dose anyone happen to know the security acsess algorithum for level 3/4 on a holden VE IPC.

Level 1/2 uses algo E8 which allows you to write the vin and variant config,

but for the life of me i cant find level 3/4 i have tried all the algos on GMLAN, other and Class 2 lookup tables.

the Moduel all so sends out a rolling seed when requesting level 3 access it is not static like level 1

be willing to pay for it if someone can find out

Algo E8 is on GMLAN lookup table 

What can be accessed in level 3/4?

1 minute ago, BLKATSG said:

What can be accessed in level 3/4?

Believe odometer correction can be done if you try a write data by identifier request on the odometer identifier with level 1/2 the ipc will respond with a negative response condition 22 pre requisite conditions are not met. 

On our 2011 Caprice PPV in SPS there is an Odometer correction file.  You might want to see if that has any hints.

4 minutes ago, BLKATSG said:

On our 2011 Caprice PPV in SPS there is an Odometer correction file.  You might want to see if that has any hints.

Where in sps is this? I thought you can’t download sps files unless connected to that specific vehicle do you have a copy of this file it might be able to be converted into a type 4 operation in DPS. Do you know if it works when the odometer is above 100km the tech2 will correct the odometer if it’s below 100km.

Thanks!

It is in sps programming under instrument cluster 2011 Chevrolet Caprice.  I was able to download it buy just connecting to a BCM oddly enough.  I think I do have the file and it is a type 4, but I couldn't get the arrangement correct.

 

I have it at home.  I'll upload it tonight.

 

This is the xml.

Quote

<?xml version="1.0"?>
<Report Vin="6G1MK5T29BL541728">
    <Rpo Vin="6G1MK5T29BL541728" ModelDesignator="1EK19">02D 1A6 4BB 6A3 6J1 6J3 6N6 6X1 7B3 7X1 8X2 9C1 9X2 A6G A98 AEH AH7 AKB AL5 AQ9 ATG AX2 AXJ BDR BIJ CJ2 D72 DD4 DNS DR9 EF7 ERR ESA EVG FCP FE9 FHS G80 GAN GW8 JFA JL9 KI2 KW7 L77 LHD MX0 MYC N10 N40 N46 NT7 QQ5 R5M RT3 T3W T4A TVU U71 UBW UDC UJ6 UQF V8D VK3 VVS WL9 XL7 XR5 XW6</Rpo>
    <Application Name="Type4Master" Version="1.22.97.10" Vcs="4.02.145" File="Type4Master.dll">
        <Title Id="358">Control Module - Configuration and Setup Function(s)</Title>
        <Module Id="0" Size="517056">10011000</Module>
        <Module Id="1" Size="143">10000001</Module>
        <Config Type="internal" Format="xml" Name="10000001">
            <!--xml version="1.0"-->
            <Config Version="1.1">
                <Action Id="1">
                    <Text Id="333">ECU Setup (Basis Configuration)</Text>
                </Action>
            </Config>
        </Config>
        <Log>
            <Action Id="1">
                <Text Id="333">ECU Setup (Basis Configuration)</Text>
                <Application Name="IPCList" Version="1.4.55.9" Vcs="4.02.60-3" File="IPCList.dll">
                    <Title Id="391">IPC - Instrument Panel Cluster - Select Configuration and Setup Function(s)</Title>
                    <Module Id="0" Size="447488">10002375</Module>
                    <Module Id="1" Size="602">10002376</Module>
                    <Config Type="internal" Format="xml" Name="10002376">
                        <!--xml version="1.0"-->
                        <Config Version="1.0">
                            <Action Id="3">
                                <Text Id="334">Check Ignition is on and press Next!</Text>
                            </Action>
                            <Action Id="1">
                                <Text Id="198">Please, wait...Establishing Vehicle Communication</Text>
                            </Action>
                            <Action Id="2000">
                                <Text Id="252">Verify the vehicle has the correct Odometer setting</Text>
                            </Action>
                            <Action Id="2">
                                <Text Id="339">Stopping Communication</Text>
                            </Action>
                            <Action Id="6">
                                <Text Id="286">Cycle the ignition switch from &quot;on&quot; to &quot;off&quot; then back to the &quot;on&quot; position</Text>
                            </Action>
                        </Config>
                    </Config>
                    <Log>
                        <Action Id="3">
                            <Text Id="334">Check Ignition is on and press Next!</Text>
                            <Time Start="2024-01-18 11:31:05.117" End="2024-01-18 11:31:08.121"/>
                            <Function Execution="succeeded"></Function>
                            <Conclusion Function="executed"/>
                        </Action>
                        <Action Id="1">
                            <Text Id="198">Please, wait...Establishing Vehicle Communication</Text>
                            <Time Start="2024-01-18 11:31:08.123" End="2024-01-18 11:31:10.292"/>
                            <Function Execution="failed" Result="68">Communication could not be established.</Function>
                            <Conclusion Function="failed"/>
                        </Action>
                    </Log>
                </Application>
                <Conclusion Function="executed"/>
            </Action>
        </Log>
    </Application>
</Report>

