search

bri3d / sa2_seed_key

VW SA2 Seed/Key Authentication for Programming Sessions
MIT License
77 stars 24 forks source link

Any actual seedkey examples for any VAG ECUs? #1

Open rusefillc opened 1 year ago

rusefillc commented 1 year ago

I know that here you have the tool, but what about actual magic inputs? Are those public/known for any ECUs?

bri3d commented 1 year ago

Yes, the SA2 "script" strings are in either the ODX files inside of the FRF flash container for any ECU or the SGO files for older ECUs, in the SECURITY-METHOD =SA2 sub-key of the SECURITYS section of the reflash SESSION definition in the ODX.

For example,

 <SECURITY-METHOD TYPE="A_ASCIISTRING">SA2</SECURITY-METHOD>
                  <FW-SIGNATURE TYPE="A_BYTEFIELD">6809824A0C84540520064A05873011201281848EA7664C4A058722541912814A0181494C</FW-SIGNATURE>

FRF files are poorly encrypted ZIP files which can be decrypted to ODX using this tool: https://github.com/bri3d/VW_Flash/blob/master/frf/decryptfrf.py . SGO files are SGML Object Files with the data xor'd with 0xFF and can be unpacked using random tools from around the Internet (I will add one to VW_Flash soon as I need to support ancient DSG gearboxes for someone's project).

Whether or not these are "public" is a bit loaded I suppose, but they are certainly known and available. FRF files can be found in the VW "Flashdaten." In some countries with good consumer protections, these can be downloaded directly from ErWin (the VW self service portal) as they are included with the car. In others you will have to find them on torrents/fileshare or similar sources. For practical purposes I think most people just torrent these using the keyword from above.

Razonics commented 1 year ago

Is the SECURITYS section supposed to be clearly identified in the file or you just have to know where to look? I can't see it in the SGO file I'm looking at.