please explain me

[marcoco]

Hi i'd like to understand how to conver decimal km into hex ,so i can find the right line in eeprom.I want understand!

For example this is a file of fiat 500

[smokey08]

I would start off with a simple file and progress from there.

The mileage is encrypted with a mathematical algorithm.

Here is an easy 1 out of my bmw e46 132000km.

The mileage is stored in the first 16bytes (16bit)

Algorithm is
hex > decimal x16 (203A > 8250 x16 =132000km)

First open windows calculator, click view then scientific.
Make sure the radiobutton is on hex. type in 203A. Now click the dec radiobutton and it should say 8250. Now you x16 and it = 132000.

If you want to change the mileage to say 50000km
50000 /16 =3125 >hex = 0C35
So then you write 0C35 in the dump

Once you understand how it works you will be able to work out harder algorithms.

Hope this helps you understand. If you need more help just ask.

[marcoco]

Good,but wath about my file..?

[z786]

Good,but wath about my file..?

i think the 1st sentence answered your question directly


I would start off with a simple file and progress from there.


once u understand the rest of his post your file will be no problem for you

[smokey08]

As requested by other members, here is another algorithm explained. This one if from a 6N Polo (dump borrowed off this great site). There is 2 things to learn in this dump that wasnt in the other one. 1st is using the xor function on the calculator and 2nd is byte swaps.

The algoritm is
swap bytes, hex xor FFFF, hex>dec, x32.

The KMs is normally easy to identify because its repeated.

Find the KMs 9D EE
Swap bytes EE 9D
Click the hex radiobutton on the calculator.
Type in EE9D then press the xor button then type in FFFF and click = and it should say 1162.
Now click the dec radiobutton to convert hex to decimal (it should now say 4450)
Next multiply 4450 by 32 and you should get the KMs, in this dump 142400km.

If you want to change the KMs;
I will use 96000KMs for example
96000 /32 = 3000>hex = 0BB8 xor FFFF = F447 then swap bytes. So in the dump you would write 47 F4

[pinkfloyd5eg]

As requested by other members, here is another algorithm explained. This one if from a 6N Polo (dump borrowed off this great site). There is 2 things to learn in this dump that wasnt in the other one. 1st is using the xor function on the calculator and 2nd is byte swaps.

The algoritm is
swap bytes, hex xor FFFF, hex>dec, x32.

The KMs is normally easy to identify because its repeated.

Find the KMs 9D EE
Swap bytes EE 9D
Click the hex radiobutton on the calculator.
Type in EE9D then press the xor button then type in FFFF and click = and it should say 1162.
Now click the dec radiobutton to convert hex to decimal (it should now say 4450)
Next times 4450 by 32 and you should get the KMs, in this dump 142400km.

If you want to change the KMs;
I will use 96000KMs for example
96000 /32 = 3000>hex = 0BB8 xor FFFF = F447 then swap bytes. So in the dump you would write 47 F4

thanks bro., so great and simple explanation, I only have some questions if possible!!

1- how can I reach the formula of the algorithm, is it only by try and error method for different dumps for same dash, or there is a fixed way for algorithm conclusion.

2- how to know if the dump has a checksum, and how I locate and correct the checksum bytes.

keep up the good job mate, thanks for your time :adore:

[smokey08]

thanks bro., so great and simple explanation, I only have some questions if possible!!

1- how can I reach the formula of the algorithm, is it only by try and error method for different dumps for same dash, or there is a fixed way for algorithm conclusion.

2- how to know if the dump has a checksum, and how I locate and correct the checksum bytes.

keep up the good job mate, thanks for your time :adore:

1- I use trial and error + experience. If you know the mileage and the hex its got to be converted to you will find it eventually.

2- If the dump has a checksum it will probably show an error once you change it. Read eeprom then drive some miles then read eeprom again and compare dumps. I will post an audi jaeger dump tommorrow and show you an example how I work out the checksum.

[Meat-Head]

Find the KMs 9D EE = 142400km.

I will post an audi jaeger dump tommorrow and show you an example how I work out the checksum.

Awesome.

For education and fraud purposes can you explain this please:

1) What is the closest you can get - this above 142400 KM could you
make it say (on dash) 142401?

2) Explain this please:-

Car comes in for a fault - so we decided it would be a speedo fault.

Display is dead - as we specalise in damage - cracked the fasica
took a dump using x-prog - on programme port check with NY04 (THREE
things only learnt because of DK) - got it to 60111.

Got a pre enjoyed dash off ebay - plugged in car said 50148
written in marker pen as well - took dump with ny04 said
50140 (unless i'm loosing the plot).

Stuck orginal dump back shows something like 60120 when in car
Or i'm i loosing the plot?

3) Checksum - can you explain - for dim folks

Thanks

[smokey08]

Awesome.

For education and fraud purposes can you explain this please:

1) What is the closest you can get - this above 142400 KM could you
make it say (on dash) 142401?

2) Explain this please:-

Car comes in for a fault - so we decided it would be a speedo fault.

Display is dead - as we specalise in damage - cracked the fasica
took a dump using x-prog - on programme port check with NY04 (THREE
things only learnt because of DK) - got it to 60111.

Got a pre enjoyed dash off ebay - plugged in car said 50148
written in marker pen as well - took dump with ny04 said
50140 (unless i'm loosing the plot).

Stuck orginal dump back shows something like 60120 when in car
Or i'm i loosing the plot?

3) Checksum - can you explain - for dim folks

Thanks

1- It depends on the algoriithm. Normally can easily set them to +or- 16km or 32km, Could get them even closer if you spend enough time on it but its not worth the hassle. For the polo dump you could make it 142402 by changing the 1st 9DEE to 9CEE, As the kms are store 16 times and the algorithm /32 this would change the km by 2km.

2- NY04 only uses the 1 block of the mileage to calculate it so the mileage it showed you was slightly incorrect. If you copied the mileage bytes out of the old dump into the new dump the mileage should be exactly the same as the old dash.

