VW MID EU / RCD310 HELP

[carradio2001]

Hi guys,

Please calculate code RCD310
VWZ1Z3H3250190
7 647 239 360
I know code address, I know the code cannot be changed, please help !

Carradio2001.

[einet]

Hello,

When you now the adresse!
Way you d?ont change it!
And for waht you need code! when you now the adresse!

einet

[carradio2001]

Hello,

When you now the adresse!
Way you d?ont change it!
And for waht you need code! when you now the adresse!

einet
Because I don't know the ALGO !
In my file, the code is CD 06 2B 01, don't know the code !
Also, I don't know WHY the eeprom cannot be cloned, the code cannot be changed. I have more files with known code and this not helped.
The special tools which read the code like MARTECH I think not read directly CD 06 2B 01 and read within another method, ask directly the radio what is your code ? :) or read directly in ASCI, code 1234 and that's it.
Personnaly I don't think exist someone which know this algo, it is too newer and this radio not soo much for making an conclusion.

Carradio2001.

[carradio2001]

I working on this algo, somebody can confirm the next codes ?
Let's help together to find this ALGO:

CODe 1 number 2 number 3 number 4 number

1852 68 93 50 FD
1858 2D 95 A6 44
1713 33 1D 9A BB
0954 AF AC 21 B1
xxxx 39 12 74 C9
xxxx 2D 0B 30 33
xxxx 64 2B AC C3
1119 1C 95 12 3E
xxxx CD 06 2B 01
xxxx 6B 93 A3 A1
0687 40 FD 90 C7
xxxx 0F 3B 0E C4
xxxx D2 4E 30 33
0400 C3 01 59 6E
xxxx 3C FD B0 2C
0330 C9 E7 E7 FA
xxxx A5 C3 46 78
0363 66 C6 52 FD
0692 2E C7 0C E4
0453 F6 36 AD 25
0506 1F 88 C8 19
xxxx 55 E6 FE AF
xxxx 58 81 AE 77
xxxx 5B B5 AA B6
1287 B1 F3 29 34
xxxx BA 6A 98 CE
xxxx FF 74 46 BC

Carradio2001.

[dj_meteo]

dear freind im working on it from last year, no chance, but somtimes when i am with a good client i search manually the code, one by one,but reset conter eatch time ,
one day i desolved resistance from pin 3 ,radio don't shows errors, so i tryed all codes, it worked
may be code is in another part in radio, so if you changed some values to clone another code,radio will not turn on
crazy algo

[carradio2001]

Hi !
Somebody says the code is in MCU, only reset counter is in eeprom, others says the code is in both: MCU and eeprom.
My opinion is code and reset counter is in EEPROM and code cannot be changed because have somewhere a checksum. The radio know always to check and modify the checksum, but we not ! or the code is in MCU and if you change in eeprom not egual and bad code result !
Another secret people tell me they discover the algo BUT not tell anyone because it's money arround and want money on every dump for which calculate the code :( or sell own software !!!
Will discover this in near or away feature ...

Carradio2001.

[branco]

code can be changed and is in eeprom
solution exists but is on private
(one friend send me code from dump )
regards

[fukukum]

Let's see who will solve this business :coffin:

[dj_meteo]

code can be changed and is in eeprom
solution exists but is on private
(one friend send me code from dump )
regards
he send you code from dump, cause serial is in dump, no chance to use this dump to clone another, many knew code adress but can not chang the lines to have same code
the man who helps you read serials from your dump send you code, try to give him only code lines and show if he can calculate it

[alexics]

It is not straight forward. It is not only the code addresses that are interlinked. You need to look to the past to discover the present. :idea:

[branco]

he send you code from dump, cause serial is in dump, no chance to use this dump to clone another, many knew code adress but can not chang the lines to have same code
the man who helps you read serials from your dump send you code, try to give him only code lines and show if he can calculate it


no at all
I got original code from serial by friend "einet"
so I asked to my other friend to change the code
he did it
regards

[carradio2001]

I put table ONLY for codes, there is a more strings inside eeprom more interesting which are checksums and error counter.

Carradio2001.

[carradio2001]

Hi 1

WHY everybody not tell the TRUTH ?
The RCD310 can be decoded easily from the dump.
In this moment only a few know the algo BUT in the near future will know more and one time will know ALL.
I asked for help. Some people can help or someone not. I will make ALL what I can do to find this algo. AFTER that I am intention to put it FREE becasue NOBODY wants to help, NOBODY want to give me ONE CODE from dump ! It is a cruel world.

Carradio2001.

[laxitylabs]

@carradio2001

hint for you: 6B93A3A1 is equal to 0065.
ciao

[blackpirate]

Hi 1

It is a cruel world.

Carradio2001.


yes! it is!
it started with you!

why your calc its not shared?for free!!!!!

you shared only with your friends..

here, on DK, we are all friends!!!!

Shareing & Help= this its all about on DK!


you will say that its your your, i agree with that, you can do anything you want, share it or not!

you wanna help us all?
you can start by shareing Calcgen!

my 2 cents...


BP

[carradio2001]

Updates:
CODe 1 number 2 number 3 number 4 number

1852 68 93 50 FD
1858 2D 95 A6 44
1713 33 1D 9A BB
0954 AF AC 21 B1
xxxx 39 12 74 C9
xxxx 2D 0B 30 33
xxxx 64 2B AC C3
0286 CD 06 2B 01
0065 6B 93 A3 A1
0687 40 FD 90 C7
xxxx 0F 3B 0E C4
xxxx D2 4E 30 33
0400 C3 01 59 6E
xxxx 3C FD B0 2C
0330 C9 E7 E7 FA
xxxx A5 C3 46 78
0363 66 C6 52 FD
0692 2E C7 0C E4
0453 F6 36 AD 25
0506 1F 88 C8 19
xxxx 55 E6 FE AF
xxxx 58 81 AE 77
xxxx 5B B5 AA B6
1287 B1 F3 29 34
xxxx BA 6A 98 CE
xxxx FF 74 46 BC

Carradio2001.

[siti]

i think 1119-1C95123E not work,this is old algo vw

[carradio2001]

i think 1119=1C95123E not work,this is old algo vw
Right ;) good point !

Carradio2001.

[siti]

update

1500-9443b129
1407-a5c34678
1567-b35d81ff
0687-40fd90c7
0906-67ee3533

[carradio2001]

BIG Question:
There is 0000-1999 or 0000-9999 codes ?

Carradio2001.

[blackpirate]

well, i saw that martech team its interested about this topic too...
but they dont offer any help! :( yes, they have a business to run!

decoding algo its stored in device box, right?
haveing the software unpacked will help??

i can obtain that!

just let me know!

please use PM system!

cheers
BP

[marinero123]

BIG Question:
There is 0000-1999 or 0000-9999 codes ?

Carradio2001.

I don't think so , their code still max 1999

[branco]

I don't think so , their code still max 1999


right!
regards

[goliat100]

It depends on whos table was radio :smokin:

[carradio2001]

It depends on whos table was radio :smokin:
ONLY RCD310

Carradio2001.

[goliat100]

ONLY RCD310

Carradio2001.
what this mean only RCD310 when all are same in basic :musicus:

[carradio2001]

what this mean only RCD310 when all are same in basic :musicus:
I think RNS510 have 0000-9999 codes and RCD310 only 0000-1999. That's the reason for make public only strings from RCD310 because IF finding this algo then no problem to extend at 0000-9999.

Carradio2001.

[branco]

I think RNS510 have 0000-9999 codes and RCD310 only 0000-1999. That's the reason for make public only strings from RCD310 because IF finding this algo then no problem to extend at 0000-9999.

Carradio2001.


h?h?!
good cristian
regards

[goliat100]

h?h?!
good cristian
regards
RNS and RCD have no any similar may be just a not error but how ever solution will be soon i hope to see it

[mlulic]

Who algoritam 58 0B B1 8F

[carradio2001]

Who algoritam 58 0B B1 8F

Soon my friend, ...soon will know !

Carradio2001.

