How to decrypt zip file password for mmi update?

[RSNAV]

Hi,
I have 4g0906961 update zip and want to update my instrument cluster using sd card update via mmi.

Details:
<pack: Name> 20140630-TopKombi-SW0519-FAT32-SD-1GB-TPKWW519AU-TPI-4G0906961-A6_A7_A8.zip.001 </ pack: Name>
<pack: Count> 1 </ pack: Count>
- <pack: Checksums>
<pack: the Checksum the Value = "441b62cefbf482a17997c38268ca35e3" the Name = "20140630-SW0519 TopKombi--the FAT32-the SD-1GB-TPKWW519AU-TPI-4G0906961-A6_A7_A8.zip.001" />
</ pack: Checksums>
<pack: Size> 14586194 </ pack: Size>
<pack: Zugversion> SW0519 </ pack: Zugversion>
<pack: SdFormat> FAT32 </ pack: SdFormat>
<pack: SdType> SDHC </ pack: SdType>
<pack: Capacity> 1 </ pack: Capacity>
<pack: Svm> TPKWW519AU </ pack: Svm>
<pack:Tpi> TPI </ pack: Tpi>
<pack: Remarks />
<pack: Password> 37FUyv7jHYP+N9XZOggksVC750rKEMypY9vJVBirj/A=</ pack: Password>
<pack: LastUpdate> 2015-06-25T15: 46: 59.3190000 + 01: 00 </ pack: LastUpdate>

Key: K73HcgjPNpZWD2n66TxvBZ3CpjY8bBcODeRseEVrhyg=

Any help to figure out the zip password would be appreciated.

[Vlad3]

You cant update instrument cluster via mmi and with sd card Daniel:)


Edit:Sry, my mistake, mixed up 4G with 8R.

[RSNAV]

[QUOTE = Vlad3; 626533] You cant update the instrument through Daniel :)[/ QUOTE]

Thanks Vlad.
Nevertheless, this was proven that Pt number 4G0 906 961 (SD card) allow A7 instrument cluster to be updated via MMI.
I have the zip file for the SD card contents from Audi's Service42, so I want to unzip the file to check the EEPROM parameters. It has something to do my new development so that's why I am asking help here. I see some members here know how to unzip the file with the information above and I am waiting for a help.

[qqq99944]

AudiSVM_Infotainmentupdate

[RSNAV]

[QUOTE = qqq99944; 626549] AudiSVM_Infotainmentupdate [/ QUOTE]

Спасибо.
Ты самый лучший!

[car_driver]

Can someone help me with this Password?

<pack:Name>4M0906961C</pack:Name>
<pack:Svm>MI2HIGHEU2519</pack:Svm>
<pack:Tpi>TPI</pack:Tpi>
<pack:Remarks></pack:Remarks>
<pack:Password>kfr7aU55neW8trbZc2q7Xw==</pack:Password>

Thank you!

[congo]

Audi_MIB2_C7PA

[car_driver]

It works! Thank you.

[piotrekpiec]

Can you help decrypt this pass?

<pack:Name>4M0906961BF</pack:Name>
<pack:Password>pn7nPhd9BrE0Fg8WGqs1Yg==</pack:Password>

This is code for pass:
K73HcgjPNpZWD2n66TxvBZ3CpjY8bBcODeRseEVrhyg=

Thank you

[chris2011]

Is this aes encryption?

Why not copy it to SD card with sd creator?

[piotrekpiec]

Becouse is compressed zip. I don't know what encryption is.

[piotrekpiec]

Can somebody help and tell me how to use sdcreator from mirrorserver?

[MMI]

Hi,

You can't use the sd card creator without connection to Audi servers. It needs some kind of connection to work.

regards

[car_driver]

Can someone help me with this Password?

<pack:Name>4M0906961DA</pack:Name>
<pack:Svm>MHI2ER3663</pack:Svm>
<pack:Tpi />
<pack:Remarks />
<pack:Password>/fqOd4rpeSmDpkcLAU0Rtw==</pack:Password>


Thank you!

[romanesh]

Can someone help me with this Password?