3- This is quite a hard one for me to explain. This is how I look at them: A checksum is a calculation of a sequence of bytes they are used to check data for corruption. Maybe the masters of manual correction (HCIP and DRPeter) could chip in a give a better description.


Here is another few questions that I want to share with all.

pls how we can know to use each method. cauz first u dosnt work with XOR and the second one with xor......

It is all an educated guess, Factors I use to help me decide are:
Look at the dump and see if I can recognise the sort of algorithm.
The manufacturer of the dash.

How do you know to use /32?

Agian this is trial and error. Most commonly algorithms use /8, /16, /32 or /64.

[Meat-Head]

polo dump you could make it 142402 by changing the 1st 9DEE to 9CEE,

2- NY04 only uses the 1 block of the mileage to calculate it so the mileage it showed you was slightly incorrect. If you copied the mileage bytes out of the old dump into the new dump the mileage should be exactly the same as the old dash.




Ok sadly we don't have to hand a polo with 142402 on it - but what you you guess the dump to be - no prises - just for fun.

Will have to double check the reading.

So when i do the IN-correction next week on Berlingo will have to take off 32 of what costomer wants then.

Thanks

Meat

[smokey08]

So when i do the IN-correction next week on Berlingo will have to take off 32 of what costomer wants then.

Thanks

Meat


No not necessarily. I dont know the berlingo algo off the top of my head. If it uses /32 in the algo the you work it in multiples of 32 to make things easy. For example customer asks for 83000. 83000 doesnt divide by 32 so you would use 83008 or 82976.

[Meat-Head]

. For example customer asks for 83000. 83000 doesnt divide by 32 so you would use 83008 or 82976.


OK so assume he wants 83000 it's a choice - slightly under or slightly over.

So then it's infact really is an IN-correction then.

But certain cars you could be correct and be excat.

So next step is we are all looking out for a polo with excatly
142402 MILES on it.

What is the differance between a KM dump and MILE dump?
(guess simply one bite)

[smokey08]

OK so assume he wants 83000 it's a choice - slightly under or slightly over.

So then it's infact really is an IN-correction then.

But certain cars you could be correct and be excat.

So next step is we are all looking out for a polo with excatly
142402 MILES on it.

What is the differance between a KM dump and MILE dump?
(guess simply one bite)

yes

yes, but the odometers are never accurate anyway due to the change in the rolling circumference of the wheel as tyres wear/pressure wrong/different weights in the car and loads of other variables.

yes

:shot:

Again it depends on the dash.

[smokey08]

Here is the A3 Algo with checksum I promised. It is Vital that we know the original km to be able to work out the checksum. Tachosoft will not work for this dash.

we will call values in:
Addresses 0x99-0x128 String1
Addresses 0x129-0x1B9 String2
Addresses 0x445-0x446 Checksum.

This is the algo

km>hex = string 2
string2 xor FFFFFFFF = string1
"original km" /100 xor "original checksum" = "0km checksum"
"new km" /100 > hex xor "0km checksum" = "new checksum"

We first work out string1
Click the dec radiobox and type in the new km you want (Im going to use 121700km) Now click the hex radio button and this will give you the value string2 (0001DB64)
Now click xor FFFFFFFF and this will give you string1 (FFFE249B)

Now we have to reverse the checksum.
Clear the calc, click the dec radiobutton and type in the original km (261036km) /100 = (2610) then click the hex radiobutton (it should now say 0A32). Now click xor and type in the original checksum (8BE7) will give you the 0km checksum (81D5).

Now we have the 0km checksum we can calculate the new one.
Click the dec radiobox and type in the new km you want (121700km) /100 = (1217) then click the hex radiobutton (it should now say 04C1). Now click xor and type the 0km checksum (81D5) = New checksum (8514)

Now we have all the values we need to modify the dump to 121700km.
String1 = FFFE249B
String2 = 0001DB64
Checksum = 8514

You can get the mileage exactly right with this algo Meat-Head :D.

[bonus2010]

smokey08 .. this is impressive stuff. Not got time right now, but will be looking at very closely :)

Thanks much appreciated. :)

[Meat-Head]

we will call values in:
Addresses 0x99-0x128 String1
Addresses 0x129-0x1B9 String2
Addresses 0x445-0x446 Checksum.

This is the algo
.


~~~~ that is complicated.

So you need to know the orginal milage well that's going to be difficut in certain cases

http://www.digital-kaos.co.uk/forums/members/81877-meat-head/albums/testing/5601-user201088-pic5599-1325638545.jpg

[smokey08]

~~~~ that is complicated.

So you need to know the orginal milage well that's going to be difficut in certain cases

http://www.digital-kaos.co.uk/forums/members/81877-meat-head/albums/testing/5601-user201088-pic5599-1325638545.jpg

By original kms I mean what its currently displaying (original or not)
Its only difficult if the dash has been in-corrected by a monkey and displays 999999.

[Johnner]

Smokey, much appreciated,and some good info there.

Just one question: From the dump,how did you arrive with those 2x bytes 203A ,if the mileage is in the 1st 16 bytes ,and neither of those are in there ?Was there a step missing from that algo ?

Regards,

[smokey08]

Smokey, much appreciated,and some good info there.

Just one question: From the dump,how did you arrive with those 2x bytes 203A ,if the mileage is in the 1st 16 bytes ,and neither of those are in there ?Was there a step missing from that algo ?

Regards,

Do you mean 0A32? I converted decimal to hex. 2610>A32

[Johnner]

No sorry,I posted a little late,I meant the BMW dump.

[smokey08]

No sorry,I posted a little late,I meant the BMW dump.

Thats hex from the dump thats posted.

http://s13.postimage.org/gb1hiiz5i/Screenshot_at_2012_01_07_01_31_47.jpg
http://www.freeimagehosting.net/00747

[Johnner]

Sorry Smokey,can't open those files you posted.I know they're hex,but where did you get those bytes from,or how did you calculate them ?203A.

[smokey08]

What file cant you open? I have changed the picture for you in my above post.

[Meat-Head]

Its only difficult if the dash has been in-corrected by a monkey and displays 999999.

can't you leech one off here?


