search

bri3d / VW_Flash

Flashing tools for VW AG control units over UDS. Compression, encryption, RSA bypass, and checksums are supported for Simos18.1/6/10, DQ250-MQB, DQ381-MQB, and Haldex4Motion-Gen5-MQB.
Other
315 stars 80 forks source link

SPC5777 (off-topic) #89

Open loskani opened 1 year ago

loskani commented 1 year ago

Hello,

This is off-topic for now for sure. But maybe there are possibilities to OBD flash the Calibration/ASW sector for MG1CS002 SPC5777?

bri3d commented 1 year ago

Standard UDS flashing is straightforward. On VW Bosch the Fingerprint / Workshop Code is important, but otherwise it's all the same.

UDS Programming Preconditions -> Enter Programming Session -> Seed/Key (on VW this is always SA2 in a Programming Session) -> Write Fingerprint -> Erase -> Request -> TransferData -> Exit -> Checksum -> Programming Dependencies.

Support for flashing any sector of any control module which has no signature checking or disabled signature checking should be very easy to write using this code as a base.

The issues come with fixing the checksums (not usually very complicated) and finding an RSA bypass exploit, which will be different for each specific ECU. I don't know what UDS-accessible RSA bypass exploit (if any) is used on MG1CS002, you'd have to disassemble a CBOOT and find out.