Re: Rover Seed/key

Hi Andy,

Thanks for that, I had a feeling it wasn't going to be easy unless
someone out there knows the algorithm and wishes to share it!

I am intending to connect the DLC to my laptop via a level shifter
and capture the raw data as it flows to and from the ACR4. This
should enable me to 'grab' some seeds and keys.
But unless it is a very simple algorithm I'll be wasting my time I
guess. (2s complement would be nice!)

Thanks,
Ron

--- In opendiag@yahoogroups.com, "Andy Whittaker" <egroups@a...>
wrote:
> Hi Ron,
>
> Unless someone gives you the algorithm, you are going to have to
disassemble
> the code and spend a lot of time analysing the keys. It is far
easier to
> desolder the PROM and reprogram it that way.
>
> Alternatively, from memory I think the EDC15 is C166 based, in that
case you
> can force into BootStrap mode and load your own loader/flash
program code.
> Unfortunately you'll need the Keil C compiler or similar to do this.
>
> Regards, Andy.
> ------------------------------------------
> Andy Whittaker
> Macclesfield, England.
> Email: mail@a...
> Web: http://www.andywhittaker.com/
> ECU Stuff: http://www.andywhittaker.com/ecu/
> ALDL Hardware: http://www.andywhittaker.com/ecu/aldl_hardware.htm
> OBD-II Hardware: http://www.andywhittaker.com/ecu/obdii_hardware.htm
> VAGFix: http://www.andywhittaker.com/vagfix
>
> ----- Original Message -----
> From: "roverron32" <roverron32@y...>
> To: <opendiag@yahoogroups.com>
> Sent: Tuesday, July 12, 2005 7:01 AM
> Subject: [opendiag] Rover Seed/key
>
>
> >I am trying to access the Bosch EDC15m ecu on my Rover 45 diesel.
> > Can anyone help with the seed/key algorithm please?
> > Its not fully eobd compliant - only mode 01 command responses are
> > available with a generic code reader.
> >
> > I found this out by using my Scantool ISO interface as a K Line
> > monitor whilst connecting a professional code reader to the DLC.
> >
> > This sets the headers to 81 13 F7 initially.(Sends 81 13 F7 81 0C)
> >
> > But it soon uses mode 27 (security access) to request a seed with
the
> > headers set at 82 13 F7. (It sends 82 13 F7 27 05 B8 C6)
> >
> > Once access is granted, the usual J2190 comands are used.
> > For example:
> > Header changes to 84 13 F7 when mode 18 for DTCs is ued.
> > It then changes to 85 13 F7 when mode 30 is used to test
actuators.
> >
> > The keep alive is 81 13 F7 3E C9.
> >
> > Thanks,
> > Ron
> >
> >
> >
> >
> >
> >
> >
> > Yahoo! Groups Links
> >
> >
> >
> >
> >
> >

 
Received on Wed Jul 20 10:15:08 2005