[Solved] BSI DELPHI series EL HW D6 - TELECODING READING BSI peugeot 208 II corsa F

I don't know who wrote it
It is not supposed to be professional ... because such analyzers are already available, and prices are from 10x as much to 100x as much.
It is supposed to be cheap and effective.

I reduced it a little and changed to 500 because it had to be set every time.
The visual studio project is here
https://github.com/horace3/Arduino_Canbus_Monitor

Everyone can develop it as they want.

And what you need to see for encoding, you can see ... cost PLN 20 ... or nothing if it will use the same arduino as for encoding (after changing the batch)
let me tell you ...

Added after 1 [hours] 50 [minutes]:

kamyczek wrote:

We can tap our analyzer as long as there is one willing to write an app for the windnda, or even better, an android

It is quite inappropriate
because we can ..... but it's best if someone .....
Write, throw it and let the folks be happy.

Although this is an idea ... I am not diminishing it, but on a different topic to be developed
I threw a link to the source - so those willing will probably be.

Let's go back to coding in PSA
the analyzer itself is just an addition to CAN viewing .. better or worse, no matter - it works.

glapsson wrote:

It is quite inappropriate

Maybe otherwise, like someone willing to write soft for wind and android, I can understand the interface on the usb

Well, it sounds better now.
Regards
I like to get dirty sometimes.

I did some sedation again on the program.
There is a function of saving the encoding to a file.
Help tab, some bells and whistles in the form of messages ....
And a toolbox from which you can code any module - even one that is not on the list, as long as you know the encryption and key.

[movie: d10ea3dcf3] https://filmy.elektroda.pl/4_1620413300.mp4 [/ movie: d10ea3dcf3]

SEARCHING FOR THE CODING KEY

If anyone is interested, please read slowly and carefully ... because there are probably a lot of my mental shortcuts .. but people who already have some knowledge in the subject and excel are not foreign to them - they will not require an extension of this description.
For the others, it will probably be necessary to create a film ... because it's hard to illustrate only with a description.

It's not that simple - if we don't have any SEED coding pair.
But it can be done.
I am just after the search for the key for coding the Autoliv c3III pillow sensor - the same for the 3008 II, etc.

And here to the moderator --- even the manufacturer allows coding the steering wheel page left right.
that is, coding this parameter we do not act against the law.

So please do not close or block - for photo proof:




Another thing, the AIRBAG sensor was used here as a teaching aid to illustrate the operation.

ATTENTION - which is important in this and probably in other controllers (ASS, ABS, AIRBAG ... these block at 100%)
WHEN ENTERING A ERROR KEY, THE CONTROLLER IS BLOCKED !!!
After blocking - it is not possible to generate SEED, i.e. the next encoding.

BUT the driver works normally - we won't break anything except the fact that the fun with coding is over at the very start.

So, before we start looking for the encoding key in such a driver, it is worth having a backup copy of the batch.

there was no problem with the airbag sensor.

After each wrong key, the sensor should be programmed with the output batch, because as I mentioned, it is impossible to trigger another SEED after the wrong SEEDKEY.


Once we have it, we can start the game of looking for the key.
Here is a description of how I approached it - maybe it's a longer way, maybe not ... I don't know - so far the only one for me.

STAGE I version 1

I take a pack of random keys or more ... I started with 20 random keys. (range 0000 to FFFF)
of which are the two worth including in this package.

And I'm starting testing on SEED SEEDKEY.

we complete NON-OPERATING pairs - in order to rule out invalid keys.

e.g.

A0975BD3
29FF774B

11734302
46BE36DF

CEB81F58
15F67BEF

3CFCCD8A
457333FD

B907B220
3FFB3FFF


e.t.c.......


As I wrote before, for some SEED SEEDKEY pairs, there may be from a few to several hundred keys or even several thousand keys.
So if the key from the first 20 package does not work for us, it excludes quite a lot of other keys from the machine.

I did a little redo my applet to generate the list of invalid keys faster (I need to fine-tune it - so it is not available for download at the moment - I used the console option) but what is possible to do it, although the process is quite slow - Generate SEEDKEY save all broken keys for given broken SEED SEEDKEY pair.

