openpilot/etc. on Toyota/Lexus/Subaru with TSK/ECU SECURITY KEY

Toyota's Sword in Rock situation (that has been pulled out quite a bit by Willem and Greg!)

Background

There is a STEERING_LKA-ish message and more in some new Toyotas that currently has an "authentication code" scheme appended to the end. The algorithm and security system for this "authentication code" is somewhat known for certain vehicles but requires a key that is unique to each vehicle to be extracted or smuggled out of the vehicle. Not all vehicles are able to have their keys extracted with what is currently known.

List of vehicles with Toyota ECU Security Key

Known vehicles with Toyota ECU Security Key on the Forward Recognition Camera of which OP doesn't currently support right now:

~~2021-2023 RAV4 Prime~~
- Known as RAV4 PHEV in non-North American markets
2024 RAV4 Prime
2021+ Venza
~~2021+ Sienna~~
(EUDM/JDM/MXDM) 2021+ Yaris GR
(USDM) 2022+ Corolla Cross (Speculated from TechInfo lookup)
- Not applicable to Thailand or Brazil.
(EUDM/JDM/MXDM) 2021+ Yaris Cross Hybrid
~~(EUDM/JDM/MXDM) 2020+ Yaris Hybrid~~
2022+ Lexus NX (Speculated from TechInfo lookup)
2022+ Tundra (Confirmed in commaai/openpilot#27869 (comment) )
(EUDM) 2022+ Aygo X (Speculated from Toyota Tech EU lookup)
2022+ Lexus LS (Speculated from TechInfo lookup)
2022+ Lexus LX (Speculated from TechInfo lookup)
2023+ Sequoia (Speculated from Being a Tundra With a SUV Body)
2023+ bz4x (Speculated from TechInfo lookup, also probably the same for sister rebranded Subaru Solterra)
2023+ TMC/JP-made Corolla (Speculated from TechInfo lookup)
- It is also unknown what form, if any amount of TSK there is on US-made 2023 Corollas. Maybe they just don't do the pairing thing but hardcode a key. No one knows.
2024+ Toyota Corolla, All origins.
2023+ Prius and Prius Prime (Speculated from TechInfo lookup)
2023+ Lexus RX (Speculated from TechInfo lookup)
2023+ Aygo X (Euro tech info Lookup).
2023+ Lexus ES (From anecdote in RP Discord's #toyota) Disputed, TechInfo has no signals of TSK, probably safe to say no TSK
2023+ Toyota Crown
2023+ Lexus RZ (Speculated from TechInfo lookup)
2024+ Grand Highlander ICE and Hybrid (Speculated from TechInfo lookup)
2024+ Highlander ICE and Hybrid (Speculated from TechInfo lookup)
2024+ Lexus TX (Speculated from TechInfo lookup)
2024+ Lexus GX (Speculated from TechInfo lookup)
2024+ Tacoma (Speculated from TechInfo lookup)
2024+ Mirai (Speculated from TechInfo lookup)
2024+ Camry (Speculated from TechInfo lookup)
And so on.... as any refreshes or new models after 2024 will have ECU Security Key so this list will more or less be just a list of all new Toyotas after 2024.

TechInfo lookup is looking at Toyota's Techinfo site (payment required, minimum ~$25) and seeing if replacing the "Object recognition camera" / "Forward recognition camera" requires an ECU Security Key update. https://discord.com/channels/469524606043160576/524327905937850394/894262224552624228

Setup Guide

For vehicles that do work, here's a very rough guide. Please send in pull requests to fix or amend it.

Based off of share-and-enjoy's and Rez's guide on Discord and previously on the openpilot wiki before it was disabled.

The instructions can and will change and are volatile. Please report and discuss any issues in the #toyota-security channel on the comma.ai Discord. The invite to that discord is at https://discord.comma.ai. Once joined, make sure to answer any prompts you see in the Discord to gain full access. Once that is answered, this link will work to get you to #toyota-security: https://discord.com/channels/469524606043160576/905950538816978974

INSTRUCTIONS STATUS: WIP 🚧

Start off with the installation guide here:

https://comma.ai/setup/comma-3x
Then once you get your Comma powered up, you'll connect it to your Wi-Fi network.
Install "Custom Software:
- When it asks you to enter a URL for "Custom Software", first try: https://installer.comma.ai/pd0wm/rav4-prime
- If you installation hangs and then restarts, try: https://smiskol.com/fork/pd0wm/rav4-prime
Get SSH setup on the device:

Download Willem's secoc GitHub folder:

SSH back into your Comma device:

ssh comma@"your Comma IP" enter comma for the login

Clone the repository:

git clone https://github.com/I-CAN-hack/secoc

Kill openpilot:
- Enter the following command:
```
pkill -f openpilot
```
- The Comma should display just the splash screen with the Comma logo.
Put the car into "Ignition on" mode but with "Not Ready to Drive":
- Slow press the "Power" button twice WITHOUT pressing the brake pedal.
Run the extract_keys.py script:
- Navigate to the secoc directory:
```
cd secoc
```
- Run the script:
```
./extract_keys.py
```

