Update IPC

[Stevebe]

Hi guys thank you for the guidance, I understand The proses now, I just never used the therm SEED before, it is a simple principle that seem to be very effective, from reading a lot of articles on this matter it would seem it’s going to get a lot more secure with the use of newer and better cryptography, hardware.. when I was learning Canbus did not exist so I have only been working with it for past 2 years, and being a old person things take longer to sink in, LOL..
Know I have more info I’ll go through all the posted info and I’m certain I’ll understand it better,
Once again thanks for taking the time to explain..

[Ursadon]

Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new

ipcupdate.png

When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing

[oscarboiro]

After copy on my arduino sketch have this error: expected initializer before 'LFSR'

i need a LFSR library? the code are only to C# or is valid to arduino?

Hi! I apologize for the delay - I finished my studies at the institute

This is pseudo C code
Here is C code, which you can use - https://gist.github.com/Ursadon/8c55972 ... efa037fabb

Also:
1) I cracked all secret keys for (probably) all modules in Ford - https://gist.github.com/Ursadon/8941ff5 ... e09f060eec
For IPC use second key.
2) I made my own CANhacker, so the development process will go faster

Thanks!!! but i have a very lower level to program and after "COpy and Paste" your code my arduino sketch dont work to calculate seed.
i made array with can bus code, example; 720 8 23 24 25 26 27 28 23 24
array(0) = 23
array(1) = 24
array(2= = 25 ....

i take only a digits of a seed and need send to your code to calculate outcode, but i dont know to do.

this is my code to read CAN BUS

CAN0.readMsgBuf(&rxId, &len, rxBuf);

and to filter signals i wrote this:

if (rxId == 0x433) {
if (rxBuf[3] == 0x0A) {
//Here code to execute action
}
}

any sugestion to put your code to calculate seed?

thanks

[Go4IT]

Extreeem goood job, Ursadon!! I'm really impressed and can't wait to test your work.

[Stevebe]

Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new
ipcupdate.png

When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing

brillient work, would it be possible try your perogram,

[Ursadon]

After copy on my arduino sketch have this error: expected initializer before 'LFSR'

i need a LFSR library? the code are only to C# or is valid to arduino?

Hi! I apologize for the delay - I finished my studies at the institute

This is pseudo C code
Here is C code, which you can use - https://gist.github.com/Ursadon/8c55972 ... efa037fabb

Also:
1) I cracked all secret keys for (probably) all modules in Ford - https://gist.github.com/Ursadon/8941ff5 ... e09f060eec
For IPC use second key.
2) I made my own CANhacker, so the development process will go faster

Thanks!!! but i have a very lower level to program and after "COpy and Paste" your code my arduino sketch dont work to calculate seed.
i made array with can bus code, example; 720 8 23 24 25 26 27 28 23 24
array(0) = 23
array(1) = 24
array(2= = 25 ....

i take only a digits of a seed and need send to your code to calculate outcode, but i dont know to do.

I'm not very familiar with AVR C compiler, but you have a problem with passing the filter to the function because of arrays? if so, then just combine "char[*]" into int32:

uint32_t seed = (static_cast<int>(array[0]) & 0xff) << 24
| (static_cast<int>(array[1]) & 0xff) << 16
| (static_cast<int>(array[2]) & 0xff) << 8
| (static_cast<int>(array[3]) & 0xff) ;

and then pass to "int generate_seed_response(int s1, int s2, int s3, int s4, int s5, int seed)" function
s1-s5 keys seems to be a "{0x08, 0x30, 0x61, 0x55, 0xAA}" (most likely)

Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new
ipcupdate.png

When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing

brillient work, would it be possible try your perogram,

I only tested the flashing external memory. I’m still afraid to overwrite the main one - if anything, I don’t have a second panel
That is why I ordered the panel from the diesel mondeo, which will come in 4-6 working days. Then I will release v1.0.0 and continue to work on the ford logo image changer (the "FLIC" project).

[Ursadon]

Version 1.0.0 (codename: "Proof-of-concept") is released. For ELS27 cable.

mainscreen.png

IPCupdater-1.0.0.zip

Pre-flight check:
1. Use ELS27Baudrate.exe to set port speed to 2MBit/s

ELS27_Baudrate.zip

2. On driver page set latency to 1 ms (otherwise update procees takes over 1 hour):

driverLatency.png

Current major bugs:
During update process don't touch mouse (because program is single-thread, i'll fix it later)

ToDo:
1. Multi-threading
2. Fix latency
3. Auto select port speed
4. More error handling
5. Add support for ELM327 (dont' use STN1170-specific commands)
6. Fix progressbar flickering
7. Show SW number before and after updating

[Stevebe]

Ursadon
do i need to instal QT brfore the ipcupdater will run as i get a error cant fing QT, or do i need to register the DLL files
it looks really good

[Ursadon]

Ursadon
do i need to instal QT brfore the ipcupdater will run as i get a error cant fing QT, or do i need to register the DLL files
it looks really good

Sorry, i forgot some lib

IPCupdater-1.0.0-withlib.zip

[tomy75]

hello

i need modifiy FW patch for my FL convers,i have car from FL
can you please help?

thenx