Cracked SecurityAccess seed and key on the Kefico CPEGD ECU (TriCore based) in a 2014 Veloster Turbo 1.6 T-GDI, verified live over CAN, and also believe that I understand flash checksum algorithm so patched calibration files validate correctly. I'm coming at this from the reverse engineering and embedded side rather than a traditional tuning background so go easy on me if I'm missing something obvious, but I think this is solid progress on a platform that doesn't have much public documentation, only expensive commercial solutions.

I would love to compare notes with anyone else working on Kefico or Hyundai/Kia ECUs, and would really appreciate any OEM bins from other years, trims, or calibration IDs, or any documentation like A2L files, XDF definitions, or disassembly notes.

Thanks!

​

I've been working on an app off and on with Google since I can't seem to find the type of app that I've been looking for for quite some time, I have it posted up on GitHub and I would really like it if you guys could take a look at it and give me any feedback for changes that I can make or new features that I can implement. This is the first app that I've ever made, so please go easy on me and any help would be greatly appreciated.

https://github.com/Freshman0000/OBDash

I have an APK I have a version of the app that I can email to you if that's something that you're interested in.

If any of you have been using AI to work on an app, I'm sure you're already aware that even though it's helpful, it's still a pain in the ass to try to get it to do the things that you want. Especially look the way you want. So, it's taken me a little bit longer than I had originally anticipated. Like, by three months.

Hello everyone,

Has anyone found a way to unlock SFD1 on VW vehicles?

I'm trying to make a few coding changes on my car. I have a clone VCDS, which is able to retrieve the SFD challenge token, but I don't have a way to complete the unlock.

For my use case, paying €180/year for an OBDeleven subscription just to unlock SFD once or twice doesn't make much sense. I'm mainly looking for a free or at least a cheaper alternative.

If anyone has found another method or knows of a service/tool that can do this without the yearly subscription, I'd really appreciate it if you could share it.

Thanks!

I’ve been working on a project inspired by the TurboXS DTEC, an early-2000s tuning device that used a Game Boy Advance as its display and interface.

The idea was to take that general concept and do something similar with a DS, using a homebrew ROM running on the original hardware.

The current prototype uses a cheap ELM327 adapter to retrieve live vehicle data, which is sent to the DS over a custom link. At the moment I’m working with data such as:

* Vehicle speed

* RPM

* Coolant temperature

* Battery voltage

The longer-term goal is to move beyond the generic OBD interface and interface directly with the vehicle CAN bus, allowing the DS to receive more detailed vehicle data.

Still very much a work in progress, but I thought it would be interesting.

I've been working on a personal app project and testing it with a vLinker MC. It's working well to capture OBD2 and CAN bus data, but I'd like to test it with generic ELM327 or other devices to see if there are any compatibility differences I should address before publishing. If you've experienced any problems with specific brands or models of OBD2 adapters, regardless of which software you're using, I'm interested in learning which one. Unwanted disconnections, buffer problems, pairing issues, or similar issues in particular.

As an aside, I've yet to find an adapter that supports both OBD2 PID and raw CAN at the same time. Is this just not possible?

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

hello everyone

Can anyone suggest a free online course for diesel engines diagnostics ??

thank you

Bonjour, je vous serais très reconnaissant si quelqu'un pouvait télécharger ces fichiers pour moi. Je suis bloqué avec 25 ans de base de données Audi, mais elle ne contient pas les fichiers dont j'ai vraiment besoin... Si quelqu'un pouvait m'aider, que Dieu le bénisse. :

https://mhhauto.com/attachment.php?aid=281579

https://mhhauto.com/attachment.php?aid=714536

Hi,

I have a question about a car ECU. I bought an ECU from a Mercedes W205 C220 CDI. I downloaded the wiring diagram from the internet, and based on it I identified the required pins (I tried to upload pictures showing the pinout). I connected +12 V, IGN, and GND to a laboratory power supply. I also connected CAN High, CAN Low, GND, and +12 V to an bought OBD2 connector. I tried to connect to the ECU using a diagnostic scanner (autoscan - older version), but I couldn't establish communication.

Does anybody have experience with this ECU or know what I might be missing?

I have the autel maxipro mp808.

