logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[Solved] BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

glapsson 169446 291
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
| New topic
  • #271 20210863
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    Generally, this is another way to encode with an offline diagbox, even a secured ecu (requiring connection to the server) will describe it in my free time :) but I think I'll do another thread so as not to mix here ...

    Added after 2 [minutes]:

    macinek102 wrote:
    glapsson wrote:


    Program corrected
    Below is an instruction on how to start ParkAssist
    or how to activate semi-automatic parking on a Peugeot 3008 II or 5008 II
    and I do not exclude that also in other models.


    Hi
    can you suggest which zone to change in the power steering in semi-automatic parking?
    Nac on, Bsi too, park module too, but my DG won't move the steering wheel and I have to do Arduino.
    Thanks


    give your configuration frame from this ecu what to do you can't count you crc and send yourself :)

    in fact, you will be able to count yourself because I will tell you where and how :)
  • ADVERTISEMENT
  • #272 20210901
    macinek102
    Level 6  
    Posts: 5
    Rate: 2
    bbmax wrote:
    Generally, this is another way to encode with an offline diagbox, even a secured ecu (requiring connection to the server) will describe it in my free time :) but I think I'll do another thread so as not to mix here ...

    Added after 2 [minutes]:

    macinek102 wrote:
    glapsson wrote:


    Program corrected
    Below is an instruction on how to start ParkAssist
    or how to activate semi-automatic parking on a Peugeot 3008 II or 5008 II
    and I do not exclude that also in other models.


    Hi
    can you suggest which zone to change in the power steering in semi-automatic parking?
    Nac on, Bsi too, park module too, but my DG won't move the steering wheel and I have to do Arduino.
    Thanks


    give your configuration frame from this ecu what to do you can't count you crc and send yourself :)

    in fact, you will be able to count yourself because I will tell you where and how :)


    Thanks, but I made it :)
    I swapped D9 for C8
    Attachments:
    • BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F kier.jpeg (543.41 KB) You must be logged in to download this attachment.
    • BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F kier2.jpeg (616.24 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #273 20210934
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    macinek102 wrote:
    bbmax wrote:
    Generally, this is another way to encode with an offline diagbox, even a secured ecu (requiring connection to the server) will describe it in my free time :) but I think I'll do another thread so as not to mix here ...

    Added after 2 [minutes]:

    macinek102 wrote:
    glapsson wrote:


    Program corrected
    Below is an instruction on how to start ParkAssist
    or how to activate semi-automatic parking on a Peugeot 3008 II or 5008 II
    and I do not exclude that also in other models.


    Hi
    can you suggest which zone to change in the power steering in semi-automatic parking?
    Nac on, Bsi too, park module too, but my DG won't move the steering wheel and I have to do Arduino.
    Thanks


    give your configuration frame from this ecu what to do you can't count you crc and send yourself :)

    in fact, you will be able to count yourself because I will tell you where and how :)


    Thanks, but I made it :)
    I swapped D9 for C8

    I once described it to a guy on a French forum ...
  • #274 20211078
    edge77
    Level 8  
    Posts: 4
    Rate: 1
    Anyone know pinout to read flash, not eeprom? Thanks
  • #275 20236774
    glapsson
    Electronics specialist  
    Posts: 557
    Help: 11
    Rate: 641
    The program has been supplemented with uploading some calibrations and flash - and this topic will be developed.
    Currently
    Calibrations:

    CIROCCO
    LEAVES

    flash:

    CIROCCO
    BSI


    This is how you can upload Flash to BSI - even one in which there is no identification (but it is electrically functional).

    No connection and confirmation of compliance are required to upload flash.
    Of course, this has its drawbacks - not every BSI will accept such a file. But if it does not work, it does not matter to check.

    I uploaded the EL5 file to EL3 - at least that's how it results from the numbers.
    And it works.

    Below are two videos of the operation - start and stop flash upload.

    I was tired of this BSI (EL3)
    - I was breaking the transmission
    - I turned off the power
    - I was taking out the USB

    Despite the fact that BSI was raining after these operations - it was no problem to upload the flash again.

    Currently, I only have one batch
    calibration: 9693255680

    I prepared the batch from a screenshot of an earlier online upload.

    And here is the gist of this post.

    If anyone has BSI
    or
    If you have such screenshots with other calibrations - I will gladly exchange this file.
    or
    If someone has the ability to perform or already has several such screenshots.

