Mondeo MK5 IPC

[hanssi]

Great, thanks.

[leader]

Strange happening....

One seed key which is always works on my bench unit GS7T-10849-ALE isn't works on GS7T-10849-BLE.
Both are IPCs from Mondeo MK5.
I putted both part number into my emulator and sniffed the seed authentications made by UCDS.
(UCDS request the HW and SW part number from IPC before looking up the seed key)
My emulator always give back "invalid seed" error message to disable UCDS to start the update and It's work with predefined static seed values.

So in case of GS7T-10849-ALE UCDS always use only 1 seed key, but in case of GS7T-10849-BLE UCDS tries 3 different keys. (If the first is not accepted, than it try to use the next one).

It seems to me that UCDS use different seed keys depending on the HW part number.

For GS7T-10849-ALE the sniffed authentication pairs are:

Code: Select all

SEEDPWD for A7A177 => 07D0FA
SEEDPWD for A1B2C3 => 43570B
SEEDPWD for 4D5E6F => 1EC4F0

And for GS7T-10849-BLE:

Code: Select all

SEEDPWD for A7A177=> F441C8
SEEDPWD for A7A177=> 07D0FA
SEEDPWD for A7A177=> 845928
				  
SEEDPWD for A1B2C3=> B0C639
SEEDPWD for A1B2C3=> 43570B
SEEDPWD for A1B2C3=> C0DED9
				  
SEEDPWD for 4D5E6F=> ED55C2
SEEDPWD for 4D5E6F=> 1EC4F0
SEEDPWD for 4D5E6F=> 9D4D22

Anybody has Mondeo MK5 IPC to make some test?
I can create a small tool to test seed authentication....

[avladimir]

Sure thing, I can help.

[leader]

Sure thing, I can help.

Nice...

What is the part number of your IPC?
It is in your car or it is a bench unit on your desk?
What interfaces do you have for the tests?

[Stevebe]

I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.

[leader]

I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.

Have you identified some JTAG pins on J500 near to SPC5606S MCU?

[avladimir]

I have an UCDS and an ELS27. P/N of the unit is FS7T-10849-BGE, on the bench.

[paxtonix]

Have you identified some JTAG pins on J500 near to SPC5606S MCU?

Might be usefull

mikrohacker.jpg

Btw. I have also mk5 ipc with those numebers - if it is helpful feel free to ask

IMG_20200214_104750.jpg

IMG_20200214_104742.jpg

[Stevebe]

Slowly working out the HS1, HS2 HS3 AND MS . had to make up a gatway to get things to run but getting there,
I’m going to sort the Can buses out I have found a mk5 gateway adaptor and a few other bits, going to try a few dumps later
Thanks to the help from leader,

EFAE39F3-10EE-4E7D-85DA-6CD192CBB4D8.jpeg

503DD3A4-0B59-4D3D-B832-0BBCFF4AC8EB.jpeg

SATNAV2.jpg

[Stevebe]

Have you identified some JTAG pins on J500 near to SPC5606S MCU?

not as yet i have been rather busy i did remember to pol the ipc for the info