Edit the script if you get an "Unexpected application version!" error:

Open the script for editing:

nano -l /data/openpilot/secoc/extract_keys.py

Comment out lines 75-77 and 90-92 by adding a # at the beginning of each line:

# if app_version not in APPLICATION_VERSIONS:
#    print("Unexpected application version!", app_version)
#    exit(1)
#
# if bl_version != APPLICATION_VERSIONS[app_version]:
#    print("Unexpected bootloader version!", bl_version)
#    exit(1)

Save and exit the editor (Ctrl+X, then Y, then Enter).
Run the script again:
```
./extract_keys.py
```

Manually add the key to params (if needed):
- Use the following command to manually change the keys:
```
echo -n "your key here" > /data/params/d/SecOCKey
```

Fingerprinting (if the car is not recognized):

Follow the guide on fingerprinting: https://github.com/commaai/openpilot/wiki/Fingerprinting
Locate the necessary ECU codes.

Add the ECU codes to fingerprints.py:

nano /data/openpilot/selfdrive/car/toyota/fingerprints.py

Scroll down to the CAR.TOYOTA_RAV4_PRIME section and enter your corresponding ECU codes:

},
CAR.TOYOTA_RAV4_PRIME: {
  (Ecu.engine, 0x700, None): [
    b'\x01896634AJ7000\x00\x00\x00\x00',
    b'\x018966342S7000\x00\x00\x00\x00',
  ],
  (Ecu.abs, 0x7b0, None): [
    b'\x01F15264284100\x00\x00\x00\x00',
    b'\x01F15264228300\x00\x00\x00\x00',
  ],
  (Ecu.eps, 0x7a1, None): [
    b'\x018965B4233100\x00\x00\x00\x00',
    b'\x018965B4209000\x00\x00\x00\x00',
  ],
  (Ecu.fwdRadar, 0x750, 0xf): [
    b'\x018821F6201300\x00\x00\x00\x00',
    b'\x018821F3301400\x00\x00\x00\x00',
  ],
  (Ecu.fwdCamera, 0x750, 0x6d): [
    b'\x028646F4210100\x00\x00\x00\x008646G3305000\x00\x00\x00\x00',
    b'\x028646F4205200\x00\x00\x00\x008646G4202000\x00\x00\x00\x00',
  ],

Disable updates

echo -en "1" > /data/params/d/DisableUpdates

Reboot the device:
- Enter the reboot command:
```
sudo reboot
```
Now, you should be ready to go!!!

Support Status Overview

Some vehicles have been attempted to be hacked and some have been successfully hacked and some not.

The status of the vehicles are as follows:

Vehicles and Possible Groupings
- Wave Early Security Key
  - These vehicles do not use the HSM.
  - These all seem to share the commonality of a ~~version 1 bootloader~~ on the EPS
  - Longitudinal
    - A little fragmented. People are making change to their own code. While latitude is clearly controlled, the state of longitudinal is all over the place.
    - Resume command spams still works from existing implementation so stop and go without touching is active if openpilot is active.
    - openpilot can't control gas or brake; no traffic lights or experimental mode. The CAN bus command to control this is currently unknown, but sought.
  - Vehicles
    - 🇹 🇸 🇸 2️⃣ 2021 RAV4 Prime 🟢
      - 2021-2023: Known to be working
      - Flagship vehicle for ECU Security Key efforts
      - Focus of Willem's Pull Request
        
        Additional fingerprints added in anrum's frogpilot port.
    - 🇹 🇸 🇸 2️⃣ 2021 Sienna 🟢🟡
      - 2021-2022: Known to be working
      - Key surprisingly at the same location as the RAV4 Prime
      - Community currently hacking it in as a RAV4 Prime. Should really be formally put it in as a Sienna. WIP.
        