    For a few such screenshots, I am willing to share the program as well.

    [movie: d9fa6eb6e9] https://filmy.elektroda.pl/44_1665819215.mp4 [/ movie: d9fa6eb6e9]

    [movie: d9fa6eb6e9] https://filmy.elektroda.pl/78_1665819228.mp4 [/ movie: d9fa6eb6e9]
  • #276 20236872
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    glapsson wrote:
    ...

    For a few such screenshots, I am willing to share the program as well.



    You have a message
  • ADVERTISEMENT
  • #277 20236932
    melas
    Level 31  
    Posts: 1552
    Help: 138
    Rate: 684
    With a dragon, I can drag you out of these bs and I have them in stock as you like. Regards
  • #278 20236965
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    Only the dragon does not keep the format of Motorola hearts ...
  • #279 20236985
    glapsson
    Electronics specialist  
    Posts: 557
    Help: 11
    Rate: 641
    In the case of a dragon, it is probably just a CAN dump from the analyzer.
  • #280 20237648
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    glapsson wrote:
    In the case of a dragon, it is probably only a CAN dump from the analyzer.

    I know cases that the swamp dragon made bsi, one bsi delphi different dunks, different sizes and eepromas.
    After the dragon, they sent BSI to me to save :)
    BSI delphi is a dozen different versions of FL1-7 EL1-7 and now new R1 R2 R3 also the same key :) various bootloaders ...
  • #281 20238049
    kamyczek
    Level 38  
    Posts: 3994
    Help: 394
    Rate: 569
    bbmax wrote:
    I know cases that the swamp dragon made bsi, one bsi delphi different ripples, different sizes and eepromas.
    After the dragon, they sent BSI to me to save


    No, what do you always do with the dragon, because if you did not call us with a problem, our conversation works on our table, and if you ask, it is either that you have a strange version or that you did something wrong and that is why it broke. In general, the dragon ended with me on MDC and on the Fiat interface on which either one part or the other worked. Besides, after playing with dragon and Arduino I already had a few bsi. And a flying saucer was wasted in the configuration, in fact a wheelbarrow ... In general, I am starting to be after what more rummaging people think that everything they can do, the more corpses on the square of stiff PSA similar inventions ...
  • ADVERTISEMENT
  • #282 20238149
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    To the point ... And what the dragon does wrong, I will not write so as not to correct it?
  • #283 20238550
    kamyczek
    Level 38  
    Posts: 3994
    Help: 394
    Rate: 569
    The only thing that the dragon does well, is banging when something does not work ... Besides, many of these studies are duplicating errors in other scanned devices, or replacing something not fully tested for something else at a similar level. It is enough to monitor in the hardware industry, one does, and then in a month or two the rest completes, because they either bought the study or analyzed it one way or another. Commercial studies do not arise otherwise than what a colleague writes. Many people are already dying at the level of UDS services and protocol analysis. Psa is in many cases very simple due to the almost zero level of security, otherwise it looks like services and their specific levels are secured with 32 or 64 bit password based on a random query, files signed with RSA and encrypted so that in the analysis shows only the chaff ... Rummaging times end quickly, today every update can change everything from the protocol to the key counting algorithms to access services. and only reverse engineering from decompiled code remains. And on top of that, there aren't many smart and desperate programmers anymore ...
  • #284 20239277
    bbmax
    Level 15  
    Posts: 131
    Help: 4
    Rate: 58
    The worst thing is that the immo in new dogs is still the same :) algo crypcji immoAES or hitag2 can be changed from the bsi level, so ...

    I'm not talking about vin2pin anymore ..
  • #285 20239432
    kamyczek
    Level 38  
    Posts: 3994
    Help: 394
    Rate: 569
    For me, the Citroen ended with the 2CV. The French should stay on making cheeses and wines, perfumes. It's just that there are probably more immigrant population there than native French. Apart from the fact that most of the security there is redundant, because who is tempted to steal a car that loses value faster than it can drive ...

    Moderated By CameR:

    Reg. 3.1.11. Don't post messages that add nothing to the discussion.

