Mondeo MK5 IPC

IPC - Instrument cluster panels (like Convers+)
hanssi
Starter
Posts: 28
Joined: 02 Jul 2019, 20:12

Re: Mondeo MK5 IPC

Post by hanssi » 12 Feb 2020, 15:17

Great, thanks.

leader
Starter
Posts: 41
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader » 12 Feb 2020, 21:08

Strange happening....

One seed key which is always works on my bench unit GS7T-10849-ALE isn't works on GS7T-10849-BLE.
Both are IPCs from Mondeo MK5.
I putted both part number into my emulator and sniffed the seed authentications made by UCDS.
(UCDS request the HW and SW part number from IPC before looking up the seed key)
My emulator always give back "invalid seed" error message to disable UCDS to start the update and It's work with predefined static seed values.

So in case of GS7T-10849-ALE UCDS always use only 1 seed key, but in case of GS7T-10849-BLE UCDS tries 3 different keys. (If the first is not accepted, than it try to use the next one).

It seems to me that UCDS use different seed keys depending on the HW part number.

For GS7T-10849-ALE the sniffed authentication pairs are:

Code: Select all

SEEDPWD for A7A177 => 07D0FA
SEEDPWD for A1B2C3 => 43570B
SEEDPWD for 4D5E6F => 1EC4F0
And for GS7T-10849-BLE:

Code: Select all

SEEDPWD for A7A177=> F441C8
SEEDPWD for A7A177=> 07D0FA
SEEDPWD for A7A177=> 845928
				  
SEEDPWD for A1B2C3=> B0C639
SEEDPWD for A1B2C3=> 43570B
SEEDPWD for A1B2C3=> C0DED9
				  
SEEDPWD for 4D5E6F=> ED55C2
SEEDPWD for 4D5E6F=> 1EC4F0
SEEDPWD for 4D5E6F=> 9D4D22
Anybody has Mondeo MK5 IPC to make some test?
I can create a small tool to test seed authentication....

avladimir
Posts: 9
Joined: 14 Dec 2019, 00:11

Re: Mondeo MK5 IPC

Post by avladimir » 13 Feb 2020, 08:50

Sure thing, I can help.

leader
Starter
Posts: 41
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader » 13 Feb 2020, 14:13

avladimir wrote:
13 Feb 2020, 08:50
Sure thing, I can help.
Nice...

What is the part number of your IPC?
It is in your car or it is a bench unit on your desk?
What interfaces do you have for the tests?

User avatar
Stevebe
Active member
Posts: 211
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe » 13 Feb 2020, 14:37

I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.
Digimod

leader
Starter
Posts: 41
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader » 13 Feb 2020, 14:57

Stevebe wrote:
13 Feb 2020, 14:37
I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.
Have you identified some JTAG pins on J500 near to SPC5606S MCU?

avladimir
Posts: 9
Joined: 14 Dec 2019, 00:11

Re: Mondeo MK5 IPC

Post by avladimir » 13 Feb 2020, 18:48

I have an UCDS and an ELS27. P/N of the unit is FS7T-10849-BGE, on the bench.

paxtonix
Active member
Posts: 88
Joined: 16 Oct 2019, 14:25

Re: Mondeo MK5 IPC

Post by paxtonix » 14 Feb 2020, 09:53

leader wrote:
13 Feb 2020, 14:57
Have you identified some JTAG pins on J500 near to SPC5606S MCU?
Might be usefull
mikrohacker.jpg


Btw. I have also mk5 ipc with those numebers - if it is helpful feel free to ask
IMG_20200214_104750.jpg
IMG_20200214_104742.jpg
You do not have the required permissions to view the files attached to this post.
Tourist

User avatar
Stevebe
Active member
Posts: 211
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe » 14 Feb 2020, 19:10

Slowly working out the HS1, HS2 HS3 AND MS . had to make up a gatway to get things to run but getting there,
I’m going to sort the Can buses out I have found a mk5 gateway adaptor and a few other bits, going to try a few dumps later
Thanks to the help from leader,
EFAE39F3-10EE-4E7D-85DA-6CD192CBB4D8.jpeg
503DD3A4-0B59-4D3D-B832-0BBCFF4AC8EB.jpeg
SATNAV2.jpg
You do not have the required permissions to view the files attached to this post.
Digimod

User avatar
Stevebe
Active member
Posts: 211
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe » 15 Feb 2020, 21:31

leader wrote:
13 Feb 2020, 14:57

Have you identified some JTAG pins on J500 near to SPC5606S MCU?
not as yet i have been rather busy i did remember to pol the ipc for the info
You do not have the required permissions to view the files attached to this post.
Digimod

Post Reply