And here I will refer to the further part of the description - if we do not have the ability to generate a list of all wrong keys, I would use the method mentioned later, i.e. we test the keys one by one 0d 0000 and sample each key several times for different SEEDs called.
We are left to write down, for example, the first 100 or 200 keys and a bit of luck and a lot of stubbornness. (i.e. STAGE I version 2)

I would like to add that all the keys are 65,535 pcs - so it's hard to hit ...... but it happens that we can hit a working key at the beginning (this is what happened to me when playing with BSI continental) and then we go to stage II - if we are satisfied it won't work, we repeat the operation for all 20 random keys.

After these 20 keys, if we do not have any working pair, we collect all these keys to one list .. eg in Excel - we exclude duplicate keys (and it may turn out that we have about 5,000 keys that will not work - using only 20 seed seedkey pairs).
it looks something like this - a snippet (there are several hundred of them ... but this is more or less what it looks like at the top of the list):

0002
0005
000E
0011
0023
0029
002F
0030
0031
0033
0034
0035
0036
0038
003D
003F
0040
0040
0042
0049
004A

....... etc (several hundred, several thousand)

now we can start driving successively from 0001 (unless it is on the list, it is the first one that is not available)

as above 0001, 0003, 0004, 0006 ... etc

we do another 10 - we generate SEED SEED KEY pairs - we find the keys for them and add them to our list (sort, exclude repeaters in excel etc.)
It can be done on the basis of one program (someone ambitious may write it) ... but I don't want to write it - because excel will do it too.

we set the column to text - because we use hex notation
we remove duplicates
we sort for a better search for free keys

Here I will add some very important information !!!

we need to capture the CAN stream all the time to record SEED and SEEDKEY !!
and VERY IMPORTANT !!
We must note the working steam !! the key alone will get us nothing.


we mark the keys to be checked

This is an example of a procedure - how many looking for so many ideas - not the only way - just a tip.






I had to program the AIRBAG sensor about 120 times until I found the first working pair.

the first key that worked is (00B3) - I will add that this is only a case that something will work or not, unless it is the correct key (the point is that a given key will work with one SEED and not another one - this is the case) - but it hits something like that and we are waiting for such a key.


STAGE I version 2

NOTE - it can also be done differently - for example for a SEED SEEDkey pair that triggered a working 00B3 key - the appropriate key would also be 0011

so already on the 11th attempt we would have a pair --- but it all depends on the SEED that our ECU will generate at the moment.
Following the stubbornness of a maniac, you can approach it in a different way - knowing that a given key can work with 1: 10 Seeds, you can repeat several codings for each key to call different seeds ... I think that the probability and the number of repetitions is very similar.

When we get such a key, WE SAVE A PAIR OF SEED SEEDKEYS !!! and we go through STAGE II

STAGE II

Example with a working pair:



And I will emphasize it once again - so that someone would not think that the key entered above is OK ....
Such randomly operating keys are not the correct key. They work with one or more SEEDs that generate ECU data, but not all.
There is only one key that will work with all SEEDs and the search process should be done on the exclusion of all others
Finding a few random keys is to find the right one among them - because it definitely is there and will work with all SEEDs.

for a working SEED SEEDKEY pair - generate all the keys.
we generate them from my program which is a few posts above.



You can already see that we can omit many keys !!!! we are starting to make big jumps.


Compare the generated keys with the list made earlier and exclude those that will not work.

now we start testing only those keys from this pair that we have not ruled out.

we should hit a rutted pair pretty quickly and another ...

Having already two pairs, I start to use my extended program (I made for 10 pairs)

the more pairs we start to have, the fewer matching keys we have.

In fact, after finding the first working pair (say 120, program about 6h with breaks)
It took me 20 minutes to find the only key.

What is this driver called in diagbox?

About me lost somewhere, you are talking about pairs 4-byte keys, you are showing something you confused me

RBG_SPEED_UDS

I would like to add that one of the smaller drivers and easily available for such tests and cheap ... and no encoding key in the French inventory.
Because there is no point in looking for something that already is ...