<pack:Name>4M0906961DA</pack:Name>
<pack:Svm>MHI2ER3663</pack:Svm>
<pack:Tpi />
<pack:Remarks />
<pack:Password>/fqOd4rpeSmDpkcLAU0Rtw==</pack:Password>


Thank you!


How did You access the service-42 MMI database ?
Do You have a program SD make and access to the database ?
After people help decipher the hash You lay out a software for people or simply ask for help to decrypt a hash?

[herr_frei]

Can someone help me with this Password?
4M0906961DA
MHI2ER3663


/fqOd4rpeSmDpkcLAU0Rtw==Thank you!L93SdFrN7

[car_driver]

Thank you. It works!


L93SdFrN7

[car_driver]

I don't have Access to service-42 database.
But i have some Firmware Updates.



L93SdFrN7


How did You access the service-42 MMI database ?
Do You have a program SD make and access to the database ?
After people help decipher the hash You lay out a software for people or simply ask for help to decrypt a hash?

[mobista]

Anyone have pass for:

iXFWMxyg979jDEHSwqXi4Q==
2019-05-18T08:59:07.6134754+02:00

[congo]

And what is it from ?

[mobista]

pack:Zugversion>K3344</pack:Zugversion><pack:SdFormat>FAT32</pack:SdFormat><pack:SdType>SDHC</pack:SdType><pack:Capacity>8</pack:Capacity><pack:Svm>MHI2ER3344</pack:Svm><pack:Tpi/><pack:Remarks/><pack:Password>iXFWMxyg979jDEHSwqXi4Q==</pack:Password>

[herr_frei]

Try 9oH53Xh

[mobista]

Works great. Thanks!

Does anyone knows pass algo?

[Lapkritinis]

Hello, I was wondering how to do it on my own.
Password found in xml - is base64 encoded 16 bits hex.
That longer "zip password" is base64 encoded 32 bit hex. That could be AES256 encryption key, but even if I do use decrypt with IV all 00, I get some rubish in output.
Anyone can give some guidance?

[PopDog]

@Lapkitinis i got a not working copy of the SD Updater Folder (can't find the Installer anymore, there it started once but without a server i deinstalled and deleted it).
I opened a DLL File with disassembler. It was programmed in .NET.

Because i'm not familiar with programming, there I found something. (2-3 long strings which could be the key) but don't understand how it is used. Encryption and Decryption is there described and works over rijndaelmanagedv2 so possible some AES Encryption -> maybe AES256 with Base64 Encoding

Maybe a programming crack understands something and can build a quick n dirty tool.


First it starts something called - get_key and get_IV
when pressing there, it sends me somewhere, where this .ctor string is which you can find also down there after base64 string @MemoryStream:

then back to the normal script -> it sets the key, the IV and a Mode -> System.Security.Cryptography.CipherMode

then it starts something like this

call unsigned int8[] [mscorlib]System.Convert::FromBase64String(string)
newobj instance void [mscorlib]System.IO.MemoryStream::.ctor(unsigned int8[])
then it starts some action which can end in a red line to a script with a false command, or a green line with something other.

.ctor string sets following two things:

ldtoken valuetype __StaticArrayInitTypeSize=9 <PrivateImplementationDetails>::E8C040FA7AE8F580FCF9EDAB3EC4CDC003EF9775 <-- possible secret key?
call void [mscorlib]System.Runtime.CompilerServices.RuntimeHelpers::In itializeArray(class [mscorlib]System.Array, valuetype [mscorlib]System.RuntimeFieldHandle)
stloc.0
ldstr aFroahasshasvgh // "FRoaHAsSHAsVGhkLEhke" <-- possible the secret or other salting key?


Other possibility is try to Bruteforce the pass. I only got it working with JtR but for winzip it can only bruteforce over cpu which is very slow.
A zip2 and pkzip2 hash is extracted with zip2john. Other tool I use hashcat (can use gpu) don't accept the zip2 hash and pkzip2 is still in development and not in the official release still trying to build here something. but till now i don't had success with it, because other ppl cracking those passes before and I stop it.

