Re: [opendiag] Rover Seed/key

Hi Ron,

Unless someone gives you the algorithm, you are going to have to disassemble
the code and spend a lot of time analysing the keys. It is far easier to
desolder the PROM and reprogram it that way.

Alternatively, from memory I think the EDC15 is C166 based, in that case you
can force into BootStrap mode and load your own loader/flash program code.
Unfortunately you'll need the Keil C compiler or similar to do this.

Regards, Andy.
------------------------------------------
Andy Whittaker
Macclesfield, England.
Email: mail@...
Web: http://www.andywhittaker.com/
ECU Stuff: http://www.andywhittaker.com/ecu/
ALDL Hardware: http://www.andywhittaker.com/ecu/aldl_hardware.htm
OBD-II Hardware: http://www.andywhittaker.com/ecu/obdii_hardware.htm
VAGFix: http://www.andywhittaker.com/vagfix

----- Original Message -----
From: "roverron32" <roverron32@...>
To: <opendiag@yahoogroups.com>
Sent: Tuesday, July 12, 2005 7:01 AM
Subject: [opendiag] Rover Seed/key

>I am trying to access the Bosch EDC15m ecu on my Rover 45 diesel.
> Can anyone help with the seed/key algorithm please?
> Its not fully eobd compliant - only mode 01 command responses are
> available with a generic code reader.
>
> I found this out by using my Scantool ISO interface as a K Line
> monitor whilst connecting a professional code reader to the DLC.
>
> This sets the headers to 81 13 F7 initially.(Sends 81 13 F7 81 0C)
>
> But it soon uses mode 27 (security access) to request a seed with the
> headers set at 82 13 F7. (It sends 82 13 F7 27 05 B8 C6)
>
> Once access is granted, the usual J2190 comands are used.
> For example:
> Header changes to 84 13 F7 when mode 18 for DTCs is ued.
> It then changes to 85 13 F7 when mode 30 is used to test actuators.
>
> The keep alive is 81 13 F7 3E C9.
>
> Thanks,
> Ron
>
>
>
>
>
>
>
> Yahoo! Groups Links
>
>
>
>
>
>

 
Received on Wed Jul 20 09:43:13 2005