        tranlocquy's fork of anrum's Frogpilot port has this separated out and fingerprints added for 2021 at least.
    - 🇹 🇸 🇸 2️⃣ 2020-2022 Yaris Hybrid 🟢🟡🟡
      - Key at least not at the same location as the RAV4 Prime
      - Brute force efforts to find key location successful on both Euro and Japanese
      - openpilot working working with heavy hacked out branch
      - First Continental Radar + Camera setup going and thus first radar controlled ACC vehicle done with. This does not mean longitudinal is controlled by openpilot though.
      - Not sold in the USA, but is in Australia, Japan, and Europe
- Wave HSM?
  - These vehicles don't seem to have a valid key in the memory returned after the exploit payload is run.
  - 🇹 🇸 🇸 3️⃣ 2023 Corolla Cross Hybrid 🔴
    - 2023: Known to be not working. Key not in visible memory. Mentioned in Willem's blog post.
  - 🇹 🇸 🇸 2️⃣ 2024 Toyota Highlander 🔴
    - 2024: Known to be not working. Key not in visible memory.
    - 02 ~~bootloader~~
- Wave with newer ~~bootloader~~? (It's not a bootloader version?)
  - These vehicles don't seem to respond to the current exploit to run arbitrary code to do things like dump memory
  - 🇹 🇸 🇸 2️⃣ 2022 Tundra 🔴
    - No known ~~bootloader~~ exploit execution
    - User ThisGuy has an extra rack on the bench. No known progress.
    - 04 ~~bootloader~~
  - 🇹 🇸 🇸 2️⃣ 2021 Venza 🟡?🔴?
    - Key at least not at the same location as the RAV4 Prime
    - Brute force efforts to find key location TBD
    - Has a 02 ~~bootloader~~ though from one sample. Strange for this vintage? Maybe another should try.
  - 🇹 🇸 🇸 2️⃣ 2024 Rav4 Prime 🟡?🔴?
    - Key at least not at the same location as other RAV4 Prime
    - Brute force efforts to find key location TBD
    - At least code is executed. Unknown what might have changed.
    - New 02 ~~bootloader~~ seen
- Notable Unknown
  - 🇹 🇸 🇸 3️⃣ 2023+ Corolla, JP and US origins.
    - While users have come by here and there, none have produced usable engineering info or experiences of note.
    - No one has tried getting things to work on a 2023 US-made Corolla that doesn't appear to have TSK.
  - 🇹 🇸 🇸 2️⃣ 2023+ GR Yaris
    - Seems externally similar to Yaris Hybrid?

Note: 🟢 = Working, 🟡 = WIP, 🔴 = Not Working and sometimes a mix.

Note 2: If it's not listed above, then there has been no documented information or attempts.

It is also unknown what is the status of the approach where we pretend to be an ECU to get the keys in a re-keying situation. This might be an approach that might work for unsupported vehicles. Theoretically anybody could dump the firmware now with the exploit to dump firmware and try to reverse engineer this but no one other than the original researchers have done this.

History and such can be found below. The most recent history is at the bottom. If you need to catch up, start from where you left off. Feel free to ask questions in Discord.

Bounty Statuses

🗳️ comma.ai Vote for Toyota Security

In June 2022, comma.ai created a paid vote/crowdfund for making openpilot support Toyota Security. Once they get 500 votes at $100 a vote, they have 6 months to figure it out and open source a solution; Otherwise, a refund will happen and all the money is returned. The current status of that is: .

Vote counts are reported every week or similar and are recorded in this spreadsheet by the community: https://docs.google.com/spreadsheets/d/1GOeN2ph9JLvOlwStZso988YPT-lILl7yZqFW8UPCFZM/edit#gid=0

The result of this vote, even though it has not met its milestone, is a pull request was produced for the RAV4 Prime to be supported in openpilot. It is currently developed on-and-off.

comma.ai's Vote for Toyota Security system store/page is located at: https://comma.ai/shop/products/vote

Please visit the page and observe what it says for official information.

In addition to their vote system, comma also has specific bounties up:

"$5k if someone cracks it and upstreams RAV4 prime support -geohot (link currently broken)
- Currently locked to Willem for Willem's PR for the RAV4 Prime to merge in completely: commaai/openpilot#32661 (comment)
We're announcing a bounty for the 2023 Corolla, 2023 Corolla Hybrid, and 2023 Prius. $500 for a working port merged.

👥 Communities Bounty

The overall community bounty has been canceled for numerous reasons:

https://www.reddit.com/r/Comma_ai/comments/1d5r7xr/comment/l6vjf9e/

Original Sheet: https://docs.google.com/spreadsheets/d/1MKS78_utvbAe74Xv7zszgEnn6JrtBgpgYlVOfoIvLEw/edit#gid=0

In its place are more specific community bounties:

Tundra Interest Group
- ~~"I’ll put up 2k for Tundra alone" - bgill66~~
  - Scrubbed / User had bumped to $5k but there was no interest. https://discord.com/channels/469524606043160576/905950538816978974/1259282479257485383

Pictures of TSK'd and non-TSK'd Camera ECUs

FWIW the outside of the ECU Security Key camera of a Rav4 Prime looks the same as a non-ECU Security Camera of a Corolla or Corolla Hatchback.

2021 Rav4 Prime:

Security Key'd Denso innards: https://discord.com/channels/469524606043160576/905950538816978974/939203494152372274

2020 Corolla/Corolla Hatchback:

A photo teardown of the 2020 Corolla camera (NON ECU SECURITY KEY) innards: https://photos.app.goo.gl/qsBaMFT6PSEs7BFXA

Current History

Here's a brief to get anybody going into this ECU Security Key issue up to speed. I'll keep updating this with links to the relevant Discord messages and other stuff as I find them.

Discord links may be linking to the middle of the conversation. Scroll up and down for context.