[carradio2001]

Update:
Code = number 1 number 2 number 3 number 4 serial no.
1852 = 68 93 50 FD VWZ1Z3Hxxxxxxx
1858 = 2D 95 A6 44 VWZ1Z2Hxxxxxxx
1713 = 33 1D 9A BB VWZ1Z2Hxxxxxxx
0954 = AF AC 21 B1 VWZ1Z2Ixxxxxxx
xxxx = 2D 0B 30 33 VWZ1Z2Hxxxxxxx
0906 = 67 EE 35 33 from #siti
xxxx = 64 2B AC C3 VWZ1Z2Ixxxxxxx
0286 = CD 06 2B 01 VWZ1Z3Hxxxxxxx
0065 = 6B 93 A3 A1 VWZ1Z3Ixxxxxxx
0687 = 40 FD 90 C7 VWZ1Z3Ixxxxxxx
xxxx = 0F 3B 0E C4 VWZ1Z2Hxxxxxxx
xxxx = D2 4E 30 33 VWZ1Z2Hxxxxxxx
0400 = C3 01 59 6E VWZ1Z3Hxxxxxxx
xxxx = 3C FD B0 2C VWZ1Z2Hxxxxxxx
xxxx = 39 12 74 C9 VWZ1Z2Ixxxxxxx
xxxx = D8 59 F0 8C VWZ1Z3Ixxxxxxx
0330 = C9 E7 E7 FA VWZ1Z2Hxxxxxxx
0363 = 66 C6 52 FD VWZ1Z3Ixxxxxxx
0692 = 2E C7 0C E4 VWZ1Z2Hxxxxxxx
0453 = F6 36 AD 25 VWZ1Z2Hxxxxxxx
0506 = 1F 88 C8 19 VWZ1Z2Hxxxxxxx
xxxx = 55 E6 FE AF VWZ1Z2Hxxxxxxx
xxxx = 58 0B B1 8F VWZ1Z2Hxxxxxxx
xxxx = 58 81 AE 77 SKZ1Z3Ixxxxxxx
1407 = A5 C3 46 78 VWZ1Z2Ixxxxxxx
1500 = 94 43 B1 29 from #siti
xxxx = 22 43 F3 4B SEZ1Z2Hxxxxxxx
xxxx = 5B B5 AA B6 SKZ1Z2Hxxxxxxx
1287 = B1 F3 29 34 VWZ1Z2Hxxxxxxx
1567 = B3 5D 81 FF from #siti
xxxx = BA 6A 98 CE VWZ1Z3Kxxxxxxx
xxxx = FF 74 46 BC SKZ1Z3Ixxxxxxx

Need more good examples with unknown and especially know code !

Carradio2001.
(Owner of CalcGEN Made by I.S.A)

[Hack01]

1415 = 73 96 45 A1 VWZ1Z3
1852 = 68 93 50 FD VWZ1Z3H

[Hack01]

0399 = F7 AC 8B D8 WZ1Z3H

[juisro]

7XX7= 91 86 BB 47 Wziz2
0XX9= 64 01 00 01 Wz1z2

[carradio2001]

7XX7= 91 86 BB 47 Wziz2
0XX9= 64 01 00 01 Wz1z2
Please send me full code on pm. If you put XX that's not help me !

Carradio2001.
(Owner of CalcGEN Made by I.S.A)

[fukukum]

0775 = E7 7E 34 77 VWZ1Z2H
0368 = 9B AC 67 88 VWZ1Z2H

[maxximum]

1394 = 58 CF 09 B0 VWZ1Z2I

Code is 1394, (not 0323), dump attached

BR: maxXimum

[carradio2001]

58 CF 09 B0 VWZ1Z2I
Code 0323 ? send result please ...

Carradio2001.

[carradio2001]

1852 = 68 93 50 FD VWZ1Z3Hxxxxxxx
1858 = 2D 95 A6 44 VWZ1Z2Hxxxxxxx
1713 = 33 1D 9A BB VWZ1Z2Hxxxxxxx
0954 = AF AC 21 B1 VWZ1Z2Ixxxxxxx
xxxx = 2D 0B 30 33 VWZ1Z2Hxxxxxxx
0906 = 67 EE 35 33 from #siti
xxxx = 64 2B AC C3 VWZ1Z2Ixxxxxxx
0286 = CD 06 2B 01 VWZ1Z3Hxxxxxxx
0065 = 6B 93 A3 A1 VWZ1Z3Ixxxxxxx
0687 = 40 FD 90 C7 VWZ1Z3Ixxxxxxx
xxxx = 0F 3B 0E C4 VWZ1Z2Hxxxxxxx
xxxx = D2 4E 30 33 VWZ1Z2Hxxxxxxx
0400 = C3 01 59 6E VWZ1Z3Hxxxxxxx
xxxx = 3C FD B0 2C VWZ1Z2Hxxxxxxx
xxxx = 39 12 74 C9 VWZ1Z2Ixxxxxxx
xxxx = D8 59 F0 8C VWZ1Z3Ixxxxxxx
0330 = C9 E7 E7 FA VWZ1Z2Hxxxxxxx
0363 = 66 C6 52 FD VWZ1Z3Ixxxxxxx
0692 = 2E C7 0C E4 VWZ1Z2Hxxxxxxx
0453 = F6 36 AD 25 VWZ1Z2Hxxxxxxx
0506 = 1F 88 C8 19 VWZ1Z2Hxxxxxxx
xxxx = 55 E6 FE AF VWZ1Z2Hxxxxxxx
xxxx = 58 0B B1 8F VWZ1Z2Hxxxxxxx
xxxx = 58 81 AE 77 SKZ1Z3Ixxxxxxx
1407 = A5 C3 46 78 VWZ1Z2Ixxxxxxx
1500 = 94 43 B1 29 from #siti
xxxx = 22 43 F3 4B SEZ1Z2Hxxxxxxx
xxxx = 5B B5 AA B6 SKZ1Z2Hxxxxxxx
1287 = B1 F3 29 34 VWZ1Z2Hxxxxxxx
1567 = B3 5D 81 FF from #siti
xxxx = BA 6A 98 CE VWZ1Z3Kxxxxxxx
xxxx = FF 74 46 BC SKZ1Z3Ixxxxxxx
0775 = E7 7E 34 77 VWZ1Z2H
0368 = 9B AC 67 88 VWZ1Z2H
1415 = 73 96 45 A1 VWZ1Z3

A part of these codes are "FAKE" because are give by the Martech team :( Who is the "mole" ?
I want ONLY trusted and good / verified codes ! for searching the ALGO.

Carradio2001.
(Owner of CalcGEN Made by I.S.A)

[fukukum]

0775 = E7 7E 34 77 VWZ1Z2H
0368 = 9B AC 67 88 VWZ1Z2H


I received my radio working dumps:cheer:

[martech_team]

@carradio2001

Do you really think we don't have other work than putting you on wrong track ? we can sleep well with our hw protection, you can try with cracking Clip too.

none of our members were putting codes. besides, don't put yourself as one-and-only who can do this, there is at least 3 other projects for 310/510 in worldwide sales.

You had also forgot to write here you had contact us for buying Clip and tools, we replied with prices and pfff silent :)
but anyway, we wish you good luck, algo is easy.

This is EOT in this theme, we will not reply more.
Martech Team.

[blackpirate]

well first post from martech in 5 months!

i wouldnt trust in your hardware protection!

you saw that PS3 was cracked!
so...
its safe as long as a skilled reverser dont buy your tool...


cheers

[carradio2001]

@carradio2001

You had also forgot to write here you had contact us for buying Clip and tools, we replied with prices and pfff silent :)
but anyway, we wish you good luck, algo is easy.

Martech Team.

Only one explanation ...I never receive your replied with prices.

Carradio2001.

[branco]

Only one explanation ...I never receive your replied with prices.

Carradio2001.

friend prices are in their website
regards

[maxximum]

Code 0323 ? send result please ...

Carradio2001.

Code is 1394

[kuti]

Hi Friend
xxxx 2D 0B 30 33 code 0822

[met76]

Hello I can replace my line of code, with a publicly known on the forum? thanks in advance

[knok]

Hello I can replace my line of code, with a publicly known on the forum? thanks in advance

no , doesn?t work only if you will change with other know string.
Till then you can have code from dealer from s/n of your unit or from others DK members which have access @ VAG data

[met76]

very thanks

[nanou128]

Please calculate code :vwz6z7h9005006.

