BCM seed key algorithm Maxus Euniq6
Hi all, I am currently working on the implementation for the Maxus Euniq6. I have been able to decipher most of the metrics I wanted, but now I need to open and close doors. I was able to get access to a scanner for the car and sniff the can while the scanner opened and closed the doors. I mostly deciphered the interaction between the car and the scanner but there seems to be a seed-key algorithm in order to authenticate the scanner with the car. (I have ruled out a simple xor of bitshift). Any ideas on how to decipher this? I have a list of seed-keys and the chatter before in case someone wants to take a look. Any help is greatly appreciated. Thanks, Jaime Middleton Software Engineer Tucar Spa ------------------------------ [image: Tucar cell phone] +56 9 42526635 [image: Tucar cell phone] jmiddleton@tucar.app <jmiddleton@tucar.app> [image: Tucar net] www.tucar.app <https://www.tucar.app> [image: Tucar location] Plaza Yolanda 80, Las Condes, Santiago de Chile
Hi Jaime Cool project on an interesting car. I can't help you directly on decyphring the seed-keys, but I found information on the Tesla key algorithms recently: https://gist.github.com/darconeous/2cd2de11148e3a75685940158bddf933 Perhaps you can find some hints there. Only a guess, but perhaps worth reading. Regards Chris Am Dienstag, dem 11.10.2022 um 17:20 -0300 schrieb Jaime Middleton:
Hi all, I am currently working on the implementation for the Maxus Euniq6. I have been able to decipher most of the metrics I wanted, but now I need to open and close doors. I was able to get access to a scanner for the car and sniff the can while the scanner opened and closed the doors. I mostly deciphered the interaction between the car and the scanner but there seems to be a seed-key algorithm in order to authenticate the scanner with the car. (I have ruled out a simple xor of bitshift). Any ideas on how to decipher this? I have a list of seed-keys and the chatter before in case someone wants to take a look. Any help is greatly appreciated.
Thanks, Jaime Middleton Software Engineer Tucar Spa
Tucar cell phone +56 9 42526635 Tucar cell phone jmiddleton@tucar.app Tucar net www.tucar.app Tucar location Plaza Yolanda 80, Las Condes, Santiago de Chile
_______________________________________________ OvmsDev mailing list OvmsDev@lists.openvehicles.com http://lists.openvehicles.com/mailman/listinfo/ovmsdev
Jaime, don't rule out a simple arithmetic operation too soon. The VW eUp for example simply applies key = seed + passcode (each 32 bits). The "security" is achieved here by obscurity, i.e. people simply need to know the function specific passcode. As you've got access to a device that implements the access scheme, a decoding vector could be reading the firmware. Regards, Michael Am 12.10.22 um 07:35 schrieb Chris van der Meijden:
Hi Jaime
Cool project on an interesting car.
I can't help you directly on decyphring the seed-keys, but I found information on the Tesla key algorithms recently:
https://gist.github.com/darconeous/2cd2de11148e3a75685940158bddf933
Perhaps you can find some hints there. Only a guess, but perhaps worth reading.
Regards
Chris
Am Dienstag, dem 11.10.2022 um 17:20 -0300 schrieb Jaime Middleton:
Hi all, I am currently working on the implementation for the Maxus Euniq6. I have been able to decipher most of the metrics I wanted, but now I need to open and close doors. I was able to get access to a scanner for the car and sniff the can while the scanner opened and closed the doors. I mostly deciphered the interaction between the car and the scanner but there seems to be a seed-key algorithm in order to authenticate the scanner with the car. (I have ruled out a simple xor of bitshift). Any ideas on how to decipher this? I have a list of seed-keys and the chatter before in case someone wants to take a look. Any help is greatly appreciated.
Thanks,
Jaime Middleton
Software Engineer
Tucar Spa
------------------------------------------------------------------------
Tucar cell phone +56 9 42526635
Tucar cell phone jmiddleton@tucar.app <mailto:jmiddleton@tucar.app>
Tucar net www.tucar.app <https://www.tucar.app>
Tucar location Plaza Yolanda 80, Las Condes, Santiago de Chile
_______________________________________________ OvmsDev mailing list OvmsDev@lists.openvehicles.com http://lists.openvehicles.com/mailman/listinfo/ovmsdev
_______________________________________________ OvmsDev mailing list OvmsDev@lists.openvehicles.com http://lists.openvehicles.com/mailman/listinfo/ovmsdev
-- Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal Fon 02333 / 833 5735 * Handy 0176 / 206 989 26
Well, it's tough to give definite suggestions without the sample list of seed-key pairs. But, checking simple xor, bitshift, known CRC algorithms, and summing are the first steps. Generally, at least until very recently, usually nobody bothered to put too much effort into the algorithms so they tended to be fairly simple. One of the best things to do is to compare what happens to the key when you change the seed. It's great if you can get thousands of pairs and find some where the seed differs by only a single bit. Sometimes that yields important clues. On Tue, Oct 11, 2022 at 4:20 PM Jaime Middleton <jmiddleton@tucar.app> wrote:
Hi all, I am currently working on the implementation for the Maxus Euniq6. I have been able to decipher most of the metrics I wanted, but now I need to open and close doors. I was able to get access to a scanner for the car and sniff the can while the scanner opened and closed the doors. I mostly deciphered the interaction between the car and the scanner but there seems to be a seed-key algorithm in order to authenticate the scanner with the car. (I have ruled out a simple xor of bitshift). Any ideas on how to decipher this? I have a list of seed-keys and the chatter before in case someone wants to take a look. Any help is greatly appreciated.
Thanks,
Jaime Middleton
Software Engineer
Tucar Spa ------------------------------
[image: Tucar cell phone] +56 9 42526635
[image: Tucar cell phone] jmiddleton@tucar.app <jmiddleton@tucar.app>
[image: Tucar net] www.tucar.app <https://www.tucar.app>
[image: Tucar location] Plaza Yolanda 80, Las Condes, Santiago de Chile
_______________________________________________ OvmsDev mailing list OvmsDev@lists.openvehicles.com http://lists.openvehicles.com/mailman/listinfo/ovmsdev
participants (4)
-
Chris van der Meijden -
Collin Kidder -
Jaime Middleton -
Michael Balzer