What file cant you open? I have changed the picture for you in my above post.

No image shown - are your albums set to private!

[marcoco]

In which tacho you have read dump #14 (http://www.digital-kaos.co.uk/forums/#post1401582)?

[smokey08]

can't you leech one off here?



No image shown - are your albums set to private!

You could do that, The immobiliser would also have to be reprogrammed.

My albums are set to registered members. The image is hosted here http://s13.postimage.org/gb1hiiz5i/Screenshot_at_2012_01_07_01_31_47.jpg


In which tacho you have read dump #14 (http://www.digital-kaos.co.uk/forums/#post1401582)?

I leeched the dump from this thread (http://www.digital-kaos.co.uk/forums/f174/audi-a3-crc-error-242321/)

[richy_rich]

Agian this is trial and error. Most commonly algorithms use /8, /16, /32 or /64.

I guess that, like using XOR, this is a low cost operation for any microprocessor for 'obfuscating' or hiding the mileage right? In the case of multiplications (and divisions when writing the mileage) like this it can simply shift the bits one way or another internally.

E.g.
Decimal 1 in binary could be written as 0001

To multiply it by 8 all the processor needs do is move the bit (1) three to the right.. giving 1000 or 8 in decimal.

To multiply it by 16 it's got to shift it four places right, 32 is five and so on.

Is that right, or do you ever get any that are multiplied by 5 or something?

Great thread by the way :)

[smokey08]

I guess that, like using XOR, this is a low cost operation for any microprocessor for 'obfuscating' or hiding the mileage right? In the case of multiplications (and divisions when writing the mileage) like this it can simply shift the bits one way or another internally.

E.g.
Decimal 1 in binary could be written as 0001

To multiply it by 8 all the processor needs do is move the bit (1) three to the right.. giving 1000 or 8 in decimal.

To multiply it by 16 it's got to shift it four places right, 32 is five and so on.

Is that right, or do you ever get any that are multiplied by 5 or something?

Great thread by the way :)

Ive never thought about it like that but I think your probably right.

Some are multiplied by different numbers for example a fiat panda uses 10

[richy_rich]

Some are multiplied by different numbers for example a fiat panda uses 10

After what the Italians did with Galileo I'm not surprised they're not entirely down with normal binary arithmetic... :) :) :)

:beheaded:

[drpeter]

Ive never thought about it like that but I think your probably right.

Some are multiplied by different numbers for example a fiat panda uses 10

Small correction old panda uses 100 and xor, new panda the same together with a piece of crypto (tables in this case)

[smokey08]

Your right I just checked and it is 100. Could you please teach us a little bit about crypto?
Thank you.

[Johnner]

Here is the A3 Algo with checksum I promised. It is Vital that we know the original km to be able to work out the checksum. Tachosoft will not work for this dash.

we will call values in:
Addresses 0x99-0x128 String1
Addresses 0x129-0x1B9 String2
Addresses 0x445-0x446 Checksum.

This is the algo

km>hex = string 2
string2 xor FFFFFFFF = string1
"original km" /100 xor "original checksum" = "0km checksum"
"new km" /100 > hex xor "0km checksum" = "new checksum"

We first work out string1
Click the dec radiobox and type in the new km you want (Im going to use 121700km) Now click the hex radio button and this will give you the value string2 (0001DB64)
Now click xor FFFFFFFF and this will give you string1 (FFFE249B)

Now we have to reverse the checksum.
Clear the calc, click the dec radiobutton and type in the original km (261036km) /100 = (2610) then click the hex radiobutton (it should now say 0A32). Now click xor and type in the original checksum (8BE7) will give you the 0km checksum (81D5).

Now we have the 0km checksum we can calculate the new one.
Click the dec radiobox and type in the new km you want (121700km) /100 = (1217) then click the hex radiobutton (it should now say 04C1). Now click xor and type the 0km checksum (81D5) = New checksum (8514)

Now we have all the values we need to modify the dump to 121700km.
String1 = FFFE249B
String2 = 0001DB64
Checksum = 8514

You can get the mileage exactly right with this algo Meat-Head :D.


Smokey,you've worked out from experience the algo,and how to correct the checksum,and you don't have Enigma or such like,how do you go about physically modifying the dump,and all the relevant bytes with the data you have,given that both blocks are approx. 145 bytes long ?

[smokey08]

Smokey,you've worked out from experience the algo,and how to correct the checksum,and you don't have Enigma or such like,how do you go about physically modifying the dump,and all the relevant bytes with the data you have,given that both blocks are approx. 145 bytes long ?

Im not sure if I understand you question. I use winhex or bless hex editors to modify the dumps.

[Johnner]

Okay,I asked for that one !!

What I mean is,the data you have worked out is only a few bytes in size.

What do you do with that data?The data you need to change is probably in block size.

How do you know what to change the data in the relevant block(s) to ?

Is there some other way to work out that data ?

[smokey08]

The data is repeated, yes change the whole block.

I think I need to go to bed :laugh: Im having problems understanding your Inglish.

[Johnner]

Huh ? You guys only spent 800 years here teaching it to us !!;)

The English that is,not how to correct mileage !!

[drpeter]

Your right I just checked and it is 100. Could you please teach us a little bit about crypto?
Thank you.

Crypto is just a name, they mean ''difficult'' with it lol.
It can be a variant of crc with polynom, it can use tables like fiat or they use other tricks. You can spent a lot of time on crypto that's why everybody is quiet about it.

[Meat-Head]

[QUOTE=drpeter;1402933]Crypto is just a name, they mean ''difficult'' with QUOTE]

Althogh some members will simply not understand - but could you explain about the fiat tables.

Do you have an example of an IN-correction we could look at.


ALSO

Difference between a dump that displays miles and KM?

[z786]

or and easier way to explain "crypto" is MH's posts

if u can understand them then you can understand crypto lol

[pinkfloyd5eg]

"Meat" has no problem with crypto or any others, since he always has his magic tape to hide any undesired NO# on the display, that what I call easy Incorrection lol

[Meat-Head]

he always has his magic tape to hide any undesired NO# on the display, that what I call easy Incorrection lol


Yes suscesfully managed to IN-correct a vechile the other day.

