TC1791_CAN_BSL
virtualcar
| TC1791_CAN_BSL | virtualcar | |
|---|---|---|
| 1 | 1 | |
| 48 | 141 | |
| - | - | |
| 0.0 | 0.0 | |
| over 2 years ago | over 3 years ago | |
| C | C | |
| - | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
TC1791_CAN_BSL
-
Simos18 Supplier Bootloader (SBOOT) Exploit: Reading Boot Passwords
In addition to the RSA signature, all Simos18 code blocks are also checked against a simple CRC checksum. And, in this case, SBOOT tries to validate the CRC checksum before it validates the RSA signature. It turns out the CRC validation is performed using an address header, and the address header has weak bounds checking. So, we can ask the ECU to checksum the boot passwords, and send us the checksum back. Since CRC is not a cryptographic hash (it is reversible), we can use the CRC values to back-calculate the boot passwords. Unfortunately, we can't do this cleanly, because the high side of the address range IS correctly bounds-checked. So instead, we have to start the CRC checksum process, then rapidly reboot into the Tricore Bootstrap Loader and dump the contents of RAM, to see the intermediate/temporary CRC values that have been calculated for only the boot passwords. https://github.com/bri3d/TC1791_CAN_BSL/blob/main/bootloader.py#L113
virtualcar
-
OBDII Emulator?
this also looks interesting https://github.com/duraki/virtualcar
What are some alternatives?
ghidra_tc1791_registers
esp32-obd2-emulator - Open-source OBD-II emulator based on an ESP32 + CAN transceiver IC, controllable via WiFi through a simple web UI (or via API)
HackBGRT - Windows boot logo changer for UEFI systems
ELM327-emulator - ELM327 Emulator for testing software interfacing OBDII via ELM327 adapter supporting multi-ECU simulation
Simos18_SBOOT - Documentation and tools about Simos18 SBOOT (Supplier Bootloader), including a Seed/Key bypass and Tricore boot password recovery tool.
raspberry-pi-os - Learning operating system development using Linux kernel and Raspberry Pi
crchack - Reversing CRC for fun and profit
RejsaCAN-ESP32 - ESP32 and ESP32-S3 board with CAN interface, runs on 12V power (with auto shutdown)
sa2_seed_key - VW SA2 Seed/Key Authentication for Programming Sessions
evdi - Extensible Virtual Display Interface
VW_Flash - Flashing tools for VW AG control units over UDS. Compression, encryption, RSA bypass, and checksums are supported for Simos18.1/6/10, DQ250-MQB, DQ381-MQB, and Haldex4Motion-Gen5-MQB.