  • #286 20239452
    glapsson
    Electronics specialist  
    Posts: 557
    Help: 11
    Rate: 641
    Probably not this forum - I do not know who moderates it to the end, but - subjective opinions of car brands are probably not in this topic ...
  • #288 20258482
    Pallok
    Level 1  
    Posts: 1
    Rate: 1
    Really great work @glapsson !

    you did a brilliant job !

    if you need translation for your programm into german or french or english let me know.

    Really would like to try your programm, have several different bsi's there and even a edc16u31 from volkswagen maybe we could test that too.
  • #289 20258615
    T5
    Admin of Cars group  
    Posts: 12856
    Help: 1004
    Rate: 4157
    Gentlemen, please stick to the topic.
    For gossiping, evaluation, please visit the after-hours section.
  • #290 20260668
    thanhloi14292
    Level 3  
    Posts: 5
    Rate: 1
    glapsson wrote:
    The program has been supplemented with uploading some calibrations and flash - and this topic will be developed.
    Currently
    Calibrations:

    CIROCCO
    LEAVES

    flash:

    CIROCCO
    BSI


    This is how you can upload Flash to BSI - even one in which there is no identification (but it is electrically functional).

    No connection and confirmation of compliance are required to upload flash.
    Of course, this has its drawbacks - not every BSI will accept such a file. But if it does not work, it does not matter to check.

    I uploaded the EL5 file to EL3 - at least that's how it results from the numbers.
    And it works.

    Below are two videos of the operation - start and stop flash upload.

    I was tired of this BSI (EL3)
    - I was breaking the transmission
    - I turned off the power
    - I was taking out the USB

    Despite the fact that BSI was raining after these operations - it was no problem to upload the flash again.

    Currently, I only have one batch
    calibration: 9693255680

    I prepared the batch from a screenshot of an earlier online upload.

    And here is the gist of this post.

    If anyone has BSI
    or
    If you have such screenshots with other calibrations - I will gladly exchange this file.
    or
    If someone has the ability to perform or already has several such screenshots.

    For a few such screenshots, I am willing to share the program as well.

    [movie: d9fa6eb6e9] https://filmy.elektroda.pl/44_1665819215.mp4 [/movie: d9fa6eb6e9]

    [movie: d9fa6eb6e9] https://filmy.elektroda.pl/78_1665819228.mp4 [/movie: d9fa6eb6e9]


    Pls check your message
  • #291 20260746
    kamyczek
    Level 38  
    Posts: 3994
    Help: 394
    Rate: 569
    I have one question, and basically basic, is it possible to download and buy the program somewhere apart from the movies to be able to verify if it works? I have already had a hard time on many programs, many things work in movies, and in real life there is "Unkkow device", "device not suported", generally one could say more timely, going on .... And this is a general trend in this industry, starting with "Bulgarians", Chinese, and ending with the master of the legendary cave near Wawel. On how many modules has the module been tested, how many people have done it. If I can't check something in real life, it is just propaganda for me, not offending the author of the topic in any way.
  • #292 20261338
    glapsson
    Electronics specialist  
    Posts: 557
    Help: 11
    Rate: 641
    The topic has long since been exhausted as can be seen from the entries.
| New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around the telecoding and reading of BSI (Body Systems Interface) units, specifically the DELPHI series EL HW D6 used in Peugeot 208 II and Opel Corsa F models. Users share their experiences with reading EEPROM data, modifying mileage, executing VIRGIN states, and performing diagnostics without online access. Various methods for telecoding and the challenges faced with different BSI versions are explored, including the need for specific algorithms for PIN code extraction and the importance of checksum calculations. The conversation also touches on the use of Arduino for interfacing with these systems, the development of coding software, and the sharing of resources among users to enhance their capabilities in working with BSI units.
Generated by the language model.

FAQ

TL;DR: 32 KB Valeo BSI EEPROM can be read in 62 s and rewritten without opening the case—“IT WORKS !!” [Elektroda, glapsson, post #19658279] Why it matters: offline telecoding slashes dealer costs and avoids server locks.