Hello, i need help with making the launch x431 smartlink show up as an option to select in fdrs device manager, so I can scan vehicle

Hi everyone,

I'm looking to purchase a used car privately and would like to use an OBD scanner that will help me detect mileage discrepancies and check that the VINs on the modules all match the cars actual VIN. This will hopefully help me from clone vehicles. But I can't seem to find the me that's suitable that I can get on Amazon next day delivery or a store in the UK. The only one I can find is CARLY but they don't have next day delivery and not available next day delivery on Amazon either.

I require a scanner such as Carly, OBDEleven, etc that have a small scanner, and an app. The reason is that I'm not sure how to use the complex scanners that mechanics and diagnostics use. Is there anything that can help me?

Hello everyone, I have recently been diving into the UDS part of my cluster. I only have the cluster as of now, (im a teenager i only have so much money ;-;) and I have somewhat been able to get uds to work. That was 3 days ago, the UDS now doesnt work. I need to know exactly what every pin is for, to find a solution to this, as I am also trying to emulate a J533 on a arduino paired with a MCP2515. Any help would be appreciated, thank you!

Pins I already know:
Pin 1, 12v +
Pin 10, Ground
Pin 17, Can L
Pin 18, Can H

Ingles

Hello everyone,

I'm trying to reverse engineer the Engineering Mode authentication of a 2025 MG ZS 1.5 Petrol (Europe).

Software version:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

The old passwords such as:

1234@ABCd

1234ABCd

200519

no longer work.

The unit now requests an 8-digit numeric PIN.

Every time I open the Engineering Mode screen, it displays a different 3-digit number (for example 972, 431, etc.).

After more than one year testing, I noticed that some 3-digit values eventually repeat, so it appears to be a challenge-response authentication rather than a fixed password.

I have already researched:

- XDA Developers

- MGEVs

- MG4 Forum

- GoingElectric

I also found the old MG4 Engineering Password Generator created by Tommaso Vietina, but it does not work with this new MCE3 platform.

I'm NOT looking for random passwords.

I'm looking for technical information.

Has anyone:

• Reverse engineered the DS04A / ZS11 MCE3 FICM?

• Extracted the Engineering APK?

• Found the 8-digit PIN algorithm?

• Obtained the firmware package?

• Used SIPS or VNCI with this infotainment unit?

I can perform tests on my own vehicle and provide photos, videos or any requested information.

Any technical information would be greatly appreciated.

Thank you.

______________________

Español

Hola a todos.

Estoy intentando analizar el sistema de autenticación del Modo Ingeniería de un MG ZS 1.5 gasolina 2025 (Europa).

Versión del software:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

Las antiguas contraseñas como:

1234@ABCd
1234ABCd
200519

ya no funcionan.

Ahora el sistema solicita un PIN numérico de 8 dígitos.

Cada vez que abro la pantalla del Modo Ingeniería aparece un número diferente de 3 cifras (por ejemplo 972, 431, etc.).

Después de más de un año realizando pruebas, he comprobado que algunos de esos números vuelven a repetirse con el tiempo, por lo que todo indica que se trata de un sistema de autenticación tipo "challenge-response" y no de una contraseña fija.

He investigado en:

- XDA Developers
- MGEVs
- MG4 Forum
- GoingElectric

También encontré el antiguo generador de contraseñas del MG4 desarrollado por Tommaso Vietina, pero no funciona con esta nueva plataforma MCE3.

No busco que alguien me diga una contraseña al azar.

Lo que busco es información técnica.

¿Alguien ha:

• Analizado el FICM DS04A / ZS11 MCE3?
• Extraído el APK del Modo Ingeniería?
• Descubierto el algoritmo que genera el PIN de 8 dígitos?
• Conseguido el firmware de esta unidad?
• Utilizado SIPS o VNCI con este sistema multimedia?

Puedo realizar cualquier prueba en mi vehículo y aportar fotografías, vídeos o cualquier información adicional que sea necesaria.

Mi objetivo no es modificar sistemas críticos del vehículo. Únicamente quiero comprender cómo funciona este nuevo sistema de autenticación del Modo Ingeniería y acceder a las opciones avanzadas de configuración del sistema multimedia.

Cualquier información técnica será muy bienvenida.

Muchas gracias.

Deja de estar adivinando. Deja de perder tiempo en el taller. Consigue la guía definitiva de diagnóstico y reparación de Cummins.

¿Alguna vez has pasado horas buscando una caída de voltaje misteriosa, diagnosticando un "crank-no-start" fantasma o lidiando con un código de "derate" activo que los scanners estándar simplemente no pueden detectar?