150,000 down to 30,000 give a or take a little.

Nothing left of seat, steering wheel, brake rubbers, radio buttons etc etc.
but think should be ok.

*ONLY* thanks to DK did manage to do and tackle this one.

Ended up doing some of it in own time - boss refused to have anything to do with it, bloke paid cash (?90 - not E10 like Anderson Maxi) - guess where the cash went??

[pinkfloyd5eg]

Yes suscesfully managed to IN-correct a vechile the other day.

150,000 down to 30,000 give a or take a little.

Nothing left of seat, steering wheel, brake rubbers, radio buttons etc etc.
but think should be ok.

*ONLY* thanks to DK did manage to do and tackle this one.

Ended up doing some of it in own time - boss refused to have anything to do with it, bloke paid cash (?90 - not E10 like Anderson Maxi) - guess where the cash went??

this is another CRYPTO POST, so where did the cash go ?? lol lol lol

[smokey08]

guess where the cash went??

To the pub?

[Meat-Head]

bosses back pocket - not a penny in mine!

ON TOPIC:-

Smokey - as your on about algerrythems - if you use the search botton - radios starting C7000 - you add 1234 to the end (involes the number 6) you can work out the code - dop you wish to explain?

Thanks

Meat

[PremierD]

lol ..............

[Meat-Head]

lol ..............


Don't know what you laughing about - was thinking of you - whilst busy prising the needles off using TSS and two 'Meat-Head-Motors' bussniess cards


It entirely depends on the cluster mate ... some will twist off easily ... some won't.. some require you to hold the shaft while twisting and then my favorite one is the TTS method ...(two tea spoons)....:flowers:

http://www.digital-kaos.co.uk/forums/f174/cluster-needle-removal-75297/#post382110

[alejuz]

HI guys
Here I leave a tutorial, I did not have time to read
Is in Spanish, but it is interesting.
Speaking at the end of the calculation
Sorry, is all I can add.

Regards: Giveup:

[sebastian]

Can alguuien explain this calculation?

0x60 B0 EF CE 40 = FABE8675 XOR 4A514835


GRACIAS

[cotymoto]

smokey08 as I can identify what type of algorithm has a eeprom? each memory or EEPROM is a type of identification algorithm

[i_shot_the_sheriff]

Well all that stuff are very interesting and i'm trying to understand such algorithms!
But what about pin codes from ecus? ;)
I mean for someone who don't have the famous icc,,,,!! Does pin codes have algorithms to "hide" em too?

Some ecu dumps just show you the pin in plain text, while others are so confusingggggg!!

[madaxe]

I have been trying to change mileage in a 2003 Ford Fiesta. It has 24c08 in the dash. Mileage displayed is 113355. I read the eeprom and it is attached.

I found some software (Tachosoft) which says line 160, third and fourth byte is mileage. In the dump this is 93 2D = 37677 in decimal. If multiply by 3, gives 113031, which is close. So I change all the bytes on line 160 and 170 that were 932D to 4CD2 (I would like mileage close to 59000). The file I write is attached.

When plugged dash into the car I get --------.

Is there a checksum ? Or is it more complicated, such as converting to km's, etc.

Thanks

[martin292009]

Your car is millas ???? i make this...
Post result
script is in km but x 1.6... millas ok...

[Galee]

This is a great thread only just seen it would like to see some more info added to this as I have learnt a lot from it.
Thanks to all of you the have contributed especially Smokey08 you are laying it down in plain English for all us new to this so that we can understad.
I have a question regarding a 206 Mileage.
Here I have attached a dump from a Peugeot 206 BSI that I got from the scrap yard to mess about with read the dump and posted it here see
http://www.digital-kaos.co.uk/forums/f174/peugeot-206-noob-bsi-mileage-question-249814/

You guys confirmed Mileage 130869 also when I used NYO it said the same.

What I don't understand Smokey08 said the mileage was in line
0x12E-0x132 = 0F EF EA 07 EC
and
0x134-0x138 = 0E EE EA 07 EC
How does that translate to 130869 I'm confused:stupido2:both are diffrent for a start.

When I enter the mileage 130869 into Tachosoft and click calculate I get 12F81300ED07ECFF

Can some please explain for me?

Again keep up the great work
guys:ciao:

[smokey08]

What I don't understand Smokey08 said the mileage was in line
0x12E-0x132 = 0F EF EA 07 EC
and
0x134-0x138 = 0E EE EA 07 EC
How does that translate to 130869 I'm confused:stupido2:both are diffrent for a start.

When I enter the mileage 130869 into Tachosoft and click calculate I get 12F81300ED07ECFF

Can some please explain for me?

Again keep up the great work
guys:ciao:


Not sure what these 2 bytes do 0E EE,
mileage can be worked out from these 3 bytes EA 07 EC.

EA 07 EC xor FF FF FF = 15 F8 13
Read the bytes backwards 13 F8 15
then convert hex to dec = 1308693
then divide it by 10 = 130869.3

BR

[Lidahus]

I don't know if this applies here, but usually the 2 bytes 0E EE are introduced to reduce write cycles on EEPROM memory.

I found a cluster which distributes mileage on 8 places, so mainly repeated 8 times. But this is not exactly true. Each time 1 km needs to be added the next place will be increased by 1. This goes in cycles through out all 8 places. If you need to find exact mileage, sum up all 8 places and divide by 8.

Similar applies to this Peugeot dump.

[captain crackers]

Lidahus, I don't think anyone in this work is bothered whether the dash reads to the exact figure. I certainly am not. Plus or minus 250 miles is good enough for most of my customers and if it is good enough for them, fine. Arthur.

[Meat-Head]

Plus or minus 250 miles is good enough for most of my customers .


Yes agreed, but what would like to know about the above mentioned polo dump smoky leeched, sadly failed i did try to use it on a job and drive the one mile, then read again, but wrongf dump.

