Any actual seedkey examples for any VAG ECUs?

[rusefillc]

I know that here you have the tool, but what about actual magic inputs? Are those public/known for any ECUs?

[bri3d]

Yes, the SA2 "script" strings are in either the ODX files inside of the FRF flash container for any ECU or the SGO files for older ECUs, in the SECURITY-METHOD =SA2 sub-key of the SECURITYS section of the reflash SESSION definition in the ODX.

For example,

 <SECURITY-METHOD TYPE="A_ASCIISTRING">SA2</SECURITY-METHOD>
                  <FW-SIGNATURE TYPE="A_BYTEFIELD">6809824A0C84540520064A05873011201281848EA7664C4A058722541912814A0181494C</FW-SIGNATURE>

FRF files are poorly encrypted ZIP files which can be decrypted to ODX using this tool: https://github.com/bri3d/VW_Flash/blob/master/frf/decryptfrf.py . SGO files are SGML Object Files with the data xor'd with 0xFF and can be unpacked using random tools from around the Internet (I will add one to VW_Flash soon as I need to support ancient DSG gearboxes for someone's project).

Whether or not these are "public" is a bit loaded I suppose, but they are certainly known and available. FRF files can be found in the VW "Flashdaten." In some countries with good consumer protections, these can be downloaded directly from ErWin (the VW self service portal) as they are included with the car. In others you will have to find them on torrents/fileshare or similar sources. For practical purposes I think most people just torrent these using the keyword from above.

[Razonics]

Is the SECURITYS section supposed to be clearly identified in the file or you just have to know where to look?
I can't see it in the SGO file I'm looking at.