[nanou128]

Please calculate code:vwz6z7h9005006

[andersonmaxi]

send ur dump nounou i think u have eprom 24c64 and ur radio car is simens vdo

[m_yura]

Code 0332 = 79 6C E7 5D VWZ1Z2Ixxxxxxxx

[carradio2001]

Still working on finding this algo. Need more good examples.
Update -- >
1852 68 93 50 FD VWZ1Z3H
1858 2D 95 A6 44 VWZ1Z2H
1713 33 1D 9A BB VWZ1Z2H
0954 AF AC 21 B1 VWZ1Z2I
xxxx 2D 0B 30 33 VWZ1Z2H
0906 67 EE 35 33 Siti / DK
0399 F7 AC 8B D8 WZ1Z3H
xxxx 64 2B AC C3 VWZ1Z2I
0286 CD 06 2B 01 VWZ1Z3H
0065 6B 93 A3 A1 VWZ1Z3I
0687 40 FD 90 C7 VWZ1Z3I
xxxx 0F 3B 0E C4 VWZ1Z2H
0822 2D 0B 30 33 ???
xxxx D2 4E 30 33 VWZ1Z2H
xxxx 2C DF 12 FA VWZ1Z2H
0400 C3 01 59 6E VWZ1Z3H
xxxx 3C FD B0 2C VWZ1Z2H
xxxx 8D 13 F2 98 VWZ1Z2I
xxxx 39 12 74 C9 VWZ1Z2I
xxxx D8 59 F0 8C VWZ1Z3I
0775 E7 7E 34 77 VWZ1Z2H
0330 C9 E7 E7 FA VWZ1Z2H
0363 66 C6 52 FD VWZ1Z3I
0368 9B AC 67 88 VWZ1Z2H
0692 2E C7 0C E4 VWZ1Z2H
0453 F6 36 AD 25 VWZ1Z2H
0506 1F 88 C8 19 VWZ1Z2H
xxxx 55 E6 FE AF VWZ1Z2H
xxxx A1 0B 11 05 VWZ1Z2I
xxxx 58 0B B1 8F VWZ1Z2H
xxxx 58 81 AE 77 SKZ1Z3I
1394 58 CF 09 B0 VWZ1Z2I
1407 A5 C3 46 78 VWZ1Z2I
1415 73 96 45 A1 VWZ1Z3
1500 94 43 B1 29 Siti / DK
xxxx 22 43 F3 4B SEZ1Z2H
xxxx 5B B5 AA B6 SKZ1Z2H
1287 B1 F3 29 34 VWZ1Z2H
1567 B3 5D 81 FF Siti / DK
0332 79 6C E7 5D VWZ1Z2I
xxxx BA 6A 98 CE VWZ1Z3K
xxxx FF 74 46 BC SKZ1Z3I

Any idea ? Any help ? ...

Carradio2001.
(Owner of CalcGEN Made by I.S.A)

[MCNexo94]

Hi i need the code for my Radio RCD 510
the ref is
VW MID EU UP1 BVX
3C8 035 195
7 647 239 360
VWZ1Z3H3257838

My Dump Eeprom 95128
http://rapidshare.com/files/425826505/ori.bin (http://rapidshare.com/files/425826505/ori.bin)

Thanks !!!

Best Regard

[carradio2001]

The new table -- >

Code / Encrypted Code / Serial Number:

1852 68 93 50 FD VWZ1Z3H3343845
1858 2D 95 A6 44 VWZ1Z2H5364930
xxxx 2E 97 69 47 VWZ1Z2I6758026
1713 33 1D 9A BB VWZ1Z2H5316100
0954 AF AC 21 B1 VWZ1Z2I6063793
xxxx 2D 0B 30 33 VWZ1Z2H5809603
0906 67 EE 35 33 Siti / DK
0399 F7 AC 8B D8 WZ1Z3H / Hack01
xxxx 64 2B AC C3 VWZ1Z2I6614287
0286 CD 06 2B 01 VWZ1Z3H3250190
0065 6B 93 A3 A1 VWZ1Z3I4224995
0687 40 FD 90 C7 VWZ1Z3I4286517
xxxx 0F 3B 0E C4 VWZ1Z2H5304734
0822 2D 0B 30 33 ???
xxxx D2 4E 30 33 VWZ1Z2H5307400
xxxx A7 4F 62 74 VWZ1Z3H3257838
xxxx 2C DF 12 FA VWZ1Z2H5952799
0400 C3 01 59 6E VWZ1Z3H3241095
xxxx C4 06 C0 2A VWZ1Z3I4234406
xxxx 3C FD B0 2C VWZ1Z2H5369329
xxxx 8D 13 F2 98 VWZ1Z2I6145938
xxxx 39 12 74 C9 VWZ1Z2I7258904
xxxx D8 59 F0 8C VWZ1Z3I4232473
0775 E7 7E 34 77 VWZ1Z2Hxxxxxxx
0330 C9 E7 E7 FA VWZ1Z2H5354998
0363 66 C6 52 FD VWZ1Z3I4244790
0368 9B AC 67 88 VWZ1Z2Hxxxxxxx
xxxx 9E BC A0 83 VWZ1Z3H3354292
0692 2E C7 0C E4 VWZ1Z2H5751894
0453 F6 36 AD 25 VWZ1Z2H5497212
0506 1F 88 C8 19 VWZ1Z2H5293971
xxxx 55 E6 FE AF VWZ1Z2H5519515
xxxx A1 0B 11 05 VWZ1Z2I7212468
xxxx 58 0B B1 8F VWZ1Z2H5321910
xxxx 58 81 AE 77 SKZ1Z3I8157651
1394 58 CF 09 B0 VWZ1Z2I6154816
1407 A5 C3 46 78 VWZ1Z2I6698080
1415 73 96 45 A1 VWZ1Z3 / Hack01
1500 94 43 B1 29 Siti / DK
xxxx 22 43 F3 4B SEZ1Z2H5693502
xxxx 5B B5 AA B6 SKZ1Z2H3538060
1287 B1 F3 29 34 VWZ1Z2H5777796
1567 B3 5D 81 FF Siti / DK
xxxx F5 5E 7C C8 VWZ1Z3H3357553
0332 79 6C E7 5D VWZ1Z2Ixxxxxxxx
xxxx BA 6A 98 CE VWZ1Z3K6349790
xxxx FF 74 46 BC SKZ1Z3I8160599
If someone CAN calculate from serial number, please tell me or us the good codes (for searching the algo).

Carradio2001.
Owner of CalcGEN Made by I.S.A

[strzyzol]

Please help with code. I have a VW Radio LOW EU BVX
Read M95128
Blaupunkt RCD310
VW Radio LOW EU BVX
1K0 035 086 AA
815 7 647 201 360
VWZ1Z2I6014271

xxxx BE 23 C8 24 VWZ1Z2I6014271

Someone kindly help me?Thanks

[gabessszzz]

Code ???? Encrypted Code 9A 66 5F CF Serial Number:VWZ1Z2l6266984

5M0 035 186 AA

[fukukum]

Code ???? Encrypted Code 9A 66 5F CF Serial Number:VWZ1Z2l6266984

5M0 035 186 AA
No new algo solution:hmmmm2:

[carradio2001]

No new algo solution:hmmmm2:

Not yet,...not yet my friend.
Maybe next year ?!?!

Carradio2001.

[fukukum]

Not yet,...not yet my friend.
Maybe next year ?!?!

Carradio2001.
:wink:
you believe you do

[karim]

HI
I NEED RADIO CODE DELPHI
3C8 035 195 SW 5024
S/N VWZ4Z3K1102911

[svetlim]

@carradio2001
carradio2001 has exceeded their stored private messages quota and cannot accept further messages until they clear some space.

[adecode]

Hi

I like Carradio2001 approach. I also need a code for decoding a RCD 510, but instead of asking for it, I would like to discover it. So, since I have some experience in the past trying to access car information, I would like to ask some starting hits. 1) Have you some starting code in any type of language to start break the algo. 2) 95128 is the e2prom for the RCD 510. Any e2prom map positions inside the e2prom for counters, keys, configuration, checksums. Please send me some guidelines

[werC]

I can decode this radio and any other radio, like a piece of cake hehe.
And don't ask me how. :champions:

WBR
Crew

[bonus2010]

I can decode this radio and any other radio, like a piece of cake hehe.
And don't ask me how. :champions:

WBR
Crew

Hello werC

Well, I've noticed your first 4 posts on Digital Kaos... and let me say... none of them have been useful.

Good for you... that you can decode this radio... but I hope you are not going to continue viewing the forum and community of Digital Kaos as a place for you to conduct your bragging..

I do hope you will consider becoming a contributing member... even in the comedy section would be more useful...

.

[werC]

bonus2010, your avatar is very nice.

WBR
Crew

[maca]

bonus2010, your avatar is very nice.

WBR
Crew
another helpful post well done m8 hope the world cup is just as good ;)

[branco]

I know "CREW" very good decoder I think one of the best
but he don't give any solution for free
regards

[siti]

hmmm:hmmmm2:... werC is algo for Crew?:wavey:

[oemrepair]

hello,


i know also CREW he is professor of decoding!!


respekt for that man:)

[adecode]

Hello all

I am trying to discover a way to help everybody to unlock this radio, and do not ask einet all the time

I have a very good background in electronics, so I believe I can help, but if I receive startup tips it will be much more easy.

1) It seems easy for some users to get the dump from the e2prom. Can you tell me how?. From what I understand from martech pdfs, we can access using the SPI interface to the e2prom, but this kind of solution can be easy for me, but I believe i hard for must of the people

2) Since no body have the algo, I believe Martech uses brute force, from what I understand from the pdf pictures, there system just try all the codes. To do this you will need to reset the safe0 to safe2 info. Does any body now the location of this bits. Are they located in the e2prom.