[Lapkritinis]

Thanks, but it didn't helped. Maybe you have some more info? It's not clear what encryption method was used, neither what was IV. E8C040FA7AE8F580FC F9EDAB3EC4CDC003EF9775 is 20 bytes length - not sure where to use that one.

[sergey307]

Who knows password for 4M0906961CC?
pack:Password>k7sN2j2kAvcY3njoXhfDxw==</pack:Password>
I decripted to this one - lKoiof1&!jhfkij, but there is mistake, I don't know where exactly

[romanesh]

Does anyone have the updates for VC 8S0906961AK ?
Please share.

У кого-нибудь есть обновления для VC 8S0906961AK ?
Пожалуйста, поделитесь.

[congo]

https://mega.nz/#!s0gUSSYS!KWdJJuoMBmY-Lvdlyyu41uXcEldKc6jGgfjMHRcLamY

[congo]

Who knows password for 4M0906961CC?
pack:Password>k7sN2j2kAvcY3njoXhfDxw==</pack:Password>

IKoiofl&!jhfkij

[romanesh]

https://mega.nz/#!s0gUSSYS!KWdJJuoMBmY-Lvdlyyu41uXcEldKc6jGgfjMHRcLamY
Thanks so much

[sergey307]

IKoiofl&!jhfkij

Thanks a lot, two mistakes in my variant)) and I was unsure only in first symbol.

[romanesh]

Please Help decrypt DES(unix) passwordDES(unix)

YmGRVkkBszEF.

[congo]

Hm, dont have it. What is it from ?

[romanesh]

Hm, dont have it. What is it from ?
(0615) - Korea mib2 q7

[car_driver]

Has anyone the Zip password for following file?

<pack:Name>4M0906961DF</pack:Name>
<pack:Password>tzrE/s61aCZ4T205/CfBcw==</pack:Password>

[jiangbo2571]

D6sK8gV

[car_driver]

Thanks, it works!


D6sK8gV

[car_driver]

Has anyone the Zip password for following files:

<pack:Name>4M0906961DQ</pack:Name>
<pack:Zugversion>MHI2_ER_AU57x_K2589</pack:Zugversion>
<pack:Password>7BjzYKGQ2bwVjpSJTnPgCw==</pack:Password>


and

<pack:Id>4M0906961</pack:Id>
<pack:Zugversion>P0040</pack:Zugversion>
<pack:Password>37FUyv7jHYP+N9XZOggksVC750rKEMypY9vJVBirj/A=</pack:Password>


Thank you!

[congo]

Qcp9Bz6F
AudiSVM_Infotainmentupdate

[car_driver]

Thank you very much!!!

[piotrekpiec]

Hello
Can somebody share root pass for 4M0906961BG?
Thank you

[romanesh]

Does anyone have the updates for VC 8S0906961AL ?
Please share.

[sergey307]

Does anyone have the updates for VC 8S0906961AL ?
Please share.

https://drive.google.com/open?id=1bDvyNkskMg1Fi_E0y83fmQfhJThzYv9s

[romanesh]

...


Thank you
very much..

[romanesh]

Please Help decrypt DES(unix) password

DES(unix)

IByYGDDGItq6k

[sergey307]

Please Help decrypt DES(unix) password

DES(unix)

IByYGDDGItq6k




IByYGDDGItq6k = ea2giuc8

[car_driver]

Hallo,



has anyone the Zip password for following files:


<pack:Name>3G0919360CP</pack:Name>

<pack:Password>qNLYKtKq9EGl/Va96UJfaA==</pack:Password>

<pack:Name>3G0919360EC</pack:Name>
<pack:Password>MW5I5sf6+ud1towBLQvLjQ==</pack:Password>

<pack:Name>3G0919360GE</pack:Name>
<pack:Password>l0p3S1I/GQ4FKq7TCbICYg==</pack:Password>

Thank you!

[jiangbo2571]

3G0919360CP---P0870

[jiangbo2571]

you telgream?

[mibmaster]

3G0919360CP pw = P0870
3G0919360EC pw = P0639D
3G0919360GE pw = P0876D

[car_driver]

Thanks!


3G0919360CP pw = P0870
3G0919360EC pw = P0639D
3G0919360GE pw = P0876D

[romanesh]

ea2giuc8
Thank you
very much..

