I need help unlocking an ECU

[Ivanbk]

I am in the process of finding the correct algorithm for a dongfeng nammi, using decompiled code. I have all the files and have done extensive work reading the decompiled assembly code. My issue is i don't have experience in this field (assembly or decompilation of ECU's). The files have algorithms for multiple ECU's in the DongFeng Brand. From my analysis, everything revolves around system_acc_enter. But i am unclear on how it really works. Ghidra is having a hard time writing good assembly for the file.

system_acc_enter is a function in which an entire exchange between the scanner and ecu happens, with functions like send_key_to_ecu, send_code_get_seed, extend_mode_enter and get_key(). My issue with the decompiled function is that there appears to be a this pointer of unknown structure being passed around with a lot of the relevant info needed to correctly analyze the flow.

From using the scanner app. I found that AX7 model and D53 Model worked and unlocked my ECU, at least in level 3 which let me control the BCM.

Any help would be super useful. I like this repo and would like to contribute a lot to it.

Feel free to ask any questions

EV_DFBF.zip

[jglim]

Hey welcome back Ivan

I took a quick look at the library, some observations:

system_acc_enter is usually called with a bunch of constant parameters e.g. system_acc_enter((a1 + 5), 6, 3u, 4u). As far as I can tell, only the second and fourth parameters are useful.

int __fastcall system_acc_enter(unsigned __int8 *a1, int key_variant, char in_param_1, char seed_key_len)

The second parameter is used to choose the key algorithm when calling calc_key::get_key, and the last parameter specifies the length of the seed/key. A struct that's shaped like this seems to work fine:

00000000 struct __fixed access_getseed_ctx // sizeof=0x10
00000000 {                                       // XREF: _Z16system_acc_enterPhihh/r
00000000     __int16 unk1;
00000002     __int16 key_buffer;
00000004     int seed_bytes;
00000008     int key_result;
0000000C     char seed_key_len;
0000000D     char in_param_1;
0000000E     // padding byte
0000000F     // padding byte
00000010 };

[Ivanbk]

Thanks for the help! I found in another de-compilation what I am pretty sure is the algorithm i am looking for. I am trying to unlock the IBC (BCM, BodyControlModule or IntegratedBodyControl ) for a dongfeng S31. I found the function seedcalckeyIBC inside of SystemAccessS31IbcBleed. My issue lies when trying to convert the assembly instructions to an equivalent C implementation I always arrive at varying results, none of them give me the correct key from the given seed. I have been at it for about a week straight with no luck, my lack of expertise is haunting me.

Here i have the assembly for all of the related functions:

