search

jglim / UnlockECU

Free, open-source ECU seed-key unlocking tool.
MIT License
254 stars 55 forks source link

Subaru SSM4 CMD_SecurityAccess #26

Open jglim opened 1 year ago

jglim commented 1 year ago

ECU Name Subaru ECUs that depend on SSM4 CMD_SecurityAccess

Source file SSM4, CMD_FhiCan.dll

Additional context Subaru ECU key material can now be extracted from SSM4 as the XML keys are now known. In their API definitions, there are typically two types of keys

I've ripped and tidied up the raw x86 instructions, and stuck them into a keygen template. As of right now, I am unable to test if it is working correctly as I do not have a known seed/key pair with an associated ECU ID/variant.

Help wanted! I would appreciate having seed/key pairs with the ECU variant (e.g. 12002/2EE2)

Here's the tool if you'd like to test the algo on your own: sandbox.zip. Windows-only, requires XP and above.

image

jnewb1 commented 1 year ago

Here's some seed/key pairs from a 2021 Crosstrek eyesight module. ECU ID appears to be 12425. Tried your tool but couldn't get it to work for this ecu. Perhaps an endianness issue?

ca5616c0 3adfc8e0

ce0baaff 4bdfdae0

1f5e4b83 94dfd2e0

8a598591 0edfaae0

d121cfea dadfbfe0

9c11699b 9cdfb3e0

2714cb65 74df8ae0

47e5e9fe b0df95e0

jglim commented 1 year ago

Thanks! I've tried swapping the endianness of the inputs and variant keys and couldn't find a match too.

Are those seed/keys generated through SSM4? I'm curious if it is using the same algo as the rip (CMD_SecurityAccess in CMD_FhiCan.dll)

jnewb1 commented 1 year ago

Thanks! I've tried swapping the endianness of the inputs and variant keys and couldn't find a match too.

Are those seed/keys generated through SSM4? I'm curious if it is using the same algo as the rip (CMD_SecurityAccess in CMD_FhiCan.dll)

Yes they are generated by ssm4. I'll try putting a breakpoint at CMD_SecurityAccess to verify