jglim / UnlockECU

Free, open-source ECU seed-key unlocking tool.
MIT License
254 stars 55 forks source link

Add KI203M version: 0042 + 0050 #37

Open Brutosss opened 8 months ago

Brutosss commented 8 months ago

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like A clear and concise description of what you want to happen.

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context or screenshots about the feature request here.

Feezex commented 8 months ago

Provide a software number, diagnostic identification results etc.

Brutosss commented 8 months ago

KI203M_0042 = KI209_1042 ?

Feezex commented 8 months ago

No, get info from das or vediamo

Brutosss commented 8 months ago

KI203M_0042 SW 26 07 HW 31 07 A203 540 69 48 AJ08_1 0.0.84 & KI203M_0050 SW 17 08 HW 34 08 A203 540 85 48 AJ09_1 0.0.84

I hope it's enough!

Feezex commented 8 months ago

ok try to use the most close sw version as far as i remember - it works like that - pre version is KI203M_0031 so up to 43 it must be same algo. 31 - 42 , 43 is a next one

Brutosss commented 8 months ago

Thank you very much for the clarification, I'll try it and confirm later!

Brutosss commented 7 months ago

ok try to use the most close sw version as far as i remember - it works like that - pre version is KI203M_0031 so up to 43 it must be same algo. 31 - 42 , 43 is a next one

I tried the previous version 31 and the one after 43 and nothing sparked, it was always on the second level, if you can help in any way to find the solution, please let me know!

Feezex commented 7 months ago

With vediamo you need to create vnd(manual commands input commands list), and need to pass a routine quickly up to security level. For ki203m :

  1. 10 92
  2. 10 86
  3. 21 09
  4. 21 60
  5. 10 F0
  6. 31 FB 00
  7. 31 FB 11
  8. 31 FB 10 Here you will get seed, and answer with 31 FA 10 + key. This will unlock memory read/write. after key acepted you must get answer 71 FA. 31 FB 11 now must response with 71 FB 07 << means level 07 is the actual (and highest)

Im not sure the timer between each commands up to step 8, can be equal of 2-3s.

Brutosss commented 7 months ago

(I already did it with version 0043 and the first time I got level 07, but I used 27 01 and 27 02 and just asked for the level before and after the SEED/KEY)

in this version 0042 when asking for the level at the end despite giving up to 71 FA then the level remained at 02!

But I'm going to try the routine in a more accurate way ;-)

Brutosss commented 7 months ago

I leave it to your appreciation if it helps! tested with version 0031 and 0043 and nothing worked!

0275

Feezex commented 7 months ago

Lool why your answer is same as seed? Make a same screens for v31 and v 43

Brutosss commented 7 months ago

command 10 86 always fails!

despite answering 71 FA the level remains at 02 and does not allow changes to be made! 0031 - 11 03 2024 0043 - 11 03 2024

Feezex commented 7 months ago

Seems perfect, have you tried to read ee?

Brutosss commented 7 months ago

ee? but it remains in version 02!

same in both versions 0031 - 11 03 2024 2

Feezex commented 7 months ago

But 71 fa means its been accepted

Brutosss commented 7 months ago

but as soon as the level is the same (02) it doesn't allow any of the forms to be written...

It seems that the codes are valid, but not for this case in this version and therefore the level transition does not occur!