info decode 93c86 fiat 500

[pazzoide]

hi guy,I would like to understand how to decode file 93c86 fiat 500.

I need to figure out the pin code and the pre-coding....

someone can help me?

[paul_12345]

if you want the remote to work them tmpro only.

[pazzoide]

I can program the chip with zedf*ll,but I want to manually figure out how to decode

[Bllinda]

I think first be lighter car ....

[pazzoide]

hello I do not understand what you mean....

[Bllinda]

maybe forum search it easier for yourself tasks
It is fiat pin discloses a decryption

[pazzoide]

as I find the pin code? what offset?
I want to understand how it works

[ninja123]

if we all knew how to do this then we would all invent our own TMPro

[bulanbulanov]

as I find the pin code? what offset?
I want to understand how it works

your file is XOR-ed from 0x0000 to 0h01DF with "E05E5E5D5DAFAF2222DCDC0606828258580E0EEFEF88886363 D4D45656A5A5BD"

382614

[ninja123]

whens your tool coming out! clever geezer

[PremierD]

He is to busy to make a tool mate ... lol

[bulanbulanov]

you are right PremierD !!! :)

[Bllinda]

With what program do XOR? Is one byte with vin calc .... ;) Thx

[bulanbulanov]

Hpmbcalc 32 bits at a time and winhex.
that's what I'm used.

[yellowstilo]

your file is XOR-ed from 0x0000 to 0h01DF with "E05E5E5D5DAFAF2222DCDC0606828258580E0EEFEF88886363 D4D45656A5A5BD"

382614

good info, i think your file should be byte swapped - it then will show you OUTPUT-JIT tester code instead of UOPTTUJ-TI and of course the byte sequence of the key and pin bytes will change too....

at Pazzoide - can you confirm your pin code ? 85557 or 85755 ? Do you have valid key codes to compare ?

Thank you !

[bulanbulanov]

I did it this way for Pazzoide, so he can verify the pin. I think it was the more likely to have it.

PIN is 85557.

[Bllinda]

I realized that....
upon discovering that does not know how to use a calculator.


Hpmbca (http://www.digital-kaos.co.uk/forums/downloads.php?do=file&id=3152)lc 32 bits at a time and winh (http://www.digital-kaos.co.uk/forums/downloads.php?do=file&id=3495)ex.
that's what I'm used.

what and how to do that calculated for the whole damp? Thx

[bulanbulanov]

I realized that....
upon discovering that does not know how to use a calculator.



what and how to do that calculated for the whole damp? Thx


32 bites at a time
and only from 0x0000 to 0h01DF

[pazzoide]

hello good evening to everyone and excuse my absence.

confirm pin 85557

@bulanbulanov thank you (http://www.digital-kaos.co.uk/forums/member.php/125444-bulanbulanov)

this string " E05E5E5D5DAFAF2222DCDC0606828258580E0EEFEF8888636 3D4D45656A5A5BD " It is the same for the whole family?

and 8 bytes that serve to precode the PCF7936 where they are?

[yellowstilo]

this is the decrypted file in the right format (just 000-1DF) - the pin bytes have to be swapped to get the pin 85557.

[autochei]

many people very smart here on dk

[yellowstilo]

i just compared with another Fiat 500 file but unfortunately this algo only works for the original poster file.
But with some Brain.exe it's possible to retrieve the decryption algo of another file without any tool or calculator by looking at the double bytes , the start- and end crypto byte and the byte order of these bytes (total of 32 bytes).
It's a lot of work because my Brain.exe is rather old , some automated calculation would be great but i guess BulanBulanov has digged into this much further....

[ninja123]

I agree, my version of brain.exe is out of date and probably virused too :) (by alcahol and children!)

[yellowstilo]

edited - double post

[yellowstilo]

just a little help for those who want to try with Brain.exe :

cut lines 000-1DF from any ori Fiat 500 93c86 file (the decrypted part) and put this in new .bin file.
examine the file for repeating double numbers in the even and odd lines, use their order in the file until you have found a string of 32 repeating double bytes + start- and end byte .
I managed to build this string just by looking at the file so it must be not that hard....
then i made a new bin crypto algo file with 15x2 lines (000-1DF) of the found string (so repeating every two lines)
to decrypt the file i used the free "Xor files" tool (use Google) which Xor's the ori and the crypto algo file - just put the ori and crypto algo file, the destination of the new file, press start and hey presto, the file is decrypted !!

good luck and take a beer to prevent a headache....