Any help is welcome

[carradio2001]

#adecode,
IF you are soo good, not move away from the main solution, which is discover the algo. The solution with trying all the codes is temporarily and for some people only for making quick money. Also remind me about old Gamma-3 Philips and DOS interface for seeking the code :))
To receive free codes from serial number is not also a good solution ! and not available for everyone and not quick solution.
As I promise IF i will discover alone this algo I will make public, because it is first time when I was upset about this approach.
About your questions, of course the counter and the code are in eeprom. Both are encrypted strings. Counter easy to find, the code hard to find ... for the moment.

Carradio2001.
(Owner of CalcGEN Made by I.S.A)

[fukukum]

#adecode,
IF you are soo good, not move away from the main solution, which is discover the algo. The solution with trying all the codes is temporarily and for some people only for making quick money. Also remind me about old Gamma-3 Philips and DOS interface for seeking the code :))
To receive free codes from serial number is not also a good solution ! and not available for everyone and not quick solution.
As I promise IF i will discover alone this algo I will make public, because it is first time when I was upset about this approach.
About your questions, of course the counter and the code are in eeprom. Both are encrypted strings. Counter easy to find, the code hard to find ... for the moment.

Carradio2001.
(Owner of CalcGEN Made by I.S.A)
my friend Waiting forward to the solution of :D

[vlk69]

Right now i did try unit VWZ1Z2Kxxxxxxx LOW EU BVX. I change code from unknow original code to know code (1500). After restart unit show SAFE 75, can put code but unit say its not ok, and change the dump to previous state with original sequnce of code. :) Funny algo inside of dump.

[carradio2001]

I see only a few guys interested directly about this thread ! We are a big comunity, why one-two-three think and work for the others ??? ...

Carradio2001.

Mery Christmas to everyone !

[adecode]

Hi Vlk69

Taking the examples that carradio2001 is putting on this thread the code is located at 0AE0 address of the E2prom. From what I understand, you switch this 32 bit code to one that is already know, and of course it did not work, because the main processor make the calculations for the algo based on the serial number also inside the e2prom and the 32 bit code did not match. Did you change the serial number also? If it is possible to get the code based on the serial, the algo should only need the serial inside the e2prom. Since I do not know if the E2prom is checksum protected, even if you change everything, you must know how to calculate the checksum and update it also. This problem (checksum) is also applied to the safe bits, but from what I understand, you can load the e2prom and the write back again with clear safe bits.

Another issue, since replacing the e2prom with another one with knowed code does not solve the problem, this mean that there is another key on the E2prom that the processor check for a match. This key should be hardcode in the flash or it represents the processor ID (different for all boards).
Another solution, could be trying to find what is looking for and switch one e2prom with knowed code with this key information. Does anyone knows if there a check sum and how to calculate it? Perhaps the solution does not need to discover the algo, something that I believe it will be much more difficult.

[branco]

Hi Vlk69

Taking the examples that carradio2001 is putting on this thread the code is located at 0AE0 address of the E2prom. From what I understand, you switch this 32 bit code to one that is already know, and of course it did not work, because the main processor make the calculations for the algo based on the serial number also inside the e2prom and the 32 bit code did not match. Did you change the serial number also? If it is possible to get the code based on the serial, the algo should only need the serial inside the e2prom. Since I do not know if the E2prom is checksum protected, even if you change everything, you must know how to calculate the checksum and update it also. This problem (checksum) is also applied to the safe bits, but from what I understand, you can load the e2prom and the write back again with clear safe bits.

Another issue, since replacing the e2prom with another one with knowed code does not solve the problem, this mean that there is another key on the E2prom that the processor check for a match. This key should be hardcode in the flash or it represents the processor ID (different for all boards).
Another solution, could be trying to find what is looking for and switch one e2prom with knowed code with this key information. Does anyone knows if there a check sum and how to calculate it? Perhaps the solution does not need to discover the algo, something that I believe it will be much more difficult.

good job friend!
good luck

[bubik]

Car radio 2001!

You talk about this ! Do you have the Rcd 310 radio?(desk)

[vlk69]

Hi adecode,

Yes, i put 4 bytes to place where i see change after unsacessfull enter of code. After unsacesfull enter CPU change 4 bytes and some bytes increments of 1. I have one rcd310 for play , not for pray (code is know) :) Marry christmas to all DK..

[adecode]

Hi vlk69

Can you send me the e2proms before change and after change. I do not have the radio here with me, so any help would be great. The bytes that are increment by 1, could be the safe0 to safe2 bytes and the 4 bytes could be the checksum? Just guessing ;)

[jlhr]

hi,
i'm from Portugal and i'm trying to find VW gamma radio code
I don't know if you can help me
i'm tring lol

vwz1z3a65212804

i am a rooki on this subject, please forgive me

Tank you a lot

and hope you can help me.
It's sad driving whitout some music

[siti]

Right now i did try unit VWZ1Z2Kxxxxxxx LOW EU BVX. I change code from unknow original code to know code (1500). After restart unit show SAFE 75, can put code but unit say its not ok, and change the dump to previous state with original sequnce of code. :) Funny algo inside of dump.


maybe code is not in 0AE only cheksum

0AE0 66 c6 52 fd code 0363
0B00 7d dd 49 e6
0B20 99 39 ad 02

662d xor dd96=BBBB
6c5f xor 7d4e=1111
dd96 xor 99d2=4444
7d4e xor 93a0=EEEE

[carradio2001]

the interesting area is -- >

0AE0 68 93 50 FD 00 00 2F 54 32 33 4A 12 00 00 87
0AF0 43 21 00 00 B3 61 AC 02 66 20 80 C0 5A 21 D2
0B00 2B D0 13 BE 00 00 5D F0 A3 78 F3 CC 00 00 87
0B10 43 21 00 00 11 38 AA 4C 2C 21 B0 CA 87 6A 62
0B20 19 E2 21 8C 00 00 B2 11 90 2E 24 5A 00 00 87
0B30 43 21 00 00 99 04 10 4F BB 12 2E 20 A4 C7 16
0B40 75 36 04 B4 0B 48 7A D7 80 C3 F1 B9 38 7B 49
0B50 59 1A 28 87 2A 69 5B DA F1 21 7E 00 CA B2 03
0B60 02 32 00 00 00 00 03 7C 19 4E C6 C7 00 00 87
0B70 43 21 00 00 D2 04 D3 70 41 3B 4A 89 15 A0 FE
0B80 00 08 D7 03 6D 03 71 05 66 06 00 08 3D 0A CC
0B90 0A 03 D7 03 CC 04 14 06 B8 02 6D 03 52 04 71
0BA0 B8 02 6D 03 52 04 71 05 00 00 00 00 32 3E 98
0BB0 26 3F 8F 76 32 3E 98 0D 26 3F 8F 76 20 00 20

The code is 68 93 50 FD but exist a link between 68 93 50 FD and 2B D0 13 BE and 19 E2 21 8C.
Also 43 21 is a delimiter. I don't know sure where is the counter and how look.

From my experiments I change only the important strings--> no effect, I change also all this area --> no effect, I change parts of dump --> no effect, I change all dump --> no effect.
I think most of you have made this experiments ... until now without effect.

Carradio2001.

[carradio2001]

Car radio 2001!

You talk about this ! Do you have the Rcd 310 radio?(desk)
Sorry, not have right now. However this model on my desk it is rarely. Only one piece in a hundred another different models.

Carradio2001.

[vlk69]

2 adecode,

here they are...

[vlk69]

I did try adrress B48, not AE0.


maybe code is not in 0AE only cheksum

0AE0 66 c6 52 fd code 0363
0B00 7d dd 49 e6
0B20 99 39 ad 02

662d xor dd96=BBBB
6c5f xor 7d4e=1111
dd96 xor 99d2=4444
7d4e xor 93a0=EEEE

[carradio2001]

0AE0 68 93 50 FD 00 00 2F 54 32 33 4A 12 00 00 87
0AF0 43 21 00 00 B3 61 AC 02 66 20 80 C0 5A 21 D2
0B00 2B D0 13 BE 00 00 5D F0 A3 78 F3 CC 00 00 87
0B10 43 21 00 00 11 38 AA 4C 2C 21 B0 CA 87 6A 62
0B20 19 E2 21 8C 00 00 B2 11 90 2E 24 5A 00 00 87
0B30 43 21 00 00 99 04 10 4F BB 12 2E 20 A4 C7 16
0B40 75 36 04 B4 0B 48 7A D7 80 C3 F1 B9 38 7B 49
0B50 59 1A 28 87 2A 69 5B DA F1 21 7E 00 CA B2 03
0B60 02 32 00 00 00 00 03 7C 19 4E C6 C7 00 00 87
0B70 43 21 00 00 D2 04 D3 70 41 3B 4A 89 15 A0 FE
0B80 00 08 D7 03 6D 03 71 05 66 06 00 08 3D 0A CC
0B90 0A 03 D7 03 CC 04 14 06 B8 02 6D 03 52 04 71
0BA0 B8 02 6D 03 52 04 71 05 00 00 00 00 32 3E 98
0BB0 26 3F 8F 76 32 3E 98 0D 26 3F 8F 76 20 00 20

Another delimiter: 00 00 87. Counter on line 0B40 -- > 80 C3 F1 B9

Carradio2001.