                             *************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             undefined  __stdcall  seedcalkeyIBC (byte *  param_1 , undef
                               assume LRset = 0x0
                               assume TMode = 0x1
             undefined         <UNASSIGNED>   <RETURN>
             byte *            r0:4           param_1
             undefined1 *      r1:4           param_2
             undefined4        Stack[-0x14]:4 local_14                                XREF[2]:     00067e78 (W) , 
                                                                                                   00067eb0 (R)   
             undefined4        Stack[-0x18]:4 local_18                                XREF[1]:     00067e92 (W)   
                             seedcalkeyIBC                                   XREF[3]:     Entry Point (*) , 
                                                                                          seedcalkeyIBC:0002b5b0 (T) , 
                                                                                          seedcalkeyIBC:0002b5b8 (c) , 
                                                                                          000d26dc (*)   
        00067e68 d0  b5           push       {r4,r6,r7,lr}
        00067e6a 02  af           add        r7,sp,#0x8
        00067e6c 82  b0           sub        sp,#0x8
        00067e6e 0c  46           mov        r4,param_2
        00067e70 14  49           ldr        param_2 ,[DAT_00067ec4 ]                          = 00069942h
        00067e72 79  44           add        param_2 ,pc
        00067e74 09  68           ldr        param_2 ,[param_2 ,#0x0 ]=>->__stack_chk_guard     = 00b72010
        00067e76 09  68           ldr        param_2 ,[param_2 ,#0x0 ]=>__stack_chk_guard       = ??
        00067e78 01  91           str        param_2 ,[sp,#local_14 ]
        00067e7a 42  78           ldrb       r2,[param_1 ,#0x1 ]
        00067e7c 01  78           ldrb       param_2 ,[param_1 ,#0x0 ]
        00067e7e 83  78           ldrb       r3,[param_1 ,#0x2 ]
        00067e80 12  04           lsls       r2,r2,#0x10
        00067e82 c0  78           ldrb       param_1 ,[param_1 ,#0x3 ]
        00067e84 42  ea  01  61    orr.w      param_2 ,r2,param_2 , lsl #0x18
        00067e88 41  ea  03  21    orr.w      param_2 ,param_2 ,r3, lsl #0x8
        00067e8c 08  43           orrs       param_1 ,param_2
        00067e8e 43  f6  6a  31    movw       param_2 ,#0x3b6a
        00067e92 00  90           str        param_1 ,[sp,#0x0 ]=>local_18
        00067e94 c2  f2  42  71    movt       param_2 ,#0x2742
        00067e98 68  46           mov        param_1 ,sp
        00067e9a c3  f7  84  eb    blx        seedtokey_modePDCU                               uint seedtokey_modePDCU(int * pa
        00067e9e 01  0e           lsrs       param_2 ,param_1 ,#0x18
        00067ea0 21  70           strb       param_2 ,[r4,#0x0 ]
        00067ea2 01  0c           lsrs       param_2 ,param_1 ,#0x10
        00067ea4 61  70           strb       param_2 ,[r4,#0x1 ]
        00067ea6 01  0a           lsrs       param_2 ,param_1 ,#0x8
        00067ea8 a1  70           strb       param_2 ,[r4,#0x2 ]
        00067eaa 07  49           ldr        param_2 ,[DAT_00067ec8 ]                          = 00069906h
        00067eac e0  70           strb       param_1 ,[r4,#0x3 ]
        00067eae 79  44           add        param_2 ,pc
        00067eb0 01  9a           ldr        r2,[sp,#local_14 ]
        00067eb2 09  68           ldr        param_2 ,[param_2 ,#0x0 ]=>->__stack_chk_guard     = 00b72010
        00067eb4 09  68           ldr        param_2 ,[param_2 ,#0x0 ]=>__stack_chk_guard       = ??
        00067eb6 89  1a           subs       param_2 ,param_2 ,r2
        00067eb8 04  bf           itt        eq
        00067eba 02  b0           add.eq     sp,#0x8
        00067ebc d0  bd           pop.eq     {r4,r6,r7,pc}
        00067ebe c2  f7  02  e8    blx        <EXTERNAL>::__stack_chk_fail                     undefined __stack_chk_fail()
                             -- Flow Override: CALL_RETURN (CALL_TERMINATOR)

///

                             *************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             uint  __stdcall  seedtokey_modePDCU (int *  param_1 , uint  p
                               assume LRset = 0x0
                               assume TMode = 0x1
             uint              r0:4           <RETURN>
             int *             r0:4           param_1
             uint              r1:4           param_2
                             seedtokey_modePDCU                              XREF[3]:     Entry Point (*) , 
                                                                                          seedtokey_modePDCU:0002b5a4 (T) , 
                                                                                          seedtokey_modePDCU:0002b5ac (c) , 
                                                                                          000d26d8 (*)   
        000a0a44 f0  b5           push       {r4,r5,r6,r7,lr}
        000a0a46 03  af           add        r7,sp,#0xc
        000a0a48 81  b0           sub        sp,#0x4
        000a0a4a 06  68           ldr        r6,[param_1 ,#0x0 ]
        000a0a4c 0c  46           mov        r4,param_2
        000a0a4e c4  f3  07  42    ubfx       r2,r4,#0x10 ,#0x8
        000a0a52 21  0e           lsrs       param_2 ,r4,#0x18
        000a0a54 30  14           asrs       param_1 ,r6,#0x10
        000a0a56 8b  f7  3e  ed    blx        f37KeyFromSeed                                   int f37KeyFromSeed(uint param_1,
        000a0a5a c4  f3  07  21    ubfx       param_2 ,r4,#0x8 ,#0x8
        000a0a5e 05  46           mov        r5,param_1
        000a0a60 e2  b2           uxtb       r2,r4
        000a0a62 30  b2           sxth       param_1 ,r6
        000a0a64 8b  f7  36  ed    blx        f37KeyFromSeed                                   int f37KeyFromSeed(uint param_1,
        000a0a68 c0  ea  05  41    pkhbt.w    param_2 ,param_1 ,r5, lsl #0x10
        000a0a6c 60  f3  07  01    bfi        param_2 ,param_1 ,#0x0 ,#0x8
        000a0a70 08  46           mov        param_1 ,param_2
        000a0a72 01  b0           add        sp,#0x4
        000a0a74 f0  bd           pop        {r4,r5,r6,r7,pc}
        000a0a76 00  00           align      align(2)

