Omega Owners Forum

Please login or register.

Login with username, password and session length
Advanced search  

News:

Please play nicely.  No one wants to listen/read a keyboard warriors rants....

Pages: 1 2 3 [4] 5 6 7 8 9   Go Down

Author Topic: NCDx security coding  (Read 9964 times)

0 Members and 1 Guest are viewing this topic.

Andy B

  • Get A Life!!
  • *****
  • Offline Offline
  • Gender: Male
  • Bury Lancs
  • Posts: 39483
    • ML350 TDM SmartRoadster
    • View Profile
Re: NCDx security coding
« Reply #45 on: 10 October 2008, 09:49:53 »

Quote
......

Did that help?

 :-?

 :y :y Yes!  :y :y
Logged

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #46 on: 10 October 2008, 09:52:45 »

Quote
That is certainly the case on the Omega....and appears to be the case on Astra H to!

AFAIK that is only true when the basic CD30 is fitted - The DVD90 certainly communicates with the vehicle ECU also, but unsure of CD70 as yet.
That applies to most post 05 models on the Vx range using this protocol.
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

Marks DTM Calib

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • West Bridgford
  • Posts: 33839
  • Git!
    • View Profile
Re: NCDx security coding
« Reply #47 on: 10 October 2008, 09:54:46 »

Quote
Quote
AFAIK it doesn't, it's purely down to head unit and screen (and telematics if fitted) hence why you can fit a paired HU and screen from another car without issue even without Tech II, as long as you have a married pair.

The CAN bus is purely between the HU and it's components, the rest of the car isn't CAN

So the coding is purely between head and screen? Car immaterial? SO if I am correct, as long as the screen / head / telematics communicate correctly, they could effectively be placed within any vehicle without the need for any further vehicle communication?

 :-/

I think I may have been looking into this in too great a depth then, as one of my other forum projects is the DVD90 from the 07 Vectra, and Oh Boy, does that communicate with the car!
 :(

This is where not being an Omega owner puts me at a disadvantage - I assumed the can was CAN ?  If not, why on earth is Tech2 needed then, or is this just an overcomplication from Vx?

 :-/

The Omega only has a minimal CAN implimentation and it only covers the Radio-display link (only some units i.e. CCRT, NCDC, some CDC2's etc) and some gearbox-engine ECU links on later cars.

Its far from a fully blown CAN setup as per the Vectra C, Astra H and Corsa D (Corsa C also had a half way house on later models).

I suspect the NCDC in the Omega was CAN based as it allows re-use between other modesl which were fully CAN (i.e. Vectra C).

Also, yes, you can take a paired screen and NCDC and fit it in any car....this is something I have done a few times and is what is currently allowing TB's setup to work :y

What this also sudgests is that the NCDC is probably (an inference on my part) also doing the same in a Vectra C setup given it has the same internal firmware.

« Last Edit: 10 October 2008, 09:57:03 by Mark »
Logged

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #48 on: 10 October 2008, 10:09:31 »

Quote
The Omega only has a minimal CAN implimentation and it only covers the Radio-display link (only some units i.e. CCRT, NCDC, some CDC2's etc) and some gearbox-engine ECU links on later cars.

Its far from a fully blown CAN setup as per the Vectra C, Astra H and Corsa D (Corsa C also had a half way house on later models).

I suspect the NCDC in the Omega was CAN based as it allows re-use between other modesl which were fully CAN (i.e. Vectra C).

Also, yes, you can take a paired screen and NCDC and fit it in any car....this is something I have done a few times and is what is currently allowing TB's setup to work

What this also sudgests is that the NCDC is probably (an inference on my part) also doing the same in a Vectra C setup given it has the same internal firmware.

That would explain my problems!!  The unit I have here is from a Vectra C and I have far more internal data than the Omega seems to be able to provide.

I have been going round in circles trying to find where the missing data is coming from without the realisation that I can now disregard a HUGE chunk of the memory dump.

 :)
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #49 on: 10 October 2008, 10:43:01 »

Has anyone tried to Tech2 a head unit not fitted to a car?

For those playing, can somebody send me any depaired dumps from any equipment (screens or head) that has originated from an Omega - As I can then compare with the Vectra dumps I have here and rule out some information.
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

TheBoy

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • Brackley, Northants
  • Posts: 105937
  • I Like Lockdown
    • Whatever Starts
    • View Profile
Re: NCDx security coding
« Reply #50 on: 10 October 2008, 13:09:22 »

Quote
Has anyone tried to Tech2 a head unit not fitted to a car?

For those playing, can somebody send me any depaired dumps from any equipment (screens or head) that has originated from an Omega - As I can then compare with the Vectra dumps I have here and rule out some information.
As Marks DTM said, on Omega, CAN is not really implemented across the car.  As long as Pair screen and stereo stay together, they will work anywhere.

