CAN RX & TX IDENTIFIERS
Code: Select all
BEM_DiagSig_Rx = 0x726
BEM_DiagSig_Tx = 0x72E
BEM_CCP_Rx = 0x706
BEM_CCP_Tx = 0x712
Send:
Code: Select all
726#0210870000000000
Code: Select all
72E#0250870000000000
Send:
Code: Select all
726#072FF2A907976A65
Code: Select all
72E#026FF2A900000000
Send:
Code: Select all
706#0101BEBE00000000
Code: Select all
712#FF00010000000000
Send:
Code: Select all
706#1202020000000000
Code: Select all
712#FF000102K1K2K3K4
Using K1-4 as your seed bytes, calcuate the key response for the module with the algorithm:
Seed Key Bytes
Code: Select all
SECURITY_ID0 = 0x41
SECURITY_ID1 = 0x55
SECURITY_ID2 = 0x36
SECURITY_ID3 = 0x74
Code: Select all
challenge0_ubl = 0
challenge1_ubl = 0
challenge2_ubl = 0
challenge3_ubl = 0
result0_ubl = 0
result1_ubl = 0
result2_ubl = 0
result3_ubl = 0
reply_cnt_ubl = 0
adden_a_uil = 0
adden_b_uil = 0
sum_uil = 0
temp1_ubl = 0
temp2_ubl = 0
temp3_ubl = 0
print(" Calculating Response Key...")
adden_a_uil = (SECURITY_ID2 << 8) + (SECURITY_ID0)
adden_b_uil = (challenge2_ubl << 8) + (challenge3_ubl)
sum_uil = adden_a_uil + adden_b_uil
result2_ubl = (sum_uil >> 8)
result3_ubl = (sum_uil & 0xFF)
adden_a_uil = (SECURITY_ID0 << 8) + SECURITY_ID1
adden_a_uil = (challenge2_ubl << 8) + challenge3_ubl
sum_uil = adden_a_uil + adden_b_uil
result0_ubl = (sum_uil >> 8)
result1_ubl = (sum_uil & 0xFF)
result3_ubl = result3_ubl * 13
result2_ubl = result2_ubl * 11
result1_ubl = result1_ubl * 19
result0_ubl = result0_ubl * 17
result3_ubl = (((temp1_ubl == result3_ubl) << 6) | ((temp2_ubl == result3_ubl) >> 2))
result2_ubl = (((temp1_ubl == result2_ubl) << 6) | ((temp2_ubl == result2_ubl) >> 2))
result1_ubl = (((temp1_ubl == result1_ubl) << 6) | ((temp2_ubl == result1_ubl) >> 2))
result0_ubl = (((temp1_ubl == result0_ubl) << 6) | ((temp2_ubl == result0_ubl) >> 2))
result3_ubl = result3_ubl ^ 17
result2_ubl = result2_ubl ^ 86
result1_ubl = result1_ubl ^ 75
result0_ubl = result0_ubl ^ 52
if result2_ubl & 0x04:
temp3_ubl = (temp1_ubl == (result3_ubl >> 4)) | (temp2_ubl == (result3_ubl << 4))
temp2_ubl = (temp1_ubl == (result2_ubl >> 4)) | (temp2_ubl == (result2_ubl << 4))
result3_ubl = temp2_ubl
result2_ubl = temp3_ubl
else:
temp3_ubl = (temp1_ubl == (result1_ubl >> 4)) | (temp2_ubl == (result1_ubl << 4))
temp2_ubl = (temp1_ubl == (result0_ubl >> 4)) | (temp2_ubl == (result0_ubl << 4))
result1_ubl = temp2_ubl
result0_ubl = temp3_ubl
print(" Key Calculated.")
R1 = result0_ubl
R2 = result1_ubl
R3 = result2_ubl
R4 = result3_ubl
print(" ", R1, R2, R3, R4)
return R1, R2, R3, R4
Send:
Code: Select all
706#1303R1R2R3R40000
Code: Select all
712#FF00030200000000
Send:
Code: Select all
706#0406SS0000000000
Code: Select all
712#FF0006UUUUUUUUUU
Send:
Code: Select all
706#0305SSUUUUUUUU00
Code: Select all
712#FF000500000004004
Attached below is a partially completed python script for use with socketcan/python-can