When Smoky (genuine ish job) corrected the replace,ent clocks, what he said 121888 was spot on, how come? :giveup:

[TULGEYWOODMAN]

Lidahus, I don't think anyone in this work is bothered whether the dash reads to the exact figure. I certainly am not. Plus or minus 250 miles is good enough for most of my customers and if it is good enough for them, fine. Arthur.


There are many times when I am grateful its worked, I dont care how accurately !

:ahhhhh:

[Lidahus]

:giveup: OK, OK, I'm giving up and stop to bother you with details :giveup:

[TULGEYWOODMAN]

:giveup: OK, OK, I'm giving up and stop to bother you with details :giveup:

yes, you are far too clever for me!

[Lidahus]

yes, you are far too clever for me!I don't believe those words from members I can't hold a candle to. :stickyman:

[TULGEYWOODMAN]

I don't believe those words from members I can't hold a candle to. :stickyman:

well I`m happy if I can plug the box in and push the buttons, all that hexydsimarl is faaaaaarr to complicated for me.

[madman47]

Smokey, wondering if you can guide me, Im trying to work this out on my own but having problems...
So i grabbed the first cluster i could, Mitsubishi about 1995.
Showing 154731Km. It has a CSI 93C46PI eprom. Easy. Read it with xprog as upa wont do it, and come up with 97 0C.
154731 in Hex is 025C6B
So, i did a byte swap giving 0C 97. If you divide 025C6B by 0C97 if gives you 30.
To test, i put 106km on the odo now giving it 154837Km. Re-reading the dump gives 99 0C. If you divide 025CD5 (154837 in hex) by 0C99 it returns 30.

SOOOOO, i asuume that there is a factor of 30.
To achieve 100,000km displayed (186A0) my logic tells me to divide this by 30 (0823) and perform byte swap back (23 08) and write to chip, however,... the chip does not display at all!!!

What on earth am i doing wrong.... I thought i was doing so well...

Cheers

[meteor80]

Hello.

Maybe someone can explain me this Citroen C4 dash- 2010year 93C66
I will have car like this to correction, but i cannot to understand algorithm, I want to learn that to the future.

[smokey08]

madman47 (http://www.digital-kaos.co.uk/forums/members/282455-madman47/) I cant see a problem with your calculation. Post original dump so I can take a look. You may need to step up the first (or last) 2bytes. For example 24 08 23 08 23 08 23 08 23 08 23 08 23 08........

[madman47]

thanks smokey, heres the dump.

[PremierD]

thanks smokey, heres the dump.

The factor is 48 mate .. 48 repititions .. try it 0C 97 >dec 3223 x48 =154704....

50,000 /48 = 1041 >hex 0411 inverted 11.04

BTW .. 30 in Hex = 48 in dec... lol

[madman47]

cheers, so, the pattern 970C was repeated 27 times, then is changes to 960C for 21 times, do i leave the 960C as it is?
BTW, i see by dividing by 48 you get 154704, where does the other 27km go?

Thanks for you help!

[PremierD]

Forget the 27 mate .. its not really thit important .. +- 48 is about as close as you will get .. (although I stand to be corrected as usual ) lol

[PremierD]

Hello.

Maybe someone can explain me this Citroen C4 dash- 2010year 93C66
I will have car like this to correction, but i cannot to understand algorithm, I want to learn that to the future.

Kms X10 to Hex then inverted .. repeated 4 times in this case .. then the compliment is Xor( subtract) that with FF FF FF .. simple

[Lidahus]

Sorry going into details again:

From dump 0x97 at address 0x00 and 0x0C at address 0x01 is HEX value 0x0C97 which calculates to 3223 in decimal.

Mileage is repeated 48 times, so mileage base value is 48 * 3223 = 154704.

Again, 0x0C97 is repeated 27 times until 0x0C96 starts. So total mileage is 154704 + 27 = 154731.

I know it's not relevant for you, but I'm just :stoned:



cheers, so, the pattern 970C was repeated 27 times, then is changes to 960C for 21 times, do i leave the 960C as it is?
BTW, i see by dividing by 48 you get 154704, where does the other 27km go?

As PremierD wrote: Calculate the HEX value of the final mileage as you like to have, write it 48 times into the dump, and don't mind about the exact value. All 48 places needs to be same in this case.

[PremierD]

Well explained mate .. and as they say "every day is a schoolday "

You just continue to be :stoned:...

[madman47]

Perfect!
Thanks heaps for you help!
OK, so for shits and giggles, if you wanted to display exactly 100,000Km,
100000/48 =2083.333
2083*48 = 99,984km (16km out form 100,000km)
2083->hex =823
Byteswap ->2308
soooo, you write 2308 in the dump 16 times, then what you would put? 2208?? for the remaining mileage blocks

Cheers

[Lidahus]

Yes, that's my theory. Odometer is a ring counter adding +1 on the next storage place for each km to be counted. In your case there are 48 places in the ring. Reason is to reduce write cycles on EEPROM which is limited.

[madman47]

legend, thanks!

[meteor80]

Excuse me my english, but I dont understand this:


. then the compliment is Xor( subtract) that with FF FF FF .. simple

[captain crackers]

Xor is basically the reverse of the hex. So the complete Xor of a hex number is 0=F, 1=E, 2=D, 3=C, 4=B, 5=A, 6=9, 7=8, 8=7, 9=6, A=5, B=4, C=3, D=2, E=1, F=0. If you learn this you won't need to bother with the Xor button on a scientific calculator. Arthur.

[Meat-Head]

The factor is 48 mate .. 48 repititions .. try it ... lol


so if your in the pub one night watching Justy22 for AGES then you know he is manually IN-correcting something.

So if Justy22 misses 1 of the 48 - what happens?

[Lidahus]

It's a bit late, mate. I'm right back from pub, but who is Justy22? And what are you trying to ask me? Sorry, I missed to get it.

[PremierD]

It's a bit late, mate. I'm right back from pub, but who is Justy22? And what are you trying to ask me? Sorry, I missed to get it.