[carradio2001]

2 adecode,

here they are...
We have:
46 EB C8 + crc (safe 0)
77 DA F9 + crc (safe 1)
24 89 AA + crc (safe 2 ?)

46 EB C8 xor 77 DA F9 = 31 31 31
46 EB C8 xor 62 62 62 = 24 89 AA

Carradio2001.

[adecode]

Hi vlk69

Thanks for the files. Taking in consideration the files, it seems that the checksum is at 0x0B48 and not at 0x0AE0, so initial assumption should be ok. What do you think siti?

The addresses and the calculations that siti mention are very interesting, so tired of making XORs calculations in windows calculator, I decide to write a program that make the calculations for us. Please find attach the XORs calculator. You just need to open a window command line (go to start->run and type cmd). This will open a console window. At that point, just go to the folder where you save the checksum.exe file and run it with the parameter equal to the e2prom file. Ex: checksum rcd510.bin.

I decide to make a final XOR between the results, and in siti example the result is 0xFFFF in both cases, something that is interesting also. With old files the 0xFFFF appears in the first calculations.

The carradio ideia about the counter, is interesting also, but you mark the green bytes wrong, it is D7 80 C3 F1. Why do you thing is a counter and not a checksum.

I would like to ask also vlk69 if he introduce a complete wrong code or only one digit, because the "counter" only misses the XOR calculations in one byte.

Why do you think last byte of "counter" is a CRC carradio2001?. Any ideias how to calculate it? From what I understand you decide to multiply the 31 by 2 and then reverse the XOR in order to calculate the next safe. Why by two, and not just add 1 to 32.

Does someone knows how to calculate the old algo? Could give me ideias for the new one. There is one post in another thread talking about an old algo for code 1119, but I did not understand how the second four bytes are calculated. In that example, the first XORs give 0xFFFF :)

Hope you enjoy the XOR calculator:D

[carradio2001]

The carradio ideia about the counter, is interesting also, but you mark the green bytes wrong, it is D7 80 C3 F1. Why do you thing is a counter and not a checksum.

Why do you think last byte of "counter" is a CRC carradio2001?. Any ideas how to calculate it?

Hi Adecode,

Well, this dump it is like Opel dumps (95640 eeprom). The counter in Opel dumps is 00 11 22 and a checksum XX. I never know how is calculate it, only use it as it is.
About D7 80 C3 F1, it is the bytes like the safe0 and safe1 dumps from our member #vlk69, maybe one digit left or right.

These "new" algos have everytime the "T23J" code in ASCII. All known new algos by me, have the code everytime on the line with the "T23J", after that is everytime checksums and counter and maybe another checksums. I marked the interesting area up this message.

Carradio2001.

[siti]

Does someone knows how to calculate the old algo? Could give me ideias for the new one. There is one post in another thread talking about an old algo for code 1119, but I did not understand how the second four bytes are calculated. In that example, the first XORs give 0xFFFF :)

Hope you enjoy the XOR calculator:D

[/QUOTE]



is very simple old algo VW,a single op math with XOR

[carradio2001]

is very simple old algo VW,a single op math with XOR
It is NOT so simply !

Carradio2001.

[adecode]

Hi Carradio2001

Any help with the old algo.

It is possible to any one to use a digital analyser and check the e2prom addresses that are read during a enter code procedure by the user. Basically is try to understand what bytes the MCU is reading to make the calculations for the algo.

From what I understand the old algo use a constant to XOR with the address 0AE0. I do not know if it is one constant or several.

What I want to prove is that there is a table of constants inside the E2PROM that is equal for all E2PROM.

Based on some information inside the E2PROM (some calculations based on the addresses mention before (AE0, B00 and B20)), the MCU calculates the offset of that table, and than make the xor of that constant with the code at 0AE0.

To prove this, I need to know the addresses that MCU access the E2PROM and then check if this addresses contain the constant information for the XOR.

Any more ideias? :)

[vlk69]

Hi, this is what i will do when have little bit more time, look what CPU do on I2C before & after enter CODE.


Hi Carradio2001

Any help with the old algo.

It is possible to any one to use a digital analyser and check the e2prom addresses that are read during a enter code procedure by the user. Basically is try to understand what bytes the MCU is reading to make the calculations for the algo.

From what I understand the old algo use a constant to XOR with the address 0AE0. I do not know if it is one constant or several.

What I want to prove is that there is a table of constants inside the E2PROM that is equal for all E2PROM.

Based on some information inside the E2PROM (some calculations based on the addresses mention before (AE0, B00 and B20)), the MCU calculates the offset of that table, and than make the xor of that constant with the code at 0AE0.

To prove this, I need to know the addresses that MCU access the E2PROM and then check if this addresses contain the constant information for the XOR.

Any more ideias? :)

[adecode]

Hi vlk69

I will be waiting for that :)

[alexics]

Hi vlk69

I will be waiting for that :)

The old algo uses a ten bye lookup table but thrree of the code addresses are xored. I should know I cracked it in the first place years ago.

[carradio2001]

Hi, this is what i will do when have little bit more time, look what CPU do on I2C before & after enter CODE.

I think your I2C analyzer not help you. Inside is a SPI eeprom: 95128.

Carradio2001.

[carradio2001]

#adecode,
...not move away from the main solution, which is discover the algo)
As I said, why not believe me ? The code is on address 0AE0 and is matter of mathematics. Need to work on the table with any kind of formula. Good luck and keep in touch !

Carradio2001.

[alexics]

The 'code area' does start at 0AE0 and the patterns in that area are based on a previous algo but that won't help trust me on this. In the old algo the interlocking checksums were the same across different models. This is one stage further on. The data is likely encrypted by a unique key stored in the processor. Once the key is known then decoding would be simple. Apply the key then use the old algo. They haven't reinvented the wheel because they want an easy solution for them that makes it very difficult for us.

Also a possible calculator would be based on the Blaupunkt calcs but be modified to make it difficult to work out for us but stupidly simple for them. It's a game of cat and mouse and they are winning it.

[alexics]

Has anyone tried xoring the code area with the radios serial number stored in the dump? This after all is unique to each set.

[cartech]

hello!
any body can give me help here?
http://www.digital-kaos.co.uk/forums/f176/rcd510-code-please-183450/

[Putas]

Hello,
I tray also to help, Is this helpful!
This is the DNL file that are programed in to the Nec850V and also the eeprom.

[gyalog_kakkuk]

Hi all

Please help this car radio
I need corect code

Thanks

Krisz

[florinyk]

please help this car radio Blaupunkt Alpha cc
VWZ1Z1S4296335
7 644 840060
1h0 035 156 a

[bonus2010]

please help this car radio Blaupunkt Alpha cc
VWZ1Z1S4296335
7 644 840060
1h0 035 156 a

Post the dump

[florinyk]

Excuse me but do not know what and where they can dump this dump.
thanks

[ferys]

RCD310 Visteon? memory24lc32!!!
Please send me code this dump
Very thanks
Good luck ferys

[oemrepair]

RCD310 Visteon? memory24lc32!!!
Please send me code this dump
Very thanks
Good luck ferys



you have more info from unit wich mcu inside?


regards

[ferys]

VWZ4Z2K.......
GEN 3 VW EU LOW
procesor NEC 70F3352GC
NXP SAF7741HV/118

Very thanks this reply
Good luck ferys

[laxitylabs]

0495 is your code
ciao

[ferys]

laxitylabs Very very thanks
This code is ok
good luck ferys

[fukukum]

0495 is your code
ciao
Does code serial number? code or dump? :jiggin:

[carradio2001]

0495 is your code
ciao
How you obtain it ?
It is not the newer RCD series, from the first pages !

Carradio2001.

[iProg-carradio]

RCD310 Visteon? memory24lc32!!!
Please send me code this dump
Very thanks
Good luck ferys


please send my foto carradio.

[alexics]

please send my foto carradio.

