Vin protection

[DGAlexandru]

Yes, post both files (log and exe) and we will check it... but if you don't have "auto-parking-on," I'm sure that all they did was the standard update.

[leader]

Leader

Another easy way to obtain the modified firmware is to use the MondeoElmTester program which will read the content of the firmware from the IPC and stores all the CAN messages int the log file. With a simple bash script you can regenerate the whole firmware from the CAN messages....
Based on m0rtal's tester program I also created my little program to read/write the vbs files and now there is the IPC Updater tool developed here on the forum which can also read the firmware from any Convers+ IPC

I have a log file of a pam update I do own the elm file as I purchased from convers mod , if I send you the log could you have a look and see if you could
Do some thing with it it would be handy to have a vbf version

If you send the log files than maybe...
It depends on if all the can messages during the the update was saved into the logfile or not.
If you send the exe as well, than i can decrypt tbe vbf also from it.

[amplified]

Im trying to decrypt or take by can sniffing, custom sbl from tpms patch. I think that this sbl changing some configuration of write limitations to eprom.

Yes it changes in eeprom 5 bytes

old post but, from what convers is that eeprom, prefl doesn't look like that on this line?

[ronald0001]

my eeprom also look different and i have a prefl....
after tpms it writes vin extra and other data in the eeprom

much much more then ony 5 bytes

[ronald0001]

and autoparking is also not only standart update....
you got 3 files for that
one standart update (same like for basismod i think)
and a secound update with modded firmware
and third the hex for the gatewaybox....

gatwaybox control now your pam....
without gatwaybox pam is wothout function anymore...
if you disconnect gatway you got error "wrong data from bcm"
for the pam

[tasicky]

AutoPAM loader loads into the PAM module the "Signal Configuration" part of firmware with one changed byte and the last two bytes for adjust the checksum. Checksum of modified vbf and standard is always 0000.

[uscovu]

Hello,

I'm new in this field and I'm trying to understand something. I do have all the mods from u c d s locked by VIN and thanks to "leader" who provide the code for vin calculation I was able to test on bench different vin and it works great but only for nonFL....
I have made same procedure and after upload is finnished the cluster is doing nothing, it is like is not exit from programming mode.
What am I doing wrong?

Thanks.

[uscovu]

I have corected the mistake and I also make a small modification to the code that was posted by "leader" to be much easier.

Code: Select all

#include <stdio.h>
#include <conio.h>

typedef unsigned long DWORD;
typedef unsigned short WORD;

#define LOWORD(a) ((WORD)(a))
#define HIWORD(a) ((WORD)(((DWORD)(a) >> 16) & 0xFFFF))

int calc(unsigned int a1, char a2)
{
  return (a1 << (32 - a2)) | (a1 >> a2);
}

int main() {
    fflush(stdin);
  char VIN[17] ;
  printf("VIN:\n");
  scanf("%s",VIN);
  int x =0, i;
  for (i=0; i<17; i++)
    x+=calc(VIN[i],i+1);
  unsigned char x1 = (HIWORD(x)+x) &  0xff;
  unsigned char x2 = ((HIWORD(x)+x) >> 0x08) & 0xff;
  printf("0xd59f6: %08X\n", x1);
  printf("0xd59EE: %08X\n", x2);
  printf("0xd5b48: %08X\n", x1);
  printf("0xd5b40: %08X\n", x2);

  getch();
};

[bigi]

AutoPAM mod is simple - it changes the CAN ID the PAM module listens for, so BCM doesn't communicate directly with it - hence why you have to have the gateway connected to interpret the BCM original CAN ID messages - and override when autopam is engaged

[fryciu]

Hello forum members!
Any of you have a vin calculator? If so, please send me a private message