At the end of the last post related to the ID4Motion, I’d just written a keygen supporting the BMW E39/E46 and BMW E6x/E9x series. However, the features added to the Automatic generation of the CTM license file were based off of the content of the features (FTR) file. When looking through the binaries, I could not determine where the skins were referenced, but there were files that I was still unable to read: ammolite.dat, ammolite.stl and the dat files located in the ECU folder.
Using Ghidra, a quick search of “.stl” and “.dat” shows defined strings for the desired files.
The pseudo-C code shows the reference for the “ammolite.stl” as well as the “readXorFile” function previously encountered when looking into the FTR file.
Switching back to Assembly, and it is easy to identify the static int value used as the XOR seed.
The pseudo-C and Assembly for the Ammolite.dat and ecu.dat files differ from the format used with the FTR and STL files, and does not reference the “readXorFile”. However, looking into the LuaFile::open function shows that it also calls the “readXorFile” using information passed as parameters to the “open” function.
Looking at the decrypted STL (Style?) file JSON shows both the friendly name, as well as the feature string used in licensing. The information in the STL can be used to incorporate all licensable features in the keygen.
Since the Honda, E3x/E4x, and E6x/E9x JDMs all use the same AES decryption key, the Honda JDM was decrypted and the associated FTR and STL files were subsequently decrypted. Use of these files allowed me to add Honda support to the keygen.
The Ammolite and ECU DAT files do not hold features necessary for licensing or beneficial to the creation of the keygen. The Ammolite.dat file appears to be a lua file used for functions to convert CANBus commands and data into information which can be used by the Ammolite GUI.
The ECU DAT files also appear to be LUA files which contain information used to hold and convert ECU specific features. (Ex: Aftermarket ECU Baud rate, supported variables, Sensor raw data : Display Scaling pairs)
The XOR seed values used for the FTR, STL, Ammolite DAT, and ECU DAT (yes, these are all different XOR seeds) were added to the keygen, allowing both encryption and decryption of these files.
JDM – ZIP Update. RSA Signed File used to update the installed application.
FTR – JSON Feature File. Built-in license file, which provides examples of valid licenses.
CTM – JSON License File. Used to update the installed license, including “virginize”, which is a transfer from the current VIN to a new VIN when resold.
STL – JSON Style File. Skin-specific file which includes imagery and qml file locations, colour offsets, fonts and other UI-specific information.
Ammolite DAT – LUA Functions File. Converts CANBus commands to information usable by Ammolite GUI.
ECU DAT – LUA ECU-specific information. Multiple files which contain information needed to communicate with various ECUs, such as baud rate, supported features, and sensor curves.
ID4Motion Keygen – Generate CTM License File – Honda
ID4Motion Keygen – Generate CTM License File – E39/E46
ID4Motion Keygen – Generate CTM License File – E9x
ID4Motion Keygen – Decrypt Ammolite.dat file to Lua
ID4Motion Keygen – Decrypt Ammolite.stl file to JSON