Many of these Discord links are to a pre-hidden channel named #toyota-security in the comma.ai Discord. Accessing #toyota-security on comma.ai Discord requires completing the simple prompt in #join-development. Otherwise, it is inaccessible. More often than not, the Discord links are to #toyota-security in the comma.ai Discord, so please complete the prompt.

Most if not all Discord links are to the comma.ai Discord accessible with an invite from https://discord.comma.ai unless otherwise noted. These other Discords include:

Retropilot (RP): https://discord.gg/GzWegVa . This Discord can also be located in the Discord's Public Server Explore/Discover (🧭 icon on left sidebar) as well.
Sunnyharbin's Openpilot Server (SP): https://discord.gg/TCTvFTKrAV . This Discord can also be located in the Discord's Public Server Explore/Discover (🧭 icon on left sidebar) as well. In case it's not clear, this is Sunnypilot's home Discord.
Openpilot Enthusiasts (Formerly "Openpilot community") (OPC): Ask or look in RP Discord. This Discord can also be located in the Discord's Public Server Explore/Discover (🧭 icon on left sidebar) as well.
MoreTorque (MT): Ask or look in OPC or RP Discord
Frogpilot (FP): https://github.com/FrogAi/FrogPilot?tab=readme-ov-file#discord

The activities, actions, and discussions on non-comma.ai Discords are/may not supported by or affiliated with comma.ai (this may even apply even to the comma.ai Discord too). In the case of MoreTorque, comma.ai is strongly opposed to that community/Discord. That said, the ECU Security Key issues affects all and relevant events and information may be there as well.

Background

For Toyota Openpilot enthusiasts, the community was very excited for the RAV4 Prime, a high performance Toyota that was going to have "Toyota Safety Sense 2" (TSS2), other awesome Toyota traits such as reliability, utility, and economy, and, new for a Toyota SUV, speed. It is the fastest accelerating real Toyota excluding Lexuses as the Supra, a BMW badged as a Toyota, does not count.

Previously seen TSS2 vehicles have had an architecture where both latitude and longitudinal are both controlled by the front-facing camera. Openpilot was able to intercept and control latitude and longitudinal all at the front-facing camera of TSS2 vehicles, promising full openpilot capabilities. No other taps in the CAN of the vehicle were needed to control or block messages for this capability.

The typical process for adding a new TSS2 vehicle is simply creating a fingerprint with reference to the closest similar vehicle and trying it out.

Timeline

2013

IOActive experiments with injecting packets to steer a Prius in a widely disseminated and seminal security assessment. Their research around this time also led to them being able to remotely inject through the radio with a FCA vehicle.
- This is way in the past, but it's important to note that even large slow dinosaurs or turtles move and it's been a few years.

August 2020

matty#8553 came on Discord as the first user with a RAV4 Prime and a new Comma 2. crazysim#7797 / @nelsonjchen offered to get the RAV4 Prime supported. Some worrying observations were immediately made in a GitHub issue after validating that the hardware was sound and working on another non-Prime TSS2 RAV4 :

The STEERING_LKA CAN message is now 8 bytes in size. Existing TSS2 vehicles had a 5 byte STEERING_LKA CAN message.
@nelsonjchen implemented and tried many checksum algorithms to try and create an identical STEERING_LKA message to what was seen in Cabana. None of them worked.
@nelsonjchen asked around on many Discords and other well-known users for help. No one was able to help.
@nelsonjchen notices that the "checksum" is the not the same for messages with the same data. It doesn't seem like a checksum. Maybe some other state is kept somewhere?
The authentication code messages change between ignitions.
@nelsonjchen notices that Toyota filed a patent about message authentication on the CAN bus.
matty#8553 eventually returned the Comma 2 within the trial period.

October 2020

November 2020

aka#2674 bought another RAV4 Prime camera ($800!) to take a look at and to see how the reprogramming works.
aka#2674 moved to San Diego area

December 2020

James-T1 takes a look at ECU Security in Toyota's TechInfo site. The Sienna and Venza are discovered to be additionally affected vehicles.
Support for the Camry with TSS 2.5 was added around this time. It did not have ECU Security Key. TSS versioning does not appear to be correlated with ECU Security Key presence.

January 2021

@nelsonjchen makes the bounty spreadsheet in Discord inspired by the recent success of the Honda 10th Gen Accord Bounty.

February 2021

Willem Melching of comma.ai took a deeper interest and posted on Discord. He is waiting for parts from affected vehicles to show up on part or junkyard sites for bench analysis.
The NHTSA had posted a PDF from Toyota about ECU Security Key and how to reconnect an ECU replacement such as a camera and so on using ECU Security Key to a vehicle. In summary, Techstream users must connect to the Techstream backend for keys.

