The HEX code is from the pdf file in post #1. Knowing the mileage isn’t going to help. The odometer HEX is known and the Checksum is known. What is not known, is what algorithm was used. Below is the odometer reading.
apologies that I didnt go back and read the initial post. can I ask, what is the 01 in position 04 in that line for? I mean, you have calculated the mileage, and say that A9 is the checksum, is the 01 meant for anything?
Look I can make this work if I use the 01 shown in the hex dump. it aligns with 5F.. 5F -> decimal = 21 01 -> decimal = 1 21 + 1 = 22. 22 -> 10110. Take 2s compliment = A BC -> decimal = 23 there is not corresponding number for this. its 00 23 -> 10111. 2s complement = 9 I have no way to verify this, to back test other samples. just making up stuff on the fly, and well, its kinda simple what the engineers might have employed. shifting bits around
This looks promising. Tried 1’s compliment with binary values, Modulo256, CRC-8 and CRC-16 all will failure. I have PM’d you another chip dump to test your theory.
yeah, this is going to take some time. you do know that you can try Mod 8, 16, 32, etc.. it doesnt have to be 256 Not sure how much processing/registers this processor on these displays have, and thinking it cant be too complex an operation that has to be performed, if its just tiny little processor/FPGA etc..
Can you do the following experiment, to work out if the checksum is using all the milage bits in its calculations Can you travel for 1km, and take another reading, to see if the checksum changes. want to work out if all bits are used, MSB, LSB... Not sure if the bike is accessible to do this
I believe I have cracked the algorithm used in the checksum calculation. Please feel free to test the attached calculator. Change the file name from .pdf to .xlsx Use the data in post #38 to test (00 to 07 in line 00000010 and 00000020). If you have your own dumps then please test and give feedback. Next project will be a mileage calculator.
Hey bro i just bought a 2015 rebuilt track ducati from police auction but it didnt come whit keys. Is there a way to reprogramme keys whitout anykeys in hand whit your method?
Just a quick comment to leave feedback for Chris - who is clearly a genius and a gentleman. He flashed an ECU for me - then posted it back with his clever key reader - I read the transponder off my only key and sent that Hex code back to chris, who quickly came back with the correct Bypass code for my Bike (basically what comes on the CARD that the dealer uses to code keys or to start the bike with an Immo fault). It worked, and now I have two coded keys !! Very grateful and kind of Chris to trust me with his clever device. It was also easier than it seems. He Shared you-tube vids of it being done and it was actually dead simple to follow. Even I could do it.
hi, I am trying to read my 848 black key on my zedbull. but the code that it reads is nothing like the above (I was able to successfully read my red key for the 999). on this one, it comes back as : type11 temic wr data: ce000000009807cb nothing else.. is it a zedbull issue? I do have the code for this key, if you need to reverse eng the above.
and now to confuse even more, my Zedbull read of my 999 red key starts at 5F, not 7D. if I am to input that, the spreadsheet will miss the last two digits of the zedbull. am I doing this correctly?