 

35 minutes ago, BLKATSG said:

It is in sps programming under instrument cluster 2011 Chevrolet Caprice.  I was able to download it buy just connecting to a BCM oddly enough.  I think I do have the file and it is a type 4, but I couldn't get the arrangement correct.

 

I have it at home.  I'll upload it tonight.

 

This is the xml.

 

WOW THANKS!!!! mabye the police were able to get access to this i dont think i have ever seen this befor in sps on my car.

Thanks again mate I’ll have a play with that file over the weekend and I’ll let you know if I find something hopefully it references the algorithum. If I find a way to get it working as a type 4 in dps I’ll send it to you 

I tried it on my VE directly from SPS and it said something about the cluster not having the correct code.

When you tried it in your car dose it ask you to enter a code or select an algorithm to use. I wish I could log your cars can bus as it’s executing this. 
 

In simple terms all you have to do is send a security access request service code $27 e.g ipc diagnostic address 0x24c response address to tester is 0x64c.

so 0x24c 02 27 01

02= PCI protocol control info look at 2 bytes of data this changes when writing long bits of data that cover more than one frame 

01 = level of security access request seed 

 

ipc will respond

0x64c 04 67 01 8E 99

04= look at 4 bytes 

67= positive response for sec acsess 

01= level 1 seed or if we set it to 03 it would request a rolling seed for level 3

8E 99= seed static but different from IPC to IPC. Rolling for level 3 

 

TESTER RESPOND 

0x24c 04 27 02 41 7F

04 look at 4 bytes 

27 security access 

02 = sending key set to 04 for returning a level 3 key 

41 7F key see photo below for calculation you need to write code if you want to calculate this quickly 

The ipc will respond 

0x64C 02 67 02 8E 99

02 look at 2 bytes 

67 positive response. 7F negative response 

02 level of security access.  Negative response condition could be incorrect key or exceed number of attempts, ect

 

we can now program vin numbers write op software and configure the cluster 

if we attempted to write a new odometer with write data by identifier service code $3B we get a negative response pre requisite condition not meet.

         

 

the reason why I’m giving all this out is because all this info is in a GM PDF document called GMW3110. I just wish I had someone explain it to me like this it is quite daunting reading this document and not having played around on the can bus to understand what they are talking about.

 

 

15 hours ago, Gazoline said:

When you tried it in your car dose it ask you to enter a code or select an algorithm to use. I wish I could log your cars can bus as it’s executing this. 

No, it does not.  I have a PCAN-USB.  I'll see if I can get it to log while trying this out.

I did a read, but I forgot the IPC is on the low speed bus, and I can only sniff the high speed with my PCAN-USB

Dam. you can’t set it to 33.33kbps?

 

I personally use a macchina m2 flashed with M2RET and I use the savvycan program to log data. 
The macchina is grate you can write custom code to it and make it send and receive ipc responses and it can decrypt the seed.

Hey mate I had a look online and guys are saying you can set the baud rate in the pcan view software 

https://www.carmodder.com/viewtopic.php?f=147&t=13849&start=90

Got 64C in my log now 😉

 

Yes you can set the baud rate, but it is only a two wire unit.  I thought I remembered I could but the low wire to chassis, and the high wire to GMLAN.  It Worked.  I'm looking in the log now.

😁😁 awesome!!!! 
did you get 24c as well.
64c is the response from the cluster 24c is the SPS program requesting data 

024C Rx 8  02 1A 39 00 00 00 00 00 

That is a read data by identifier $1A

identifier 39