MicroHacker Forum

Online community for electronics and microcontroller reverse engineering
https://microhacker.denkdose.de/

Update IPC

https://microhacker.denkdose.de/viewtopic.php?t=33

Page 3 of 16

Re: Update IPC

Posted: 29 May 2019, 18:36
by Stevebe
Hi guys thank you for the guidance, I understand The proses now, I just never used the therm SEED before, it is a simple principle that seem to be very effective, from reading a lot of articles on this matter it would seem it’s going to get a lot more secure with the use of newer and better cryptography, hardware.. when I was learning Canbus did not exist so I have only been working with it for past 2 years, and being a old person things take longer to sink in, LOL..
Know I have more info I’ll go through all the posted info and I’m certain I’ll understand it better,
Once again thanks for taking the time to explain..

Re: Update IPC

Posted: 04 Jun 2019, 18:10
by Ursadon
Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new
ipcupdate.png
When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing

Re: Update IPC

Posted: 05 Jun 2019, 11:49
by oscarboiro
Ursadon wrote: ↑25 May 2019, 16:38
oscarboiro wrote: ↑30 Apr 2019, 08:49
After copy on my arduino sketch have this error: expected initializer before 'LFSR'

i need a LFSR library? the code are only to C# or is valid to arduino?
Hi! I apologize for the delay - I finished my studies at the institute :)

This is pseudo C code
Here is C code, which you can use - https://gist.github.com/Ursadon/8c55972 ... efa037fabb

Also:
1) I cracked all secret keys for (probably) all modules in Ford - https://gist.github.com/Ursadon/8941ff5 ... e09f060eec
For IPC use second key.
2) I made my own CANhacker, so the development process will go faster :)
Thanks!!! but i have a very lower level to program and after "COpy and Paste" your code my arduino sketch dont work to calculate seed.
i made array with can bus code, example; 720 8 23 24 25 26 27 28 23 24
array(0) = 23
array(1) = 24
array(2= = 25 ....

i take only a digits of a seed and need send to your code to calculate outcode, but i dont know to do.

this is my code to read CAN BUS

CAN0.readMsgBuf(&rxId, &len, rxBuf);

and to filter signals i wrote this:

if (rxId == 0x433) {
if (rxBuf[3] == 0x0A) {
//Here code to execute action
}
}

any sugestion to put your code to calculate seed?

thanks

Re: Update IPC

Posted: 05 Jun 2019, 15:56
by Go4IT
Extreeem goood job, Ursadon!! :D I'm really impressed and can't wait to test your work.

Re: Update IPC

Posted: 05 Jun 2019, 20:31
by Stevebe
Ursadon wrote: ↑04 Jun 2019, 18:10 Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new
ipcupdate.png

When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing
brillient work, would it be possible try your perogram,

Re: Update IPC

Posted: 06 Jun 2019, 16:35
by Ursadon
oscarboiro wrote: ↑05 Jun 2019, 11:49
Ursadon wrote: ↑25 May 2019, 16:38
oscarboiro wrote: ↑30 Apr 2019, 08:49
After copy on my arduino sketch have this error: expected initializer before 'LFSR'

i need a LFSR library? the code are only to C# or is valid to arduino?
Hi! I apologize for the delay - I finished my studies at the institute :)

This is pseudo C code
Here is C code, which you can use - https://gist.github.com/Ursadon/8c55972 ... efa037fabb

Also:
1) I cracked all secret keys for (probably) all modules in Ford - https://gist.github.com/Ursadon/8941ff5 ... e09f060eec
For IPC use second key.
2) I made my own CANhacker, so the development process will go faster :)
Thanks!!! but i have a very lower level to program and after "COpy and Paste" your code my arduino sketch dont work to calculate seed.
i made array with can bus code, example; 720 8 23 24 25 26 27 28 23 24
array(0) = 23
array(1) = 24
array(2= = 25 ....

i take only a digits of a seed and need send to your code to calculate outcode, but i dont know to do.
I'm not very familiar with AVR C compiler, but you have a problem with passing the filter to the function because of arrays? if so, then just combine "char[*]" into int32:

uint32_t seed = (static_cast<int>(array[0]) & 0xff) << 24
| (static_cast<int>(array[1]) & 0xff) << 16
| (static_cast<int>(array[2]) & 0xff) << 8
| (static_cast<int>(array[3]) & 0xff) ;

and then pass to "int generate_seed_response(int s1, int s2, int s3, int s4, int s5, int seed)" function
s1-s5 keys seems to be a "{0x08, 0x30, 0x61, 0x55, 0xAA}" (most likely)
Stevebe wrote: ↑05 Jun 2019, 20:31
Ursadon wrote: ↑04 Jun 2019, 18:10 Okay, today I wrote a program (proof-of-concept) that successfully erased flash and wrote a new
ipcupdate.png

When the flash is clean, the IPC is always restarts (aka "bootloop")

i'm using ELS27 cable (ELM327-compatible) with some sort of "tuning" - in driver page, need to change timeouts from 16ms to 1ms, otherwise the upgrading process takes more than 1 hour.

For erasing flash i used "RoutineControl" = 0x31 with "RoutineControlType" = 0x01 (startRoutine) and "routineIdentifier" = 0xFF 0x00 (p.290 ISO14229 - ""eraseMemory"")"
Detailed update log is here - https://docs.google.com/spreadsheets/d/ ... sp=sharing
Also, i scanned Ford DSFM site (https://www.fordtechservice.dealerconne ... roduct=IDS) in order to search for new IPC firmwares. I put the data in the table:
https://docs.google.com/spreadsheets/d/ ... sp=sharing
brillient work, would it be possible try your perogram,
I only tested the flashing external memory. I’m still afraid to overwrite the main one - if anything, I don’t have a second panel :)
That is why I ordered the panel from the diesel mondeo, which will come in 4-6 working days. Then I will release v1.0.0 and continue to work on the ford logo image changer (the "FLIC" project). :)

Re: Update IPC

Posted: 09 Jun 2019, 17:02
by Ursadon
Version 1.0.0 (codename: "Proof-of-concept") is released. For ELS27 cable.
mainscreen.png
IPCupdater-1.0.0.zip

Pre-flight check:
1. Use ELS27Baudrate.exe to set port speed to 2MBit/s
ELS27_Baudrate.zip
2. On driver page set latency to 1 ms (otherwise update procees takes over 1 hour):
driverLatency.png

Current major bugs:
During update process don't touch mouse (because program is single-thread, i'll fix it later)

ToDo:
1. Multi-threading
2. Fix latency
3. Auto select port speed
4. More error handling
5. Add support for ELM327 (dont' use STN1170-specific commands)
6. Fix progressbar flickering
7. Show SW number before and after updating

Re: Update IPC

Posted: 10 Jun 2019, 00:05
by Stevebe
Ursadon
do i need to instal QT brfore the ipcupdater will run as i get a error cant fing QT, or do i need to register the DLL files
it looks really good

Re: Update IPC

Posted: 10 Jun 2019, 15:54
by Ursadon
Stevebe wrote: ↑10 Jun 2019, 00:05 Ursadon
do i need to instal QT brfore the ipcupdater will run as i get a error cant fing QT, or do i need to register the DLL files
it looks really good
Sorry, i forgot some lib :oops:
IPCupdater-1.0.0-withlib.zip

Re: Update IPC

Posted: 14 Jun 2019, 19:21
by tomy75
hello

i need modifiy FW patch for my FL convers,i have car from FL
can you please help?

thenx
All times are UTC
Page 3 of 16

Powered by phpBB® Forum Software © phpBB Limited