But

I used the key for ESP: ESP90 key 60A5
as a certainty - and now I have ESP blocked for coding.
Now I approach the issue of encryption keys more carefully.

I will repeat drivers that are blocked with the wrong encryption key:

ASS
AIRBAG
ESP

glapsson wrote:

RBG_SPEED_UDS

I would like to add that one of the smaller drivers and easily available for such tests and cheap ... and no encoding key in the French inventory.

give testimonials of the software from it .. I'll check

98.237.414.80

Rx STD ID 00000744 data 0322F08000000000

Rx STD ID 00000644 data 101962F080982374

Rx STD ID 00000744 data 30000A0000000000

Rx STD ID 00000644 data 211480000D982374

Rx STD ID 00000644 data 2214800711FFFF03

Rx STD ID 00000644 data 2301000005240000

Oh, I can see that you have already missed the sensor

Yes

Here is the info for the others - because I used the phrase that the sensor was cheap.
I got the sensor from a friend - molasses. So it cost me nothing.
And I am obliged to point out his contribution to these activities.

after the calculations, I have two keys left.
now I have to do a dozen or so encodings to exclude the one that will cause an error at some point.

But there was another problem.
Because as you already know - I recognize encoding bytes and not only the steering wheel pages with coding bits, and all the options .. passenger airbag switch, driver's side, curtains, airbags, sensors, etc ...
And you can code it from the batch level without the need to use SEED and OBD and any interface - except of course the programmer and they know which byte and which bit.
And it works great - I can say that when you do something else and there is a need to recode English, for example, you can do it right away on bytes.
.
However, there is a problem with saving the OBD coding without opening the sensor.
The whole procedure is basically going well.
calling
start
identification reading
calling SEED
reply SEEDKEY
permission for programming 2E ......
Data passes ... but the encoding doesn't change .....
after reboot, we have the starting position without any changes we have made.

I used the CAN configuration option ... maybe you need to use the data transfer option?
Or maybe it is a problem with the sensor itself ... because it is after some slight transitions.

I have completed the description of my method of finding the Encoding Key - with fewer mental shortcuts - so if someone has read it, you can analyze it again.

And this sensor may have a lock on the can, like the new BSI, that the save was successful and does not change the VIN, it will be something similar with NACs in W4 there is info in the diagbox that after inserting a new one into the car, it has a 15-minute service for coding, after this time, the option will be blocked, without warranty claims ...

As for the blockade, I think I agree, but I will see other options.
For now, I will be testing the lock options because it's strange that everything will pass and not save.
the coding area is extended by a dozen or so cells with "switches"
the whole area of coding and "switches" ends with a -CRC-16 / MODBUS checksum.
So there will be no problem to fight with "switches", maybe something will be explained ---- such a hobby.

As for the various keys from the network - a colleague bbmax - asked to test a certain encryption key.
unfortunately it doesn't work - which is why my decision to look for real codes.

Because as I wrote ESP, I have already blocked --- I did not make a copy of the batch- a ...

two movies with the code broken
and with my code

everything can be seen in the logs what has passed and what has not.


FILM WITH CODE BE and here a warning - the code can be seen and not to use it.
Maybe it works with several SEED codes but it just failed in my test.

[movie: 20143d44fa] https://filmy.elektroda.pl/35_1621333781.mp4 [/ movie: 20143d44fa]



FILM WITH CODE OK
[movie: 20143d44fa] https://filmy.elektroda.pl/69_1621333806.mp4 [/ movie: 20143d44fa]

I am also throwing logs from txt encoding.

I will also put in here the identification readings of the batches that I tested.
Because in previous posts there was such a request.
I get coded on all of them, but I can't remember them.
And that's why something from the blockage may be up.

cross-section of various cars: c3 III, 3008 II, 208II and probably 508

Your random SEED is set all the time to 00000000?

ok now i noticed --- and it could mislead you ......
sorry there was a bug in the CAN commands, but that's not what the movies were about ... just accepting the key.

