[Solved] BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

@glapsson nice grazing, and speed of reading.

Still looking for a solution for keyseed CONTINENTAL - eeprom reading
start here: https://www.elektroda.pl/rtvforum/topic3743099-120.html#19680488

I decided to commit a little program to decompose the PSA algorithm.

Maybe thanks to this - by looking at the components and what and where when it occurs - it can be mathematically reversed.
maybe not.......

If someone wants to play, I put a applet.

I would like to help, unfortunately I am not fluent in this topic (cryptology).

Maybe someone has an idea or knows what algorithm connects these SEED and SEEDKEY pairs

44BA4A48
445C6F75

8AAED9D9
971229CD

B71D5FCD
C5B30385

16BBC2B9
5E1F5BFE

F4B466E1
33B03C6E

120C010E
9351E800

D24C87CE
F1CE9379

4538BB55
086957DC

E04D293E
0C53D7B8

BA9C053B
0D868B58

6007F43B
95AF9B83

F9FD9F19
740A2104

D9C7F26C
672C2847

F60E69CB
58EC7560

0E59E495
05C403B6

6233ED06
41091E50

E12AC4B1
392E3736

A457AEAC
6BA6C124

Below is the BSI configuration program (coding - basically finished ... testing, I'm looking for errors such as unnecessary active switch ... something does not go out, etc.

program in the PL and EN version (EN is a translator .... may require corrections.)

The program was able to download the full configuration on the basis of all coding zones known to me (about 400).
So I have a BSI and it asks about all zones in my database.
If bsi does not respond to a given zone (because it is not in the software) then it is not included in the backup file.
As a result, only the zones that are in the backup file are uploaded to the new bsi.

Due to many questions about the availability of the program - ask by email because I will need some information to run.

[movie: 850dd0a5cc] https://filmy.elektroda.pl/63_1636982781.mp4 [/ movie: 850dd0a5cc]

Tonight or tomorrow I will throw in a free BSI VALEO eeprom and flash reading program for testing (this is a test version - you use it at your own risk).

of course, I will attach the Arduino batch because I had to make changes to be able to send logins to the BSI.

Files available for points - but you can always ask me for points if you don't have any.

Below are two attachments - not an encoder just mentioned for eeprom and flash reading
VALEO is currently operational, and continental and delphi logging is partially running.

If anyone has an idea for the SEED algorithm for continental
pairs in the previous post, I will finish the continental and share.

The rest of logging into Conti. I have composure.

VIN recognition is already in valeo .. for now open.

Thank you

Testniete and something does not go, spitting log2.txt in datalog / valeo /

bbmax wrote:

Testniete and something does not go, spitting log2.txt in datalog / valeo /

sorry .. so I cleaned my test files that I also cleaned the log files ..
Already added no points

it reads probably ok
but not saving

only eeprom is not written to flash

a few words of explanation
read files are saved as .bin - in the program in the Datatemp directory
Uploading traditionally from the indication of the file.

The program is still in the process of being developed and has many operating flaws
I don't know what it will look like in the end, that's why some things are suspended.
There is no flash programming entered because I have the impression that after uploading I found two errors and I do not know what they result from.
So that someone on my dogs does not know that he has damaged himself - there is no this option ... with eeprom, it always somehow goes to get out.

After reading and uploading, it is worth turning off and on the bsi power supply, because it does not always want to start cold.

the progress bar is not fully established because some operations require several loops and I left it for tweaking at the end - when uploading - it starts quite late.
There is much room for improvement but I am facing the second SEED algorithm to continental
because I can't generate a reply.
I have further log operations worked out.
And now I focused more on research on this topic.

I understand, but you can't upload eprom, that's what I mean ..

It would be nice that the reference number was taken from the ZI F0FE wife, the last 3 bytes are the calibration ref number, i.e. the software reference number and to save the eeprom with this number

I checked - a moment ago - I took what I put in from the electrode and read it and programmed it without any problems.
So I don't know where your problem is ... this project is just under construction so .... it works as it works .. it may be due to differences in bsi ... I don't know

as for the naming of the file - it should be standardized in this way ...
as for the name itself, whether it will be it or something else, it is being overwritten at the moment - I have to rule it out too ... but it's not for now.
but at the moment the main issue is read-write stable.

