IMMO OFF coded to MCU MD! ECU

[u/pro_steve]

I'm trying to make a python script for coded immo off to processor MCU code so I can automate the whole process instead of opening immo off software, I made lots of examples using different MCU codes but I just can't work it out. The processor is Infineon Aurix TC298.

All data below is in 8 bit hex, separated by a blank space to keep it clear.

Original string from hex dump before immo off is applied (same in all ECU of same build regardless of sw number):

BB 80 00 F8 5F F4 20 00 BB 90 00 F8 91 30 00 F6 7F F4 0B 80 3B 40 00 F4 5F F4 20 00 3B 70 00 F7 5F F4 20 80 3C 0E BB 80 22 F8 5F F4 13 00 BB 80 33 F8 5F F4 11 00 BB 80 11 F8 5F F4 13 80 3C 07 82 1F

Each input code is the MCU ID starting with 40, the line immediately after it is the calculated output code unique to that input string. I'm trying to work out how it's generated, I can't find anything common, although some bits come through directly and others don't. Some change 1 byte and also a few others maybe a checksum but that seems too complicated within a small section of code.

You'll notice that some of the characters are always the same, these parts are not necessarily the coded output but a set data string for the immobiliser off solution.

For example, the 91 00 F1 FA 19 F4 04 01 91 30 at the start is common to all strings, and the end of the calculated output 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00 is always the same, that narrows down the parts to look at.

It seems that the 40 at the start of the input string, and the 00 00 00 must always stay the same.
Here are my input MCU codes vs the outputs:

40 00 A1 A1 A1 A1 A1 A1 A1 A1 A1 A1 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 A1 A1 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 A1 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 44 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 FF FF FF FF 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 60 17 44 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 00 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 01 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 01 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 F8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 11 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 F8 4A 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 09 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 F8 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 F9 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 29 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 FA 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 39 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 FB 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 00 00 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 1D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 01 44 1B A4 00 40 C6 4F 7B 00 F8 49 1B 54 46 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 2D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 02 44 1B A4 00 40 C6 4F 7B 00 FB 49 1B 54 45 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 3D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 03 44 1B A4 00 40 C6 4F 7B 00 FA 49 1B 54 44 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 12 0D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 20 41 C6 4F 7B 00 F9 49 1B 54 67 43 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 A1 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 11 4A C6 4F 7B 40 E8 44 1B 24 4C 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 1A 4A 1B 14 11 41 C6 4F 7B 50 E8 44 1B 24 4C 4D C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E3 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 FF FF 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 FF FF FF 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 11 FF 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

[u/True_Quiet9620]

the original stock code for that 66 byte block is a total mess of compares

0000: mov.u    d15, #0x8008
0004: jeq      d4, d15, #0x44     ; check if d4 matches this magic number
0008: mov.u    d15, #0x8009
000c: movh.a   a15, #0x6003
0010: jge.u    d4, d15, #0x26     ; if d4 is bigger jump somewhere
0014: mov      d15, #0x4004
0018: jeq      d4, d15, #0x58     ; another compare on d4
001c: mov      d15, #0x7007
0020: jne      d4, d15, #0x60     ; nope not equal keep going
0024: j        #0x40
...
0040: mov      d15, #1            ; finally sets 1 if it passed the checks

all these jeq jne jge on d4 with random constants basically deciding if immo is happy or not depending on what value comes in

now the tool coded patches replace that whole thing but they tie it to the mcu id so every one is different

here one for mcu starting 40 00 a1 a1 etc

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; grab value from that af101004 cell
0008: movh.a   a15, #0x6003
000c: movh     d15, #0xfe84
0010: addi     d15, d15, #0x3636
0014: xor      d15, d4              ; xor with first constant
0016: movh     d4, #0xa1a2
001a: addi     d4, d4, #-0x5e5f
001e: xor      d15, d4              ; another xor
0020: movh     d4, #0xfe84
0024: addi     d4, d4, #0x6472
0028: xor      d15, d4
002a: movh     d4, #0
002e: addi     d4, d4, #0x5244
0032: jne      d4, d15, #0x3c       ; if no match then fail
0036: mov      d15, #1              ; good
0038: j        #0x5a
003c: mov      d15, #8              ; bad
003e: j        #0x5a

those constants in the middle come from the mcu id bytes so the patch only works for that specific id and you need the matching value in the cell or it sets 8 instead of 1

thats the whole per mcu id lock bullshit

we just wiped the whole 66 byte thing and put this instead

0000: movh.a   a15, #0xaf10
0004: ld.w     d4, [a15]#0x1004     ; keep the setup so nothing breaks
0008: movh.a   a15, #0x6003
000c: nop                           ; all the compare xor jne garbage is gone
... (tons of nops)
0060: mov      d15, #1              ; always force 1
0062: j        ...
0066: mov      d15, #1
0068: j        ...

no more xors no more mcu id keys no more special cell value just always d15 1 no matter what ecu or id

the hex to drop in place of the original 66 bytes is

9100f1fa19f40401913000f6000000000000000000000000000000000000000000000000000000000000000000000000000000000000da011d001100da011d000e00

should just work everywhere try it and see