[paul_12345]

just a little help for those who want to try with Brain.exe :

cut lines 000-1DF from any ori Fiat 500 93c86 file (the decrypted part) and put this in new .bin file.
examine the file for repeating double numbers in the even and odd lines, use their order in the file until you have found a string of 32 repeating double bytes + start- and end byte .
I managed to build this string just by looking at the file so it must be not that hard....
then i made a new bin crypto algo file with 15x2 lines (000-1DF) of the found string (so repeating every two lines)
to decrypt the file i used the free "Xor files" tool (use Google) which Xor's the ori and the crypto algo file - just put the ori and crypto algo file, the destination of the new file, press start and hey presto, the file is decrypted !!

good luck and take a beer to prevent a headache....



you could... but you could also say that lines 140 and 190 are probably going to be 00's in which case those 2 lines contain the string to xor.

or take the even lines and pick the most common value in each column and assume that would be 0 so is the correct value to use in the string then do the same for the odd lines.

[pazzoide]

It is EASY TO FIND THE STRING IN FILE....TWO DIFFERENT POSITIONS,
@bulanbulanovto find the pre-coding offset bytes ?
8 bytes that are used to prepare the transponder and then be able to add with zedf*ll or T*ode

[yellowstilo]

It is EASY TO FIND THE STRING IN FILE....TWO DIFFERENT POSITIONS,
@bulanbulanov

to find the pre-coding offset bytes ?
8 bytes that are used to prepare the transponder and then be able to add with zedf*ll or T*ode

these bytes should be in line 160 - they probably will be stored encrypted in the transponder in a simple way - in a Megamos id48 all 12 bytes / 6 words are stored but i don't know how this is done on a Fiat 500 with other transponder....

@ Paul 12345 - thank you for simplified method of finding the string , i really have to update my Brain.exe as it's so obvious.....

[pazzoide]

ID46 (PCF7936/46) pre-code is 8 BYTE ;) - 12 bytes is for chip id48. I hope someone can confirm what these bytes

[pazzoide]

new file, the pin is 3524c?
I think it's not fair!!!!

0x10 byte location 0x140 = 17B9CA17F0CA55F05755885778880A78
0x10 byte location 0x190 = 3B0A533B0E53A10ED2A19DD2C59D91C5


something escapes

[bulanbulanov]

new file, the pin is 3524c?
I think it's not fair!!!!

0x10 byte location 0x140 = 17B9CA17F0CA55F05755885778880A78
0x10 byte location 0x190 = 3B0A533B0E53A10ED2A19DD2C59D91C5


something escapes


swap the file !!!

383006

[pazzoide]

I did not understand what you mean by swap.....


11 22 33 44 swap result 22 11 44 33 ?

and then I do not understand how you can convert

52c3c64c to 24336

[PremierD]

If you do not understand that mate .. give up take up woodworking .... :)

[pazzoide]

friend to me it says ... learn the art and put it aside.....You can always serve one day

[PremierD]

No mate .. it says Byte swap ...:)

[bulanbulanov]

I did not understand what you mean by swap.....


11 22 33 44 swap result 22 11 44 33 ?

and then I do not understand how you can convert

52c3c64c to 24336


1 or A: -->>1
2 or B: -->>2
3 or C: -->>3
4 or D: -->>4
5 or E: -->>5
6 or F: -->>6
7 or 0: -->>7
8 : -->>8
9 : -->>9

C3524CC6 => 24336

[pazzoide]

THANK YOU SO MUCH GOOD FRIEND. I HOPE TO BE USEFUL TO YOU

[Bllinda]

@bulanbulanov (http://www.digital-kaos.co.uk/forums/member.php/125444-bulanbulanov)

Please do not bother,
failing to even button press, not to mention the reputation ....
and here lazy to look for the forum ... (http://www.digital-kaos.co.uk/forums/showthread.php/463786-alfa-fiat-iveco-bcm-dumps-need?highlight=123456+63412).


1 or A: -->>1
2 or B: -->>2
3 or C: -->>3
4 or D: -->>4
5 or E: -->>5
6 or F: -->>6
7 or 0: -->>7
8 : -->>8
9 : -->>9

C3524CC6 => 24336

Everything must be on the plate ....? And chew ....


friend to me it says ... learn the art and put it aside.....You can always serve one day

Join Date : Mar 2016
Posts : 12
Thanks : 1

Thanked 1 Time in 1 Post

[pazzoide]

I do not understand what you mean Friend @DK Veteran
I'm just trying to figure out quickly....so you know what I mean when I talk.
I hope it is not a problem!

[pazzoide]

I noticed that some files are not to be swapped....What occurs? to know if it did swap?

[yellowstilo]

look at my file i posted - when you can read the tester code ( "OUTPUT-JIT") the file is decoded correctly.
Otherwise swap the file.

[pazzoide]

I sensed this thing ;)

[checcogame]

hello....can you explain me please how you decrypt this file ? I mean the whole process. Thanks

[yellowstilo]

i already explained you by PM but if you do not understand the previous pages you have to learn more about some basic things first - i also learned by reading a lot and trying things until i understand how it works - not everything is presented as a ready-cooked meal, you have to do some effort yourself too after you get so much information for free here....
good luck !