Mercedes Diagnostics: Security Protocol Analysis

Hello,

I have some Mercedes OBD logs and I need information about the protocol and how the security works here.

Attempt 1:

Code:

00:13:08:9499 Tx 1 0x744 s 8 02 10 03 55 55 55 55 55 00:13:09:0195 Tx 1 0x724 s 8 06 50 03 00 14 00 C8 00 00:13:09:8378 Tx 1 0x744 s 8 11 03 2E F1 00 DD 8B 79 00:13:09:8394 Tx 1 0x724 s 8 30 20 00 01 7C 7C DD FE 00:13:09:8413 Tx 1 0x744 s 8 21 73 48 8F 62 E0 6E 9B 00:13:09:8433 Tx 1 0x744 s 8 22 A1 D2 FA 55 2D FE BD 00:13:09:8443 Tx 1 0x744 s 8 23 81 FD D8 89 07 6A 86 00:13:09:8463 Tx 1 0x744 s 8 24 5F D2 47 91 6B 73 FB 00:13:09:8494 Tx 1 0x744 s 8 25 6F 5B 48 5C 8B EA FD 00:13:09:8513 Tx 1 0x744 s 8 26 B8 8D AD C7 B8 52 8E 00:13:09:8533 Tx 1 0x744 s 8 27 AE EE FC CC 66 4F E8 00:13:09:8553 Tx 1 0x744 s 8 28 4E DA A8 3F 98 2E 58 00:13:09:8573 Tx 1 0x744 s 8 29 0E 37 97 26 B0 ED 44 00:13:09:8603 Tx 1 0x744 s 8 2A 11 38 08 A1 86 38 8F ...

Attempt 2:

Code:

00:10:20:9523 Tx 1 0x744 s 8 02 10 03 55 55 55 55 55 00:10:20:9941 Tx 1 0x724 s 8 06 50 03 00 14 00 C8 00 00:10:21:7930 Tx 1 0x744 s 8 11 03 2E F1 00 93 A4 F8 00:10:21:7950 Tx 1 0x724 s 8 30 20 00 01 7C 7C DD FE 00:10:21:7972 Tx 1 0x744 s 8 21 5C C2 8F 62 E0 C3 B7 00:10:21:7989 Tx 1 0x744 s 8 22 B0 FE 46 4C 9D A3 26 00:10:21:8009 Tx 1 0x744 s 8 23 97 A3 D8 89 07 6A B4 00:10:21:8018 Tx 1 0x744 s 8 24 A4 DC DB 70 6B B2 A3 00:10:21:8057 Tx 1 0x744 s 8 25 8C C0 96 C1 E5 93 58 00:10:21:8088 Tx 1 0x744 s 8 26 67 70 7B 4D B8 C9 98 00:10:21:8098 Tx 1 0x744 s 8 27 F0 2F A4 24 49 04 B0 00:10:21:8118 Tx 1 0x744 s 8 28 AD DA C7 BC AE E2 7F 00:10:21:8160 Tx 1 0x744 s 8 29 22 8B 97 26 B0 ED 44 00:10:21:8178 Tx 1 0x744 s 8 2A D9 EB 54 3E 52 87 8F ...

Code:

0x744 s 8 11 03 2E F1 00 xx yy zz

Attempt 1 and 2 should ideally have identical data. The numbers in row 3, which appear as "xx yy zz," seem to be some kind of key and apparently influence all the other numbers that are included in the multi-message.

Does anyone have any idea how this is calculated?

Regards,
Jackson.

Any information?

I understand how the TP protocol works, and that's not the problem.

Here's another way to explain it: If I send the exact same "diagnosis messages" 10 times and log them, the "RAW" data in the multi-messages will always be completely different. This suggests that they are somehow encrypted. What method is being used for this encryption?

This is the Seed & Key method. You need to know the key in order to interpret the data. If it's an older model (KWP2000), you can find corresponding programs online. With newer models using UDS, it becomes a bit more difficult. Just search for Seed/Key generators.