Seed Key Algorithm Analysis/Disassembly

Seed Key challenge is the method commonly used to get the correct access rights, so that we can execute download/upload commands.

It doesn't matter if the control unit uses RSA encryption or a simple Seed/key algorithm, we have always been successful in getting access to the control unit.

recently popular SEED & KEY Algorithms available:

S.No Algorithms
1 Range/Land-Rover with 24C16 OBD (Does mileage change, no R/W eep)
2 Jaguar XJ with 24C16 OBD (Does mileage change, no R/W eep)
3 Ford Fiesta 2013 diag (this is this xeq) (Can R/W eep by bootloader)
4 Ford 95320 Diag (cover Focus, Transit) (Does mileage change, no R/W eep)
5 Ford Fiesta from 2010 diag(Can R/W eep by boot loader)
6 Ford Ka 2009-2014 diag
7 Opel Insignia and friends (those BCU Opel (24c16, 95160) (Does mileage change, no R/W eep)
8 BCU Opel Meriva (Does mileage change, no R/W eep)
9 MB with 95640 for (A W176, B W246, CLA W117, ML W166, GL X166 ,SLK R172, SL R231) - diag solution
10 Evoque with 93c76 – diag solution (This covers Jaguar F-Type and RR Sport 2016, too)
11 Porsche cayanne – diag solution
12 W205 mileage change from obd2 SK algo -  Blocker needed
13 MB W204 mileage correction SKC algo  - NO blocker needed
14 MB W222 mileage correction SKC algo - Blocker needed
15 simos7 eeprom read/write from obd2
16 med17 edc17 ecu eeprom decryption algo from dump (eeprom block ids 0800 0900 0A00)
17 tp22 23 24 25 creation from megamos
18 passat 2007+ comfort module eeprom decrypt algorithm
19 Simo18 SKC
20 Scania EMS6 (truck)
21 Audi Bcm2 with 95320 + NEC70F3239,NEC70F3380,NEC70F3381 AND NEC70F3381 or NEC70F3634 (without eeprom) decrypt and encrypt algorithm
22 Magnetti Marelli 6F3 ECU (both CAN and K-line) RW e2p RW flash and RW MCU 555;
23 Magnetti Marelli 8DF ECU (K-line) RW e2p RW MCU5553;
24 Magnetti Marelli 8F2 / 8F3 ECU (both CAN and K-Line) RW e2p RW MCU5565.
25 med17 edc17 CRC + ecu eeprom decryption algo from dump (like edc17c74)
26 PSA Valeo 4L00M+95128/25128 CAN (BSI2004-P0X-00).EEPROM 95128/25128 R/W, show PIN, 9S12DP512 FLASH R/W
27
PSA Valeo 2M48H+24C128 CAN (BSIEV-X0X-00) . EEPROM 24C128 R/W, show PIN, 9S12XEP768 FLASH R/W
28  PSA Valeo SC667152+95256 CAN (BSI-N0X-00). EEPROM 95256 R/W, show PIN, SC667152 FLASH R/W
29 PSA Johnson Controls easyCAN4+29LV400+95128 CAN (BSI2004-H0X).EEPROM 95128 R/W, show PIN, 29LV400BB FLASH R/W
30 PSA Johnson Controls easyCAN4F1M-32+95128 CAN (BSI04EV-K0X).EEPROM 95128 R/W, show PIN, easyCAN4F1M-32 FLASH R/W
31 PSA Siemens D76F0018+95160 KLINE (BSI-E0X-00/BSI-F0X-00) . EEPROM 95160 R/W , show PIN
32 PSA Siemens 1L00M+95128/95256 CAN (BSI-S0X-00). EEPROM 95128/95256  R/W, show PIN, 9S12DP512 FLASH R/W)
33 PSA Continental SC667050+95256 CAN (BSI-Q0X-00)  EEPROM 95256 R/W, show PIN, SC667050 FLASH R/W
34 PSA Johnson Controls SPC560B60+95128 CAN (BSI04EV2-KEX) EEPROM 95128 R/W, show PIN,SPC560B60 FLASH R/W
35 PSA Siemens D76F0018+95160 KLINE (BSI-E0X-00/BSI-F0X-00) . EEPROM 95160 R/W , show PIN
36 PSA Siemens 1L00M+95128/95256 CAN (BSI-S0X-00). EEPROM 95128/95256  R/W, show PIN, 9S12DP512 FLASH R/W
37 PSA Continental SC667050+95256 CAN (BSI-Q0X-00).   EEPROM 95256 R/W, show PIN, SC667050 FLASH R/W
38 PSA Johnson Controls SPC560B60+95128 CAN (BSI04EV2-KEX).EEPROM 95128 R/W, show PIN,SPC560B60 FLASH R/W
39 Cummins Ecu diagnosis seed/key algo and encryption J1939 protocol (CM2150E)
40 FIAT DELPHI BSI 70F3237+93C86 CAN . EEPROM   93C86 R/W ,show PIN, show KEY preparartion data. 70F323 FLASH R.
41 FIAT DELPHI BSI 70F3379+93C86 CAN . EEPROM   93C86 R/W ,show PIN, show KEY preparartion data. 70F3379 FLASH R.
42 FIAT DELPHI BSI 70F3633 CAN . 70F3633 data flash read ,show PIN, show KEY preparartion data.
43 FORD DELPHI BSI 70F3379+93C86 CAN . EEPROM   93C86 R/W ,show PIN, show KEY preparartion data. 70F3379 FLASH R
44 Toyota USA - G and H key immobox reset
45 Chery A5 BCM