///

                             *************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             int  __stdcall  f37KeyFromSeed (uint  param_1 , uint  param_2
                               assume LRset = 0x0
                               assume TMode = 0x1
             int               r0:4           <RETURN>
             uint              r0:4           param_1
             uint              r1:4           param_2
             ushort            r2:2           param_3
                             f37KeyFromSeed                                  XREF[3]:     Entry Point (*) , 
                                                                                          f37KeyFromSeed:0002c4d4 (T) , 
                                                                                          f37KeyFromSeed:0002c4dc (c) , 
                                                                                          000d2be8 (*)   
        000a074c 2d  e9  f0  41    push       {r4,r5,r6,r7,r8,lr}
        000a0750 4f  f6  f0  73    movw       r3,#0xfff0
        000a0754 84  b2           uxth       r4,param_1
        000a0756 c0  f6  ff  73    movt       r3,#0xfff
        000a075a 03  ea  10  1c    and.w      r12 ,r3,param_1 , lsr #0x4
        000a075e 05  23           movs       r3,#0x5
        000a0760 4f  f0  80  08    mov.w      r8,#0x80
        000a0764 03  ea  10  33    and.w      r3,r3,param_1 , lsr #0xc
        000a0768 08  ea  84  16    and.w      r6,r8,r4, lsl #0x6
        000a076c 43  ea  0c  0e    orr.w      lr,r3,r12
        000a0770 4f  f0  2a  0c    mov.w      r12 ,#0x2a
        000a0774 0c  ea  90  23    and.w      r3,r12 ,param_1 , lsr #0xa
        000a0778 0c  ea  94  05    and.w      r5,r12 ,r4, lsr #0x2
        000a077c 4f  f0  40  0c    mov.w      r12 ,#0x40
        000a0780 4e  ea  03  0e    orr.w      lr,lr,r3
        000a0784 2e  43           orrs       r6,r5
        000a0786 0c  ea  04  17    and.w      r7,r12 ,r4, lsl #0x4
        000a078a 3e  43           orrs       r6,r7
        000a078c 4f  ea  ce  07    lsl.w      r7,lr,#0x3
        000a0790 47  ea  56  17    orr.w      r7,r7,r6, lsr #0x5
        000a0794 79  40           eors       param_2 ,r7
        000a0796 08  ea  90  07    and.w      r7,r8,param_1 , lsr #0x2
        000a079a 3b  43           orrs       r3,r7
        000a079c 0c  ea  10  10    and.w      param_1 ,r12 ,param_1 , lsr #0x4
        000a07a0 c4  f3  00  17    ubfx       r7,r4,#0x4 ,#0x1
        000a07a4 18  43           orrs       param_1 ,r3
        000a07a6 04  23           movs       r3,#0x4
        000a07a8 47  ea  04  17    orr.w      r7,r7,r4, lsl #0x4
        000a07ac 03  ea  14  13    and.w      r3,r3,r4, lsr #0x4
        000a07b0 3b  43           orrs       r3,r7
        000a07b2 2b  43           orrs       r3,r5
        000a07b4 db  00           lsls       r3,r3,#0x3
        000a07b6 43  ea  50  10    orr.w      param_1 ,r3,param_1 , lsr #0x5
        000a07ba c0  b2           uxtb       param_1 ,param_1
        000a07bc 50  40           eors       param_1 ,param_3
        000a07be 40  ea  01  20    orr.w      param_1 ,param_1 ,param_2 , lsl #0x8
        000a07c2 c0  43           mvns       param_1 ,param_1
        000a07c4 00  b2           sxth       param_1 ,param_1
        000a07c6 bd  e8  f0  81    pop.w      {r4,r5,r6,r7,r8,pc}

[Ivanbk]

I forgot to add a pair of seed key responses. Any help would be really appreciated, I am going bald over this.

[jglim]

I couldn't find those instructions from the binaries that you attached, except for a similar f37KeyFromSeed in libDFBF.so.

f37KeyFromSeed takes in two additional parameters in R1 and R2. You will need to find those values first.

