From bcb77faa30da1babce0aca79a2d63c99618226c2 Mon Sep 17 00:00:00 2001
From: JinGen Lim <1116555+jglim@users.noreply.github.com>
Date: Fri, 2 Jul 2021 10:47:44 +0800
Subject: [PATCH] Add VGS provider from VGSNAG2

---
 README.md                                     |  47 ++++++++++--------
 .../UnlockECU/Security/VGSSecurityAlgo.cs     |  33 ++++++++++++
 UnlockECU/UnlockECU/Security/VolkswagenSA2.cs |   1 -
 UnlockECU/VisualUnlockECU/key.ico             | Bin 1150 -> 0 bytes
 UnlockECU/db.json                             |  16 ++++++
 5 files changed, 74 insertions(+), 23 deletions(-)
 create mode 100644 UnlockECU/UnlockECU/Security/VGSSecurityAlgo.cs
 delete mode 100644 UnlockECU/VisualUnlockECU/key.ico

diff --git a/README.md b/README.md
index 2310474..dc14693 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,8 @@ Free, open-source ECU seed-key unlocking tool.
 
 ## Getting started
 
+[Try it out here in your browser](https://unlockecu.sn.sg/), or read more on how to use a local, offline copy:
+
 Download and unarchive the application from the [Releases](https://github.com/jglim/UnlockECU/releases/) page, then run the main application `VisualUnlockECU.exe`.
 
 Ensure that you have *.NET Desktop Runtime 5.0.0*. , available from [here](https://dotnet.microsoft.com/download/dotnet/5.0).
@@ -14,9 +16,7 @@ Ensure that you have *.NET Desktop Runtime 5.0.0*. , available from [here](https
 
 MIT
 
-Icon from [http://www.famfamfam.com/lab/icons/silk/](http://www.famfamfam.com/lab/icons/silk/)
-
-Excluding the icon, this application **does not include or require copyrighted or proprietary files**. Security functions and definitions have been reverse-engineered and reimplemented.
+This application **does not include or require copyrighted or proprietary files**. Security functions and definitions have been reverse-engineered and reimplemented.
 
 *When interacting with this repository (PR, issues, comments), please avoid including copyrighted/proprietary files, as they will be removed without notice.*
 
@@ -40,25 +40,26 @@ Here is an example of a definition:
 
 ```
 {
-    "EcuName": "ME97",
-    "AccessLevel": 5,
-    "SeedLength": 2,
-    "KeyLength": 2,
-    "Provider": "PowertrainBoschContiSecurityAlgo2",
-    "Origin": "ME97_ME97_13_10_01",
-    "Parameters": [
-      {
-        "Key": "Table",
-        "Value": "37C1A8179AE3745B",
-        "DataType": "ByteArray"
-      },
-      {
-        "Key": "uwMasc",
-        "Value": "4108",
-        "DataType": "ByteArray"
-      }
-    ]
-  }
+  "EcuName": "ME97",
+  "Aliases": [],
+  "AccessLevel": 1,
+  "SeedLength": 2,
+  "KeyLength": 2,
+  "Provider": "PowertrainBoschContiSecurityAlgo1",
+  "Origin": "ME97_ME97_13_10_01_J",
+  "Parameters": [
+    {
+      "Key": "ubTable",
+      "Value": "FCAD1E5941992FCD",
+      "DataType": "ByteArray"
+    },
+    {
+      "Key": "Mask",
+      "Value": "4300",
+      "DataType": "ByteArray"
+    }
+  ]
+}
 ```
 
 Currently, these security providers are available:
@@ -82,6 +83,8 @@ Currently, these security providers are available:
 - RDU222
 - RVC222_MPC222_FCW246_LRR3
 - SWSP177
+- VGSSecurityAlgo
+- VolkswagenSA2
 
 The definitions file `db.json` should be found alongside the application's main binary.
 
