LET'S MAKE NISSAN Glove Box CALCULATOR

[ben1980]

I'M TRYING TO MAKE A CALCULATOR FOR NISSAN GLOVE BOX 12 HEX CHR .
PLEASE POST GLOVE BOX 12 CHARACTER AND ITS PIN CODE .
SO I CAN MAKE A CALCULATOR FOR YOU GUYS

...IF ANYONE KNOWS THE algorithm CAN YOU SHARE IT ..

[rokibar]

good idea. 415251

[KERIMNBO]

E8B26AA8CD95 Pin Code ABFEA6FA55B7

[steveleo]

Get the flashdump of the micro and we can do it the proper way. I don't think you can recalc it with some examples.

[ben1980]

about 300 example needed to run some rundom algo through first 3 byte to crack it .

[ben1980]

cracked it
It was easier than I thought it'd be

[Johnner]

SO..........Do you wanna give any details ?

[steveleo]

Pretty sure he had access to a original calc and made some "choosen plaintext attacks". If the calc is very simple this works very well. Would be interesting anyway if he gives out some info. But usually in forums it's only "i found solution" and thread finished.

BTW, if anyone is still interested in cracking this and making a program send me a PM.



Little Update -> some progress already made on this. Getting close to it. If someone has a calc and can help me with some "choosen plaintext attacks" let me know via PM. I think i don't need 300 ;-)

[steveleo]

I still don't understand why if quote then spacebar is deactivated if i write below quoted text... Strange

Anyway, this nissan code is anything but rocketscience. The examples posted in the other thread here were sufficient to crack it. I had 21 samples collected in total here. So it was like 1 hour putting all examples together, then 5 mins with windows calc to "crack" the simple part and another 5 minutes playing with my beloved Dev-Cpp and done.

If you want to verify -> "BeefFaceBabe" will give "CD898DA323F6" :stung:

@Johnner... I sent you PM



Pretty sure he had access to a original calc and made some "choosen plaintext attacks". If the calc is very simple this works very well. Would be interesting anyway if he gives out some info. But usually in forums it's only "i found solution" and thread finished.

BTW, if anyone is still interested in cracking this and making a program send me a PM.

Little Update -> some progress already made on this. Getting close to it. If someone has a calc and can help me with some "choosen plaintext attacks" let me know via PM. I think i don't need 300 ;-)

[steveleo]

Ok, so code calculator is online. It's free but i think if i post a link admins will kick me. If any admin PM me i can send him the link and he can give me a go or not.

Cheers.

[dtip]

you can put link in text file , zip it and share it if you want i dont think it is against the rules, can you send me pm please. tnx

[steveleo]

you can put link in text file , zip it and share it if you want i dont think it is against the rules, can you send me pm please. tnx

Yeah who knows. I don't know. Don't want to get banned for this. Would be cool if a mod says something.

PM sent... report back please.

[Johnner]

Yeah...go ahead...stick into text file and post..

[steveleo]

Yeah...go ahead...stick into text file and post..

So if anyone has something against this then just sent me a PM and i'll remove it. Link in attachement....

[KERIMNBO]

i worked out to crack it thank to ben1980
only first 3 byte important the rest is so easy


about 300 example needed to run some rundom algo through first 3 byte to crack it .

[steveleo]

Nice. Everybody who is still looking how to crack it is now on my page and trying like crazy to find it... It's always nice that people post "wow i cracked it" and shit like that. I made it public now so everybody can use it. What just sucks are the guys that flood my system with tries to crack it. Btw, if you read "I don't know who you are..." then you are blocked.

And to this fu***** who tries with proxy... Why not just ask for info? What is your problem?


i worked out to crack it thank to ben1980
only first 3 byte important the rest is so easy

[steveleo]

Here as promised the sourcecode of the calc. Password via PM only to people who contributed here.


416326

[lion0304]

Here as promised the sourcecode of the calc. Password via PM only to people who contributed here.


416326

Thank you mate for your contributation. It is nice job and helpful.