Vectra may be more complex, particularly at the display end, as the display is a bridge between low and medium speed buses (Vectra-C has 3 buses).

My NCDR1500/GID/Telematics/CDC3 came from a Astra-G.  I do not have the code it was originally paired with, hence cannot depair it all.  It works perfectly in the Omega, bar a couple of issues unrelated to this discussion.


The 2013 and CID I am playing with are connected up to a battery by a few wires, and car on my living room carpet, much to Mrs TheBoy's annoyance ;D, and they pair/depair perfectly, proving that a car and the rest of its interfaces are not required :)
Logged
Grumpy old man

TheBoy

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • Brackley, Northants
  • Posts: 105937
  • I Like Lockdown
    • Whatever Starts
    • View Profile
Re: NCDx security coding
« Reply #51 on: 10 October 2008, 13:15:54 »

Quote
Quote
Well, I plugged the CDC board into my currently depaired 2013, and live data on security state on CDC was ID N.OK Yet (basically CDC Safe).  I told the 2013 it now had a CDC, and live data on CDC, security state was ID OK (ie, working). 2013 still depaired from anything.

Do I understand correctly then that you have managed to fix the fault on the 2013/CDC3 of CDC-SAFE by reprogramming using the live data? As that may help with another way in !!
The CDC board was in another 2013 belonging to another member, but showing CDC-SAFE.

When I fitted to my little rig, the live data showed it wasn't working (can't tell from screen due to a fault with screen panel itself).

So I reset the cdc board, via tech2, to be for NCDC series (a small reprog function), and told NCDC that it now had CDC, and as far as I can tell, its happy.

So assuming that CDC is not coded, it appears I have fixed a CDC-SAFE error via Tech2 by reseting its config on what type of HU it is connected to.

Obviously, this is just one, and by no means a scientific survey.

If anyone near Marks DTM or I has any unit in CDC-SAFE, we would love to attempt this method again.
Logged
Grumpy old man

Marks DTM Calib

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • West Bridgford
  • Posts: 33839
  • Git!
    • View Profile
Re: NCDx security coding
« Reply #52 on: 10 October 2008, 13:37:57 »

Quote
The CDC board was in another 2013 belonging to another member, but showing CDC-SAFE.

When I fitted to my little rig, the live data showed it wasn't working (can't tell from screen due to a fault with screen panel itself).

So I reset the cdc board, via tech2, to be for NCDC series (a small reprog function), and told NCDC that it now had CDC, and as far as I can tell, its happy.

So assuming that CDC is not coded, it appears I have fixed a CDC-SAFE error via Tech2 by reseting its config on what type of HU it is connected to.

Obviously, this is just one, and by no means a scientific survey.

If anyone near Marks DTM or I has any unit in CDC-SAFE, we would love to attempt this method again.

So it did work then!
Logged

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #53 on: 10 October 2008, 13:41:40 »

Quote
Quote
Quote
Well, I plugged the CDC board into my currently depaired 2013, and live data on security state on CDC was ID N.OK Yet (basically CDC Safe).  I told the 2013 it now had a CDC, and live data on CDC, security state was ID OK (ie, working). 2013 still depaired from anything.

Do I understand correctly then that you have managed to fix the fault on the 2013/CDC3 of CDC-SAFE by reprogramming using the live data? As that may help with another way in !!
The CDC board was in another 2013 belonging to another member, but showing CDC-SAFE.

When I fitted to my little rig, the live data showed it wasn't working (can't tell from screen due to a fault with screen panel itself).

So I reset the cdc board, via tech2, to be for NCDC series (a small reprog function), and told NCDC that it now had CDC, and as far as I can tell, its happy.

So assuming that CDC is not coded, it appears I have fixed a CDC-SAFE error via Tech2 by reseting its config on what type of HU it is connected to.

Obviously, this is just one, and by no means a scientific survey.

If anyone near Marks DTM or I has any unit in CDC-SAFE, we would love to attempt this method again.

Thats quite interesting, as although I know for certain that CDC3 is unrelated to both the code and the majority of this excercise, it indicates the Tech2 is capable of overwriting data in more than one location on the CDC3 simultaneously. I suspect that the data is actually changed via the head unit connected to, and actually via the Tech2 directly to the CDC3.

Now that you have a CDC3 that was CDC-SAFE and now reactivated via Tech2 is there any way you can take a memory dump from the 8 pin 24LC64 on the vertical board, as wold be interesting to see if data simply re-written with original from the head unit, or modified via the tech2

This could give a further indication to the data out signals for the handshake.
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #54 on: 10 October 2008, 13:44:49 »

Quote
If anyone near Marks DTM or I has any unit in CDC-SAFE, we would love to attempt this method again.