diff --git a/UnlockECU/UnlockECU/Security/VGSSecurityAlgo.cs b/UnlockECU/UnlockECU/Security/VGSSecurityAlgo.cs
new file mode 100644
index 0000000..9350812
--- /dev/null
+++ b/UnlockECU/UnlockECU/Security/VGSSecurityAlgo.cs
@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Generic;
+
+namespace UnlockECU
+{
+    /// <summary>
+    /// Implementation of VGS Algo from VGSNAG2
+    /// No formal name was found for this provider and it may be renamed in the future.
+    /// </summary>
+    class VGSSecurityAlgo : SecurityProvider
+    {
+        public override bool GenerateKey(byte[] inSeed, byte[] outKey, int accessLevel, List<Parameter> parameters)
+        {
+            byte[] cryptoKeyBytes = GetParameterBytearray(parameters, "K");
+            uint cryptoKey = BytesToInt(cryptoKeyBytes, Endian.Big);
+
+            if ((inSeed.Length != 4) || (outKey.Length != 4))
+            {
+                return false;
+            }
+
+            long seed = BytesToInt(inSeed, Endian.Big);
+            long seedKey = cryptoKey * (cryptoKey ^ seed);
+
+            IntToBytes((uint)seedKey, outKey, Endian.Big);
+            return true;
+        }
+        public override string GetProviderName()
+        {
+            return "VGSSecurityAlgo";
+        }
+    }
+}
diff --git a/UnlockECU/UnlockECU/Security/VolkswagenSA2.cs b/UnlockECU/UnlockECU/Security/VolkswagenSA2.cs
index 0d41776..96b0415 100644
--- a/UnlockECU/UnlockECU/Security/VolkswagenSA2.cs
+++ b/UnlockECU/UnlockECU/Security/VolkswagenSA2.cs
@@ -180,7 +180,6 @@ namespace UnlockECU
                 // Console.WriteLine($"IP: 0x{InstructionPointer:X} Reg: 0x{Register:X8} CF: 0x{CarryFlag:X8} Op: {instructionSet[InstructionTape[InstructionPointer]].Method.Name} ");
                 instructionSet[InstructionTape[InstructionPointer]]();
             }
-            Console.WriteLine($"Exec done, reg = 0x{Register:X8}");
             return Register;
         }
     }
diff --git a/UnlockECU/VisualUnlockECU/key.ico b/UnlockECU/VisualUnlockECU/key.ico
deleted file mode 100644
index 2aec3032a62e41151e90d95cc3c528d2c0b86518..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1150
zcmaJ;O-~b16nzyFma=l~vQ1q`L1a{jf<|3P`~xmcbmh(sYNe!FXfQPaLgFWJMQ98m
zF&b(_44BeN4F;zTg0&VTwle*gcG}Xh$NL7xV8irH&b)c|-gEAKXBacl)6l@^eTZG%
z&)7l6n3+H!ifqSeW2Y!rz1klKx?6@9*PA>alQws7^Tg2md(}0y&K=&^!fdhtdrZO8
zp9R?Z=TpZ$Qx9r!cIVDa#PK0lMyHs;`LB66VtF*W{App})yVETqi^D8eW@)7iy4^b
zBy_DPaQ>h<+yO~&zkF!K)8o8<TCHG0+Cpa}2eV(o>2MBxnnrN5)iwECuia}W{xH|z
z7*CYY6_H_`PoYhe(I4Y}1f-_k*DID=A`UwvXt_TVG|)kY=I~|8=w4G`{+!0Kr967S
zD`+2!<C&~tEU&`q2;-=G`ct)rKF8U~IBv`(;HCQrVip(4(<^HQoD5}Qqq&@^GORtM
z;qon2YwVo&ajomK3EWvPppAUJOd8js3ND3ZG%svxSnML2?@mSb(%@cvDX8e%DB?Et
z*5M$%b2L+HD2*3%7t2i%M*O$g@;_b=@dket@rJx{FUz>Fn#WA>4~}@24f)@SDh77?
zYh2><xjMXYNaV9^WEH}Yf7+nG_D@4JBi9)HUDCLm&zCS7HRS4g+(TZ^HJ&6(;P<Hz
zSDRrx`be*<wd)%EE*zZ8W3@QdIbFkuTTc$w5lq}k4m+Wqv3GR@6Jtd>{s)Swl&eq;
H4lwo?Hpavz

diff --git a/UnlockECU/db.json b/UnlockECU/db.json
index 966aad2..1d4a634 100644
--- a/UnlockECU/db.json
+++ b/UnlockECU/db.json
@@ -8684,5 +8684,21 @@
         "DataType": "ByteArray"
       }
     ]
+  },
+  {
+    "EcuName": "VGSNAG2",
+    "Aliases": [],
+    "AccessLevel": 17,
+    "SeedLength": 4,
+    "KeyLength": 4,
+    "Provider": "VGSSecurityAlgo",
+    "Origin": "VGSNAG2_vgsnag2_sec_12_06_01",
+    "Parameters": [
+      {
+        "Key": "K",
+        "Value": "1E71744E",
+        "DataType": "ByteArray"
+      }
+    ]
   }
 ]
\ No newline at end of file