[ben1980]

bravo steveleo

[steveleo]

First bunch of passwords is out. Enjoy.

[caliskan71]

123456789012 = 7BA321104D47
123456789013 = 7BA320104D47
123456789014 = 7BA327104D47
..............

I dond have calc but algo not big secret

[steveleo]

Sure, if you use my webpage to generate examples. It's overwhelming how many people tried to flush my page with examples to crack the code. Only one guy made over a 1000 requests with proxy ip changing. Crazy. I made now a IP-Block on my webpage. So you got some tries and then you're blocked. If you look at my webpage you'll see that there are more interesting FREE tools on it than this Nissan Glove box thing. But the important thing is these tools i made are FREE and i won't change this.


123456789012 = 7BA321104D47
123456789013 = 7BA320104D47
123456789014 = 7BA327104D47
..............

I dond have calc but algo not big secret

[Elroybeka]

Thank you for your contributation. send me password :)

[daniersms]

CDB26AA8D4CA = ABE7F96E55B7 Tested 100/100 correct :burnout:

[KERIMNBO]

First bunch of passwords is out. Enjoy.
steveleo (http://www.digital-kaos.co.uk/forums/member.php/478697-steveleo)
PASSWORD PLEASE

[steveleo]

You got it already buddy...


i worked out to crack it thank to ben1980
only first 3 byte important the rest is so easy

[kiszka]

..........

[steveleo]

Winrar 5.0


what program it is packaged because it knows how error

[albertros]

I got it:-

BEEF FACE BABE = CD89 8DA3 23F6 (THANKS STEVELEO)

play with calc and above example

[steveleo]

Yep, you solved the first part of the answer. Only missing second part.

Correctly it's CEBABE xor 33333 = CD898D


Well it looks like I am barking up the wrong tree but I got:-

BEEF FACE BABE = CD89 8DA3 23F6 (THANKS STEVELEO)

XOR EBABE WITH 33333 = D89 8D

try on your own example

[kiszka]

..........

[steveleo]

Dude, i don't understand what you want :-(


1. colleague was right he got helpful vote
2. how it run the

[Klimek]

Mathematik oder Atomphysik ?

[steveleo]

What you mean? (Mathe, Physik?)


Mathematik oder Atomphysik ?

[Klimek]

if you can do something yourself from beginning to end?

[Klimek]

write something in the company, I do not know what he was writing C ++

[paul_12345]

This maybe more user-friendly (Dont enter spaces etc as it will crash)

416771

[Klimek]

failure of the practice, too much theory

[Bllinda]

incorrectly calculates ... (http://www.digital-kaos.co.uk/forums/showthread.php/442833-help-need-nissan-micra-k12-pincode). ;)

This maybe more user-friendly (Dont enter spaces etc as it will crash)

[steveleo]

Here is the way for Windows Calc as i'm sick of all the idiots hacking my server...

BEEFFACEBABE -> CD898DA323F6


IMPORTANT NOTE!! All calcs were made with Windows Calc in "Programmers Mode" and then in HEX-Mode (F5) !!!!


So how to calc this:
First step is part it -> BEEFFA CEBABE
Now CEBABE xor 33333 = CD898D (first part of answer)


Now a litte bit more complicated "BEEFFA"
BEEFFA * 4 = 2FBBFE8
We need only 3 Bytes and if there is something more we cut it and add it
In this example the 6 bytes are FBBFE8. So we cut the "2" and add it.
It's not always that there is a overflow digit!! If there is none, then it's fine


So we cut and add:
-> 2 FBBFE8 -> FBBFE8 + 2 = FBBFEA


Now a final XOR


FBBFEA xor 589C1C = A323F6


Together -> CD898D A323F6 (finished)


@paul_12345 (http://www.digital-kaos.co.uk/forums/member.php/116186-paul_12345)

It's not the most brilliant idea to post unprotected DotNet apps, but you're welcome...

