Comments on: The basics of electronic security bypassing https://jestineyong.com/the-basics-of-electronic-security-bypassing/ Semiconductors, Test Equipments, Circuit Board Troubleshooting, Electronic Repair Courses and Many More! Sun, 05 May 2019 13:16:24 +0000 hourly 1 https://wordpress.org/?v=5.4.19 By: Bern Wortelboer https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-356996 Sun, 05 May 2019 13:16:24 +0000 https://www.jestineyong.com/?p=9940#comment-356996 Hello Chris,

Amazing article,This is what I was looking for. It took a while to find an article like this and now i can strat to exeperiment with my car radio.I have some questions though. It's about a renault carradio. car 2006 radio, navigation, dashboard 2011. Radio has a 2 way anti theft security. First comparing vin code dash, radio with vin of the car.
Cant reprogram the dashboard vin becaurse its already programed. so I was thinking of following the staps in your article to set this command "checking code" to NOP. I know the radio code but i've never bin asked to put the code in becaurse of this vin code check and compare.I'm I on the right direction here? Also a question about the Eeproms. I have looked into the radio( It's a bosch factory renault car radio) and found 4 components that look like an Eeprom as there is a "NXP TJA 1040 AP03" a "25P16VPA 91094" a "25P08VPA 91074" and a "95256WQ K103H" But which one is the Eeprom? Can You tell me? Can I read it on board or do I have to desolder the Eeprom? Hope that you can give me answers to this matter.
Anyway your article set me in a new direction and there will be al lot more to explore without giong totaly blind.
ThaNks in advance.
Best regards Bern Wortelboer, From Holland.

Likes(0)Dislikes(0)
]]> By: Imad https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-343477 Sat, 06 Oct 2018 21:28:57 +0000 https://www.jestineyong.com/?p=9940#comment-343477 Very very useful and good article (easy to understand)

Likes(1)Dislikes(0)
]]> By: Ravi kumar https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-298817 Wed, 07 Sep 2016 00:16:55 +0000 https://www.jestineyong.com/?p=9940#comment-298817 In reply to Chris.

Good morning sir,
what is difference between EEPROM dump,BIN,and firmwrae

Likes(0)Dislikes(0)
]]> By: Chris https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-288195 Mon, 16 May 2016 16:26:40 +0000 https://www.jestineyong.com/?p=9940#comment-288195 Somehow you are correct but it is hard to be a part of your work from my point of view because the distance between as.
My first question is:
What is your machine architecture what you are used to disassembling the firmware from the cpu?

Likes(0)Dislikes(0)
]]> By: Jesse https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-250465 Thu, 20 Aug 2015 00:06:14 +0000 https://www.jestineyong.com/?p=9940#comment-250465 In reply to Chris.

Chris,I am still working on understanding assembly code and how it processes during engine start up to keep the engine running. It appears that when in open loop, it may be running on preset table values in the CPU..however, it relies on the security check results; it runs the subroutine in the eeprom to either keep the engine running or not. This is very challenging work, but making slow progress. So far, I have made a couple of changes to the bin file with no improvements. Will carry on.
jesse

Likes(0)Dislikes(0)
]]> By: Jesse https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-248930 Mon, 10 Aug 2015 23:48:04 +0000 https://www.jestineyong.com/?p=9940#comment-248930 In reply to Chris.

The lines that I believe are part of the subroutine that makes the first digit comparison for correct pin number reads as the following. Here's how it reads and my understanding. I may be completely wrong on this but it's the best I can do at this point.

cmp eax, 0x7207b0f - If eax is equal to the source, go to jp
or ebp, DWORD PTR [ecx+0xf] - if eax is not equal come here next
jp loc 0000031 - comes here if eax equals value
leave

I'm still studying the logic that follows to see how it is checking the remaining digits.
Thanks,
jesse

Likes(0)Dislikes(0)
]]> By: Jesse https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-248626 Sun, 09 Aug 2015 05:48:26 +0000 https://www.jestineyong.com/?p=9940#comment-248626 In reply to Chris.

Hi Chris,
I have made little progress. I have been learning Assembly language.
What I did was disassemble the hex dump and I have been studying it to find the line where the comparison is made between the stored pass code in the EEPROM and the one coming in from the immo. I was thinking to change the result of the comparison result (prior to the reporting of its value to the CPU so that it does not stop execution/ignition/fuel.

You're right, I've discovered this is a lot deeper than reading and writing eeproms. The positive side of it is that I think may have found the subroutine where the comparison is made and stored in the EAX register. I should know soon.
My next challenge will be figuring out how to translate the needed change on to the hex dump file. I disassembled the file online on this website and I do not have the ability to modify it there. https://www.onlinedisassembler.com/odaweb/

Am I approaching this the right way?
thanks for your response!
j

Likes(0)Dislikes(0)
]]> By: Chris https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-248411 Fri, 07 Aug 2015 23:04:30 +0000 https://www.jestineyong.com/?p=9940#comment-248411 Jesse:
Sorry because I'm late.
Are you made any progress?
Maybe you have a problem in the CPU firmware of your ECU.
Than you have to flash the CPU firmware.
That is another stuff than reading/writing eeproms.

Likes(1)Dislikes(0)
]]> By: Jesse https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-244990 Sun, 19 Jul 2015 03:36:25 +0000 https://www.jestineyong.com/?p=9940#comment-244990 Hello Chris,
I bought a better programmer, GQ universal USB programmer for now. I checked the EEPROMs that are on the ECU now and just for giggles compared the bins..the correct VIN showed up on both and Hex data were the same. I went ahead and re-installed and repeated the procedure mentioned previously. Still no better results and the same code from before P0603. I tried reading the VIN number again and this time it does show up on the scanner instead of N/A like before. Other than that, no improvement. I will continue doing research in syncing it to the immobilizer next, which means I may be taking the immobilizer apart to try to read the memory there to read for comparison purpose. So, far I have learned more about EEPROMs and mapping than I was ever aware of..this has really been awesome!. I'll report soon on any new developments. j

Likes(0)Dislikes(0)
]]> By: Jesse https://jestineyong.com/the-basics-of-electronic-security-bypassing/comment-page-1/#comment-244063 Wed, 15 Jul 2015 03:01:13 +0000 https://www.jestineyong.com/?p=9940#comment-244063 Hi Chris,
After failed attempts at reading the EEPROM with a cheap universal programmer, I decided to take a chance and solder them to the ECM. Fortunately the soldering operation went smooth. I also fully charged the battery ahead of time. After installing the ECM, I scanned for trouble codes. One trouble code came up: P0603 Keep alive memory error. It had not shown up before.
I proceeded to turn the key to start it and the green flashing key/immobililzer came on. Of course it would not start. Then, I re-connected the OBDII scanner to see if it would read the VIN number but it did not come up, it showed N/A or something like that. For the heck of it I cleared the code and read again with the same code showing up.
This seems to indicate a problem with the eeprom? The last thing I did was to check the solder on the eeprom legs and pads..and they looked fine. I am in the process of procuring the parts to build the circuit card for SeeProg. Hopefully this will shed some light. Not sure what else to try at this point while I make the ciruit. Any ideas? j

Likes(0)Dislikes(0)
]]>