Seed Key

[Tech-link]

Vin 1GCHC24U43E337667
CIN 12579405
CVN 0000FA22

2003 SILVERADO AUTOMATIC

My request is for information on what the seed & key would be for this application?

Any help would be appreciated

[Tech-link]

Sorry forgot one very important piece of information the
received seed from the VCM

Sent 6C 10 F1 27 01
recv 6C F1 10 67 01 60 EB

[Shifted]

As far as I understand, the Seed and Key pair values are generated per an algorithm. The PCM provides the software with a seed, the software uses a formula to generate a key, and provides that back to the PCM. That means that you can't just say, here's the VIN, and a seed, then ask for the key, since it should be different each time you request it.

But that might not be 100% accurate, its just what I understand from reading all the threads here, and whatever information I can find on the internet.

[Tech-link]

I found it, It took some time but It is done, Its late and time for bed...

[Shifted]

Would you like to share how you did this? This is the next step I need...

[ourflat]

Please share with all of us.....

[FastFieros]

Here is a nice set of Seed / Key responses

$3842 (the seed)

I challenge that with a Hex value between 00 and FF ( I think that is the range)

Lets say I send it $00

The response is $C7BD

Lets say I send it $01

The response is $49E5

Lets say I send it $02

The response is $F5A9

Lets say I send it $03

The response is $F385

Lets say I send it $04

The response is $5BF0

Anyone get a formula from that?

Loyde

[FastFieros]

Taken from the internet

Mode $27—Security Access Mode
FUNCTIONAL DESCRIPTION—The primary purpose of this mode is to restrict unauthorized intrusion into the onboard
controller. Improper programs could potentially damage the electronics or other vehicle components
or risk the vehicle's compliance to emission or safety standards. This mode is intended to be used to
implement the data link security measures defined in SAE J2186.
The external device will request the controller to "Unlock" itself by sending Request #1. The controller will
respond by sending a "Seed" using Response #1. The external device will respond by returning a "Key"
number back to the controller using Request #2. The controller would compare this "Key" to one internally
stored. If the two numbers agree, then the controller will enable ("Unlock&quot the external device's access to
specific test modes and indicate that with Mode $67, Response #2. If upon two attempts of a Request #2
where the two keys do not compare, then the controller will insert a 10 s time delay before allowing further
attempts. This time delay will also be required before responding to a Mode $27 request #1 for each
controller power-on.
If a device supports security, but is already unlocked when a Request #1 is received, that device should
respond with a Response #1 message with a seed of $00 00. A test device could use this method to
determine if a device is locked by checking for a non-zero seed.
The security system will not prevent normal diagnostic or vehicle communications between external devices
and the on-board controller. Proper "Unlocking" of the controller is a prerequisite to the external device's
ability to perform some of the more critical functions such as reading specific memory locations within the
controller, downloading information to specific locations, or downloading routines for execution by the
controller. In other words, the only access to the controller permitted while in a "locked" mode is through the
product specific software. This permits the product specific software to protect itself from unauthorized
intrusion.
Devices that provide security should support reject messages if a secure mode is requested while the device
is locked. The reject message to be returned is a general response message Mode $7F, with a response
code $33 to indicate the product is secured.
Some devices could support multiple levels of security, either for different functions controlled by the device,
or to allow different capabilities to be exercised. These additional levels of security can be accessed by using
requests #3 and #4, etc. The second data byte of the request for seed should always be an odd number, and
the second data byte of the message to send the key should be the next even number.

>>>>>>>>>>>>&g t;>>>>>>>>>>>> >>>>>>

So, this explains the process of the Seed / Key challenge.

Loyde

[Shifted]

I have 4 sets of seed/key pairs for the 4 cylinder ECU. We've cracked the v8 algorithm, but the 4 cylinder one isn't as simple.

Anybody who wants to help, click the link in the bottom of my sig.

Thanks.

[Chris@HPTuners]

if you worked out the V8 algo then the 4cyl should be no problem at all

[FastFieros]

if you worked out the V8 algo then the 4cyl should be no problem at all

Flipping HiLo bytes does not work on every VCM. There is a matrix table for the Seed Key which entails 256x13 possible algro's.

Knowing the oprand for that VCM is the search.

Loyde

[Tech-link]

Hello All Sorry that I have not been very active lately... I have been very busy with other automotive related embedded electronics.

The method used to extrapolate the seed key pairs has been tested.

I hope to be able to spend some up coming free time to share this with you all.

[FastFieros]

Flipping HiLo bytes does not work on every VCM. There is a matrix table for the Seed Key which entails 256x13 possible algro's.

Knowing the oprand for that VCM is the search.

Loyde

Wow, I wrote this, but at the time had no clue what the real value of the 256 formulas I had were.

I have learned a little since June when I got this document.

I have VSpy 2 that captured a nice write session which gives me the seed and key. Well, I managed to get the formula also for the 3800 PCM's. I can do the Csums for the 3800 PCM also.

Now if I could only figure out how to make a bootloader, and use it to move all this info around.

Loyde