Thats quite easy to re-create that experiment, I can send you a simple memory dump for the CDC3 eeprom alone, that would flag the processor to give a CDC-SAFE error
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #55 on: 10 October 2008, 14:09:05 »

Quote
I suspect that the data is actually changed via the head unit connected to, and actually via the Tech2 directly to the CDC3.

Sorry, should say

I suspect that the data is actually changed via the head unit connected to, and not actually via the Tech2 directly to the CDC3.

 :-[
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

TheBoy

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • Brackley, Northants
  • Posts: 105937
  • I Like Lockdown
    • Whatever Starts
    • View Profile
Re: NCDx security coding
« Reply #56 on: 10 October 2008, 21:58:51 »

Tonights update...

Back to CDC, this is coded to the device ring.

However, if you DONT know the code, tell the display and radio its doesn't exist, pair the radio and display, then add cdc back in to ring.  Looks like that works.

To depair, remove cdc from radio and display ring, then depair.

Forgetting to remove CDC from stereo or display config, and attempting pair/depair, will reduce its life by 1.  I guess when all lives have been used, game over (but guessing its something that people such as Dave DND can reset).
Logged
Grumpy old man

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #57 on: 11 October 2008, 08:32:29 »

Quote
Tonights update...

Back to CDC, this is coded to the device ring.

However, if you DONT know the code, tell the display and radio its doesn't exist, pair the radio and display, then add cdc back in to ring.  Looks like that works.

To depair, remove cdc from radio and display ring, then depair.

Forgetting to remove CDC from stereo or display config, and attempting pair/depair, will reduce its life by 1.  I guess when all lives have been used, game over (but guessing its something that people such as Dave DND can reset).

The CDC3 does not require a code when used with the NCDC head, (internal or external) even though there is data in the memory locations, so depairing and repairing with the correct and WORKING unit does seem to work using this method. However, I would not recommend trying this with the externally CODED CDC3 units connected to head units that require the need for the CDC3 code to be used (CCR600 etc), as you may open up a can of worms!!

But I have noticed by using this method that you are actually using the Tech2 to reset the CDC3, instead of its own internal programs and head unit communications and this then appears to be running a different data set to its initial program.  

You have spotted the counter that has already decreased by 1, (and you may find that it keeps reducing on its own!! monitor the memory dump!! ) but this appears to now be coming from the head unit, not the changer, as it cannot appear to be reset - if the CDC3 dump is reset manually, it now defaults back to its decreased state, so the head unit has now been altered also. The only way I have found to reset that counter is to reload the previous head unit dump again manually. I have taken mine to -3 but hesitant to go much further as I`m not sure what else is altering and if it can be fully recovered.

but if you look at the rest of the memory data as a whole, including now the head unit dump, you have also effectively reset and updated PART of the system, (that appears to be dependant on the firmware of the Tech2) and you will see that the changer is now running with completely different data to the head unit.

Although a usefull experiment, it may be exceptionally difficult to recover and reset the data from the head unit if they were allowed to remain connected for any length of time, and a complete rebuild may follow. Until all data is understood, this is certainly not something we know how to do yet at this stage.

The problem with playing around with the CDC3 data, is that is was actually bugged in the first place, which is why the CDC-SAFE error is so prevalent, and to fix this requires a firmware upgrade and a few alterations to the memory dump, (but all on the vertical board).

I would be interested to see your CDC3 memory dump though, and I can point out where the code location is for you, so that you can at least play around with a known bit of data if that helps.
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk

TheBoy

  • Administrator
  • *****
  • Offline Offline
  • Gender: Male
  • Brackley, Northants
  • Posts: 105937
  • I Like Lockdown
    • Whatever Starts
    • View Profile
Re: NCDx security coding
« Reply #58 on: 11 October 2008, 09:56:44 »

Dave DND - I wonder if I could get a dump off CDC to you, you could let me know the code, so I could try the original experiement of trying to learn a depaired code via cdc/cdc3 - assuming the code its paired with is the one thats stored in the cdc/cdc3

Downside of that plan, when I played with certain other units with small SM eproms, I had a 50% success rate if removing them without breaking pins or cooking chips - and in this case whats stored on chips is more important than the chip itself...
Logged
Grumpy old man

Dave DND

  • Omega Baron
  • *****
  • Offline Offline
  • Gender: Male
  • DND Services Ltd
  • Posts: 4216
    • Paignton, Devon
    • View Profile
    • DND Services Ltd
Re: NCDx security coding
« Reply #59 on: 11 October 2008, 09:59:00 »

If struggling to remove the chips, do you want to send the vertical pcb to me, I can take readings and send back with a full memory dump printout as well ?

 ;)
Logged
Radio & Decoding Technician
In Car Audio Service Department
www.dndservices.co.uk
Pages: 1 2 3 [4] 5 6 7 8 9   Go Up
 

Page created in 0.032 seconds with 18 queries.