I am more interested in whether everyone who has downloaded and tested on valeo works like me.
If there are problems - it would be worth using the analyzer to see where the problems are. so that I can eliminate them.
Well, because when it works fine for me, it's hard for me to change something blindly.

make a window so that the printserial goes to the window you will not need an additional tool .. but I will check this entry right away


it works, reading and writing something I had to crash.

it makes no sense .. the file can be named as you like.
I'm talking about eprom.
another thing is you read the eeprom file for the second time and previously you changed something (pin vin, encoding, etc.) ...
and what ... the reference will not give you anything because the information you have changed is important.
second, you overwrite these files by using only a reference.
You do one car and return to it after a few hours and in the database you have 100 files and only references ...
then you will find out which car it was.
As for the flash, I agree that the reference is definitely the site.

today I made a small correction because I played one loop a bit too quickly
and sometimes on CANI-e arduino could not be made.
and the log files were uploaded with the program

I'm going to do it in time .. now I have a different job.

otrzymuję ten błąd, a kiedy kontynuuję, znowu pojawia się błąd

Dodano po 5 [minuty]:

Win32 Version: 4.8.4110.0 built by: NET48REL1LAST_B
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
System.Xml
Assembled Version: 4.0.0.0
Win32 Version: 4.8.3761.0 built by: NET48REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------
System.DirectoryServices
Assembled Version: 4.0.0.0
Win32 Version: 4.8.3761.0 built by: NET48REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.DirectoryServices/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.DirectoryServices.dll
----------------------------------------
mscorlib.resources
Assembled Version: 4.0.0.0
Win32 Version: 4.8.3761.0 built by: NET48REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/mscorlib.resources/v4.0_4.0.0.0_en_b77a5c561934e089/mscorlib.resources.dll
----------------------------------------
System.Windows.Forms.resources
Assembled Version: 4.0.0.0
Win32 Version: 4.8.3761.0 built by: NET48REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms.resources/v4.0_4.0.0.0_en_b77a5c561934e089/System.Windows.Forms.resources.dll
----------------------------------------

************** JIT Debugging **************
To enable JIT debugging, this application or
in the computer's (machine.config) .config file
The jitDebugging value must be set in the system.windows.forms section.
Also compiled with app debugging enabled
should be.

For example:





Unhandled exceptions with JIT debugging enabled
saved on the computer instead of being processed in this dialog
The JIT is sent to the debugger.

Did you upload the arduino?
If not, you will not log in because the French batch does not provide for sending full login frames.
or you downloaded versions without log files ... I corrected it
download again - I will give you electrode points.

thanks for your support

glapsson wrote:

Did you upload the arduino?
If not, you will not log in because the French batch does not provide for sending full login frames.
or you downloaded versions without log files ... I corrected it
download again - I will give you electrode points.

hello I downloaded the program gets Eprom. But it doesn't pull the flash part.

We managed to add a change of mileage and a pin today.
If I do the stories and vin, I'll throw it in.

[movie: 6eacc63cd2] https://filmy.elektroda.pl/80_1637359758.mp4 [/ movie: 6eacc63cd2]

Hello
Wsady with LOCK you also mastered, read the pin ??

I haven't approached the topic yet
The next thing is changing the VIN ... on the file it is quite problematic
I'm talking about a bin file from a computer ... one from a database.
Because there are two versions of this BSI
open version
and lock version (Fu.k)
and the two versions have two different methods of positioning and computing the CRC for the VIN.
This can be done ... in the lock version, a bit
but in the open version ... hmmmmmm I have to think how to do it to make it count quickly and easily ... because the position of the CRC is variable.
In a workable file ... but in a damaged one with an incorrect output sum - it may fail.

There is no problem with a change on a living organism because after CANE it will do itself - just like in diagbox and writing it basically does not make much sense for a valeo.

Of course, I am writing this entire program on the basis of such that it is possible to process data both from BSI after reading and also from the file itself.
And the functions already available work like that.

I tested a little
There are 3 versions of the BSI software, the same eeprom is variable

Reference starting at 9679 ....
Pin plain txt can be changed Vin diagbox arduino
Reference starting with 9691 ... Same as above
Reference from 9695 ... Here's a LOCK and Vin can be written once like virgin bsi is

Flash return from 95 to 91 works but eeprom stays from LOCK does not change PIN stays the same

But a downgrade to 79 breaks the PIN and is still LOCK
This is when flashing .ulp files like diagbox does it ..

With a downgrade, when a good eeprom 79, 91, 95 is uploaded, depending on the reference, everything flashes

The program writes nicely, I will add that after writing, you need to turn off the power for a minute to clear the frame and save it in the eeprom.