March 2021

April 2021

October 2021

November 2021

geohot creates a #toyota-security channel on Discord and makes a rough plan sketch to try to help the community (this channel is under the Development section of Discord, checkout #join-development if you don't see it):
1. list all the ECUs that have the security
2. find out what chips are in those ECUs. ideally we find a dumpable one without any hw security features
3. dump the firmware!
4. understand the algorithm/keys doing the encryption. at this point, openpilot will work if it's rekeyed.
5. if possible, break the crypto. at this point, openpilot will just work
the comma team does have logs of the pairing process and is able to see some xml stuff with some unknown values labeled M1, M2, M3, and so on
Somebody on RP Discord claims a friend of theirs has used their OP hardware to crack the system with OP working on their 2021 Venza. They wish to stay anonymous/low at this time. They are not interested in releasing their work but could be interested in releasing it for the bounty amounts to be paid to a charity.
- "Alright, here is what I understood from our convo. He said the ecu key is really important at lest the way he is doing. Without that ecu cannot community at all so op has no chance of working obviously. So he overwrite the original key with the new key that he generated in online portal. While the key is being sent to the car he does mitm to grab the handshake and duplicate and use that every time he wants to use op(he said something about hash being encrypted not sure what that was all about) . He also said he using using two panda and arduino. Asked him if he is interested in handing over his progress to comma so they can improve and make it better but he said no for now."
- Added as "Mysterious Stranger" in bounty/interested user spreadsheet.

December 2021

January 2022

Willem Melching from comma.ai posts a 4 part blog post about his own adventures in hacking a VW golf ECU including dumping and reverse engineering it on his own time.
IceyJ#0001 is planning to work with MBrownies#7412 on dumping something next month. IceyJ#0001 was delayed a bit by sickness and other issues.
#toyota-security discusses dumping the flash as seen on the LKAS forward camera
The Rav4 Hybrid 2022 doesn't work out of the box with fingerprinting. At first glance it looks like the radar changed and security key wasn't added.
(MT Discord) ryleymcc#4808 creates a #toyota channel in MT Discord and posts a request with offer of help/partnership to skilled hardware developers to develop a Toyota Torque Interceptor. When asked if this was a possible alternative to CAN MITM on Security Key Toyotas and referencing this discussion, ryleymcc#4808 claims it would circumvent all the Security Key issues.
- NOTE: comma.ai strongly disapproves of ryleymcc#4808's work and operations, citing serious safety concerns.
- This approach would likely not fulfill much of the bounty as it is currently specified as it is unlikely to make it into a release branch.

February 2022

March 2022

April 2022

"new project ... Rav4 prime EPS" - Greg J Hogan of comma.ai who is experienced with firmware analysis
"Still alive after surgery :)" - Greg J Hogan of comma.ai takes apart an EPS.
"[ryleymcc#4808] would ship a free TI to anyone who can use it to work around this ECU security [key] problem."
- note: it looks like comma deleted this post, see above's "NOTE: comma.ai strongly disapproves of ryleymcc#4808's work and operations, citing serious safety concerns."
(RP Discord) wocsor#0313 notes that the MCU on the Rav4 Prime EPS Greg posted appears to be off the shelf and purchasable on DigiKey. However, there may be on-chip security that may need to be defeated and he was unable to locate a datasheet for it so far.
Huge news. TheReaper#0283 has dumped a Yaris Engine ECU as part of their tuning effort.. @nelsonjchen reached out to a few technical fellows on the spreadsheet. If you're a technical fellow, and are interested, please reach out.

May 2022

No progress on looking at the Yaris Engine ECU.
geohot has mentioned that if a Lexus with the system were bought for comma.ai, it would be cracked or given back to the community if it isn't cracked in 12 weeks.

June 2022

July 2022

Comma Vote reaches 42 votes, also known as the answer to life, the universe, and everything.
Erich#4634 discovers that bulk votes are discounted. Comma/Geohot are amused and replies they will honor the unintentional bulk vote discount.
The bulk vote party spreadsheet is launched for bulk votes contingent on some criteria: https://docs.google.com/spreadsheets/d/1GOeN2ph9JLvOlwStZso988YPT-lILl7yZqFW8UPCFZM/edit#gid=1958149470
- A new counter/badge is produced along-side as well
geohot: Bulk votes can be bought in blocks of 10.
CARS.md, an intermediate source file behind https://comma.ai/vehicles or the vehicle compatibility list on comma's site, is updated with a list of Toyota Security Key vehicles. It has not been pushed to comma's site yet as of July 27, but eventually will.
Toyota posts a video about TSS 3.0. The video description mentions "23 Corolla, 23 Corolla Hatch, 23 Corolla Cross, 23 GR Corolla, 23 Crown, 23 bZ4X". The bZ4X and the Corolla Cross are known released vehicles with Security Key. The others are unknown and as of July 27, 2022, not on TechInfo yet for confirmation.
Some discussion about how the system works along with a description from AUTOSAR about how a system would work

