading eeprom after 1 CAN frame (32kb) takes 62sec. (1 minute) and it is acceptable.

    That's it

    flash is 48x bigger than eeprom

    Thus, the reading in this form takes about 50 minutes.

    It is not done every day and it would be acceptable too, but in 50 minutes a lot can happen.
    Running out of electricity etc ....

    I checked that Arduino can receive 8 good frames for 1 time, but because they are not multi-type frames,
    that is, they do not have a description of how many bytes it will be and the next frames are not indexed - Arduino does what it wants - how it sends it to the series.

    The first two frames are ok and then, for example, with 4 frames it gives in this order ..
    1 2 4 3

    of course arduino is only a problem as these frames have to be sent to the computer after the series.
    Because the Arduino, as I wrote, receives several frames ... but to be able to process them in a computer with one loop, the loops must be sent as 1 string, they must be merged before sending to the serial.

    Now, to read flash, I have, for example, x number of frame query loop
    by receiving the merged two frames as 1 string, I could reduce the query quantity by half
    the time for a reading would therefore be halved - that is much less.

    And a reading of 4 frames would be completely satisfactory.

    I need to work on this
  • #141 19677550
    PeugeotTeknik
    Level 7  
    Perzan0101 wrote:
    goes to run android auto in rcc with this Arduino device if it is not available originally ???


    Tanka
  • #142 19679938
    agreje
    Level 3  
    glapsson wrote:
    Due to repeated inquiries about selling the program
    I encourage everyone to write their own version.




    I want to improve myself. Did you create it in Visual Studio, how can I open it, thanks.
  • ADVERTISEMENT
  • #143 19680385
    glapsson
    Electronics specialist  
    The VisualStudio project started below.
    As for the style - if it does not suit someone - let them throw it into the trash.

    It includes a monitor because that was the request for that too.
    I myself think that it is redundant because we get the same after processing in the form of data.

    The content is a VS project

    this is how it looks like in the movie:

    [movie: f99dbe4348] https://filmy.elektroda.pl/86_1635516846.mp4 [/ movie: f99dbe4348]
    Attachments:
  • #144 19680488
    glapsson
    Electronics specialist  
    I will come back to the topic of eeprom download and write using ARDUINO with BSI after OBD

    Valeo composed.

    but there is a problem with CONTINENTAL

    because either there is another SEEDKEY algorithm
    or there are other so-called "secret codes of the algorithm"
    Logging into the date mode looks like this:

    FD 00 00 00 00 00 00 00
    FD 47 E9 04 17 00 00 00
    FE DA DA 35 98 00 00 00
    FE 00 00 00 00 00 00 00

    Unfortunately, it is not possible to generate a key from this pair based on a known algorithm.

    The diagnostic session key is C318

    unfortunately after substituting this SEED and key

    47E90417

    generates:

    657F5D7B

    and it should
    DA DA 35 98

    and no other key from the scope:
    0001 to FFFF

    does not give such a SEEDKEY

    So either a different computation algorithm or other algorithm codes.
    Maybe someone has something?

    Here are a few working pairs - for any of them it is impossible to generate a key from the current algorithm and codes.

    BA9C053B
    0D868B58

    6007F43B
    95AF9B83

    F9FD9F19
    740A2104

    D9C7F26C
    672C2847

    F60E69CB
    58EC7560

    0E59E495
    05C403B6

    6233ED06
    41091E50

    E12AC4B1
    392E3736

    A457AEAC
    6BA6C124

    I even wrote a decoder for these secret codes, assuming we know the key
    then we have to decode a number consisting of 255x255x255x255x255x255 possibilities

    The jump to the 4th position takes place every 24sec - with a good, unloaded 20sec comp.
    255x20 = that is, every 17 minutes for 5 positions
    255x17 = 72h need to jump to the 6th position ..

    and on the 6th position there are another 255 possibilities ... it's about 2 years ... well, you need some time

    and this is assuming that we know the key.

    because we still have 65535 key possibilities.

    Sooner the sun has time to become a red giant ............

    However, there are interfaces that read this bsi - so the algo or the codes are known.

    Maybe someone came across something on the network?

    in this video you can not see the change in pos. 1 and 2 because it is so tight that you simply cannot see it.
    [movie: d8719fdfd0] https://filmy.elektroda.pl/81_1635520940.mp4 [/ movie: d8719fdfd0]

    As for the keys, I have certain types
    Because in flash next to the encoding key in diag C318 mode.
    there is ... maybe a second key .. with an emphasis on maybe
    because it might be in a different place entirely.

