Security acsses mode

Developer topics relating to software that reflashes or modifes ECU code and data

Moderator: Freon

Security acsses mode

Postby justinforda » Tue Oct 21, 2008 11:50 am

Hi Guys I am new here. working on my progect I was checking how the
write to EEprom ocures on SH7058 PCM Outback 2005. Using OEM scan tool. And you have to pass through security acsses login first.

when you reflash this type of PCM do you have to pass Login aswell.
80 F1 10 27 01 CRC
80 10 F1 67 01 ss ss ss ss CRC
80 F1 10 27 02 kk kk kk kk CRC

is any one have seed key formula?
Posts: 2
Joined: Tue Oct 21, 2008 11:01 am
Location: Montreal

Postby Jon [in CT] » Thu Oct 23, 2008 7:01 am

I've read here that the seed/key (aka, challenge/response) algorithm for the sti04 ecu is the same as the one for the wrx04 ecu. So it might be the same for your Outback's ecu. If so and if you're fluent in C++, then you can find the algorithm in this early version of Ecuflash's source code for 16-bit ecus:
Jon [in CT]
Posts: 352
Joined: Sat Jan 01, 2005 10:23 am

tnx Jon

Postby justinforda » Thu Oct 23, 2008 8:11 pm

Looks like it is diferant unless there is a mistake somwhere
ECU is ID A2WC500S PN22611AJ65A

valid challange set I got for this PCM
0D 71 A0 04->4C 5E 6C B8

chalange set from formula WRX04 16bit ECU
0D 71 A0 04->9A 28 20 5E

is any one have valid set for WRX04 16bit ECU?
any information on how meny diferant fomulas usedthrough the years

some one kick me to right direction
Posts: 2
Joined: Tue Oct 21, 2008 11:01 am
Location: Montreal

Return to Reflashing Software

Who is online

Users browsing this forum: No registered users and 1 guest