[Zdenek]

pls: ug6HiWQAm947Y
Thanks

[hrdinaveliky]

Please this hash: OJYl.aBOIdAYk
Thanks

[acetonazzz]

Maybe someone have access to SDcreator?
Need help

[Bas]

As a test i downloaded a bunch of firmware from a server.
3G0919360AC and 3G0919360AA

From both firmwares i have the xml file and all the zip files (.z01 till .z41 for example). However if i want to open the mail Zip file i get an error that it could not be opened als archive.

Could somebody help me with it? How do i join all the files and enter password.

[Bas]

Can somebody calculate pass for me:
<pack:Name>V0020170901</pack:Name>
<pack:Password>8Or4EgpinyS/4WzPvl1lDA==</pack:Password>

<pack:Name>V0020170902</pack:Name>
<pack:Password>IzInGvpkm0igH57ajamCkA==</pack:Password>

<pack:Name>V0020171001</pack:Name>
<pack:Password>a/v5X2AxcUrKJ3HS/HS6yA==</pack:Password>

<pack:Name>V0020171002</pack:Name>
<pack:Password>hptVG5BYWlhRor6KwUUZXQ==</pack:Password>

<pack:Name>V0020180501</pack:Name>
<pack:Password>flFoyr/hH4BbIanNlupAPg==</pack:Password>

I can share the files when unpacked.

[mibmaster]

V0020170901 = SkodaMIBfirst
V0020170902 = SkodaUpdateMIB
V0020171001 = Skoda_MIB2
V0020171002 = Skoda2017_Dez
V0020180501 = blank, no password

Have fun!

[Bas]

V0020170901 = SkodaMIBfirst
V0020170902 = SkodaUpdateMIB
V0020171001 = Skoda_MIB2
V0020171002 = Skoda2017_Dez
V0020180501 = blank, no password

Have fun!


Thank you, unfortunatey all the zips have bad headers. Any tips to recover them?

[mibmaster]

@Bas:
It's strange, try to unpack in latest WinRar or 7zip

[Bas]

@mibmaster

i tried 7zip, winzip and winrar. Downloaded with other internet connection and different pc, same results

[mibmaster]

@Bas:
Upload all files of one pack somewhere and send me the link. I'll take a look at it. From where have you downloaded these files?

[Bas]

@Bas:
Upload all files of one pack somewhere and send me the link. I'll take a look at it. From where have you downloaded these files?

Thanks for the help. I've sent you a PM with the link etc

[harwin3]

I decoded 322 passwords, more to come.

have fun with it

https://mega.nz/file/Iu5FgADT#D6o3Bb3MRLGnbuGyGmIYkqfgMFuYeuO_cMnXdltVF iQ

[onyx4]

do you can say, how you decoded passwords :rolleyes:

[Chini]

do you can say, how you decoded passwords :rolleyes:
Something like this: echo qNLYKtKq9EGl/Va96UJfaA== | openssl enc -aes-256-ecb -d -base64 -K <AES KEY>

[vag-flashdaten]

Is there access to mirrorserver2 or is it blocked?

[Moe2501]

Hi,
does anybody has pass for
MU221 S1056
Best Regards

[totalfree]

Something like this: echo qNLYKtKq9EGl/Va96UJfaA== | openssl enc -aes-256-ecb -d -base64 -K <AES KEY>

Hi.
Can you give the key <AES KEY>?
Thanks

[ahmedmph]

Greetings all

i would like to have the file of my car MMI 4M0906961DF.zip

[Versus]

Please decrypt password:
<pack:Password>4nYZ4ze040yXqXGPFNPU2A==</pack:Password>

[congo]

Here you go -> VST0561

[mobista]

Your password is: VST0561

[Versus]

Thanks, working pass.

[Bas]

Can somebody decrypt this pass

<pack:Password>aoEj2/FuRxbg9WwrI+3+fQ==</pack:Password>

[jiangbo2571]

​Eliska1972

[Bas]

thank you, is working

[MovieKnight]

It looks like these Updates are not listed anywhere. Zip Files has Password. Somehow possible to decrypt for us?

