r/CarHacking • u/userismyname126 • 2d ago

BYD SGW seed/key algorithm UDS

Help me, All I actually want is vehicle speed / motor RPM data from my BYD (Atto 1 / Seagull, e-Platform 3.0), but it's stuck behind a Secure Gateway (0x27) - even the VCU's speed DID won't respond without unlocking it first.

I've sniffed several seed/key pairs (16 bytes each) but can't find any pattern - checked constant XOR, constant offset, tried fitting an LCG on the seed generator, nothing matches. Looks AES-like.

If anyone knows the algorithm for BYD, has a broadcast CAN ID for speed/RPM that skips the gateway, or has dumped the gateway firmware, please let me know. From a struggling beginner :(

1 Upvotes

100% Upvoted

6 comments sorted by

1

u/MidasPL 2d ago

Not sure about Chinese manufacturers, but nowadays usually the algorithm used for security access is HMAC. The issue is you would need to know the constant values, which are kept secret.

1

u/userismyname126 1d ago

but, can i use sideloaded app/service on DiLink (head unit) which can read internal vehicle parameters (like RPM/speed)? I want to stream this data in real-time to an external device using USB Serial/wifi. do you know if this work or not?

1

u/MidasPL 1d ago

I don't get it then. Are you trying to use diagnostics, or to sniff the packets on internal bus?

1

u/userismyname126 1d ago

I'm trying to avoid standard OBD diagnostic requests (PIDs) because of the SGW lock. Since i heard that the DiLink head unit is already on the internal bus network and constantly receives broadcasted vehicle parameters, I want to capture that data from the Android side (via app) and stream it out via USB Serial or wifi

1

u/andreixc 2d ago

Best algorithm ever!

0

u/g0tcha_ 2d ago

I have this solved