August 2022

September 2022

October 2022

November 2022

Willem Melching formerly of comma posts a picture with "Will it Glitch?" with what appears to be a RAV4 Prime EPS board with many probes on Twitter.
- Rav4 Prime EPS board previously seen on Greg Hogan's Twitter
"Yes! Turns out the Renesas RH850/P1M-E is vulnerable to a similar attack as the RX65... ", cont.
- Cite: https://www.collshade.fr/articles/reneshack/rx_glitch_article.html
- It appears a firmware dump of a relevant Toyota Security Key ECU has been accomplished. It does not meet my criteria for a firmware dump milestone yet as instructions for reproduction are not all present, but the dump does seem to have been accomplished.
Willem Melching posts a writeup of how to and what to do to get the firmware dumped.
- This meets all my criteria for the firmware dump milestone and I am working on collecting and closing the bounty.
Greg Hogan posts a screenshot of Ghidra presumably looking at the Rav4 Prime EPS Firmware with some already work done and named functions/fields.
Sent out "Toyota Security Key Firmware Dump Bounty Gathering Letter"
The new SecOC/Security Key LTA message is discovered to be at 0x131.
"SecOC message parsing, MAC truncated to 28 bits looks like AUTOSAR SecOC profile 3 (JASPAR)"
/u/imgeohot (geohot, presumably?) "Literally the only "locked out" car is a small minority of Toyota's. We offered votes for sale, but we didn't sell many. It's not a OMG they are locked out, it's why would we care it's like 5 obscure cars. Will solve when it comes to Corolla or Prius.". (not sure if geohot knows or acknowledges TSK has arrived to Japanese-made Corollas yet.)
vybhavab#6727 puts down the $20 to look up a batch of cars for 2023. The "Toyota Sequoia" is only offered in Hybrid and it has TSK.

December 2022

January 2023

"So is looking in there now and unfortunately the procedure for mounting the front camera includes a step 5 that instructs you to update the ecu security key 😒 [for Toyota Aygo X]"
A comma_ai Twitter Space occured where Comma's Greg talked about TSK for ~10 minutes. Unfortunately, there are no recordings but some recollections.
- "i think greg said reflashing the ecu to disable security might happen first less desirable and clean"
- "i asked if secured corolla/prius would mean comma would take action before the vote quota was met. george didn't seem to care too much and that the votes mattered more."
- "oh, greg mentioned the eps they bought didnt look like it was ever installed in a car lol"
$480 of the FW Dumping Bounty sent to Willem Melching. Unfortunately, this was less than half of the promised bounty for a firmware dump.. Ko-Fi Link
"Replace your EPS with one that has never been in a car and the key used for SecOC MAC generation will be 0x11111111111111111111111111111111 openpilot could work as long as you don't re-key, but stock system will not 🤣" -gregjhogan
2023 Prius (Standard) has Security Key
Someone(s) volunteers to try to replace their EPS with a out of the box un-unkey'd EPS to get OP going. Of course, talk is cheap on Twitter and no one can blame that someone if they backout due to cold feet but if it's serious.....
- The message counterpart for that offer on Discord seems to not be there now.
The 2023 Corolla Hybrid sold in Brazil still seems to be using Denso and does not have Security Key

February 2023

March 2023

April 2023

@nelsonjchen asks u/LordKing64, a reddit user who produces spreadsheets for those looking to hunt down extremely desirable Toyotas to run a scrape against the ICE 2023 Toyota Corolla to see what percentage of ICE corollas are Japanese-made, which get locked up with TSK.
- It's a snapshot, assuming that it is generalizable for the ICE Corolla through the rest of the model year.
- https://docs.google.com/spreadsheets/d/15FaeZggrsoSizcqARb-eJXpbLFqoYUVtk6s_qFFwSXk/edit#gid=0
- About 1% of ICE Toyotas in the US are produced in Japan across all trims.
- Note: To date, no one has attempted to port OP to the 2023 ICE US-made Corolla.
More scrapes from /u/LordKing64 produces this spreadsheet of 2023 Corolla origins. . About a quarter of Corollas (not including GR, have TSK on them).
Oof, even more 2023 ICE JP Corollas

May 2023

June 2023

July 2023

August 2023

comma.ai has its periodic social and product convention "comma_con" to announce new products, meet and greet contributors and users, and talk about the future.
- comma ai | Shipping github.com/commaai/openpilot | Adeeb Shihadeh | COMMA_CON talks | CPO
  