private void button1_Click(object sender, EventArgs e)
{
string s1 = this.textBox1.Text.Substring(0, 6);
string s2 = this.textBox1.Text.Substring(6, 6);
int num1 = int.Parse(s1, NumberStyles.HexNumber);
int num2 = int.Parse(s2, NumberStyles.HexNumber) ^ 209715;
int num3 = (num1 << 2 | num1 >> 22) & 16777215 ^ 5807132;
this.textBox2.Text = (string.Format("{0:X}", (object) num2) + string.Format("{0:X}", (object) num3)).Insert(2, " ").Insert(5, " ").Insert(8, " ").Insert(11, " ").Insert(14, " ");
}

@Klimek (http://www.digital-kaos.co.uk/forums/member.php/476076-Klimek)

I still don't understand what you want buddy. But i think everything is fine.

[paul_12345]

@paul_12345 (http://www.digital-kaos.co.uk/forums/member.php/116186-paul_12345)

It's not the most brilliant idea to post unprotected DotNet apps, but you're welcome...

private void button1_Click(object sender, EventArgs e)
{
string s1 = this.textBox1.Text.Substring(0, 6);
string s2 = this.textBox1.Text.Substring(6, 6);
int num1 = int.Parse(s1, NumberStyles.HexNumber);
int num2 = int.Parse(s2, NumberStyles.HexNumber) ^ 209715;
int num3 = (num1 << 2 | num1 >> 22) & 16777215 ^ 5807132;
this.textBox2.Text = (string.Format("{0:X}", (object) num2) + string.Format("{0:X}", (object) num3)).Insert(2, " ").Insert(5, " ").Insert(8, " ").Insert(11, " ").Insert(14, " ");
}



??? You uploaded sourcecode so why do I care about protecting this?

[Klimek]

who needs it?.......................

[Johnner]

.......................






Your edit comes too late mate.....I've seen what you posted...and not going to allow anyone who f*cks around with other peoples property,to further their own interests....Goodbye :banghead:

[paul_12345]

incorrectly calculates ... (http://www.digital-kaos.co.uk/forums/showthread.php/442833-help-need-nissan-micra-k12-pincode). ;)

please post the examples in which it calculates wrong.

[steveleo]

Your calc is good. I tested it. No worries.

And for your programm. I just wanted to mention it. DotNet is really nice, as even if you send a "compiled" programm it's still the sourcecode. Only a friendly reminder.


please post the examples in which it calculates wrong.

[ben1980]

much simpler than this see if you can spotted......................So we cut and add:-> 2 FBBFE8 -> FBBFE8 + 2 = FBBFEANow a final XORFBBFEA xor 589C1C = A323F6Together -> CD898D A323F6 (finished)

[steveleo]

much simpler than this see if you can spotted......................So we cut and add:-> 2 FBBFE8 -> FBBFE8 + 2 = FBBFEANow a final XORFBBFEA xor 589C1C = A323F6Together -> CD898D A323F6 (finished)

Or another way for the second part:
BEEFFA xor 162707 = A8C8FD
A8C8FD * 4 = 2A323F4 = 2 A323F4 -> A323F4 + 2 = A323F6

Maybe even the two parts play together some way, but i never checked that. I usually have seeds that you can't crack even with "chosen plaintext" and mostly not even if you know that calc and "only" the initvalues are missing. So for me this looks pretty easy.

[steveleo]

**** deleted ****

[paul_12345]

As a little Christmas gift i made a standalone programm. No internet connection required. Pass via PM as always. Leechers not welcome...

417748

bit pointless when I've already posted a program without password needed... or has this got more calcs??

[steveleo]

Ok... Be happy with it. I removed it :-)


bit pointless when I've already posted a program without password needed... or has this got more calcs??

[Bllinda]

I can find archivo password?

With (http://www.digital-kaos.co.uk/forums/showthread.php/565650-Merry-Christmas-and-Happy-New-Year-2017) the New Year

**** deleted ****

[paul_12345]

Ok... Be happy with it. I removed it :-)

Dont have to remove it because of me... just saying bit pointless especially adding password.

[steveleo]

I added password just because of all leecher guys. Gone anyway now so problem solved ;-)


Dont have to remove it because of me... just saying bit pointless especially adding password.

