Built-in FCA seed→key (PowerNet)#

pacifica_obd.fca_keys ships the FCA/Stellantis PowerNet seed→key algorithms and the selector that picks one, so pacifica-obd security can compute a 0x27 key without any external provider file on the modules this project supports.

# show which algorithm would be used (offline, no adapter)
uv run pacifica-obd security --module 742 --device-id 11872 --level 1 --explain

# dry run: read the seed only, never send a key
uv run pacifica-obd security --module 742 --device-id 11872 --level 1

# unlock: send the key (still gated by --confirm)
uv run pacifica-obd security --module 742 --device-id 11872 --level 1 --unlock --confirm

The module is deliberately conservative: a wrong key can lock a module, so whenever more than one algorithm could apply the command refuses and lists the candidates instead of guessing.

1. What is shipped#

src/pacifica_obd/fca_keys.py is checked in (so the tool works with no vendor material present) but is generated. It exposes:

The selector is the recovered dispatcher reduced to what is reachable for a module in pacifica.json: a row is kept only when its ECU type is one of ours or a device id it selects on belongs to one of our modules. Rows keyed solely on something an operator cannot supply — part-number strings (m_c4), guided-procedure overrides (m_ge) — are dropped, so the selector can never silently run one of them.

The table keys on three discriminators an operator can give on the command line:

When the bundled dataset pins a single device id for a module the CLI uses it automatically; when a module has several (e.g. IPC 11871/11872) you must pass --device-id, because the two map to different algorithms.

2. Coverage of the RU module set#

Levels are the security levels (S1, S3, S5, S61, S65) recovered for each module. "resolves with" is what the CLI needs to pick exactly one algorithm.

For example, IPC_PN S1 resolves like this:

$ uv run pacifica-obd security --module 742 --device-id 11872 --level 1 --explain
algorithm: CalculateKeyS1_IPC_PN_Sup00C6_Var49_AlgID0257_V01 (IPC_PN level 0x01; device=11872)

The full 131-row table can be listed from Python:

uv run python -c "from pacifica_obd import fca_keys as k; print(len(k._SELECTOR), len(k.ALGORITHMS))"

Verified vectors#

These algorithm names and keys are the original C#'s output for seed 12 34 56 78; tests/test_fca_keys.py asserts the shipped Python reproduces every one.

Most algorithms take a 4-byte seed; a few (e.g. the ORC row above) take 8, and the key they return is still 4 bytes. fca_keys records both widths: _SEED_WIDTH (how many seed bytes to rebuild from the integer — so an 8-byte seed with leading zeros is not silently shrunk to 4) and _KEY_WIDTH (how many key bytes security_access sends, which is not the seed's length). When security_access calls the provider it passes the seed's real byte length as width, and the provider exposes its output length as key_width.

3. What could not be mapped (and why)#

4. CLI behaviour#

5. Regenerate / verify#

tools/build_fca_keys.py regenerates src/pacifica_obd/fca_keys.py from the decompiled key class, the dispatcher and pacifica.json:

# inputs (once):  ilspycmd -p -o dec --nested-directories <app>.exe
python3 tools/build_fca_keys.py \
    --source dec/ad.cs --map Map.xml --selector dec/af.cs \
    -o src/pacifica_obd/fca_keys.py

Verify the freshly generated module against the original C# (build the harness first with tools/extract_seedkey.py --emit-harness):

python3 tools/extract_seedkey.py --source dec/ad.cs --map Map.xml \
    --emit-harness /tmp/gt && (cd /tmp/gt && dotnet build -c Release)
python3 tools/build_fca_keys.py --source dec/ad.cs --map Map.xml \
    --selector dec/af.cs -o src/pacifica_obd/fca_keys.py \
    --verify /tmp/gt --samples 4
# verify: 512 agree, 0 mismatch, 0 refused over 128 algorithms x 4 seeds

A single algorithm can also be checked the usual way:

python3 tools/extract_seedkey.py --source dec/ad.cs --map Map.xml \
    --emit CalculateKeyS1_IPC_PN_Sup00C6_Var49_AlgID0257_V01 \
    -o /tmp/ipc.py --verify /tmp/gt --samples 8

Unit tests (no hardware, no vendor material):

uv run python tests/test_fca_keys.py

6. Related#

• fca-seedkey-selector.md — how the dispatcher and the Calculate* functions were recovered, and how to build a custom provider from your own install (--provider FILE).
• chrysler-sgw.md — the Security Gateway, bypass, writes.
• pacifica-data.md — the bundled module dataset this selector keys off.