Just Ignore him mate .. he talks the biggest lot of sh1t sometimes .. lol

[Meat-Head]

Just Ignore him mate .. he talks the biggest lot of sh1t sometimes .. lol

Still intreasted to know if ANYBODY misses one of the 48 points, what does display show?

[PremierD]

Still intreasted to know if ANYBODY misses one of the 48 points, what does display show?

Use you loaf mate .. the algo calls for 48 .. so just put forty ~~~~en eight in ..

[ALEXEI]

Xor is basically the reverse of the hex. So the complete Xor of a hex number is 0=F, 1=E, 2=D, 3=C, 4=B, 5=A, 6=9, 7=8, 8=7, 9=6, A=5, B=4, C=3, D=2, E=1, F=0. If you learn this you won't need to bother with the Xor button on a scientific calculator. Arthur.

easy use NOT from win scientific calc, equals with xor ff

[Meat-Head]

Use you loaf mate .. the algo calls for 48 .. so just put forty ~~~~en eight in ..

*SORRY* - i is as thick as pig shit when it comes to numbers, misunderstood, thought you meant old miles was say 200,000
now 40,000

80 times so edited dump is.

I'll keep out the way, just nice to know these things for when down the pub.

now keeping quiet, thanks. :creep:



as ff ff gg hh tr 7f ty ty iy 40000
as ff ff gg hh tr 7f ty ty iy 40000
as ff ff gg hh tr 7f ty ty iy 40000
as ff ff gg hh tr 7f ty ty iy 40000
as ff ff gg hh tr 7f ty ty iy 40000
as ff ff gg hh tr 7f ty ty iy 40000

[maca]

Sorry for being thick but what ~~~~ are you lot talking about lol

[PremierD]

"now keeping quiet, thanks"

Good Idea ..

[Meat-Head]

"now keeping quiet, thanks"

Good Idea ..


:roflmao::roflmao:


Sorry for being thick but what ~~~~ are you lot talking about lol

in simple Inglish milages are often 'hidden' in dumps and you need a good brain to figre them out.

best thing to do is read the post by smokey about the polo, then keep quiet, think that's best. lol

[maca]

Nah your all to clever for me lol keep up the good work though :top:

[madman47]

Ok, so, after playing with the mitsi panel, and getting my head around that one, i picked up another, This time a Nissan of 95-99 vintage. Using my own brain from what i had learnt from the mitsi one, but i cannot see any tie up between the dump and the odo reading, ive tried all sorts of combinations and calculations..
I gueesed the odo is at 60x0A to 60x0F
ODO reads 165578km

IC is a 93C46

[PremierD]

Ok, so, after playing with the mitsi panel, and getting my head around that one, i picked up another, This time a Nissan of 95-99 vintage. Using my own brain from what i had learnt from the mitsi one, but i cannot see any tie up between the dump and the odo reading, ive tried all sorts of combinations and calculations..
I gueesed the odo is at 60x0A to 60x0F
ODO reads 165578km

IC is a 93C46

Suggestion .. leave Nissans till last ..lol

[Lidahus]

I gueesed the odo is at 60x0A to 60x0F
ODO reads 165578km
Did you read the EEPROM as 16 bit? If you swap odd and even columns you will get closer to final result.

[philipofmoira]

Hi guys,
I have Honda jazz 06 .Using tachosoft I can calculate the mileage but do I need checksum correction for this particular car? I know the procedure explained here but don't have the chip out to try.
Any help appreciated

[hugos31]

mileage calculator;;;;;;;;;;;;;;;;;;Please upload a manual on how to use tachosoft

[Lidahus]

The question wasn't how to use tools, but to understand how they are working. I know, for most of you it's not important to know the algo, but I'm still :stoned:looking for algo's instead of doing sudokus.

[madman47]

Totally agree. Any muppet can use a computer program to work it out for them, the skill and reward is understanding how and why they work.

:marchmellow:

[big633]

How about Ducati 1098

[Lidahus]

I don't know about the structure of your Ducati dump, but I will try to explain what might be happen:

The EEPROM 24C16 is able to write up to 16 Bytes at once.
On the dump you found that line 10 and 20 had been duplicated. If this is the failure probably the ?P tried to write line 10 with content as you found on line 10. For this at first a control Byte with I?C slave address and at second a one-Byte memory address will be sent in serial order to 24C16 (Most Significant Bit at first), and after this address information those Bytes to be written into memory will be sent. The address 20 is just a 1-Bit shift of address 10. So my assumption is that while transmitting the address one clock cycle was missing for some reasons, or the clock line had an additional spike on wrong place. This way address 10 accidently turned into address 20. Usually the EEPROM circuit should find out such bus errors, but in your case it didn't happen. This way you can find duplicated entries in your dump.

Is this what you had asked for?

[madman47]

Ok, so, I give up, ive now spent 4 days on trying to work out Nissan algo, can some smart cookie fill me in on what im missing...
This is what ive worked out:
The mileage is from 50x00 to 60x0F
The data from 50x00 to 60x09 is the counter from 0-54km
The data from 60x0A to 60x0B is the base counter:
when odo is 0-53km 60x0A to 60x0B is 00 80
when odo is 54-107km 60x0A to 60x0B is 07 80
when odo is 108-160km 60x0A to 60x0B is 38 80
when odo is 161-214km 60x0A to 60x0B is 3F 80
when odo is 215-268km 60x0A to 60x0B is C0 81
when odo is 269-321km 60x0A to 60x0B is C7 81
when odo is 322-375km 60x0A to 60x0B is F8 81
when odo is 376-429km 60x0A to 60x0B is FF 81
when odo is 430-483km 60x0A to 60x0B is 00 8E
when odo is 484-536km 60x0A to 60x0B is 07 8E
etc etc

But there seems to be no pattern to the counter on data block 60x0B (80, then 81, then 8E etc)

This is driving me mental

:giveup::giveup::giveup:

[Lidahus]

Take a detour on binary view. This will show you the Nissan algo. What I could not find is the true distance calculation. It's not exact multiples of 54km. I tried miles, yards, but none of them matched. Maybe someone else can give a hint.

