Successful variant-coding on Diogenes

[jglim]

Hi folks,

I may have successfully variant-coded a CRD3 on the bench. The changes are persistent even after physically reconnecting the power supply. From my perspective, it seems to be OK, though I do not know how to check if it is really 100% working.

This is the fragment as seen in Vediamo before I started (Start-stop strategy: Default ON):

This is the write process using Diogenes (Version 1.4)
There's an unusual negative response when writing, but the changes seem to be applied fine. This needs investigating.

This is the fragment in Vediamo again, to check if the change was successful (it is now Default OFF):

Fingerprinting

Previously, I set a compile-time flag to protect operators from accidentally bricking their ECU, since there were 4 bytes that were unknown.

The 4 unknown bytes at the end of some variant strings appear to be a fingerprint. When looking at @N0cynym's trace #1 (reply in thread), I noticed that VGSNAG2 was unusual as it did not specify for a fingerprint parameter. However, when looking in the implicit VC fragment itself, the last 4 bytes are marked as "fingerprint".

Another observation is @Feezex's log at #1 (comment) , where the first ever RVC command had a fingerprint of 00 03 87 98, which changed to 00 00 00 01. My bench CRD3 also shows similar behavior, where the fingerprint field changed to 00 00 00 01 after variant coding.

To confirm if this is valid (i.e. fingerprint can be any value), can any kind folk please check if they have "successful" vehicles running with a fingerprint of 00 00 00 01 with no problems? If unsure, upload a trace at #5 and I will check.

[N0cynym]

Here you can view the trace:
vgs2nag2_coding_to_default_succes.xlsx

[jglim]

Wow! This is incredible and there is so much to digest. Fantastic job N0cynym!!
I just looked through your logs, the write looks successful; sorry to trouble you with manual session change, and manual variant selection.

Below: this is what I understand from looking at your trace. I don't know how VGSNAG2 works, hence I am surprised that there is no security access required for variant-coding (e.g. 27 05)

// WVC: attempt to write new VC (78 64..)
WVC
10 30  3B B1 78 64 40 40 
30 00 00 FF FF FF FF FF 
21 02 00 00 00 00 00 00 
22 00 00 00 00 03 00 00 
23 01 00 03 02 00 00 00 
24 00 C0 00 1A 00 5A 0A 
25 E8 03 E8 03 0C 08 C2 
26 01 8F 54 87 51 21 66 

// single WVC NR
03 7F 3B 80 FF FF FF FF 

// RVC: old VC (78 68..)
RVC
02 21 B1 00 00 00 00 00 

10 30  61 B1 78 68 68 77 
30 00 0A 00 00 00 00 00 
21 09 00 00 04 00 03 02 
22 03 03 02 00 04 01 00 
23 01 00 04 02 02 02 00 
24 80 E0 00 21 01 5A 0A 
25 E8 03 E8 03 C6 07 81 
26 01 D4 7F 87 51 21 66 

FN_ECU_Reset (NR)
02 11 01 00 00 00 00 00 
03 7F 11 80 FF FF FF FF 

FN_ECU_Reset (NR)
02 11 01 00 00 00 00 00 
03 7F 11 80 FF FF FF FF 

SES_Extended_Diagnostic_Session
02 10 92 00 00 00 00 00 
02 50 92 FF FF FF FF FF 

FN_ECU_Reset (OK)
02 11 01 00 00 00 00 00 
01 51 FF FF FF FF FF FF 

SES_Extended_Diagnostic_Session
02 10 92 00 00 00 00 00 
02 50 92 FF FF FF FF FF 

// RVC: old VC (78 68..)
RVC
02  21 B1 00 00 00 00 00 

10 30  61 B1 78 68 68 77 
30 00 0A 00 00 00 00 00 
21 09 00 00 04 00 03 02 
22 03 03 02 00 04 01 00 
23 01 00 04 02 02 02 00 
24 80 E0 00 21 01 5A 0A 
25 E8 03 E8 03 C6 07 81 
26 01 D4 7F 87 51 21 66 

// WVC: new VC (78 64..)
WVC
10 30  3B B1 78 64 40 40 
30 00 00 FF FF FF FF FF 
21 02 00 00 00 00 00 00 
22 00 00 00 00 03 00 00 
23 01 00 03 02 00 00 00 
24 00 C0 00 1A 00 5A 0A 
25 E8 03 E8 03 0C 08 C2 
26 01 8F 54 87 51 21 66 

// one WVC NR, one WVC OK !!!
03 7F 3B 78 FF FF FF FF 
02 7B B1 FF FF FF FF FF 

FN_ECU_Reset
02 11 01 00 00 00 00 00 
01 51 FF FF FF FF FF FF 

// RVC: new VC (78 64..)
02  21 B1 00 00 00 00 00 
10 30 61 B1 78 64 40 40 
30 00 0A 00 00 00 00 00 
21 02 00 00 00 00 00 00 
22 00 00 00 00 03 00 00 
23 01 00 03 02 00 00 00 
24 00 C0 00 1A 00 5A 0A 
25 E8 03 E8 03 0C 08 C2 
26 01 8F 54 87 51 21 66 

// RVC: new VC (78 64..)
02  21 B1 00 00 00 00 00 
10 30 61 B1 78 64 40 40 
30 00 0A 00 00 00 00 00 
21 02 00 00 00 00 00 00 
22 00 00 00 00 03 00 00 
23 01 00 03 02 00 00 00 
24 00 C0 00 1A 00 5A 0A 
25 E8 03 E8 03 0C 08 C2 
26 01 8F 54 87 51 21 66 

[N0cynym]

No problem, I will test more different ecus for you.

About vgs2nag2 (variant of vgsnag2) it one of the early devices with low diagnostic version 0101 and without any security sessions.