Reverse engineering.Automotive tools.IT security.

Founded in 2005, Adam Engineering is South Africa's oldest firmware reverse engineering company and, to our knowledge, the only one that specialises in automotive. We pair that with long-standing experience in penetration testing, red teaming and ethical hacking.

● diagnostic sessionCAN 500 kbit/s
  • 2005Founded
  • 19Brands worked for
  • 11Solutions delivered
  • 396Algorithms extracted

What we do

Six areas of work. Pick one to see how it works, step by step.

Automotive control unit analysis and disassembly

Every modern vehicle is run by control units, and what they hold is locked away. We work out how to reach it.

We analyse a specific control unit for the information required to access its flash or other memory through the diagnostic port, where that is possible. With the level of access found, we work to reach the basic commands, download data and upload data, that read and write bytes in flash and EEPROM.

What we examine

The control unit itself: its memory, its diagnostic port and the level of access it allows.

What you end up with

A working route into the unit's flash and EEPROM, so its data can be read and written.

Where it is used

Diagnostics, tuning and tool development, where a control unit has to be read or reprogrammed.

How it works

Request a quote

How seed-key security works

Engine control unit with wiring harness

ECU

Functions locked

Adam Engineering handheld diagnostic tool

Tool

Requests access

  1. 01

    The ECU provides a seed

    A short string of byte values, sent to the tool.

    What is a byte? One pair of characters, such as A3. It is the smallest piece of data the ECU sends.

  2. 02

    The tool computes a key

    It transforms the seed using a secret algorithm.

  3. 03

    The ECU compares

    It applies the same algorithm internally and checks the tool's key against its own.

  4. 04

    Access is authorised

    If the two agree, the tool is assumed to know the algorithm.

Byte values shown are an illustration.

Seed-key algorithms

Algorithms we list by vehicle or control unit. Search by make, module or chip.

  • Land Rover / JaguarRange Rover / Land Rover, 24C16, OBDMileage correction. No EEPROM read/write.
  • Land Rover / JaguarJaguar XJ, 24C16, OBDMileage correction. No EEPROM read/write.
  • Land Rover / JaguarRange Rover Evoque, 93C76Diagnostic solution. Also Jaguar F-Type and Range Rover Sport 2016.
  • FordFord Fiesta 2013, diagnosticsEEPROM read/write via bootloader.
  • FordFord 95320, diagnostics (Focus, Transit)Mileage correction. No EEPROM read/write.
  • FordFord Fiesta from 2010, diagnosticsEEPROM read/write via bootloader.
  • FordFord Ka 2009 to 2014, diagnostics
  • FordFord Delphi BSI 70F3379 + 93C86, CANEEPROM read/write, PIN display, key preparation data. 70F3379 flash read only.
  • OpelOpel Insignia and similar BCUs (24C16, 95160)Mileage correction. No EEPROM read/write.
  • OpelOpel Meriva BCUMileage correction. No EEPROM read/write.
  • Mercedes-BenzMercedes-Benz with 95640 (W176, W246, W117 CLA, W166 ML, X166 GL, R172 SLK, R231 SL)Diagnostic solution.
  • Mercedes-BenzMercedes W205Mileage change via OBD2 algorithm. A blocker is needed.
  • Mercedes-BenzMercedes W204Mileage correction via SKC algorithm. No blocker needed.
  • Mercedes-BenzMercedes W222Mileage correction via SKC algorithm. A blocker is needed.
  • PorschePorsche CayenneDiagnostic solution.
  • VW / AudiSiemens SIMOS7EEPROM read/write via OBD2.
  • VW / AudiMED17 / EDC17 ECUEEPROM decryption from dump (EEPROM block IDs 0800, 0900, 0A00).
  • VW / AudiMED17 / EDC17 CRCECU EEPROM decryption from dump, for example EDC17C74.
  • VW / AudiTP22 / 23 / 24 / 25Creation from Megamos.
  • VW / AudiPassat 2007+ comfort moduleEEPROM decryption.
  • VW / AudiSIMO18SKC.
  • VW / AudiAudi BCM2 with 95320 and NEC70F3239, 70F3380, 70F3381 or 70F3634 (no EEPROM)Decryption and encryption.
  • TrucksScania EMS6
  • TrucksCummins CM2150EDiagnostic seed/key and encryption for the J1939 protocol.
  • Magneti MarelliMagneti Marelli 6F3 ECU, CAN and K-lineEEPROM and MCU read/write. Flash read/write.
  • Magneti MarelliMagneti Marelli 8DF ECU, K-lineEEPROM and MCU5553 read/write.
  • Magneti MarelliMagneti Marelli 8F2 / 8F3 ECU, CAN and K-lineEEPROM and MCU5565 read/write.
  • PSAPSA Valeo 4L00M + 95128/25128, CAN (BSI2004-P0X-00)EEPROM read/write, PIN display, 9S12DP512 flash read/write.
  • PSAPSA Valeo 2M48H + 24C128, CAN (BSIEV-X0X-00)EEPROM read/write, PIN display, 9S12XEP768 flash read/write.
  • PSAPSA Valeo SC667152 + 95256, CAN (BSI-N0X-00)EEPROM read/write, PIN display, SC667152 flash read/write.
  • PSAPSA Johnson Controls easyCAN4 + 29LV400 + 95128, CAN (BSI2004-H0X)EEPROM read/write, PIN display, 29LV400BB flash read/write.
  • PSAPSA Johnson Controls easyCAN4F1M-32 + 95128, CAN (BSI04EV-K0X)EEPROM read/write, PIN display, flash read/write.
  • PSAPSA Siemens D76F0018 + 95160, K-line (BSI-E0X-00 / BSI-F0X-00)EEPROM read/write, PIN display.
  • PSAPSA Siemens 1L00M + 95128/95256, CAN (BSI-S0X-00)EEPROM read/write, PIN display, 9S12DP512 flash read/write.
  • PSAPSA Continental SC667050 + 95256, CAN (BSI-Q0X-00)EEPROM read/write, PIN display, SC667050 flash read/write.
  • PSAPSA Johnson Controls SPC560B60 + 95128, CAN (BSI04EV2-KEX)EEPROM read/write, PIN display, SPC560B60 flash read/write.
  • FiatFiat Delphi BSI 70F3237 + 93C86, CANEEPROM read/write, PIN display, key preparation data. 70F3237 flash read only.
  • FiatFiat Delphi BSI 70F3379 + 93C86, CANEEPROM read/write, PIN display, key preparation data. 70F3379 flash read only.
  • FiatFiat Delphi BSI 70F3633, CANData flash read, PIN display, key preparation data.
  • OtherToyota USAG and H key immobiliser reset.
  • OtherChery A5 BCM

Automotive tools

Tools designed and developed in-house.

  • Diagnostic tools
  • Tuning tools
  • PIN code reading tools
  • Key adaptation tools

What reverse engineering is

Reverse engineering is the process of discovering the technological principles of a device, object or system through analysis of its structure, function and operation.

It often involves taking something apart, whether a mechanical device, an electronic component or a software program, and analysing its workings in detail. The result is used in maintenance, or to make a new device or program that does the same thing without copying anything from the original.

The purpose is to deduce design decisions from end products with little or no additional knowledge of how they were originally produced. The same techniques are now applied to legacy software systems, to replace incorrect, incomplete or otherwise unavailable documentation.

From the blog

Notes from the bench.

Reverse engineering the VW online key programming function

ECU data and flashing with Google Glass

UAV development

Ford Ranger 3.2 TDCi

Request a quote

Tell us about the control unit, tool or system you need help with. You are only a moment away from quality service and advice.

info@adamengineering.co.za