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F
  • #145 19681523
    agreje
    Level 3  
    glapsson wrote:
    Due to repeated inquiries about selling the program
    I encourage everyone to write their own version.



    You are great. Thank you very much, brother.

    Could you please give the visual file of the * .exe PSA BSI TOOL you gave here? There is more data in it that will help me.

    I was able to work. I am thankful to you.
  • #146 19683628
    glapsson
    Electronics specialist  
    As in another thread, I admitted to my colleague:
    tzok
    he was right - that's why I asked to close.

    I know this is far from perfect but I improved:

    part of the code is above.
    Buttons and all descriptions are dynamically generated from an external txt file.

    The code has been greatly simplified.

    BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

    For those few buttons in the middle, you can also do it, but ... without exaggeration ...
    Although I will actually do it - it will be easier to translate into other languages like something.

    [movie: f635447c70] https://filmy.elektroda.pl/47_1635689869.mp4 [/ movie: f635447c70]
  • #147 19687662
    drago
    Level 20  
    @glapsson Great Respect for your work and time,
    @bbmax also Great Respect for knowledge and time.
    I am currently working (in my free time) on the full pin-out of the cirocco meter from the Peugeot 3008/5008 after 2017, which I am going to mount to my 508 from 2012. Mechanically, of course, it does not fit and I have to cut the board, but before I do it, I would like to have all the working functions that I have, i.e. ESP on / off, PDC sensors on / off. Thanks to my friends from France, I had no problems with setting up Nac, a 180-degree camera, cirocco ... but I would like more goodies. The guys from France are combining with arduino to get around ESP, I am combining with the cirocco eeprom to activate it (I have already written and measured all the pins of the meter). I have an original dump in which one input in cirocco works and it seems to me that the eeprom modification should run ESP and PDC, plus the appropriate pin overvoltage in the 18-pin plug (without combining with the arduino). In addition, I would like to show speedlimit on cirocco, a colleague from Russia did it but he wants massive money for it. I treat it as a hobby, I like to bury something next to my car, will you help?
    Greetings.
  • #148 19688052
    bbmax
    Level 15  
    There is a strange thing with cirocco and it also depends on the software ..
    From which FW have a problem, even at the dealer with the diagbox, it incorrectly codes the confused configuration zones.

    As for the cube, you can assign a maximum of 7 inputs and 7 outputs (led), I still have an arduino at home, but the fuel pump has died and the car is standing, I can finally collect and check this ESP and PDC natively ..
  • #149 19688102
    glapsson
    Electronics specialist  
    This will probably be the final version of the BSI coding program.
    Due to the use of dynamic button generation, it is good to edit without interfering with the program code.
    I post a program with working encoding in the "calculator present" zone
    in PL I have other zones .. but it's not free anymore.
    I haven't done the rest on EN yet.

    The program is bilingual in PL and EN
    and maybe I will also do FR because I have a list in this language from my friend bbmax

    That's how it works:

    [movie: 2715582559] https://filmy.elektroda.pl/74_1635938897.mp4 [/ movie: 2715582559]



    I must add that in the version here posted as a DEMO with the possibility of encoding the calculators present, I did not implement the "N" normal function for the Arduino batch.

    If, during the test, someone receives artifacts instead of the VIN number and has problems with communication, I suggest manually switching to this mode from the terminal.

    Just fire up the terminal and enter N on the send line and send it to arduino.

    The full version of the PL and EN program, which is basically ready - also has the ability to download the full configuration without the need to break through single coding when transferring data to another BSI.
    Attachments:
  • #150 19688107
    bbmax
    Level 15  
    glapsson wrote:
    ...
    I post a program with working encoding in the "calculator present" zone
    bilingual version in PL and EN


    mega robot :)

    Probably there will be anomalies because BSI has it to himself that depending on what SW reference version has more or less options present ..
    but it will complete over time ..
| New topic
Report a violation of the law

Topic summary

The discussion revolves around the telecoding and reading of BSI (Body Systems Interface) units, specifically the DELPHI series EL HW D6 used in Peugeot 208 II and Opel Corsa F models. Users share their experiences with reading EEPROM data, modifying mileage, executing VIRGIN states, and performing diagnostics without online access. Various methods for telecoding and the challenges faced with different BSI versions are explored, including the need for specific algorithms for PIN code extraction and the importance of checksum calculations. The conversation also touches on the use of Arduino for interfacing with these systems, the development of coding software, and the sharing of resources among users to enhance their capabilities in working with BSI units.
Summary generated by the language model.
ADVERTISEMENT