The way to find the code ........ logic analyzer! :goodpost:

[giruzzo]

Do you need the code? 0767 alg.... OD D2 59 81 :ciao:

[Aniskey]

HI PPLE Please need code for radio
dump is atached
VWZ1Z216753226
815 7 647 201 360 VW RADIO LOW EU BVX
1K0 035 186 AA

[alexics]

Do you need the code? 0767 alg.... OD D2 59 81 :ciao:

OK Then so what is 0766, 0765, 0764, 0763 etc etc. Be useful not cryptic. Otherwise SSSSSHHHHHHHHH!

[bonus2010]

OK Then so what is 0766, 0765, 0764, 0763 etc etc. Be useful not cryptic. Otherwise SSSSSHHHHHHHHH!


Fellow member is referring to his post here..

http://www.digital-kaos.co.uk/forums/f176/vw-mid-eu-rcd510-help-185948/#post942817

Who has posted the code for line #AE0 of the dump....

Most importantly, member has tried to help... as Carradio2001 was initially seeking valid codes relating to encrypted values at the begining of this thread...

[andersonmaxi]

no carradio 2001 in rns 510 ther is 1999 number
i find the code of this radio there is 3 days with matimatic 0000 to 1999
any wel solved

[florinyk]

HELP please
code vw gamma
VWZ6Z3R1125909

9022 215 88719 04

003 9439 1125909
THANKS

[aissa09]

poste dump :manuscarf:

[vavrich]

HELP pros?m
K?d ***353;koda RNS310 3T0035191 SKZ1Z2K9265067 BLAUPUNKT 7612032053

[workas]

Hi in Rusian forum found that code are in ECU-uPD70F3356GJ and same in eeprom.just chrypted by procesor mask.I found datasheet for that type of ecu
http://www2.renesas.com/maps_download/pdf/U17790EJ3V1UD00.pdf.I am a bad in programing ,but for some people i hope this info will be good :)

[Taras+]

You can link to some forum talking about?
Datasheet how many dead poultice long lies in the network.
ps If there's a couple of colleagues percent. eeprom can share.

[bonus2010]

@Taras+

Not really sure what you mean...... that's OK though..

For everyone else... please take note that it is against DK forum rules to link to any other forum of similar content.

Apologies... if I have mis-interpreted you.

[workas]

@Taras+

Not really sure what you mean...... that's OK though..

For everyone else... please take note that it is against DK forum rules to link to any other forum of similar content.

Apologies... if I have mis-interpreted you.


"Do not put anything ahead of God your Creator." :alberteinstein:

[workas]

i found that wellon VP-990 (http://www.kanda.com/products/wellon/VP-990.html) support this type of processor in ISP .But i don't have it :( i have just beeprog+ but no support for this MCU

[goliat100]

I'm just wondering when this carp will stop ,serious decoders already solved this issue , there are few possibilities more which are not published ,rumors that talking about easy solutions and free for all will less until some of this decoders make mistake ,so i suggest to keep your good will and use tools which are affordable on market until it have some worth to decode :alberteinstein:

[Taras+]

@Taras+

Not really sure what you mean...... that's OK though..

For everyone else... please take note that it is against DK forum rules to link to any other forum of similar content.

Apologies... if I have mis-interpreted you.
Not understand the question. If you broke the rules, please post to jam the moderator. Good luck.

[gabessszzz]

Hi all

Please help this car radio
I need corect code

Thanks

http://rapidshare.com/files/447331921/golf6_r__di___rcd310_blau_95128_LOW_EU_G__BVX_5M0_ 035_186_AA_VWZ1Z2I6266984__BP_NR7_647_202_360.bin

[bonus2010]

Hi all

Please help this car radio
I need corect code

Thanks

http://rapidshare.com/files/447331921/golf6_r__di___rcd310_blau_95128_LOW_EU_G__BVX_5M0_ 035_186_AA_VWZ1Z2I6266984__BP_NR7_647_202_360.bin

That's the newer algo.... I've not seen it being answered by dump. If you've seen it answered, it's been through a member having access to the VW database. (however, that's rare) using serial number.

All I can ask, if you get the code through other means ... can you post it here. (This would help members who are trying to work out the algo.... for the next time)

Best of luck..

[aissa09]

for information

[karim]

I Need Radio Code VW RNS310
BP-Nr.7 612 032 080
VW-Nr. 3C0 035 270
S/N VWZ1Z2K9135873

[zakisat02]

cdr 310 eu
epromme 24c32
delphi
and
cdr310 baupunkt
epromme 95128

[siti]

RCD310 DELPHI code 1xx7,rest find alone:beheaded:

[zakisat02]

rcd delphi code 1??7 ?
rcd310 blaupunkt code?

[kuti]

Hi Friends
I just have a RCD 310 without code.
Dump attached if someone has some idea nad whant to try own solution on this radio send PM.

[deffc0n]

I have 5F5F6568 for rcd310 vwz1z216859366.

[Car235]

I have 5F5F6568 for rcd310 vwz1z216859366.

If you need dump for this serial HERE (http://www.digital-kaos.co.uk/forums/f176/vw-radio-rcd310-195277/#post1014547) :bandit: (http://www.digital-kaos.co.uk/forums/f176/vw-radio-rcd310-195277/#post1014547)

[karim]

WHERE I CAN FIND THE CODE IN THIS RADIO
vwz4z3k............

I'VE FIND THE EEPROM
E5P02
P001
WHAT IS THE EQUIVALENT OF THIS EEPROM

[Carsoft2003]

HI I Need code for this car radio

BLAUPUNKT GMBH
VWZ1Z3G6702146
1K0 035 195 AA
EEPROM : 95128

THANKS IN ADVANCE

[Car235]

HI I Need code for this car radio

BLAUPUNKT GMBH
VWZ1Z3G6702146
1K0 035 195 AA
EEPROM : 95128

THANKS IN ADVANCE

Try code =1838= :top:

:party:

[siti]

HI I Need code for this car radio

BLAUPUNKT GMBH
VWZ1Z3G6702146
1K0 035 195 AA
EEPROM : 95128

THANKS IN ADVANCE
pls try this dump,code 9999

[Carsoft2003]

Big Thanks To Car235 and siti , I test your dump code 7777 is ok

[karim]

Code 9999 or 7777

[bonus2010]

Code 9999 or 7777


Siti's dump currently posted is 9999

[Amine13]

Hello mate,s here is RCD310 dump from 95128, need code, thanks to all.
1K035186AA BVX

[bubik]

Dump missing.read again

[rtv2011]

Hello mate,s here is RCD310 dump from 95128, need code, thanks to all.
1K035186AA BVX


new algo ......no possible

[iProg-carradio]

Hello mate,s here is RCD310 dump from 95128, need code, thanks to all.
1K035186AA BVX



bvx eu low 1K0xxx AA 95128 radio code.bin = 2048 - not right, 95128 = 16384 - ok size

[bubik]

Yes yes....

[Amine13]

OK mates, thanks for that, will read again and post dump.

[bubik]

Dump size not good!

[sofix]

Hi. I Need Radio Code VW RCD310
VW Radio LOW EU
BP-Nr.7 647 201 360
VW-Nr. 1K0 035 186AA
S/N VWZ1Z2I7262739

Thanks in advance.

[davidfeng]

no code need in my radio

[davidfeng]

:stupid:here is the dump

[BALI7605]

Hello,

Anyone could help me out on this CDR310. Please find attached the dump from a 95128.
Thank you,

bali

[Amine13]

Hello mates,
Thanks for your good job,
I read again the 95128 and got the right size. Radio is RCD310 1K035186AA BVX.
here is file.
All the best..

[bonus2010]

VW MID EU/ RCD310 MID

This thread has become a bit old... but I feel there still exists a very high interest in finding an easy solution to decoding this radio. That easy solution would be if the code exists in the eeprom and of course the method of encyption can be discovered.

I've been 'dreaming in hex' and studying the eeprom dumps carefully. A good expression given by another member... understand it so well. :)

Hey, I've no idea whether the code is in eeprom or both in the eeprom and MCU, or just in the MCU. lol

I'm appealing to members who would like to colaborate in a bit of research.. given the opportunity.

Member would need to have the radio on the bench, the correct code and tested... maybe obtained by VW dealership. (I can't provide the original code)

I would like to test if the code given can be changed by editing the original eeprom dump. So member would need to post their dump with the correct code, and I'll reply with the edited dump, and change the code to '1234'. ... to be re-written to the eeprom. (OK, if you've got the time to do this.. without a screaming customer breathing down your neck)

If this experiment works.... it will prove that the eeprom data is 100% connected with the code.

Thanks in advance for anyone who would like to entertain me in some experimental research....