You can also try to emulate f37KeyFromSeed in Unicorn. Remember to set the registers (R0 = seed, R1, R2 = xor parameters)

from unicorn import *
from unicorn.arm_const import *


def hook_code(uc: Uc, address, size, user_data):
    if address == 0:
        raise UcError(8)
    is_thumb = (uc.reg_read(UC_ARM_REG_CPSR) & 0x20) > 0
    # print(f'> 0x{address:X}, size = 0x{size:X} : {uc.mem_read(address, size).hex()}, thumb: {is_thumb}')


if __name__ == '__main__':
    vm_section_text = 0x400000
    vm_stack_size = 0x1000
    vm_stack_position = vm_stack_size >> 1
    vm_entrypoint = vm_section_text

    vm_section_text_bytes = bytes(b"\x2D\xE9\xF0\x41\x4F\xF6\xF0\x73\x84\xB2\xC0\xF6\xFF\x73\x03\xEA\x10\x1C\x05\x23\x4F\xF0\x80\x08\x03\xEA\x10\x33\x08\xEA\x84\x16\x43\xEA\x0C\x0E\x4F\xF0\x2A\x0C\x0C\xEA\x90\x23\x0C\xEA\x94\x05\x4F\xF0\x40\x0C\x4E\xEA\x03\x0E\x2E\x43\x0C\xEA\x04\x17\x3E\x43\x4F\xEA\xCE\x07\x47\xEA\x56\x17\x79\x40\x08\xEA\x90\x07\x3B\x43\x0C\xEA\x10\x10\xC4\xF3\x00\x17\x18\x43\x04\x23\x47\xEA\x04\x17\x03\xEA\x14\x13\x3B\x43\x2B\x43\xDB\x00\x43\xEA\x50\x10\xC0\xB2\x50\x40\x40\xEA\x01\x20\xC0\x43\x00\xB2\xBD\xE8\xF0\x81")

    mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)

    mu.mem_map(vm_section_text, 0x1000)  # code
    mu.mem_write(vm_entrypoint, vm_section_text_bytes)
    mu.mem_map(0, 0x1000)  # stack, unused
    mu.reg_write(UC_ARM_REG_SP, vm_stack_position)

    mu.hook_add(UC_HOOK_CODE, hook_code, None)
    mu.reg_write(UC_ARM_REG_R0, 0x6DA7A7E1)  # seed
    mu.reg_write(UC_ARM_REG_R1, 0x5B)  # xor-r1
    mu.reg_write(UC_ARM_REG_R2, 0x2E)  # xor-r2

    try:
        mu.emu_start(vm_entrypoint + 1, vm_entrypoint + len(vm_section_text_bytes) + 1)
    except UcError as e:
        if e.errno == UC_ERR_FETCH_UNMAPPED:
            print(f'Key: {mu.reg_read(UC_ARM_REG_R0):08X}')
        else:
            print(f'Unhandled UC Exception: {e}, {e.errno}')

[Ivanbk]

Found the Algorithm to Unlock Level 3. It is working on the car.

Thanks for the help @jglim !

I can send the C implementation of the Algo to add it to the list.

I also found that higher levels use the Car vin as an input parameter for another, more complicated algorithm.

[jglim]

That's good news, glad to hear that!

Sure, you can attach it here and we can try to figure how to integrate it with UnlockECU

[Ivanbk]

Perfect, sorry for the late reply. Here is the algorithm:

With some brute forcing, I found that the algorithm used the following hex in the algo to "fuzz" the numbers: 0x13243546. This hex worked with all key->seed pairs, and we successfully got level 3 access in the car. There is another algorithm (more complex) for a higher level access which lets you reprogram key's, but it was out of my scope.

