A set of tools to edit and flash both factory and custom made VBF files using a SocketCAN compatible interface.
Developed as a part of an Open Source Focus RS tuning stack but should be useful with many other models as well.
$ pip3 install can pyserial crccheck
It can be used as a module to provide ISOTP implementation and UDS functionalities including SecurityAccess
$ ./vbflasher.py can0 /tmp/E3B1-14C039-AA.vbf /tmp/G1FC-14C036-AF.vbf /tmp/G1FC-14C381-AF.vbf
$ ./vbfextract.py /tmp/G1F7-14C367-AL.vbf
[+] DATA: G1F7-14C367-AL loaded
Extracting: 0x00c08000, 0x2000 bytes... OK
$ perl -e 'print "\xAA\x00" x5' | dd of=/tmp/G1F7-14C367-AL.vbf.0x00c08000 bs=1 seek=$((0x136a)) conv=notrunc
$ ./vbfmake.py --sw G1F7-14C367-AL-170C --type DATA --can CAN_HS --ecu 0x703 --fix-checksum --out /tmp/G1F7-14C367-AL-170C.vbf --erase-memory 0x00c08000:0x00002000,0x00ccfe80:0x00000180 0x00c08000:/tmp/G1F7-14C367-AL.vbf.0x00c08000
[*] Generating DATA VBF file for 0x703
[+] Adding 0x2000 bytes block from /tmp/G1F7-14C367-AL.vbf.0x00c08000 at 0x00c08000
[*] Calculating checksum for G1F7-14C367 ...
[+] Checksum 0x59ae. Fixed!
[+] Writing /tmp/G1F7-14C367-AL-170C.vbf ...
$ ./vbflasher.py can0 /tmp/G1F7-14C368-AA.vbf /tmp/G1F7-14C366-AL.vbf /tmp/G1F7-14C367-AL-170C.vbf
[+] SBL: G1F7-14C368-AA loaded
[+] EXE: G1F7-14C366-AL loaded
[+] DATA: G1F7-14C367-AL-170C loaded
[+] Successfully opened can0
[+] Starting Diagnostic Session 0x02... OK
[ ] Unlocking the ECU...
[+] Got seed: 1f 7c 69
[+] Magic bytes: 0xfa5fc0
[+] Sending key: 9a 64 ce
[+] Success!
[*] Loading SBL...
[ ] Requesting download of 0x000003d0 bytes to 0x00e00000
[+] Sending 0x03d0 bytes block # 1/1... OK
[+] Transfer done.
[+] Calling SBL at 0xE00000... OK
[*] Flashing EXE...
[+] Erasing memory:
0x00c0a000: 0x5000 bytes... OK
0x00c10000: 0x30000 bytes... OK
0x00c40000: 0x20000 bytes... OK
0x00cc0000: 0x10000 bytes... OK
[ ] Requesting download of 0x00005000 bytes to 0x00c0a000
[+] Sending 0x0400 bytes block #20/20... OK
[+] Transfer done.
[ ] Requesting download of 0x00050000 bytes to 0x00c10000
[+] Sending 0x0400 bytes block #320/320... OK
[+] Transfer done.
[ ] Requesting download of 0x00000f00 bytes to 0x00cc0000
[+] Sending 0x0300 bytes block # 4/4... OK
[+] Transfer done.
[ ] Requesting download of 0x00008378 bytes to 0x00cc1000
[+] Sending 0x0378 bytes block #33/33... OK
[+] Transfer done.
[ ] Requesting download of 0x000003e4 bytes to 0x00cca000
[+] Sending 0x03e4 bytes block # 1/1... OK
[+] Transfer done.
[ ] Requesting download of 0x00003e5c bytes to 0x00ccc000
[+] Sending 0x025c bytes block #16/16... OK
[+] Transfer done.
[*] Flashing DATA...
[+] Erasing memory:
0x00c08000: 0x2000 bytes... OK
0x00ccfe80: 0x180 bytes... OK
[ ] Requesting download of 0x00002000 bytes to 0x00c08000
[+] Sending 0x0400 bytes block # 8/8... OK
[+] Transfer done.
[?] HWPartNo: G1F7-14C365-AE
[?] PartNo: G1F7-7H417-AK
[?] Checking current strategy... G1F7-14C366-AL
[?] Current calibration: G1F7-14C367-AL