Automobile seed key calculation, pass code & pin code immo calculator

Automobile seed key calculators

Nowadays, a car is not only a precise mechanic but also an advanced computer managing every aspect of driving or any other functionality.

Special diagnostic software that allows you to update your car's software, program new keys or perform any other functions, often requires you to provide access keys in order to perform a specific action.

These keys are required every time and are not free of charge. These are usually generated from the VIN number of the vehicle.

Solution

Our company offers a specialized service consisting in performing reverse engineering of any diagnostic software and attempting to extract algorithms needed to generate access keys and creating calculators based on them or providing source codes of algorithms in any programming language.

Example. Restored car seed key algorithm source code in Python programming language.

#!/usr/bin/env python

crc_table_0 = [
    0x2A, 0xFD, 0xF3, 0x11, 0xBF, 0x83, 0x22, 0x21, 0x07, 0x33,
    0x18, 0x60, 0xFE, 0x7E, 0xA4, 0x42, 0x6B, 0xFD, 0x04, 0x75,
    ...
]

crc_table_1 = [
    0x47, 0x47, 0x45, 0x76, 0x37, 0x45, 0x59, 0x2E, 0x45, 0x2A,
    0x25, 0x1F, 0x00, 0x75, 0xFF, 0x78, 0x05, 0xF5, 0x3D, 0x98,
    ...
]

crc_table_2 = [
    0xB6, 0x96, 0x0A, 0x2A, 0xA9, 0x21, 0x41, 0x4B, 0x52, 0xE7,
    0x2E, 0x01, 0x01, 0x14, 0x61, 0x02, 0x6B, 0x6A, 0x05, 0x7E,
    ...
]


def calc(seed, param_flags):
    v8 = param_flags >> 12

    v6 = param_flags & 0xFF

    v7 = (param_flags >> 8) & 0xF

    if param_flags & 0xFF:

        for i in range(4):

            if v7 == 3:

                if v8 == 1:
                    crc_table = crc_table_0
                    crc_item_index = 13 * v6 + 1 + 3 * i
                    control_code = crc_table_0[13 * v6 + 3 * i]
                else:
                    crc_table = crc_table_1
                    crc_item_index = 13 * v6 + 1 + 3 * i
                    control_code = crc_table_1[13 * v6 + 3 * i]

            else:

                crc_table = crc_table_2
                crc_item_index = 13 * v6 + 1 + 3 * i
                control_code = crc_table_2[13 * v6 + 3 * i]

            #print "seed = " + hex(seed) + " control code = " + hex(control_code)

            if control_code == 5:
                seed = (seed >> 8) | (seed << 8)

            elif control_code == 0x14:
                seed += crc_table[crc_item_index + 1] + (crc_table[crc_item_index] << 8)

            elif control_code == 0x2A:
                seed = ~seed

                if crc_table[crc_item_index] < crc_table[crc_item_index + 1]:
                    seed += 1
                elif control_code == 0x37:
                    seed &= crc_table[crc_item_index] + (crc_table[crc_item_index + 1] << 8)

            elif control_code == 0x4C:
                seed = (seed >> (16 - (crc_table[crc_item_index] % 16))) | (seed << crc_table[crc_item_index] % 16)

            elif control_code == 0x52:
                seed |= crc_table[crc_item_index] + (crc_table[crc_item_index + 1] << 8)

            elif control_code == 0x6B:

                v2 = crc_table[crc_item_index + 1] % 16
                seed = (seed << (16 - v2)) | (seed >> v2)

            elif control_code == 0x75:
                seed += crc_table[crc_item_index] + (crc_table[crc_item_index + 1] << 8)

            elif control_code == 0x7E:
                seed = (seed >> 8) | (seed << 8)

                if crc_table[crc_item_index] >= crc_table[crc_item_index + 1]:
                    seed += crc_table[crc_item_index + 1] + (crc_table[crc_item_index] << 8)
                else:
                    seed += crc_table[crc_item_index] + (crc_table[crc_item_index + 1] << 8)

            elif control_code == 0x98:
                seed -= crc_table[crc_item_index + 1] + (crc_table[crc_item_index] << 8)

            elif control_code == 0xF8:
                seed -= crc_table[crc_item_index] + (crc_table[crc_item_index + 1] << 8)

            seed = seed & 0xFFFF

        return seed & 0xFFFF

    else:
        return ~seed & 0xFFFF


def finder(seed, expected):

    for i in range(0xFFFF):

        val = calc(seed, i)

        if val == expected:

            print "seed = " + hex(seed) + " expected = " + hex(expected) + " param_flags = " + hex(i)

            return i

    print "couldn't find param_flags param for the provided expected value!"


key = 0


# expected result 0xBD19
result = calc(0x34D6, 0x0028)
print hex(result)

# expected result 0x5703
result = calc(0x4A3C, 0x0028)
print hex(result)

# expected result 0x14E7
result = calc(0x667E, 0x0028)
print hex(result)

# expected result 0x17DC
result = calc(0x9126, 0x0392)
print hex(result)

# expected result 0x337B
result = calc(0x7587, 0x0392)
print hex(result)

# find the param for the seed & result pair
param_flags = finder(0x7587, 0x337B)

# expected result 0x337B
result = calc(0x7587, param_flags)
print hex(result)

Advantages

Once delivered, the calculator can be reused or included in other software, dramatically reducing the cost of car services.

Estimated time

The estimated time of the service depends on the complexity of the task and cannot be determined without a initial analysis.

Pricing

Costs are determined individually after an initial analysis, taking into account additional work that may occur in the case of any non-standard solutions.