VAG-COM/VCDS EVERYTHING

**badrax** · 3rd January, 2021, 06:50 PM

Originally Posted by DreamLand69

Nothing select interface. Only pc no car.
Attachment 773875

Attachment 773876

Will you see the id if you use the loader?

Sent from my iPhone using Tapatalk

**DreamLand69** · 3rd January, 2021, 07:26 PM

With Loader the same. I have not connected it to the car, nor 12v

**kaalis** · 3rd January, 2021, 07:30 PM

Originally Posted by miouser

how to understand this at all?
the same thing is written four times ?!

Also noticed that in his previous posts.

Sent from my SM-J510FN using Tapatalk

**jan4** · 3rd January, 2021, 07:32 PM

with loader the situation is the same ; NO

**badrax** · 3rd January, 2021, 08:20 PM

More updates

Serial number used by my clone is:
hv21b04-000059-233fed-b8bd54-vliahh-5a6c (Using VCDS 20.4.1)
hv21b04-000059-233fed-b8bd54-vchahh-5a22 (Using VCDS 20.12.0)

One part is changing and that is this "vchahh"
It looks like that this part is the VCDS version number and does not contain info about the cable itself.
Can anyone confirm this by testing with multiple versions of VCDS?

This part "000059-233fed" comes from some AES decrypted data and when I change it I usually end up with an invalid serial number.
Next byte "b8" looks like some checksum of the first part coz if I use a serial I find on inet then this number is automatically updated to the one from the serial.

Then this part "bd54" is a bit interesting coz it comes from the STM chips Unique Identifier (UID) usually located at the address 0x1FFF7A10.
The code running at address 0x0804000 read the UID from this address but the code at 0x08010000 read it from flash memory just after the bootloader.
I think the cloners modified firmware is running at 0x08010000 and that the code found at 0x08040000 is the firmware extracted by them and comes from a genuine cable.
Well of course I can be wrong but it just looks like it.
Also the bootloader verifies the code at 0x08040000 and then runs the code at 0x08010000 which makes no sense at all so also an indicator of what I just wrote could be the case. Since the firmware at 0x08040000 is unmodified it will have the correct checksum and to make thinks easy they change the bootloader to verify this part?

So why is this important.
The UID is used as an AES key to decrypt the license info located in flash so perhaps every update from RT is different and will be encrypted with the cables UID.
And here is also where the interface id comes into play.

If I use the default interface id from my clone (H11-022819) and run VCDS 20.12 it tells me that I need an update but when I go to the update page it tells me no update needed.
Now if I change the interface id the update starts but fails after some time coz I also think there is a relation between this id and the UID. RT might have a connection between interface id and UID and since the one I have don't match my cable tries to decrypt the data with the wrong key.
Makes any sense ?

I believe the fake UID used by the clone also comes from the genuine cable they dumped

Now the cable that support update uses the same serial as the one that does not support it (pleas some one verify this) so the UID in the AES data must be the same.
However they might have changed the UID after the BL and the cable interface id so this is why I would love to see what it is.

So when you users that have the upgradable cable runs the VIIPlusLoader. Does it show any info at all that can be shared?
Sharing to much info is better that non and can help with this project!

Well. Just some thought and perhaps this could relate to some one like YOU and that you can help fill in the blanks.

oh and last part of serial [5a22] is just a checksum of everything before this

regards

**ESPRIT** · 3rd January, 2021, 10:57 PM

Good job. The sellers do not have much information, but when my 415-20.4.1 stopped connecting to the car, the support's first question was: did the laptop not connect to the Internet by any chance during work? So they know that when trying to update, the cable is banned, but it is not known how.

**flyfvdi** · 4th January, 2021, 04:33 AM

Originally Posted by badrax

https://www.st.com/en/microcontrolle...2f405-415.html

“The STM32F415 also integrates a crypto/hash processor providing hardware acceleration for AES 128, 192, 256, Triple DES, and hash (MD5, SHA-1)”

However I was informed that on the back of the cable that support updates there is an extra small chip that does not exist on the genuine cable. Perhaps you are referring to this chip?

But my point is that if RT starts using the crypto hw that exist in the 415 the clone (using the 405) wont support this and will have to do this in sw or use the external chip. (I assume the clone is based on firmware extracted from a genuine cable)

Sent from my iPhone using Tapatalk

The vcds hex-v2 with stm405 chip company does not use the ross-tech original vcds hex-v2 fiirmware. they develop themselves firmware. so can update the firmware freely anytime by VII PLus Loader.
to use the ross-tech original vcds hex-v2 software freely anytime.

**Roma77** · 4th January, 2021, 09:28 AM

Originally Posted by flyfvdi

The vcds hex-v2 with stm405 chip company does not use the ross-tech original vcds hex-v2 fiirmware. they develop themselves firmware. so can update the firmware freely anytime by VII PLus Loader.
to use the ross-tech original vcds hex-v2 software freely anytime.

VII PLus Loader is this your development?

**flyfvdi** · 4th January, 2021, 09:42 AM

Originally Posted by Roma77

VII PLus Loader is this your development?

The company in china shenzhen develop and produce vcds hex-v2 with STM32F405VGT6

**Roma77** · 4th January, 2021, 09:44 AM

Originally Posted by flyfvdi

The company in china shenzhen develop and produce vcds hex-v2 with STM32F405VGT6

This is not an answer)

VII PLus Loader built on the same base as VCDS Loader V1.22.1 Release Setup (EN) for hex v1

**flyfvdi** · 4th January, 2021, 10:02 AM

[QUOTE=Roma77;4032986]This is not an answer)

VII Plus Loader is just support vcds hex-v2

Loader-1.png

VCDS Loader(V1.22) is just support vcds v1

vcds v1 loader en.jpg