#include <stdint.h>
#include <stdio.h>
/**
 * @brief Performs the specific seed-to-key calculation for mode 0x27.
 *
 * @param seed_bytes A pointer to a 4-byte array containing the seed.
 * IMPORTANT: The exact source and order of these bytes relative
 * to the ECU communication needs confirmation based on the
 * assembly's stack reads (sp-0x92, sp-0x91, sp-0x90, sp-0x8f).
 * This implementation assumes:
 * seed_bytes[0] = byte loaded from sp-0x92
 * seed_bytes[1] = byte loaded from sp-0x91
 * seed_bytes[2] = byte loaded from sp-0x90
 * seed_bytes[3] = byte loaded from sp-0x8f
 *
 * @return uint32_t The calculated 32-bit key for mode 0x27. Returns 0 if input is NULL.
 */
 
 
 static inline uint32_t byte_swap32(uint32_t val) {
    // Use GCC/Clang intrinsic if available
#if defined(_GNUC) || defined(clang_)
    return __builtin_bswap32(val);
#else
    // Manual implementation as a fallback
    val = ((val << 8) & 0xFF00FF00) | ((val >> 8) & 0x00FF00FF);
    return (val << 16) | (val >> 16);
#endif
}

 
 
uint32_t seedtokey_mode05(uint32_t this_val, uint32_t* ptr_to_seed) {
    // 000abdba: ldr r1, [r1, #0x0] (Dereference input pointer)
    uint32_t seed = *ptr_to_seed;
    uint8_t input_bytes[4];
    // Extract bytes from seed conceptually, mimicking stack storage access pattern.
    // Assembly loop (i=1..4) loads from sp+9, sp+a, sp+b, sp+c.
    // Mapping: i=1 -> MSB, i=4 -> LSB.
    
    input_bytes[0] = (uint8_t)(seed >> 24); // MSB (accessed when i=1)
    input_bytes[1] = (uint8_t)(seed >> 16); // Byte 2 (accessed when i=2)
    input_bytes[2] = (uint8_t)(seed >> 8);  // Byte 3 (accessed when i=3)
    input_bytes[3] = (uint8_t)(seed);      // LSB (accessed when i=4)

    // Initialize accumulator
    uint32_t current_this = this_val;

    // Core Processing Loop (Assuming 4 iterations)
    for (int i = 1; i <= 4; ++i) {
        uint32_t r2_temp;
        // Load byte corresponding to iteration 'i'.
        // Assembly uses index 'i', accessing bytes in order MSB to LSB.
        uint8_t loaded_byte = input_bytes[i - 1];

        // Perform the core calculation: r2 = (this >> 4) + (this << 5) + loaded_byte
        r2_temp = (current_this >> 4) + (current_this << 5);
        r2_temp += loaded_byte;

        // XOR back into accumulator: this ^= r2
        current_this ^= r2_temp;
    }

    // Final byte reversal (mimics rev.eq on success path)
    uint32_t final_result = byte_swap32(current_this);
    return final_result;
}
// --- Example Usage ---


int main() {
    // IMPORTANT: Replace with the actual 4 seed bytes read from the correct
    // locations (sp-0x92, sp-0x91, sp-0x90, sp-0x8f) during execution
    // when mode 0x27 is active.

    uint32_t token = 0x13243546;
    uint32_t seed_from_can = 0xE1A76D34;
    uint32_t key = seedtokey_mode05(token, &seed_from_can);

    printf("Calculated Key (Mode 0x27): 0x%08X\n", key);

    return 0;
}

[Autodiagcc]

Hi,
I need help for unlock audio navigation Renault and Dacia.
Seed 64 Bits.
Thanks in advance.

[copancn]

I am in the process of finding the correct algorithm for a dongfeng nammi, using decompiled code. I have all the files and have done extensive work reading the decompiled assembly code. My issue is i don't have experience in this field (assembly or decompilation of ECU's). The files have algorithms for multiple ECU's in the DongFeng Brand. From my analysis, everything revolves around system_acc_enter. But i am unclear on how it really works. Ghidra is having a hard time writing good assembly for the file.

system_acc_enter is a function in which an entire exchange between the scanner and ecu happens, with functions like send_key_to_ecu, send_code_get_seed, extend_mode_enter and get_key(). My issue with the decompiled function is that there appears to be a this pointer of unknown structure being passed around with a lot of the relevant info needed to correctly analyze the flow.

From using the scanner app. I found that AX7 model and D53 Model worked and unlocked my ECU, at least in level 3 which let me control the BCM.

Any help would be super useful. I like this repo and would like to contribute a lot to it.

Feel free to ask any questions

EV_DFBF.zip

Hello, I am very interested in the files you provided. I am also learning reverse engineering techniques. Do you have any other similar files available? I would greatly appreciate it if you could provide them.Could you kindly let me know if there is anywhere I can download them?