  [23:49.760 --> 23:52.360] [Audience Question] Which car brands are the easiest to support [23:52.360 --> 23:53.360] and the hardest to support? [23:53.360 --> 23:55.600] <cut> [23:55.600 --> 23:56.760] <cut> [23:59.760 --> 24:03.360] Adeeb: So easiest to support, this is really changing now, actually. [24:03.360 --> 24:06.360] The software platforms and the cars, at least for the ADAS, [24:06.360 --> 24:09.360] were pretty stable for about like three, four years. [24:09.360 --> 24:10.760] And we did a lot of this initial work [24:10.760 --> 24:12.360] maybe three, four years ago. [24:12.360 --> 24:13.760] And now we're in this cycle where [24:13.760 --> 24:15.360] Honda, Toyota, Honda, Toyota, Honda, [24:15.360 --> 24:18.160] we're in this cycle where Honda, Toyota, Honda, a lot of them [24:18.160 --> 24:21.080] are changing their platforms right at the same time. [24:21.080 --> 24:23.720] So that's the hard part right now, [24:23.720 --> 24:25.600] is we're getting this influx that [24:25.600 --> 24:27.960] are all different right now. [24:27.960 --> 24:31.400] The hardest ones now are the ones that implement the Autosar [24:31.400 --> 24:33.160] secure onboard communication. [24:33.160 --> 24:34.560] We haven't spent much time on it, [24:34.560 --> 24:36.320] but that'll be a little bit of a project. [24:36.320 --> 24:39.600] It just adds more overhead to porting a car.
- Jason Young (a major non-comma.ai openpilot contributor) discusses SecOC as a bad thing to see when attempting to port OP to a new vehicle.
The Toyota B Harness seen in the 2023 Corolla and the 2023 Prius go on sale in comma's shop after a tester was located.
rap_rep_291 on Discord discovers that Vector's (A popular CAN Bus Analyzer and debugging tool) tooling may have SecOC "OEM Security Addons" "free of charge" for some OEMs. Toyota is not mentioned specifically though. Vector stuff is $20k though.
The Lexus UX 2023 2023 are looked up to not have Security Key.
oremaxis is trying to hook up the Japanese 2023 Prius with the current comma B Harness. There are missing connections and some issues with the harness relays.
.malachor reports that Toyota is moving to GTS+ away from TechInfo and that there's some sort of capture or key stuff possibly going on with the newer platform as well.
Toyota B Harness updated with more wires needed/as seen on Prius 2023

September 2023

celeryferrari on discord dumps a bunch of PDFs of the ECU replacement for the forward camera for Lexuses. Notably, the 2024 Lexus ES doesn't have replace ECU Security Key as a procedure
- Question follow up to original ES reporter stupefacient on Retropilot

October 2023

November 2023

Range Check Trick to check vote count no longer works
A small discussion on that mentions 2023 Toyotas such as a bz4x and 2023 Sienna known to have TSK can have their immobilizers changed by a non-Toyota tool. (OPC Discord)
- A later discussion comma Discord establishes this as not as big a deal. Adding a key with a key already present is easy.
Range trick to check votes works again.
VineTimeLive#2651 paid $25 and looked up a bunch of models after Toyota's paywall. Summary below.
- Highlander 2024, even though it still has TSS 2.5, got TSK . Not unexpected for it being rather oddly the most change prone.
- The 2024 Rav4 still does not have TSK.
- 2024 Lexus TX, has TSK, not big surprise
- There is no longer a differentiation between JP and US 2024 Corollas for TSK. All 2024 corollas have TSK.
- The 2023 ES and 2024 ES does not have TSK, contrary to what others may have reported.
A small discussion on differences between Toyota Dealership and independent shop access re: TSK and Techstream
- "The local branches don't have the data. Any dealer that wants to swap a secured ECU for repairs has to login through Techstream to get the one specific key for the ECU he is installing at that time. Third party shops have to do the same but they don't even get Techstream Global access. They get case-by-case access if Toyota approves it. (E.g. parts number matching and so forth)"
A post with a sample of an exchange between Techstream and Toyota servers.
"interesting how european ecu security key can do offline key writing"

December 2023

January 2024

Added more vehicles:
- 2024+ Lexus TX (Speculated from TechInfo lookup)
- 2024+ Lexus GX (Speculated from TechInfo lookup)
- 2024+ Tacoma (Speculated from TechInfo lookup)
- 2024+ Mirai (Speculated from TechInfo lookup)
Q: I’ll tell my friends, can we spend marketing budget on new Toyota/lexus ecu cracking? :kekw: geohot: no, buy votes
- https://discord.com/channels/469524606043160576/954493346250887168/1197701819686715462

February 2024

"I’m working on blog post. Will post that together with the script. (UPDATE: Blog post in March 1)

The risk is not super high, but it’s very inconvenient if the rack needs to be replaced. In the meantime I’ve tested it on a second rack pulled from a crashed vehicle, and it worked fine." - Willem
- https://discord.com/channels/469524606043160576/905950538816978974/1205056507973214208
Comma staffer Shane mentions that comma has determined the Corolla radar to be CAN-FD. While not TSK related, there is info that comma has discovered and not released yet.
- https://discord.com/channels/469524606043160576/1194100053879558225/1205747241718124544

March 2024

Major Update from former comma staffer Willem Melching:
- New blog post is out! Extracting the SecOC keys used for securing the CAN Bus on the 2021+ RAV4 Prime. https://icanhack.nl/blog/secoc-key-extraction/
  
  Research started all the way in 2022, but took many evenings of reverse engineering to get code execution.
  
