Hands-On: Security Access Implementation

#!/usr/bin/env python3
# SecurityAccess Level 1: seed-key exchange implementation
import udsoncan, hashlib, hmac, struct
from udsoncan.client import Client

LAB_SECRET = bytes.fromhex("0123456789ABCDEF")  # lab only!

def compute_key(seed: bytes) -> bytes:
    # HMAC-SHA256 truncated to 4 bytes
    h = hmac.new(LAB_SECRET, seed, hashlib.sha256)
    return h.digest()[:4]

def do_security_access_level1(client) -> bool:
    # Step 1: request seed (subFunction 0x01)
    resp = client.request_seed(0x01)
    if not resp.positive:
        print(f"RequestSeed failed: NRC 0x{resp.code:02X}"); return False

    seed = resp.service_data.security_seed
    print(f"Seed received: {seed.hex()}")

    # Step 2: compute key
    key = compute_key(seed)
    print(f"Computed key:  {key.hex()}")

    # Step 3: send key (subFunction 0x02)
    resp = client.send_key(0x02, key)
    if resp.positive:
        print("SecurityAccess Level 1: UNLOCKED")
        return True
    else:
        print(f"SendKey failed: NRC 0x{resp.code:02X}")
        return False

# Usage:
# client.change_session(udsoncan.services.DiagnosticSessionControl.Session.extendedDiagnosticSession)
# success = do_security_access_level1(client)
# if success: client.write_data_by_identifier(0x0101, bytes([0x05]))

#!/usr/bin/env python3
# Verify lockout: 5 wrong keys → NRC 0x36; then NRC 0x37 during delay
import udsoncan, time
from udsoncan.client import Client

def test_lockout_behaviour(client):
    client.change_session(udsoncan.services.DiagnosticSessionControl.Session.extendedDiagnosticSession)

    # Attempt 1–5: send wrong key each time
    for attempt in range(1, 6):
        resp = client.request_seed(0x01)
        seed = resp.service_data.security_seed
        wrong_key = bytes([0xFF, 0xFF, 0xFF, 0xFF])  # deliberately wrong

        resp = client.send_key(0x02, wrong_key)
        print(f"Attempt {attempt}: NRC 0x{resp.code:02X} ", end="")
        if resp.code == 0x35:
            print("(invalidKey - expected)")
        elif resp.code == 0x36:
            print("(exceededNumberOfAttempts - LOCKOUT TRIGGERED)")
            break

    # Attempt during lockout: expect NRC 0x37
    try:
        resp = client.request_seed(0x01)
        if resp.code == 0x37:
            print("During lockout: NRC 0x37 (requiredTimeDelayNotExpired) - CORRECT")
        else:
            print(f"FAIL: expected NRC 0x37 during lockout, got 0x{resp.code:02X}")
    except Exception as e:
        print(f"Exception during lockout test: {e}")

    # Verify lockout persists after ECU reset
    client.ecu_reset(0x01)  # soft reset
    time.sleep(2)
    client.change_session(udsoncan.services.DiagnosticSessionControl.Session.extendedDiagnosticSession)
    resp = client.request_seed(0x01)
    if resp.code == 0x37:
        print("PASS: lockout persists after ECU reset (NvM-stored lockout counter)")
    else:
        print("FAIL: lockout should persist after reset")

#!/usr/bin/env python3
# Verify service access requires correct security level
import udsoncan
from udsoncan.client import Client

def run_boundary_tests(client):
    results = []

    # Test 1: Write DID without SecurityAccess → NRC 0x33
    client.change_session(udsoncan.services.DiagnosticSessionControl.Session.extendedDiagnosticSession)
    try:
        client.write_data_by_identifier(0x0101, bytes([0x05]))
        results.append(("FAIL", "Write without security should return NRC 0x33"))
    except udsoncan.exceptions.NegativeResponseException as e:
        results.append(("PASS" if e.response.code == 0x33 else "FAIL",
                        f"WriteDID without security → NRC 0x{e.response.code:02X}"))

    # Test 2: Level 2 service (RoutineControl EraseMemory) with only Level 1 → NRC 0x33
    # (After doing Level 1 SecurityAccess)
    # do_security_access_level1(client)
    # try:
    #     client.routine_control(...)  # Level 2 routine
    # except NegativeResponseException as e:
    #     results.append(("PASS" if e.response.code == 0x33 else "FAIL",
    #                     "Level 2 routine with Level 1 access"))

    # Test 3: RequestDownload in ExtendedDiag (wrong session) → NRC 0x25
    try:
        client.request_download(0x00, bytes([0x80, 0x00, 0x00, 0x00]), bytes([0x00, 0x01, 0x00, 0x00]))
        results.append(("FAIL", "RequestDownload in Extended should return NRC 0x25"))
    except udsoncan.exceptions.NegativeResponseException as e:
        results.append(("PASS" if e.response.code == 0x25 else "FAIL",
                        f"RequestDownload in ExtDiag → NRC 0x{e.response.code:02X}"))

    for status, desc in results:
        print(f"[{status}] {desc}")