[nomis]

Here is a Hex calculator .. maybe useful for someone ..
Actually i want to continue this topic! Because i learn many things from here ..
Thank you guys .. Specially to smokey08 (http://www.digital-kaos.co.uk/forums/members/136801-smokey08/)
Home page (http://www.hexprobe.com/hpmbcalc/index.htm)
rar pass: 923885
Download (http://www.mediafire.com/?86unc88n4hc3go6)

[TULGEYWOODMAN]

The question wasn't how to use tools, but to understand how they are working. I know, for most of you it's not important to know the algo, but I'm still :stoned:looking for algo's instead of doing sudokus.

Blimey, a bit of a sweeping statement!
Are you saying that most of the members dont know about algo`s?

lidahus. perhaps you would be so kind as to sort out the case tractor question posted by autosocket on the 20 November?

[nomis]

lidahus. perhaps you would be so kind as to sort out the case tractor question posted by autosocket on the 20 November?
Read & post dump then read again after some 100 & again 3 or 4 time & post .. lol lol .. Of-course young man.. lol

[TULGEYWOODMAN]

Read & post dump then read again after some 100 & again 3 or 4 time & post .. lol lol .. Of-course young man.. lol

Not very easy to say to tractor exporter " please dont sell it yet mate, run it up for a few hundred hours a couple of times"

Whats that?.......oh! Youve got 17 tractors that want doing.

hang on a moment, I will just ask nomis what I should do.:party:

[nomis]

hang on a moment, I will just ask nomis what I should do.
See your avatar what is in your hand .. lol lol
"Sorry"

[Johnner]

See your avatar what is in your hand .. lol lol
"Sorry"


What ? Batter the tractors into submission ?

[TULGEYWOODMAN]

See your avatar what is in your hand .. lol lol
"Sorry"

olympic tractor starter.........fill with diesel, light it, stick it into inlet manifold..................BOSH ! away she goes.

[Meat-Head]

i'll have a dib at this 'general purpose' thread.

had a Shaso in the other day, eeprom B??? - 93C46 ecu - thought would save the matching dump set for my dk friends

ecu just full of 9F ? immo off TOTALLY differ ant.

tried as 93S46 whatever, same dump, unable to write, used a 93C66 worked, car started.

leeched a dump off here, request for immo off, was a expected dump?

anbyone explain?

[Lidahus]

lidahus. perhaps you would be so kind as to sort out the case tractor question posted by autosocket on the 20 November?
Mission accomplished: The tractor question (http://www.digital-kaos.co.uk/forums/f174/case-4200-series-tractor-93c46-hours-304796/#post1779992) :smokin:

[AvechuchoAxel]

Who can give us a detailed info about FORD calculation? Thanks!!!

[gtmech]

How about IMMO Algorithms?? Hardly ever do Dash stuff, can someone give an IMMO Algo a try? Alfa Romeo is a good example to try or maybe a Peugeot 307, these are both cars that have there Pin Codes crypted

[autodigitec]

This has some great information here. Currently writing a little piece of software to help me finding these algorithms faster :P

I'll share my findings here soon hopefully

[meteor80]

Hello.
Can someone explain me how to calculate PIN in OPEL CD30MP3 ?
In attachment are two dumps found here in D-K with two differents PIN codes.
How to calculate and how to change this code?

[Meat-Head]

Right go stalk justy22. He had a thread for radio code premierd posted on line?? The code is in hex.

(iShit Failiure) so might not be back

[Meat-Head]

Here see if this helps *HATES* editing posts

http://www.digital-kaos.co.uk/forums/f176/corsa-cd-2005-need-code-285397/#post1652509

[dashradio]

Different radio's, one is a CD30 the other is a CDR500, totally different

[meteor80]

Yes dashradio you are right.
In my dumps there are files from the same radio.
It is loged to car without using opcom- only using dump.
I wonder if I just change PIN is it ebough?

[dashradio]

The software in post #10 of this topic may help you

http://www.digital-kaos.co.uk/forums/f176/opel-cd30-cd30mp3-grundig-decode-guide-172375/#post846411

[afitijuana]

What do you need to know about it ?

[Rerouter]

Ok think its fair time i chipped in, a while back it was asked how to differentiate from miles to km, for a few standard algorithms e.g. "Yazaki 17" or "Yazaki 48" (I nickname them), the difference is whether you increment from the start or from the end, I believe this is the same with some YNS and denso algorithm's as well,

so far there are a few standard algorithms (so far 25 that i have standardized in my scripts, with 5 covering 400 odd panels out of my 1800 scripts), sometimes with a x2 or a /2 thrown in on some dashes just to confuse things a little. some panel makers use the same few algo's across any eeprom, others change it every eeprom model, others keep it the same but play with the offset,

[hcsaibot]

Can somebody please explain me how this algo works

Ducati Dash
---------------------------------------------------------------------------
(31462.3KM)
FF CC 04 00 03 00 00 00 00 BA

04 CC FF --> 314623 -->31462.3KM

BA == Checksum

---------------------------------------------------------------------------
(1350.0KM)
BC 34 00 00 03 00 00 00 00 6C

34 BC --> 13500 --> 1350.0KM

6C == Checksum

---------------------------------------------------------------------------

I tried a lot, but i found no solution:hypnotysed:

[pite3]

Can somebody help me with this algo?

4B98---------------60

Swap->Hex-Dec-> 38987Km Chksum 60

-

FA37---------------D0

Swap->Hex-Dec-> 14330Km Chksum D0

-

9618---------------38

Swap->Hex-Dec-> 6294Km Chksum 38


Thanks for help in advance.

[Meat-Head]

Try looking for tachosoft. See if that helps

[smokey08]

pite3, Post an example file. I suspect there may be more bytes involved in the checksum.

[pite3]

I've tried some of this and only theese bytes changes...

Here is some dumps.

302293

[pite3]

nobody can help ?

