BootStrap Loader - Security access

[MpowerE36]

Hi,

I try to do a bootstrap loader on my Bosch MEVD17.2.G (TC1797 mcu) in bench mode without opening the ecu as my PCMflash tool does but I am stuck at the security access before transfering the bootloader. I think it is a sort of seed key : ecu sends 10 kind of random bytes and the host must answer with 20 bytes. I was sure the algorithm was in the BootRom (0x8FFFC000-0x8FFFFFFF) but after successfully dumped and disassembled it I haven’t found the algorithm in the code (only 16kb). Maybe someone know where is located this algorithm in the code ?

[NamGrandPaa]

Newbie here

[NamGrandPaa]

How many posts do I need to PM?

[MpowerE36]

I've finally succeeded to find where is located this algorithm. It is on hwel1 and hwel2 (OTP area). I translated it in Python (approximately 3000 lines of code). I now understand why some programming tools don't succeed to pass the security test on last version of this ecu. It is because bmw had modified their algorithm on the last version of hwel1 and hwel2.

[MpowerE36]

It works like this :
1) ecu uses the seed it sends to the host to calculate an internal 20 bytes key thanks to a first algorithm
2) ecu receives the 128 bytes host key and calculates another internal 20 bytes key thanks to a second algorithm
3) if both internal 20 bytes keys are identical, then the security test has been passed