[alexics]

VW MID EU/ RCD310 MID

This thread has become a bit old... but I feel there still exists a very high interest in finding an easy solution to decoding this radio. That easy solution would be if the code exists in the eeprom and of course the method of encyption can be discovered.

I've been 'dreaming in hex' and studying the eeprom dumps carefully. A good expression given by another member... understand it so well. :)

Hey, I've no idea whether the code is in eeprom or both in the eeprom and MCU, or just in the MCU. lol

I'm appealing to members who would like to colaborate in a bit of research.. given the opportunity.

Member would need to have the radio on the bench, the correct code and tested... maybe obtained by VW dealership. (I can't provide the original code)

I would like to test if the code given can be changed by editing the original eeprom dump. So member would need to post their dump with the correct code, and I'll reply with the edited dump, and change the code to '1234'. ... to be re-written to the eeprom. (OK, if you've got the time to do this.. without a screaming customer breathing down your neck)

If this experiment works.... it will prove that the eeprom data is 100% connected with the code.

Thanks in advance for anyone who would like to entertain me in some experimental research....

The code IS in the eeprom but if it is changed it causes all sorts of problems.

[bonus2010]

The code IS in the eeprom but if it is changed it causes all sorts of problems.


Ahhh... maybe not a good idea then. So.. you've managed to get radio to accept a different code, but functionality probs occur? Would make you think there is more checksums involved, than that what exists for the code lines. I have found others, but probably not them all.

[goliat100]

anyway i hear from martech users it is a kids play now :D

[bonus2010]

anyway i hear from martech users it is a kids play now :D


Very good mate.... I was expecting your input. lol

[kuti]

Friends
If You whant decode this radio You Can built own "martech" interface with cost of 50Euro.
Brutal Force takes max 7h, I think till now it's a simples way.

[zabra]

Kuti can you put more info about this tool

[goliat100]

depends on brain bruteforce is max 30 min and on unbrained it can take a centuries :dancing2:

[kuti]

I built it with UPA, and Arduino Board.
All You have to do is connect to key of radio TTL signal from output arduino pins and after 2 tries check error counter in M95128. Write simple programm in Delphi or other Langauage and You have martech "solution" for RCD 310.

[deffc0n]

Blaupunkt
RCD310
eeprom 95128

[weber]

BLAUPUNKT VW RADIO LOW EU BVX 1K0 035 186 AA eeprom 95128 s/n VWZ1Z2L9183415 made portugal,help mi code

[iProg-carradio]

BLAUPUNKT VW RADIO LOW EU BVX 1K0 035 186 AA eeprom 95128 s/n VWZ1Z2L9183415 made portugal,help mi code

haljawi ne budet

[weber]

haljawi ne budet

v iProg takova kalka net

[Valera]

Any body can help with this RCD-310 :

VWZ1Z2I60078651
VW-1K0 035 186 AA
BP-7 647 201 360

Here dump with two attemps.
Thanks anyway !

[iProg-carradio]

Any body can help with this RCD-310 :

VWZ1Z2I60078651
VW-1K0 035 186 AA
BP-7 647 201 360

Here dump with two attemps.
Thanks anyway !

Edit: phone number removed

[andrey3]

I built it with UPA, and Arduino Board.
All You have to do is connect to key of radio TTL signal from output arduino pins and after 2 tries check error counter in M95128. Write simple programm in Delphi or other Langauage and You have martech "solution" for RCD 310.

ok, you can explained to the key work? to join?
thanks!

[Taras+]

RCD510 DECODE Orange-5 .mp4 - YouTube

RCD510 decoding ~ 4-5 minutes
RCD310 decoding ~ 7-8 minutes

[bubik]

Taras+!

radio old algo?

[oemrepair]

There is no "old" or "new" algo in rcd radios. Algo the same in all models. Just almost nobody knows this algo well (except 3 - 4 people/world), there is reason, why ...

[oemrepair]

True decoding of it takes 1min - read MCU and 5 sec - read eeprom + 1 min - manual calculation, 2 min 5 sec total.


Friends
Brutal Force takes max 7h, I think till now it's a simples way.

[bonus2010]

There is no "old" or "new" algo in rcd radios. Algo the same in all models. Just almost nobody knows this algo well (except 3 - 4 people/world), there is reason, why ...

'Old' or 'New'... call it what you like. However, there is a difference though.. :)

Still wondering if the 'mask' is stored in the eeprom also... :confused:

[oemrepair]

"mask" stored in MCU. So you have to read it too for code calculation. MCU + eeprom dumps = code.

BTW, nice PQRST avatar... :)

[bonus2010]

To tell you truth... getting bored with avatar, never got round to measuring vital parameters. lol

.
http://i54.tinypic.com/29capts.jpg

[andersonmaxi]

HELLO GUYS
I NEED THE CODE OF THIS RADIO CD VW POLO
THX U FOR UR HELP
.
http://i54.tinypic.com/29capts.jpg[/QUOTE]

[alexics]

'Old' or 'New'... call it what you like. However, there is a difference though.. :)

Still wondering if the 'mask' is stored in the eeprom also... :confused:

BBB (Bull**** baffles brains)

[einet]

Hi,
@andersonmaxi
I tray to send you a email but you don?t accept PM!
But sorry I?m in hollydays until Sep.

[bonus2010]

Enjoy your holidays einet and have a good time.... :)

[andersonmaxi]

hello bonus have u solition for decode this radio vwz1z2lxxx
polo
thx u

[bonus2010]

hello bonus have u solition for decode this radio vwz1z2lxxx
polo
thx u

Sorry mate... unfortunately I don't have a solution ..

In the above posts.. I was only speaking rubbish lol

[murat332]

Carradio2001.
hi friend
algorithm looks like a very difficult but if we get a little bit of code, why not a certain file :vollkommenauf:

[murat332]

****************************************
0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687 test ok.
****************************************
0000AE0-C4-04-BB-DB
0000B00-AA-6A-D5-B5
0000B20-AF-6F-D0-B0 Code 7598 test ok.
****************************************

[Valera]

****************************************
0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687 test ok.
****************************************
0000AE0-C4-04-BB-DB
0000B00-AA-6A-D5-B5
0000B20-AF-6F-D0-B0 Code 7598 test ok.
****************************************
You change code in RCD 510 (310) or it'f from different radios ?

[murat332]

You change code in RCD 510 (310) or it'f from different radios ?
no, my friend
I have friends dealing with the code argoritma
thanks :vollkommenauf:

[andersonmaxi]

hello murat332
i change the addres of my dump of your

0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687
but the radio dont want star
then i program with original dump the radio work
i think we canot change this addres
thx u all

[alexics]

This is an attempt to change a code with a presumed calculated table. Anyone care to test it?

[murat332]

hello murat332
i change the addres of my dump of your

0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687
but the radio dont want star
then i program with original dump the radio work
i think we canot change this addres
thx u all
my friend works with the original radio cast
your radio will not work after the installation of a different eeprom file (power on ?):hmmmm:

code files that will be solved together with different friends here cripto :vollkommenauf:

[Valera]

This is an attempt to change a code with a presumed calculated table. Anyone care to test it?
Please explain little bit more how you change 0x0ae0 data ?
I can calculate data to rest fields from data of 0x0ae0 field ( thanks to calculator autor several post's before ).
Can you post oryginal dump for rest people who don't hawe presumed calculated table ?
Sorry for my poor english ......
Can you change code in my dump ?
I hawe one rcd-310 for testing .....

[Valera]

hello murat332
i change the addres of my dump of your

0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687
but the radio dont want star
then i program with original dump the radio work
i think we canot change this addres
thx u all
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D
in this strings are checksums generated from 0000AE0-40-FD-90-C7 by xor witch values shown witch xor calculator.
you can change 0000AE0 and recalculate botch b00 & b20 witch xor walues but where we can get rigth 0AE0 data ? :shakehands:

[alexics]

Please explain little bit more how you change 0x0ae0 data ?
I can calculate data to rest fields from data of 0x0ae0 field ( thanks to calculator autor several post's before ).
Can you post oryginal dump for rest people who don't hawe presumed calculated table ?
Sorry for my poor english ......
Can you change code in my dump ?
I hawe one rcd-310 for testing .....

Do you have the code for this dump or is it unknown?