[rokibar]

steveleo (http://www.digital-kaos.co.uk/forums/member.php/478697-steveleo) you have to clear your inbox. best regards

[wheepy]

Many thanks for your great job !

BTW, I did noticed that for some cases (ex : D4CDDC568498 --> 55B7AB0BAB6F ) the code don't add the missing 0 on the second part.
It can easily be corrected by checking the length of the part, and if it's only 5 digit, you add a leading 0.

Cheers,
Michael

[steveleo]

Many thanks for your great job !

BTW, I did noticed that for some cases (ex : D4CDDC568498 --> 55B7AB0BAB6F ) the code don't add the missing 0 on the second part.
It can easily be corrected by checking the length of the part, and if it's only 5 digit, you add a leading 0.

Cheers,
Michael

If you do with windows calc it is the problem that it just removes any leading zeros. No problem if you make it for example in c.

// D4CDDC568498 --> 55B7AB0BAB6F
uint64_t sticker=0xD4CDDC568498;
uint32_t part1=(uint32_t)(0x33333^(sticker&0xFFFFFF));
uint32_t part2=(uint32_t)(sticker>>24);
part2<<=2;
part2+=part2>>24;
part2&=0xFFFFFF;
part2^=0x589C1C;
printf("%06X%06X\n",part1,part2 );

[wheepy]

If you do with windows calc it is the problem that it just removes any leading zeros. No problem if you make it for example in c.

// D4CDDC568498 --> 55B7AB0BAB6F
uint64_t sticker=0xD4CDDC568498;
uint32_t part1=(uint32_t)(0x33333^(sticker&0xFFFFFF));
uint32_t part2=(uint32_t)(sticker>>24);
part2<<=2;
part2+=part2>>24;
part2&=0xFFFFFF;
part2^=0x589C1C;
printf("%06X%06X\n",part1,part2 );

It’s not only with windows calc - I speak about the small software version, found somewhere above in this post :)
for my own use, in already made a small tool that make the calculation in VB.Net, based on this algorithm, that does the trick too! And also correct the missing 0 problem.

Thanks for your comment anyway :)


Envoyé de mon iPhone en utilisant Tapatalk

[danyguit2000]

This is very handy tool and thanks for sharing it.
I also noticed that leading "0" is missing from time to time which was a little annoying,
but managed to rebuilt it because you never know if "0" is missing in first or second part...




https://i.ibb.co/g7MzdRs/Untitled1.jpg (https://imgbb.com/) https://i.ibb.co/gwbWsXh/Untitled.jpg (https://imgbb.com/)

[steveleo]

This is very handy tool and thanks for sharing it.
I also noticed that leading "0" is missing from time to time which was a little annoying,
but managed to rebuilt it because you never know if "0" is missing in first or second part...


i just made a "online" version:

https://onlinegdb.com/SkO8hVxYS

Pretty handy those online c-compilers.

full source:

#include <stdio.h>


int
main ()
{
unsigned long long sticker = 0xD4CDDC568498;
unsigned int part1 = (unsigned int) (0x33333 ^ (sticker & 0xFFFFFF));
unsigned int part2 = (unsigned int) (sticker >> 24);
part2 <<= 2;
part2 += part2 >> 24;
part2 &= 0xFFFFFF;
part2 ^= 0x589C1C;
printf ("%06X%06X\n", part1, part2);
return 0;
}

[antonypaul]

Thanks for the calculator and explaining the process how its work

[Oktawian]

This is very handy tool and thanks for sharing it.
I also noticed that leading "0" is missing from time to time which was a little annoying,
but managed to rebuilt it because you never know if "0" is missing in first or second part...





https://i.ibb.co/g7MzdRs/Untitled1.jpg (https://imgbb.com/) https://i.ibb.co/gwbWsXh/Untitled.jpg (https://imgbb.com/)


Good Day

Is it possible to get the nissan glovbox calc ?

Best Regards

[caliskan71]

its free in OTOCHECK.COM (http://otocheck.com) with some other tools (without register)