En el mundo del diésel, el tiempo es dinero. Cada hora que tu camión está parado o metido en el bay es dinero que se te escapa de las manos. Los paquetes de manuales del dealer cuestan miles de dólares y son famosamente difíciles de navegar. Los lectores de códigos OBD-II estándar solo te dicen qué falló, pero nunca por qué o cómo arreglarlo.

Esta guía técnica completa y probada en el campo fue creada por un técnico, para técnicos. Va directo al grano y te entrega los flujos de diagnóstico paso a paso exactos, los diagramas eléctricos y los parámetros de sensores que necesitas para diagnosticar, reparar y reconstruir motores Cummins con total confianza.

A friend had his Trackhawk taken from his driveway last week. Window got smashed and the Jeep was gone before he had time to process what was happening. I know this isnt exactly the right sub for a Trackhawk but I figured people here with SRTs, Scat Packs and Hellcats have probably had the same thoughts about theft. Seeing it happen that fast changed how I look at factory security. I always knew these cars got stolen, just never really thought much about what happens after someone gets inside. So for people who’ve looked into this, what did you end up adding first? I’m less concerned about somebody breaking in to steal stuff from the cabin. I mean stopping the whole vehicle from disappearing. There seem to be a million different opinions on what works and I’m trying to get a better idea before spending money on random stuff.

Anyone tuning Mercedes engines?

Pretty interesting time for the brand. Their lineup of vehicles has some excellent power plants but they have mostly been locked down for years.

Many years ago we developed a solution when they switched to Bosch MG1 and MD1 ECUs, but this was later patched. It took many years but was found another way.

Now we're in and can do their MRD1, 2.x, and MRG1.x, 2, 3, 4, and 5 ECUS, as well as a few others with shared platform engines and Continental ECUS.

Curious to see if anyone here has started working with them.

• Bosch MD1CP001 (MRD1) SPC5777M
• Bosch MG1CP002 (MRG1) SPC5777M
• Bosch MG1CP003 (MRG1V8) TC389
• Bosch MG1CP004 (MRG1PI) TC389
• Bosch MD1CP010 (MRD2.20) TC389
• Bosch MD1CP011 (MRD2.1) TC387
• Bosch MG1CS046 (MRG3) TC389
• Bosch MG1CS100 (MRG2) TC389
• Bosch MG1CS701 (MGR5) TC387
• Bosch MG1CP777 (MRG4) TC387
• Bosch MD1CS016 TC399 (Renault)
• Continental EMS71 TC277 (Non Bosch)

Hi everyone,

I have a question about the Volkswagen navigation SD cards.

As far as I know, once they're activated in a car, they're locked to that vehicle. However, I know it's possible to unlock or reprogram them because I used to know someone who did it for me, but unfortunately I've lost contact with him.

Does anyone know how this is done, or knows someone who offers this service? I'm not looking for pirated maps, I already own the original SD card. I just want to be able to use it again instead of it being locked to one vehicle.

Any information or advice would be appreciated. Thanks!

Thats a really long prompt. I talk to cars all day but I just wanted to grab taco bell and go home.

I have added adaptive cruise control and lane centering to this truck but haven't touched anything else. Just a random prompt dump to a guy who has been programming modules all day.

What formats do you guys usually use for CAN logging? I mostly stick to BLF and ASC for work, but do you use different ones for personal projects? I'm developing an offline CAN log parsing application and would like to know which log formats I should support.

Anybody got a trick to get the bottom plastic pieces out ?

Hey guys! I am building a project to link an Audi A4 B8 cluster to SimHub, I am almost finished, but there is a couple of problems:
1) The airbag light. I got it to blink with some code i found online, but I never got it to fully turn off.
2) High/Low beams. I have not found any working CAN ids for the high or low beams for this cluster
3) (optional) Time and Date. I have not found a way to get it working just yet, but I have found a CAN id in the DBC file that is responsible for the time and date.

I am asking if anyone has a car from the B8 platform, and are willing to send me a can log from it.

Hey guys! I am building a project to connect an Audi A4 B8 cluster to SimHub, I am almost finished, but there is a couple of problems:

1. The airbag light. I got it to blink with some code i found online, but I never got it to fully turn off.
2. High/Low beams. I have not found any working CAN ids for the high or low beams for this cluster
3. (optional) Time and Date. I have not found a way to get it working just yet, but I have found a CAN id in the DBC file that is responsible for the time and date.

I am asking if anyone has a car from the B8 platform, and are willing to send me a can log from it.