Saab pu-2135B radio locked issue, how to resolve?

[kora]

Hi firend. If you're reading this, just be happy)

BUt if its not difficul, of course ,could you can help me with replacing the VIN in the radio dump?) my VIN is :YS3DF58N3X2066207

Or maybe explain me how to do it with own hands?) I found where the VIN is in the dump, it is written in a special order, i tried to replace it, but nothing works, i need to change some more values, but i do not know wich ones, and i do not know how to understand it either)

ANd if you are lazy, then i understand you perfectly well) you dont owe me anything,just be happy)

[criollo]

.

Try 1616 and comment.

.

[kora]

Thanks for reply man
but my “gramophone” don’t support code input)

[kora]

Experimentally (I entered zeros in unnecessary parts of the code), found out what data is responsible for authorizing the device by VIN number (circled with a red line, data at the address from 0x87 to 0x93),

I uploaded a screenshot with the code below


the VIN itself is indicated in two places in a special order (or rather the last 6 values, in this example VIN
was 069343, in the file it is it is written like this - the first number is the last number 3, the second number is the first number 0, the rest go in order, as a result we get 306934 ), marked in blue.


if you change any value at these addresses, we get a broken firmware and a RADIO CODE error

I tried to enter my VIN 066207 (it should look like 706620 in the file), I get the RADIO CODE

I studied other firmware on this forum, before and after the fix, I realized that along with the VIN number, the data thatI circled in purple is still changing

The data that is not circled has never changed in other firmware, but if you enter zeros in them, the firmware stops working (RADIO CODE)


I can't figure out how the PURPLE data and the VIN number are related, how is this data related?





If you have any ideas, please write)

If you have read to the end, know that you are the best)

[kora]

UPD: The number 87, circled in purple, does not need to be changed, most likely it is some kind of... "constant"?I studied other firmware, and there are only 3 numbers at this address - B0, 91, 87


But the other numbers circled in purple always change, simultaneously with the replacement of the vin numbers, most likely this is a checksum, I will call it so on


I found dumps with almost the same vin number, only two characters differed, in one file vin 30 69 34, and in the other 30 69 43


in both files, in the checksum, the second number was 19,
but the second one is changing
one of the files in my screenshot


in another file, where vin 30 69 43, the checksum looks like this 19 19


now I'm trying to figure out how this amount is calculated, by what formula, or how it is calculated

[teed]

Publish a package with more files - I'll take a look at it - maybe I'll find something together

[kora]

Hi bro, thanks for the reply, I have a few dumps, but they are not cleared of unnecessary information,


but it is not difficult to isolate yourself from it, the necessary bytes are always at the same address,

always from 0x87 to 0x93, the first number is always 04

you can ignore the rest


dumps.rar