4G0906961M <pack:Password>wojE6uggzLdHCTAxffdEQQ==</pack:Password>
4K0906961AF <pack:Password>FXuFthXOAav2xZ+I2iksuw==</pack:Password>
4K0906961AG <pack:Password>rBTsrRJhpvUzBsRSUUJ87w==</pack:Password>
4N0906961AG <pack:Password>Znee6LCZW/8iveFp0OcQLg==</pack:Password>
4N0906961AK <pack:Password>li61944U1+A4078G4799mw==</pack:Password>
4N0906961AM <pack:Password>+F6Bz4Q6rFgSg4qB4mrGyQ==</pack:Password>
4N0906961AN <pack:Password>2IPbzODn3rvZ4A5UAzL6fw==</pack:Password>
8S0906961AN <pack:Password>kz4a2568wmsQSXUiYHkJ9g==</pack:Password>
8S0906961AQ <pack:Passwort>0cNHzo0FvFj3ar6WIMr1bQ==</pack:Passwort>
8W6906961A <pack:Passwort>I9CKyYy7izMMNcGPweZiUQ==</pack:Passwort>
8W6906961C <pack:Passwort>+JzrXVcp4wX5WLahVJMQpQ==</pack:Passwort>
8W6906961E <pack:Passwort>k+J+gAdF/GI6dzcE5+SdTQ==</pack:Passwort>
83A906961A <pack:Passwort>zpe5ZEdZbDe857Wj3/84Ig==</pack:Passwort>

[congo]

​6753hF3
ksznh6G4
haF6h7
tF8dL4
0n3Sd5
et7Njh9
6Gbm8D5
GepmFg286S
w8bUndP
kOj5f7D4
tgen6G
TlNv6s
6G4dF5

[MovieKnight]

thank you congo :) you are the best!

[Bas]

Can somebody decode theses for me?

<pack:Password>K/8Y4YkRngBDpBpkKZsSCw==</pack:Password>


<pack:Password>bEWrJkGKrZxoxAGJZAYpN/LTo1cKy1TqlBiic28QGas=</pack:Password>

[mib2pmaster]

Interesting pass ... what software is that for ;)

Deniska.1984
H6.VR,Mr|#F@YQS@Byk&

Regards.

[Bas]

Interesting pass ... what software is that for ;)

Deniska.1984
H6.VR,Mr|#F@YQS@Byk&

Regards.

thank you!

It is Skoda MEN3 firmware. I have a unit that had SK370x P9494 MU464. Now updated to P0113 with MU469, but i want to update it to SK370 P2345L MU1790.

Do you have any ideas? When ready Meta it stays blank. I have tried some older versions, but no luck.

https://turbo-quattro.com/blob:https://web.whatsapp.com/ff4d9cda-ab6a-4552-9f03-c532c6642242

[Bas]

it worked, i updated the unit from 469 to 1790. Again, thanks for the passes.

[Versus]

Please dexrypt password
<pack:Password>4nYZ4ze040yXqXGPFNPU2A==</pack:Password>

​Thanks

[mib2pmaster]

VST0561

[pupu14]

Hello!

Could somebody crack the password for these?

1) flFoyr/hH4BbIanNlupAPg==
2) ptaUQ69C4IgAb3FlX/SyuA==
3) zjjVF8OEuIKCBNkWEb2kNw==

[jiangbo2571]

Hello!

Could somebody crack the password for these?

1) flFoyr/hH4BbIanNlupAPg==
2) ptaUQ69C4IgAb3FlX/SyuA==
3) zjjVF8OEuIKCBNkWEb2kNw==




1 no
2 1701
3 SW0108

[pupu14]

1 no
2 1701
3 SW0108

Thank you very much!

[pupu14]

Can someone please help me with this one?

4N0906961AE / Pass: 9CUY44Ff4lG75omBE1RaUQ==

[congo]

​t5sK8

[sfvuhhsdfg]

May I ask how to unlock these strings in the forum? Can you tell me the method? If so, can you send me a private message? I really need it. If possible, you can use Mege or it can be paid. Thank you.

[sfvuhhsdfg]

Can somebody help me？

[congo]

Post the hash here ...