[Valera]

Do you have the code for this dump or is it unknown?
It's unknown but radio for testinng i my desk ihawe few monts ....:hmmmm:

[alexics]

It's unknown but radio for testinng i my desk ihawe few monts ....:hmmmm:

Unless it has been modified the code will start with 0 or 1. This cuts down the number of options. The rest will be 000 to 999. So you end up with 2000 possible codes. I will try to help narrow the odds. :hmmmm:

[alexics]

Possible code variations based on the pattern for code 0687

40 FD 90 C7 code 0687
71 39 7A 94 code 1234
40 D3 A1 E9 code 0998
71 AE 8F 61 code 1561

[bonus2010]

Possible code variations based on the pattern for code 0687

40 FD 90 C7 code 0687
71 39 7A 94 code 1234
40 D3 A1 E9 code 0998
71 AE 8F 61 code 1561



And..... 71 6A 18 61 would be 1111 :top:

[alexics]

Please explain little bit more how you change 0x0ae0 data ?
I can calculate data to rest fields from data of 0x0ae0 field ( thanks to calculator autor several post's before ).
Can you post oryginal dump for rest people who don't hawe presumed calculated table ?
Sorry for my poor english ......
Can you change code in my dump ?
I hawe one rcd-310 for testing .....

The first digit of your code should be a 1 so that leaves 1000 code combinations. I am investigating further.

[alexics]

Valera I think your code is 1?70. Probably wrong so don't expect too much. You have now only 10 codes to test to see if I am right.

[alexics]

And..... 71 6A 18 61 would be 1111 :top:

You must work for the CIA.:party :

[andersonmaxi]

hello guys and what abt CODE OF this ????
0AE0 8C A8 36 ED
0B00 41 65 FB 20
0B20 C1 65 7B A0

[murat332]

hello murat332
i change the addres of my dump of your

0000AE0-40-FD-90-C7
0000B00-FD-40-2D-7A
0000B20-BA-07-6A-3D Code 0687
but the radio dont want star
then i program with original dump the radio work
i think we canot change this addres
thx u all

hello my friend
I know he needed to operate the processor to rcd510
For a change made ***8203;***8203;to the eeprom does not turn on the radio
the radio does not work.
I think it necessary to run the processor
only the code files that we bring together some code that will solve the algorithm.:hmmmm:
murat

[andersonmaxi]

yes maybe
any wel i send message to einet he have soliton for this radio calc by serial

[Car235]

yes maybe
any wel i send message to einet he have soliton for this radio calc by serial

For these two days .....................
You can alone find code try one by one.

[murat332]

Or --------------

[curdeballans]

as fresh searcher - remember for xor research

M XOR K = C
C XOR K = M
and
(M XOR K) XOR K = M

[siti]

Or --------------
for old algo vw,i think:top:

[murat332]

for old algo vw,i think:top:
yes can be my friend :rolleyes:

[alexics]

Something fishy going on here. I have done a recalculation and valeras code comes out as 9999. hmmmmm

This looks like a direct mod of the old patterns. Clever.

Ahhh! This is the mod shown on youtube.

[andersonmaxi]

thx u all
solved with mr einet

[murat332]

rcd310, 510 series radio, thanks for the einet

[andersonmaxi]

einet perfect guy

[andersonmaxi]

hello guys if u want calc the dump the code of my dump is 1346
good luck

[Valera]

Something fishy going on here. I have done a recalculation and valeras code comes out as 9999. hmmmmm

This looks like a direct mod of the old patterns. Clever.

Ahhh! This is the mod shown on youtube.
Pls explane bit more ....

[alexics]

Pls explane bit more ....

Ask Mr Bonus to look at the top line of your code in the dump and ask what code he would expect it to be.

[houssem12]

hello, can you help me to get the code for this radio
blaupunkt
815 7 647 239 360
vwz1z3i5396362
thanks

[boukad]

HI ALL
Please calculate code CODE PIN RADIO VW FOLF 06 BLAUPUNKT GMBH
815 7 647 201 360
VWZ1Z217233095
VW RADIO LOW EU BVX
1K0 035 186 AA
EPROME ST95128
MADE IN PORTUGAL
THANKS FOR ALL

[boukad]

hi
hi please code pin vw rcd radio

[plamen2]

HELP CODE RCD510 VW MID EU DAB UP1 BVX
3C8 035 195A
815 7 647 240 360
VWZ1Z3I5294520
Thanks.

[paljamp]

Hello guys, it may be useful for discovering algo
RCD 310 Blaupunkt
VW Radio LOW EU G+ BVX
7 647 202 360
VWZ1Z2K8534898
Code = 1017
if necessary I can also give you dump files

[Argento7]

Hello guys, it may be useful for discovering algo
RCD 310 Blaupunkt
VW Radio LOW EU G+ BVX
7 647 202 360
VWZ1Z2K8534898
Code = 1017
if necessary I can also give you dump files

With dump I think is better.
BTW, any progress @ carradio2001 work?

[mullay]

Hi

i have here an Skoda amundsen,this is the same like VW rns 310

SKZ1Z2I8982507

can help with code ?

regards

[camel131]

Did anyone try to replace procesor NEC D70F3356 with procesor from other rcd radio ,and it works with the same code? or not ?
Code depends of both - eeprom and processor or not ?
Can't find pdf datasheet for this procesor NEC D70F3356GJ(A)

[einet]

this is nec 850

[Taras+]

Code location in eeprom !

[camel131]

Code location in eeprom !
Is it really possible to calculate code only from eeprom (not from serial) ?
How much code depends of processor nec?
Now I can transfer code to other rcd dump but it works only in orginal radio.
Is it no dependieces?

[laxitylabs]

@camel131

code is generated and compared in radio ram from nec data. Taras+ can't calc code from eeprom, maybe he can only knew code location as he wrote, that's all. some bytes from nec plays with ee but this is hard knowledge and won't be spread soon. you can't clone from one ee to other, unless you will copy nec too. that's all. if you need really to decode then find tools for this, if you need free solution forget unless you can understand renesas pdf c#. ciao

[camel131]

Let we see that code can be calculated only from eeprom.
Here is fragment of eeprom from rcd510 -blaupunkt vw mid eu up1 bvx.
I know oginal code (found by brute force method - "fast fingers").
If anybody tell me the same true code ,then I believe that it is possible.

This real code is in rar file with password.
If somebody tell the true code I show you password for this rar file to see the
real ,already known code.(It is for be sure that code is known for me before)

[sucman]

Some people can count if not 4 that first and second digits of the code of the dump.

[carradio2001]

camel131 (http://www.digital-kaos.co.uk/forums/members/123556-camel131/), yes that's the code location and is cripted. I have more examples of good codes and strings. Not calculation is the big problem in this algo but the connection from eeprom and something else which i don't know if it is a constant word or variable (worse case).
Still working ... when I will discover I will make a big surprise for you: free algo !!!

Carradio2001.

[Taras+]

I can decode this carradio not from VIN before than 10 minutes.
Also i can decode this carradio with absent M95128 and bad data in eeprom !

[carradio2001]

I can decode this carradio not from VIN before than 10 minutes.
Also i can decode this carradio with absent M95128 and bad data in eeprom !
And tell us HOW can do that ?


Carradio2001.

[Taras+]

Orange-5 + HPX modules from pavel-pervomaysk .

[bubik]

Taras+

This module can decode new algo?

[Taras+]

Yes. Can decoding and change code.
Can move Skoda or VW
RCD510 DECODE Orange-5 .mp4 - YouTube

[camel131]

Let we see that code can be calculated only from eeprom.
Here is fragment of eeprom from rcd510 -blaupunkt vw mid eu up1 bvx.
I know oginal code (found by brute force method - "fast fingers").
If anybody tell me the same true code ,then I believe that it is possible.

This real code is in rar file with password.
If somebody tell the true code I show you password for this rar file to see the
real ,already known code.(It is for be sure that code is known for me before)
Digital Kaos (http://www.digital-kaos.co.uk/forums/attachments/f176/84344d1318765669-vw-mid-eu-rcd310-help-rcd510.png)

talking,talking,talking...

Till now nobody correct 0xxx

[Taras+]

To camel131, i can, if you know code from dump.

[camel131]

I know code ,here is link with my code for verify.
If you tell me true code ,then I send you password for to txt file with my code ,where is writen my code number.
Then I say MASTER

http://www.digital-kaos.co.uk/forums/attachments/f176/84374d1318787409-vw-mid-eu-rcd310-help-real-code.rar

[Taras+]

You not understand me.
If you know code for your dump, i can change him from 0000 to 9999.
But if you send me RADIO, i decoding him less than 10 minutes etc.

[camel131]

It means that it is not possible to find code only from dump(without serial and without radio) ?

[alexics]

It means that it is not possible to find code only from dump(without serial and without radio) ?

The guy in his car just wants to listen to music he doesn't care how clever the bloke is that did it for him.

[Taras+]

Special for camel131.
Decoding process not USE VIN code.

[camel131]

But why all the time you want to be far away from the main theme?
Can you find the code seeing only dump or not?
I think not.
With radio, you can search for the code one by one using for this some fast
typing and checking (perebor).
Changing the previously known code is a different story.
Why destroy already opened door.