PDA

View Full Version : CAS 3+


Deimis
3rd July, 2018, 03:29 PM
Is anyone can write isn in this eeprom?

Thank's
brobble
3rd July, 2018, 03:56 PM
As far as I know you will need to read out one working key. Only with this data (password) it is possible to decrypt and recrypt the long ISN. Keys 1,2,3 and 6 are used.

Here is ISK low and high of your used keys. With this you can read out the keypassword with any hitag reader. With this password somebody can decrypt and recrypt ISN.

Key1: DFE5 37F78C4E
Key2: 5D7A 809336A1
Key3: 1485 93BC284D
Key6: 76AB F0A85747

Greets MR...
kiszka
3rd July, 2018, 04:52 PM
..........
brobble
3rd July, 2018, 05:35 PM
I´m a little bit confused now.

@kiszka: You posted the key passwords for key1 and key2. I (just for fun and education) made a key with ISK Low and High and your posted password for key 2. Then I took my vvdi2 and decrypted ISN. ISN was 5B666A8C7FDB53B909D81EF1801E009D. But this ISN I can find in his dump in plain, not crypted. I thought until now the 16Byte ISN is crypted. How can you know his key password without to know his ISN? Or is ISN in his dump not crypted?
I made (for testing) new file with new ISN. But this only can work, if ISN is not crypted in dump. Otherwise I need real key password. I made this all by hand with hexeditor. I´m really not sure. For me this is more for fun and education.

Greets MR...
Deimis
3rd July, 2018, 06:04 PM
I just want to check errors with new msv80 in a car, because I have bsd error in ista with old ecu. Is it possible write this isn in this eeprom and start a car? I have spare msv80 and cas from same car without key, right now I dont have spare usa key for testing.

Thanks
PixelsFixed
3rd July, 2018, 06:13 PM
I have matching MSV80, cas module, two brand new keys, and E90/91/92 door lock if they're of any use to you?
brobble
3rd July, 2018, 06:13 PM
You can read ISN from CAS dump with working key. And this ISN you should be able to write to ecu with VVDI2.

Greets MR...
Deimis
3rd July, 2018, 06:20 PM
I have read ecu isn with vvdi 2 from obd with my oem cas and working key. But I do not see option in vvdi2 write isn from ecu to cas.
Deimis
3rd July, 2018, 06:21 PM
Pixelsfixed With what tool?
brobble
3rd July, 2018, 07:15 PM
Your File eeprom.bin is readed from your CAS3 of car, right? The open VVDI BMW Tool, go to ECU/CAS ISN, choose CAS+ and load your eeprom.bin. VVDI2 will tell you to put working key from this CAS to programmer. It will read out the password and decrypt ISN. Now you can change it and save dump. Rewrite to CAS and you are done. Or you try to write decrypted ISN from your CAS to MSV80.

Greets MR...