I have mastered the VIN topic - regardless of the LOCK or open batch version or any other batch - changing the VIN in the .bin file with the checksum calculation.
The VIN lookup is an incremental area calculation with a cyclical shift until a matching checksum is found.
So - only in a working file.

maybe Virgin will come tomorrow .. then either flash or history .....
we'll see.

you can work with bin files only.

Only VALEO for the time being.

Maybe you could improve the reference reading because it does not match anything and does not change with the change of flash version and it should
Below is how it should look like and how the identification of these two wives is correctly written.

--- this is the reading of zone F080 --- the so-called ZA Authentication Zone which is invariable when flashing with diagbox
Tx 752 3 22 F0 80
Rx 652 25 62 F0 80 96 74 98 08 80 00 06 96 78 35 59 80 60 01 FF FF 00 00 FF FF FF FF



- Zona F0FE --- the so-called ZI zona identification, the reference number changes along with the flashing of the REF number, the last 3 bytes embossed
Tx 752 3 22 F0 FE
Rx 652 27 62 F0 FE 00 00 00 00 06 B3 1B 08 0C 10 01 6F 1E 17 0B 15 00 00 00 00 00 02 91 51 08

Slightly
but it will take a while

added virgin.
and changed the reference display.

Of course, it now only adds the executive file that needs to be replaced.

Correction = by doing virgin I fired the PIN change ... so it happens ..
For people with a small number of points - the program is developing and there will be a lot of changes.
And there will be errors that will be picked up over time.
The program will never be pointless ... so your decision whether you download corrections every now and then ... or wait for the end of the stage, e.g. VALEO.

Points are not a problem for people who share what they have ... because then they collect points.

I will exchange the BSI DELPHI encoder (or points) for:
valeo and conti PIN algorithms
and Continental login (2nd level eeprom download).
Maybe someone has .....

glapsson wrote:

Slightly
but it will take a while

added virgin.
and changed the reference display.

Of course, it now only adds the executive file that needs to be replaced.

Correction = by doing virgin I fired the PIN change ... so it happens ..
For people with a small number of points - the program is developing and there will be a lot of changes.
And there will be errors that will be picked up over time.
The program will never be pointless ... so your decision whether you download corrections every now and then ... or wait for the end of the stage, e.g. VALEO.

Points are not a problem for people who share what they have ... because then they collect points.

I will exchange the BSI DELPHI encoder (or points) for:
valeo and conti PIN algorithms
and Continental login (2nd level eeprom download).
Maybe someone has .....

hello there is a problem

You stay on the 3rd login.
Got the entire program downloaded with the files?
And don't quote entire posts - it's getting trash.



in the Datalog directory
is to be a Valeo directory
and in it two files log2 and log3

that was a lot earlier - I'm not throwing the whole program right now, only .exe modifications

And if there is still a problem, I will work on it.
I will add that the program is generally a curiosity - it works with Arduino.
I am not able to test all of the Valeos.

And it will cease to be a curiosity when Continental and DELPHI talk.

Respect for the work you put in
Any of your colleagues tried to code the engine controller?
I need such an operation
308 T9 driver VD46.1
I have read DIAGBOX encoding frames

and coding description


The problem is I don't know how to do it
you can see that here are multi frames
someone will suggest

Tomorrow should come V56.1 - I'll be writing the coding
we'll talk when I write.

you've got two encoding containers here
2100
2101

For example, 2101

HEX ---------------- BIN

02 -------------- 0000 0010
EF -------------- 1110 1111
F7 -------------- 1111 0111
F7 -------------- 1111 0111
DF -------------- 1101 1111

E.T.C.......

EVERY BIT CAN BE CODING.

so either you have a tool to change the encoding and check which bit is responsible for it - quick and simple solution
Either you change single bits and see what has changed - or it hasn't changed
A very time-consuming solution - it is best to write a quick program for such editing.

Here I also notice that the encoding is - as if Xored
It is similar in other ECUs (PSA engine controllers).
So 1 is an empty bit and 0 is the encoding, for example "YES"
I assume that this is also the case here - it results from the appearance of the coding.

it is also worth adding that it is often the case that there can only be one assigned bit per line.

e.g. we have F7 encoding

1111 0111

It may turn out that it is impossible to code such a line 1111 0011

only at most 1111 1011 (HEX FB)

So 0 changes its position

if I wrote it XOR it would look like this

0000 1000

change on

0000 0100

But it may or may not be so.

here a piece of EDC17c60 encoding, I assume it will be similar



I hope I made the topic clearer?

kalisz1 wrote:

someone will suggest

in the photos, the coding description, you have a diagbox reading, because why didn't you download the frame 2101 from the old one?