Page 2 of 8
Re: Mondeo MK5 IPC
Posted: 12 Feb 2020, 15:17
by hanssi
Great, thanks.
Re: Mondeo MK5 IPC
Posted: 12 Feb 2020, 21:08
by leader
Strange happening....
One seed key which is always works on my bench unit GS7T-10849-ALE isn't works on GS7T-10849-BLE.
Both are IPCs from Mondeo MK5.
I putted both part number into my emulator and sniffed the seed authentications made by UCDS.
(UCDS request the HW and SW part number from IPC before looking up the seed key)
My emulator always give back "invalid seed" error message to disable UCDS to start the update and It's work with predefined static seed values.
So in case of GS7T-10849-ALE UCDS always use only 1 seed key, but in case of GS7T-10849-BLE UCDS tries 3 different keys. (If the first is not accepted, than it try to use the next one).
It seems to me that UCDS use different seed keys depending on the HW part number.
For GS7T-10849-ALE the sniffed authentication pairs are:
Code: Select all
SEEDPWD for A7A177 => 07D0FA
SEEDPWD for A1B2C3 => 43570B
SEEDPWD for 4D5E6F => 1EC4F0
And for GS7T-10849-BLE:
Code: Select all
SEEDPWD for A7A177=> F441C8
SEEDPWD for A7A177=> 07D0FA
SEEDPWD for A7A177=> 845928
SEEDPWD for A1B2C3=> B0C639
SEEDPWD for A1B2C3=> 43570B
SEEDPWD for A1B2C3=> C0DED9
SEEDPWD for 4D5E6F=> ED55C2
SEEDPWD for 4D5E6F=> 1EC4F0
SEEDPWD for 4D5E6F=> 9D4D22
Anybody has Mondeo MK5 IPC to make some test?
I can create a small tool to test seed authentication....
Re: Mondeo MK5 IPC
Posted: 13 Feb 2020, 08:50
by avladimir
Sure thing, I can help.
Re: Mondeo MK5 IPC
Posted: 13 Feb 2020, 14:13
by leader
avladimir wrote: ↑13 Feb 2020, 08:50
Sure thing, I can help.
Nice...
What is the part number of your IPC?
It is in your car or it is a bench unit on your desk?
What interfaces do you have for the tests?
Re: Mondeo MK5 IPC
Posted: 13 Feb 2020, 14:37
by Stevebe
I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.
Re: Mondeo MK5 IPC
Posted: 13 Feb 2020, 14:57
by leader
Stevebe wrote: ↑13 Feb 2020, 14:37
I will try to get a few dumps from my mk5 ipc , on bench, have we got any can I’d and data to control the functions as yet,
I do have a mate that has a mk5 I’ll see if I can get a log of his car.
Have you identified some JTAG pins on J500 near to SPC5606S MCU?
Re: Mondeo MK5 IPC
Posted: 13 Feb 2020, 18:48
by avladimir
I have an UCDS and an ELS27. P/N of the unit is FS7T-10849-BGE, on the bench.
Re: Mondeo MK5 IPC
Posted: 14 Feb 2020, 09:53
by paxtonix
leader wrote: ↑13 Feb 2020, 14:57
Have you identified some JTAG pins on J500 near to SPC5606S MCU?
Might be usefull
mikrohacker.jpg
Btw. I have also mk5 ipc with those numebers - if it is helpful feel free to ask
IMG_20200214_104750.jpg
IMG_20200214_104742.jpg
Re: Mondeo MK5 IPC
Posted: 14 Feb 2020, 19:10
by Stevebe
Slowly working out the HS1, HS2 HS3 AND MS . had to make up a gatway to get things to run but getting there,
I’m going to sort the Can buses out I have found a mk5 gateway adaptor and a few other bits, going to try a few dumps later
Thanks to the help from leader,
EFAE39F3-10EE-4E7D-85DA-6CD192CBB4D8.jpeg
503DD3A4-0B59-4D3D-B832-0BBCFF4AC8EB.jpeg
SATNAV2.jpg
Re: Mondeo MK5 IPC
Posted: 15 Feb 2020, 21:31
by Stevebe
leader wrote: ↑13 Feb 2020, 14:57
Have you identified some JTAG pins on J500 near to SPC5606S MCU?
not as yet i have been rather busy i did remember to pol the ipc for the info