[Rerouter]

0x10 is the LSB of the milage, 0x11 is the next lsb, you then times this number by 2 to get your milage value out of the dump,

as for writing, i'm thinking 0x14/0x15 may be some other value, and 0x19 is a fancy checksum,

[pite3]

Yes, rerouter you right.

The mileage is at 0x10-0x11 and 0x20-0x21. on 0x14-0x15 and 0x24-0x25 are the reset service counters. the checksums are on 0x19 and 0x29.

But how can calculate this?

[daniele1968]

very interesting answer thanks very good explanation

[testit34]

Can anyone tell me how to calculate the check sum byte on fords. I know how to calculate mileage but can't figure out how to get checksum value. I know can be done with many calculators I want to understand how to do it manually
thanks in advance

[Johnner]

Testi,calculating the cs on fords manually,involves looking through a series of tables,with a series of XOR'S involved.It's not easy if you don't know what you're doing.

You would be better off looking for some scripts in here instead.


It's not a CS byte,it's a CS nibble,btw....

[testit34]

Hi Johnner
Thank you for the reply. If you can PM me 1 example or post it here I am sure I will understand the process just 1 PLEASE. Yes I know it's the right most nibble. Example 0006 6 is the check sum.
thanks in advance

[big633]

0x10,0x11, 0x12,0x14 0x15 check sum 0x19
0x20,0x21,0x22 0x24,0x25 check sum 0x29

check sum i don't know how to cal
0x14 for more 10000 0x15 for service code
0x24 for more 10000 0x25 for service code

[meteor80]

I have similar question but not about mileage just about serial number.
I have licensed file for dedicated serial number.
Can someone find where is stored serial number in this file?
Serial 002279.

[janushaan]

I would start off with a simple file and progress from there.

The mileage is encrypted with a mathematical algorithm.

Here is an easy 1 out of my bmw e46 132000km.



The mileage is stored in the first 16bytes (16bit)

Algorithm is
hex > decimal x16 (203A > 8250 x16 =132000km)

First open windows calculator, click view then scientific.
Make sure the radiobutton is on hex. type in 203A. Now click the dec radiobutton and it should say 8250. Now you x16 and it = 132000.

If you want to change the mileage to say 50000km
50000 /16 =3125 >hex = 0C35
So then you write 0C35 in the dump

Once you understand how it works you will be able to work out harder algorithms.

Hope this helps you understand. If you need more help just ask.


smokey has been smoking some good stuff,, i need that,, impressive stuff,, will look into it

[qubits]

I have similar question but not about mileage just about serial number.
I have licensed file for dedicated serial number.
Can someone find where is stored serial number in this file?
Serial 002279.
Did you see E7 08? I don't think it's that easy anyway if it's an expansive software/hardware. Proper way to crack this is using a decompiler?

[meteor80]

Thanks guys but this solutions doesn't works.

[qubits]

Thanks guys but this solutions doesn't works.
did you check if there is checksum?

[meteor80]

Cannot find that.

Wysłane z mojego MX_Base przy użyciu Tapatalka

[Marens2007]

Hello every body I'm new on all this I'm understand some parts but dot have a clue whats is hor and becs and where I can get them I'm using hex editor NEO maybe there is problem or I'm just don't know how to use Thanks

[ascrap2003]

Use Windows Calc it's all you need, study simple algo first Denso, Old Ford etc then progress to more complex such as some Hondas.

Heres a important tip 90% of the time the hex or in some cases first few bytes in hex such as hondas is where the mileage is calculated, you just have to know the location of the hex and look for a pattern or repeated hex in most cases.

Mileage is usualy mileage converted to kilometers in most cases then divided by 8, 16, 32, 64, 128 etc then convert that result which is the decimal to hex. Sometimes swapping bytes is needed.

Denso works different look up a Denso conversion table and you will take bytes and swap then convert to mileage, sounds complicated but it is actually somewhat simple and practice makes perfect read up a lot in the forums you will get everthing you need. Decent Math skills a must!!!

[Berubeg]

This is realy helpful post thank's to all!!!!
your experience have no price

[Marens2007]

Thanks for Ur answer I'm understand this part but how about pin code calculation are it's works in same way ?Thanks again for u r time

[Marens2007]

460031 for sample this pick where he get 42454353 and after 35343836 THANKS

[kreepyme]

Hi guys! I found this over the forum and I am stuck
...how this checksum is calculated???

for example...
1 km in dump I have 00 00 0A 17 where 17 is the ckecksum
10 km in dump I have 00 00 64 71 where 71 is the checksum
31 km in dump I have 00 01 37 45 where 45 is the checksum
6125km in dump I have 00 EF 42 3E where 3E is the mighty checksum


if someone can explain please...

[DCT748]

...........

[DCT748]

for which vehicle?
seems to be simple : the sum + D ????
0A + D = 17
64 + D = 71
01 + 37 + D = 45
EF + 42 + D = 013E = 3E

you have to check it

[kreepyme]

THAT'S IT!

YOU ARE THE MAN OF THE DAY !:applause:

btw, it's from a scooter

[canoaslan]

I think I posted the original question in the wrong section, now I dont know how to delete it. I cant say im new to this, but there is one algo i cant wrap my head around.
these 2 dumps, from a 2015 Q5 MM DASH EE 95320 that have been confirmed by the uploaders that the modified dumps work. how do they calculate the km and why is it repeated 4 times a row.

745733745734
to make it more confusing, here we have tested and confirmed modified dumps, of the same type, from a 2015 Q5 MM DASH EE 95320 hw, sw edited dump that works fine aswell, but it hasnt been modified like my previous post with the data being the same over the 1st 4 lines. what is going on?
745732745731

[canoaslan]

And to make it more confusing, here we have tested and confirmed modified dumps, of the same type, from a 2015 Q5 MM DASH EE 95320 hw, sw edited dump that works fine aswell, but it hasnt been modified like my previous post with the data being the same over the 1st 4 lines. what is going on?
745713745714

[kisobran]

Can someone look at this dump and tell me how many kilometers this car has.
It's a Lan Rover Velar 2019 Instrument cluster dump with 24C64
Thank you very much