initial commit

Author: bri3d

README.md

@@ -0,0 +1,12 @@
+# SA2 Seed Key
+
+SA2 Seed/Key authentication is a mechanism for authorizing test / tool clients with Volkswagen Auto Group control units, usually used to unlock a Programming session to re-flash the control units.
+
+The SA2 Seed/Key "script" is contained in the FRF or ODX flash container, and consists of a small bytecode machine in which simple opcodes are applied to the "seed" provided by the ECU to generate the "Key".
+
+# Usage:
+
+```
+vs = Sa2SeedKey([0x68, 0x02, 0x81, 0x49, 0x93, 0xa5, 0x5a, 0x55, 0xaa, 0x4a, 0x05, 0x87, 0x81, 0x05, 0x95, 0x26, 0x68, 0x05, 0x82, 0x49, 0x84, 0x5a, 0xa5, 0xaa, 0x55, 0x87, 0x03, 0xf7, 0x80, 0x6a, 0x4c], 0x1a1b1c1d)
+result = vs.execute() # 0x6a37f02e
+```

sa2_seed_key/__init__.py

@@ -0,0 +1,106 @@
+from collections import deque
+
+class Sa2SeedKey:
+  register: int
+  carry_flag: int = 0
+  instruction_tape: bytearray
+  instruction_pointer: int = 0
+  for_pointers: deque = deque()
+  for_iterations: deque = deque()
+
+  def __init__(self, instruction_tape, seed):
+    self.instruction_tape = instruction_tape
+    self.register = seed
+
+  def rsl(self):
+    self.carry_flag = self.register & 0x80000000
+    self.register = self.register << 1
+    if(self.carry_flag):
+      self.register = self.register | 0x1
+    self.register = self.register & 0xFFFFFFFF
+    self.instruction_pointer += 1
+
+  def rsr(self):
+    self.carry_flag = self.register & 0x1
+    self.register = self.register >> 1
+    if(self.carry_flag):
+      self.register = self.register | 0x80000000
+    self.instruction_pointer += 1
+
+  def add(self):
+    self.carry_flag = 0
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 5]
+    add_int = operands[0] << 24 | operands[1] << 16 | operands[2] << 8 | operands[3]
+    output_register = self.register + add_int
+    if (output_register > 0xffffffff):
+      self.carry_flag = 1
+      output_register = output_register & 0xffffffff
+    self.register = output_register
+    self.instruction_pointer += 5
+
+  def sub(self):
+    self.carry_flag = 0
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 5]
+    sub_int = operands[0] << 24 | operands[1] << 16 | operands[2] << 8 | operands[3]
+    output_register = self.register - sub_int
+    if (output_register < 0):
+      self.carry_flag = 1
+      output_register = output_register & 0xffffffff
+    self.register = output_register
+    self.instruction_pointer += 5
+
+  def eor(self):
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 5]
+    xor_int = operands[0] << 24 | operands[1] << 16 | operands[2] << 8 | operands[3]
+    self.register = self.register ^ xor_int
+    self.instruction_pointer += 5
+
+  def for_loop(self):
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 2]
+    self.for_iterations.appendleft(operands[0] - 1)
+    self.instruction_pointer += 2
+    self.for_pointers.appendleft(self.instruction_pointer)
+
+  def next_loop(self):
+    if(self.for_iterations[0] > 0):
+      self.for_iterations[0] -= 1
+      self.instruction_pointer = self.for_pointers[0]
+    else:
+      self.for_iterations.popleft()
+      self.for_pointers.popleft()
+      self.instruction_pointer += 1
+
+  # bcc = branch conditional
+  def bcc(self):
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 2]
+    skip_count = operands[0] + 2
+    if(self.carry_flag == 0):
+      self.instruction_pointer += skip_count
+    else:
+      self.instruction_pointer += 2
+
+  # bra = branch unconditional
+  def bra(self):
+    operands = self.instruction_tape[self.instruction_pointer + 1:self.instruction_pointer + 2]
+    skip_count = operands[0] + 2
+    self.instruction_pointer += skip_count
+
+  def finish(self):
+    self.instruction_pointer += 1
+
+  def execute(self):
+    instruction_set = {
+      0x81 : self.rsl,
+      0x82 : self.rsr,
+      0x93 : self.add,
+      0x84 : self.sub,
+      0x87 : self.eor,
+      0x68 : self.for_loop,
+      0x49 : self.next_loop,
+      0x4A : self.bcc,
+      0x6B : self.bra,
+      0x4C : self.finish
+    }
+    while(self.instruction_pointer < len(self.instruction_tape)):
+      instruction_set[self.instruction_tape[self.instruction_pointer]]()
+    return self.register

sa2_seed_key/sa2_seed_key.py

@@ -0,0 +1,22 @@
+import setuptools
+
+with open("README.md", "r") as fh:
+    long_description = fh.read()
+
+setuptools.setup(
+    name="sa2-seed-key", 
+    version="0.0.1",
+    author="Brian Ledbetter",
+    author_email="[email protected]",
+    description="SA2 Seed/Key Authorization for Volkswagen AG Vehicles",
+    long_description=long_description,
+    long_description_content_type="text/markdown",
+    url="https://github.com/bri3d/sa2_seed_key",
+    packages=setuptools.find_packages(),
+    classifiers=[
+        "Programming Language :: Python :: 3",
+        "License :: OSI Approved :: MIT License",
+        "Operating System :: OS Independent",
+    ],
+    python_requires='>=3.6',
+)

setup.py

@@ -0,0 +1,13 @@
+import unittest
+from sa2_seed_key.sa2_seed_key import Sa2SeedKey
+
+class TestSa2SeedKey(unittest.TestCase):
+  def test_security(self):
+    vs = Sa2SeedKey([0x68, 0x02, 0x81, 0x49, 0x93, 0xa5, 0x5a, 0x55, 0xaa, 0x4a, 0x05, 0x87, 0x81, 0x05, 0x95, 0x26, 0x68, 0x05, 0x82, 0x49, 0x84, 0x5a, 0xa5, 0xaa, 0x55, 0x87, 0x03, 0xf7, 0x80, 0x6a, 0x4c], 0x1a1b1c1d)
+    self.assertEqual(vs.execute(), 0x6a37f02e)
+    vs = Sa2SeedKey([0x68, 0x02, 0x81, 0x4A, 0x10, 0x68, 0x04, 0x93, 0x08, 0x08, 0x20, 0x09, 0x4A, 0x05, 0x87, 0x22, 0x12, 0x19, 0x54, 0x82, 0x49, 0x93, 0x07, 0x12, 0x20, 0x11, 0x82, 0x4A, 0x05, 0x87, 0x03, 0x11, 0x20, 0x10, 0x82, 0x4A, 0x01, 0x81, 0x49, 0x4C], 0xa04eb1ed)
+    res = vs.execute()
+    self.assertEqual(vs.execute(), 0x3C7876D8)
+    
+if __name__ == '__main__':
+    unittest.main()