I've already improved the movies --- and the next two tests were done, which confirms what I'm saying because the same thing happened again.

and I added logs so as not to take screenshots of the procedure - only it can be traced in the file.


You can elaborate on this question because I don't understand - I'm not a self-taught engineer.
I think I know what you want to ask ...
I am using a customized french algorithm
based on the SEED delivered with the ECU and the key and the add-on ... described in its studies.
Of course rewritten to C # because he just made it available in other languages.

you can follow in its descriptions how the algorithm works
It can be easily adapted to generate keys based on SEED SEEDKEY pairs.

With the correct key, each driver is coded 100/100

So the fact that the AIRBAG is not registering, it does not result from the SEED key or the CAN upload procedure.

I am more inclined to unblock access with an additional procedure or sometimes access.
unfortunately, I can't code it in the original using DIAGBOX - so I can't see it.

I tested the times from 100ms to 5000ms without changes

I wonder if the BSI unlocking procedure is not required for the time of airbag coding ..... hmmm.

I CHECKED

Simultaneously unlocking the airbag and the BSI does not help.
The procedure is probably called from a different level - as can some procedures, e.g. in BSI (reading eep flash and changing the waveform).

Or maybe some drivers in diagbox are coded without BSi, i.e. they do not go on pins 3-8 only on 6-14

bbmax wrote:

Or maybe some drivers in diagbox are coded without BSi, i.e. they do not go on pins 3-8 only on 6-14

unfortunately, the scheme for AIRBAG does not provide such an option.
I will play with the double unlocking function - BSI and AIRBAG
while resetting the switches I have tracked.
maybe he'll say something.
just if you had to remove the sensor to change the switch it would be pointless.
like the controller on the table, coding and slack by the way.
I will add that I checked in about 20 batches and the coding is in the same place.
you can write a separate batch processing routine for coding with CRC counting.
or try downloading from the location after CAN and not from the encoding container.

Added after 50 [minutes]:

I will come back to the topic (question about) random keys.
as the name suggests .. from a random translation

Do I understand it correctly?????

so you might as well call all random keys that will fit into a SEED pair

e.g. for a pair that does not pass to the proper key, it additionally generates such keys:



and a few others - and from time to time such keys "surprise"
Can they be called random ?????

This time I ask because I don't know?

Interestingly, I used a few pairs and none of them gave the answer B8D6 ...
but someone took this key from somewhere ...

There are currently two such popular similar types of PSA sensors that identify themselves essentially identically in DIAGBOX

SPC560 and uPD70F3624 (these are not sensor names ... just to be clear ... but we know what's going on)

maybe there is some misconception about this broken key.

Due to the fact that I can not undergo OBD coding yet - using the already written data, I added a little program and you can code the AUTOLIV SPC560 sensor from the file level.

This is what it looks like:

[movie: 9f9178a4c8] https://filmy.elektroda.pl/47_1621531466.mp4 [/ movie: 9f9178a4c8]

Another version of the BSI program
I have now improved my mileage customization.
It is also possible to enter VIN and PIN to the cleared BSI via OBD.
Soon I will add taking options on VIRGIN and I will try to reset history .. but it's complicated ...
Mileage and Virgin will be "hybrid" operations - available after the batch has been ripped using the programmer.

The CRC-16 / CCITT-FALSE checksum calculator is also available for download
for earlier work - with coding on a batch with a net.

[movie: 6c958ccd1b] https://filmy.elektroda.pl/55_1621635501.mp4 [/ movie: 6c958ccd1b]

The Glapsona program for spc560p50 works perfectly, cracks the batch and codes great. Respect for the author

Another panel appeared in my application.

It is a BSI preparation panel as VIRGIN
PIN RESET
VIN RESET
HISTORY DTC RESET

of course, all changes are made together with the CRC counting - so, for example, the history area is not damaged and can save new DTCs.
Doing this area just for cleaning without a CRC blocks that area.

I have a Conti Abs sensor to do airbag support and maybe smega in the second program for coding other drivers.

