{"id":278,"date":"2019-09-29T11:54:24","date_gmt":"2019-09-29T06:24:24","guid":{"rendered":"https:\/\/tangentmotorsport.com\/?p=278"},"modified":"2019-09-29T11:54:24","modified_gmt":"2019-09-29T06:24:24","slug":"medc17-uds-flashing-exploit","status":"publish","type":"post","link":"https:\/\/blogs.tangentmotorsport.com\/?p=278","title":{"rendered":"MEDC17 UDS Flashing Exploit"},"content":{"rendered":"\n

Just finished writing the backbone of my flashtool last week. Can flash any MEDC17(presently only UDS based). Here’s a snippet of a EDC17C46 being flashed on bench:<\/p>\n\n\n\n<\/a>\n\n\n\n

It’s not just an FRF flash. Any modified file can be flashed(code and data area). An exploit in the bootloader is leveraged to allow RSA check(TPROT) to be bypassed and allow unsigned code to execute.<\/p>\n\n\n\n

Presently using Tactrix Openport 2.0(J2534) as an interface and Arduino Due for logging CAN traffic.<\/p>\n","protected":false},"excerpt":{"rendered":"

Just finished writing the backbone of my flashtool last week. Can flash any MEDC17(presently only UDS based). Here’s a snippet of a EDC17C46 being flashed on bench: It’s not just an FRF\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"tms_video_length":"","tms_tool_url":"","footnotes":""},"categories":[5],"tags":[73,70,26,72,71,74],"ecu":[],"vehicle":[],"class_list":["post-278","post","type-post","status-publish","format-standard","hentry","category-re","tag-bootloader","tag-flash-tool","tag-medc17","tag-obd","tag-obd2","tag-rsa-patch"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t