  PoC: https://github.com/I-CAN-hack/secoc
- - Extracted the firmware from an ECU, using Fault Injection to bypass the locked debug port.
  - Reverse engineered the application code, to understand how SecOC was implemented and find the location of the keys in RAM.
  - Reverse engineered the bootloader, to understand how the update procedure works and how we can upload and run shellcode.
  - We built a shellcode that extracts the keys from RAM and sends them out over CAN, then reboots the device.
- It is a long read, but it is exactly why this is such a hard problem and there are some serious hurdles to overcome when it comes to extracting the keys.
- An incomplete exerpts of some other information:
  - There is a way to extract the SecOC key from the RAV4 Prime without disassembly.
  - During the construction of the payload, a secret key must have been extracted from the firmware in order to upload code to the EPS, run it, and extract the key. This isn't correct secure design but it lets third parties like comma.ai and I-CAN-hack to extract the key by uploading temporary code to the EPS to extract the key.
  - By not using the "Hardware Security Module" in the firmware, the key can be extracted from memory. Newer cars may use the HSM, which hides the key from memory, and getting the key out from those is an unsolved problem. What are the newer cars is unclear, but the 2023 Corolla Cross they looked at was using the HSM.
- Some people are looking to get the key from their Rav4 Prime
Discord Followups on comma.ai Discord:
Willem: "Grab your SecOC key and share a route in #⁠toyota-security and I'll finish the car port for the RAV4 Prime!"
There is some discussion on whether it is possible to intercept the key during a re-keying process. (#general)
hdoublearp on Discord was able to retrieve their SECOC key with Willem's script.
hdoublearp report on his collaboration with Willem
- "There is some progress on the port, thanks to Willem, lateral is working. Still some missing safety features, but the initial issues with the Prime’s new PCM messages are sorted out. Willem had to make some changes to account for gearing difference in the Prime compared to other models. I’ve sent my latest feedback and test scenarios to him, and will continue working with him on it.
- hdoublearp posts a video. It is a video of an assisted lane change on a RAV4 Prime, a feature that does not exist on TSS2 but does in openpilot.
  
  2619375277588803360.mov
There is still work to figure out some of the new messages.
A second RAV4 Prime by @chrispypatt seems to have come online from Willem's work.

April 2024

May 2024

June 2024

July 2024

August 2024

A suggestion is made again to try to make a unified patch in a repo for TSK users.
Willem, Greg, and Robbe wins the DEFCON Car Hacking Village CTF and with it, a Model 3. (X, formerly known as Twitter)
- "We did it again!!! We got 1st place in the #defcon32 @CarHackVillage CTF. This year we won a Tesla Model 3, and the whole team has their own Black Badge now 😎. @gregjhogan @robbederks"
META: GitHub discussions have been shuttered in favor of all discussion going on at Discord. . Please link users to https://github.com/optskug/docs/ for the latest news/history from here on out. Unfortunately, there's no way to make old GitHub links redirect so this is the best that can be done. The old link, for reference is: https://github.com/commaai/openpilot/discussions/19932
gregjhogan clarifies what the first byte of a UDS firmware version is. It's not a bootloader version?
- "The first byte returned when reading the firmware versions using UDS read data by id isn't part of the version number, it is how many applications are running on the ECU (for example if it has two cores, there may be a separate application running on each core) and it tells you how many you can extract from the rest of the data returned."

This is an image of the CAN BUS traffic on a Rav4 Prime. The "checksum" for the Lane Keep Assist messages are now very high in entropy, indicative of some sort of signing or encryption being used. ↩

Name		Name	Last commit message	Last commit date
Latest commit History 17 Commits
archive		archive
README.md		README.md

sthompson-celerity/docs

Folders and files

Latest commit

History

Repository files navigation

openpilot/etc. on Toyota/Lexus/Subaru with TSK/ECU SECURITY KEY

Background

List of vehicles with Toyota ECU Security Key

Setup Guide

Support Status Overview

Bounty Statuses

🗳️ comma.ai Vote for Toyota Security

👥 Communities Bounty

Pictures of TSK'd and non-TSK'd Camera ECUs

Current History

Background

Timeline

2013

August 2020

October 2020

November 2020

December 2020

January 2021

February 2021

March 2021

April 2021

May 2021

June 2021

July 2021

August 2021

September 2021

October 2021

November 2021

December 2021

January 2022

February 2022

March 2022

April 2022

May 2022

June 2022

July 2022

August 2022

September 2022

October 2022

November 2022

December 2022

January 2023

February 2023

March 2023

April 2023

May 2023

June 2023

July 2023

August 2023

September 2023

October 2023

November 2023

December 2023

January 2024

February 2024

March 2024

April 2024

May 2024

June 2024

July 2024

August 2024

Footnotes

About

Resources

Stars

Watchers

Forks

Releases

Packages 0

Packages