But in BSI I only had to get eeprom and flsah after OBD and crack the PIN key.
[movie: dc729692f8] https://filmy.elektroda.pl/49_1622012847.mp4 [/ movie: dc729692f8]

glapsson wrote:

I will come back to the topic (question about) random keys.
as the name suggests .. from a random translation

Do I understand it correctly?????

so you might as well call all random keys that will fit into a SEED pair

e.g. for a pair that does not pass to the proper key, it additionally generates such keys:

there is a classic 2703 random login
2704 authorization in response
And since the key looks 32-bit there, you must either know the algorithm or have 5GB of data for 1 session. Only that scanning such a number of keys, assuming only 10s per pair and 60 years ...

I do not understand what you're asking
it's all already ............... when it comes to coding, of course.

i am not talking about downloading flash or eeprom.

2703
you get SEED from ECU 4 bytes ....

the answer algorithm is here - I'm using it
it is enough to have the key.
There are 65535 possible keys for such a SEED to generate a response.

having a response you send 2704 and 4 response bytes)

However, the ECU accepts the specified response, not the key

but it happens that a random key is able to generate a good answer ....... and the ecu will also click.

Of course, there are a lot of drivers that don't code anymore after the wrong answer.

But it was all there

THE ALGORITH IS !!!

It took me 6 hours with many interruptions to break the key ... not 60 years.

It would take 60 years to generate all the keys from 00 00 00 00 to ff ff ff ff. besides, the seed for each session can be different and there can be several sessions. you wrote that there are 65535 combinations that would mean that only two bytes are valid, not 4. And the very algo flashed to me somewhere in the studies of my colleagues from France. The editor itself is very cool, the more that I have IOterminal, so reading is what.

I will add that every flash (after obd2) in my case BSI2010 erases errors and VIN and the mileage is 00000000, the pin remains untouched, as the cables come to the EL4 connection that I purchased for testing ... github and the missing ones can be extracted from the calibration files or from flashy .cal / .ulp where they are saved in the plaintxt line S11 ....

Added after 1 [minutes]:

glapsson wrote:

I do not understand what you're asking
it's all already ............... when it comes to coding, of course.

i am not talking about downloading flash or eeprom.

2703
you get SEED from ECU 4 bytes ....

the answer algorithm is here - I'm using it
it is enough to have the key.
There are 65535 possible keys for such a SEED to generate a response.

having a response you send 2704 and 4 response bytes)

However, the ECU accepts the specified response, not the key

but it happens that a random key is able to generate a good answer ....... and the ecu will also click.

Of course, there are a lot of drivers that don't code anymore after the wrong answer.

But it was all there

THE ALGORITH IS !!!

It took me 6 hours with many interruptions to break the key ... not 60 years.

As for the algo, it is also for Immo

kamyczek wrote:

It would take 60 years to generate all the keys from 00 00 00 00 to ff ff ff ff. besides, the seed for each session can be different and there can be several sessions. you wrote that there are 65535 combinations that would mean that only two bytes are valid, not 4. And the very algo flashed to me somewhere in the studies of my colleagues from France. The editor itself is very cool, the more that I have IOterminal, so reading is what.

2 byte key is enough .. that is 65535 key combinations.
And because there is an algo, I don't understand what your problem is.

Maybe with the numbers you want to discourage others who like to play with it.

And another thing, what I have already written, are SEEDs for which a specific answer can be generated with even several hundred keys.
so having SEED and SEED key pairs that work - it's easy to find those keys that will handle both pairs.

And with such pairs, e.g. 6, the number of keys that will handle all these pairs can be from several to even 1 of the right one.

and a few keys, it is easy to test over coffee.