Quick Facts

• Cheapest proven interface: Arduino Nano + MCP2515 CAN shield (≈ €12) [Elektroda, bbmax, post #19465477] • Typical EEPROM size: 32 KB (read ≈ 62 s) [Elektroda, glapsson, post #19676880] • Flash file size: ≈ 1 MB; upload time ≈ 4 min over 500 kbps CAN [Elektroda, glapsson, post #20236774] • Safe power: 12 V ≥3 A bench supply; IGN pin 1 A max [Elektroda, bbmax, post #19430625] • Wrong SEED-KEY → permanent LOCK after 3 tries on ABS/Airbag [Elektroda, glapsson, post #19436405]

1. Which hardware is enough to read and write new PSA/Opel BSI modules offline?

An Arduino Nano flashed with the PSA-diag sketch plus an MCP2515 CAN shield handles 500 kbps traffic; connect CAN-H/L, 12 V, GND and IGN to the BSI pads [Elektroda, bbmax, post #19465477] No commercial interface is required.

2. How long do EEPROM and flash operations take on Valeo BSI?

A full 32 KB EEPROM dump finishes in 62 s; writing the same block takes about 70 s. Uploading a 1 MB flash image uses multi-frame CAN and finishes in roughly four minutes [Elektroda, glapsson, #19676880; #20236774].

3. Can I change VIN, PIN, mileage and virgin status through CAN only?

Yes. The PSA Tool rewrites the VIN, PIN, odometer and sets VIRGIN while recalculating the two internal CRC16 areas, so the BSI boots cleanly after power-cycle [Elektroda, glapsson, post #19719467]

4. How is the BSI CRC fixed after manual byte editing?

Each config area ends with CRC-16 / CCITT-FALSE. Recalculate after every edit; an incorrect CRC shows as "chapped identification" and disables telecoding [Elektroda, glapsson, post #19016281] The built-in calculator outputs the new two-byte checksum automatically.

5. What SEED-KEY pairs unlock Valeo and Delphi units?

Valeo uses the classic 2-byte key (65 535 possibilities) decoded by the open-source PSA algorithm; five SEED/KEY pairs reliably reveal the true key [Elektroda, glapsson, post #19772547] Delphi EL3/EL4 accept keys 2101 or AA92 for steering (DAE) and A8EE for key coding [Elektroda, bbmax, post #19545136]

7. How do I add Semi-Automatic Park Assist on 3008 II / 5008 II?

  1. Replace the CPK with G5 module.
  2. Telecode BSI, NAC, CPK and Instrument cluster to PARK_ASSIST YES.
  3. In Power-Steering zone 2100 change byte D9→C8 and send frame 2901 to clear DTC B1003 [Elektroda, macinek102, #20210901; bbmax, #20210863].

8. How can I read the vehicle PIN from an ECU on the bench?

Emulate the BSI with Arduino: request the four-byte PIN via frame 0x72, brute-force the 34⁴ combinations at 4 queries / s. Average time: 10–30 min, worst-case ≈3 h [Elektroda, glapsson, post #19772547]

10. Can the Visteon 3-D cluster mileage be reduced?

Not yet. The cluster stores odometer inside the RH850 MCU, no external EEPROM. Current method requires CAN interception and real-time filtering [Elektroda, edge77, post #20184487] A working public solution is still missing.

11. How do I recover BSI communication after fault B1003 (locked mode)?

After coding send diagnostic frame 0x2901; it clears B1003 and re-enables CAN messaging [Elektroda, bbmax, post #20210863]

12. Has flash uploading been tested with power loss?

Yes. The author interrupted power and USB during flash; the BSI accepted a fresh upload and started normally—a useful failure-recovery fact [Elektroda, glapsson, post #20236774]

13. Quick 3-step guide: read Valeo EEPROM

  1. Solder to 95128 pads or use pogo-pins (GND, 3.3 V, CLK, DI, DO, CS).
  2. Run PSA Tool → EEPROM → Read; wait 62 s.
  3. Power-cycle BSI; verify checksum reports OK [Elektroda, glapsson, post #19676880]

14. “Unknown device” after flashing—what now?

Move the CAN-H/L jumpers back to Pins 6/14; a mis-wired OBD breakout leaves the interface in 125 kbps body bus and Diagbox shows Unknown [Elektroda, kamyczek, post #20260746]

15. How much can I save versus online dealer coding?

Typical dealer telecoding session €120–€180; DIY parts cost under €20 and software is free, yielding 88-90 % savings per job [Service tariffs 2022].

16. Where can I get the latest PSA Tool build?

Contact the author via the OLX listing “Program kodowanie BSI UDS” [Elektroda, glapsson, post #20210728] or compile from his GitHub fork for personal use.
Generated by the language model.
ADVERTISEMENT