Because it's not about testing all the keys.
Only those that "surprised"

maybe I don't know something but I went to the official website of IOTerminal and somehow I don't see DELPHI

I do not understand something about this translation, My way, it is like this You have a specific diagonostic session 10 02, 10 03, 10 0b etc. After establishing communication, you log in, ask for a query 27 .... You receive a random query, count the answer according to the algorithm, you answer the driver counts or the answer is correct as is you have access, as well as it does not accept further commands. And the key and response pairs are as many as the query values can be generated. io terminal you need to look at the bi program on the page one in the program the other. Besides, because of all these cooperations, I sometimes start to wonder about the Opel, Citroen, Renalt or other boon inside. besides, if the algo is correctly calculated, there is no surprise, only the seed calculation of the answer and it's gone. if there are 15 attempts, it is randomly selected from the available database and that's it.

https://github.com/ludwig-v/psa-seedkey-algorithm

Read the description .... how to find the key ... because it makes no sense for me to write it a second time.
If you do not try, you will not understand that there is not one key, but even several hundred, to generate an answer.
for one SEED only

For example

e.g. 12 34 56 79

it works on the following keys (after an algo of course) and gives a good answer - such a seed repeats from time to time and goes to "hit".

00 22
00 45
00 79
01 03

e.t.c
a e.g. SEED

23 45 78 92

works on keys

00 25
00 47
00 79
01 13

for example, 00 79 was repeated for both of them - so it is more likely - the others can be completely ruled out because they did not work with a different seed

and this way of exclusion is quickly ruling out those not working with everyone

The operation is not about looking for only the exclusion of the wrong ones.

Having two three pairs that worked with one key
after writing the appropriate formula .....
one can throw away the thousands that do not act in favor of the few who act with all the known

and keys to the more popular ecu
https://github.com/ludwig-v/psa-seedkey-algorithm/blob/main/ECU_KEYS.md

I just posted it ..... again in this topic.
And I will add.
Read and read again and analyze - because there is everything.
I launched c # for the first time in February - and now I write better or worse applications, but they work.
And if someone does not want to - it's to the cash register.
There will be no ready-made products for free - the topic is to indicate the possibilities.

But I have already put a lot on this topic.

If someone is surprised what I am doing this for - in terms of my application - I answer:
It was mainly the desire to learn a programming language that worked.
And the occasional need for BSI coding.
And the topic of BSI seemed interesting to pursue while learning.
And that's how I put it together.

And one more thing - I really like that two more people are actively involved in the topic.
They show what they have managed to do - it motivates them to continue working.
It creates something like competition but also gives a kick because if someone has succeeded in something, I should also do it.

I was a complete layman - I will add.
And I still do not know much - but somehow I manage.

(Of course, math is the basis - it's a pity to bother with no grounds)

If someone would like to try c #, I recommend a link as a donkey:


https://www.youtube.com/watch?v=qVMX17uoHbk&list=PL6aekdNhY7DAeU-2LEGBDXls60Yy-Ubbu

here it is also worth starting from scratch - but you can also try from here
https://docs.microsoft.com/pl-pl/visualstudio...ate-csharp-winform-visual-studio?view=vs-2019

can also be useful:
https://forbot.pl/blog/kurs-arduino-podstawy-programowania-spis-tresci-kursu-id5290

Added after 3 [hours] 43 [minutes]:

Yesterday the tests went - everything works great.
I had to make a few corrections.
among others mileage - it is now calculated for bin search ... no need to know mileage - mileage algorithm and CRC is enough to find it directly in the batch - no OBD needed.
I changed it because it was cumbersome to manually enter the mileage ... once with a comma, once without ... I corrected it.
Of course, for the mileage - it would be more elegant if I reset the sub-meter because it looks stupid in the screen ...
but no problem with that.
other functions elegantly
VIN
PIN
HIST

I set the mileage at 6000 km









The mistakes are fine .... BSI has a lot of DTCs on the table, but I had an airbag sensor plugged in and I unplugged it - adding works.






Everything is so prepared that it can be done on .bin files, but with the possibility of a quick switch to OBD - I will only add the batch reading after the OBD.

Change of mileage ...
And now someone will ask, but why are these CRC and HEX ...
Of course, they are unnecessary here ... but at the testing stage - I have an automatic preview of whether the program actually found the lines with the course.
not a random area to match as a trace line ... likeI will process a dozen batches and everything will be ok - it will probably fall out or it will stay that way because it does not bother anything.

[movie: dba0abd48e] https://filmy.elektroda.pl/25_1622130954.mp4 [/ movie: dba0abd48e]