Bosch eBike DiagnosticTool - eBike OBD2 Diagnostic Suite 8.1.6.0

Sunshine33 said:

Connection to the bike via the USB socket on the Purion display

Modification of the toke...

Click to expand...

• The Bosch diagnostic cable — this is a specific USB cable that connects directly to the BDU's service port (drive unit). Bosch reference: often called "Diagnostic cable" or "Service cable". It has a proprietary connector on the motor side → USB on the PC side.

• Connection via Purion USB → access limited to the display only → communication error with moteur/batterie = normal behavior
• Connection via the BDU diagnostic port → full CAN access → motor + battery + HMI visible
• The fake token allows you to bypass dongle authentication, but you still need the correct physical connection

Sunshine33 said:

The bike connection works perfectly in IBD mode, and access to the motor, display, and battery w...

Click to expand...

• IBD mode (Dealer/Service) → connection via Purion USB works perfectly, access to motor + battery + display OK
• OEM mode → communication error with the motor and battery
• Need: access assisted configuration in OEM mode to change the gear ratio (switching from 10-speed → 12-speed)

1. Check the logs — in the installation folder, look for a logs/ or data/ folder. After an attempt in OEM mode, there should be a detailed log file indicating exactly at which stage communication fails (token authentication, CAN initialization, or a specific request). Can you post the contents of the log?
2. The .bpc file — have you loaded a Mondraker profile (.bpc), or are you using a generic profile? Without the correct .bpc, OEM mode may send incorrect initialization parameters.
3. BDU firmware version — what firmware version is displayed for your Performance Line CX in IBD mode? Recent Gen 2 units have strengthened OEM token validation in the latest firmware updates.

• The HID connection via the adapter (VID: 0x108C, PID: 0x0182) is OK
• Communication with the HMI (Purion, CAN addresses 0x03A/0x03D) works perfectly — services HMI_OnboardCondition_Read and HMI_SystemChargeState_Read respond correctly
• The TesterPresent (0x3E) requests on the HMI (0x022/0x023) receive positive responses (0x7E00)

• The DiagnosticSessionControl requests (service 0x10, sub-function 0x03 = Extended Session) sent to addresses 0x024 (drive unit) and 0x02C (battery) systematically receive an 0x7F10 response — this is a Negative Response for service 0x10, so the drive unit and battery refuse to open the extended session.

1. Look in the patch files for anything related to SecurityAccess, SeedKey, 0x27, or modified DLL/JAR that handle CAN authentication. The fake token alone is not enough — the seed/key algorithm also needs to be resolved on the drive unit and battery side.
2. Which .bpc did you load? The OEM profile normally contains the manufacturer-specific authentication parameters. Without the correct Mondraker .bpc, the tool is probably sending the wrong initialization sequence.
3. Look in the complete log (3.76 MB, we only have an excerpt here) for lines containing SecurityAccess, 0x27, SeedKey, authentication or token — and post those excerpts. This will show whether the tool attempts authentication and fails, or does not attempt it at all.

misterr-d said:

Click to expand...

Gemini said:

Thanks for the log, I analyzed it in detail. Here's what it shows:

What works:

• The HID connection via the adapter (VID: 0x108C, PID: 0x0182) is OK
• Communication with the HMI (Purion, CAN addresses 0x03A/0x03D) works perfectly — services HMI_OnboardCondition_Read and HMI_SystemChargeState_Read respond correctly
• TesterPresent (0x3E) requests to the HMI (0x022/0x023) receive positive responses (0x7E00)

What fails:

• The DiagnosticSessionControl requests (service 0x10, sub-function 0x03 = Extended Session) sent to addresses 0x024 (drive unit) and 0x02C (battery) consistently receive a 0x7F10 response — this is a Negative Response for service 0x10, meaning the drive unit and battery refuse to open an extended session.

Why:

In IBD mode, the tool uses the default session (0x1001) or a dealer session accepted without prior authentication. In OEM mode, it attempts an extended session (0x1003) that requires SecurityAccess (service 0x27) with a valid seed/key beforehand.

The tokenfakeibd fools the PC-side software into displaying the OEM interface, but it does not fool the BDU and battery themselves. These ECUs expect a real authentication handshake before accepting the extended session — and since it does not happen, they reject the request.

To move forward:

1. Look in the раtсh files for anything related to SecurityAccess, SeedKey, 0x27, or modified DLL/JAR that handle CAN authentication. The fake token alone is not enough — the seed/key algorithm also needs to be solved on the drive unit and battery side.
2. Which .bpc did you load? The OEM profile normally contains the manufacturer-specific authentication parameters. Without the correct Mondraker .bpc, the tool is probably sending the wrong initialization sequence.
3. Search the full log (3.76 MB, we only have an excerpt here) for lines containing SecurityAccess, 0x27, SeedKey, authentication or token — and post those excerpts. That will show whether the tool attempts authentication and fails, or does not even attempt it.

In summary: the physical connection works; the problem is the CAN-level authentication that the motor and battery reject in OEM session. You need either the correct seed/key algorithm or the correct .bpc with Mondraker credentials for session 0x1003 to be accepted.

Click to expand...

Sunshine33 said:

You can just delete the error codes

Here is another, more complete log file, there are 3 ge...

Click to expand...

• in the Trace_log: the block around the OEM call (the lines containing 0x10 03 / 1003 / 0x7F10 + the relevant address 0x024 et/ou 0x02C)
• in the remote_log: the lines just before the failure that mention SecurityAccess et/ou 0x27 (seed/key)
• in the log.log</b> or at startup: whether bpc / profile is mentioned (Mondraker profile name, path, “loaded profile,” etc.)
  

• File: 0095061.8.6.0PerfLineCXPedelec25kmhderailleurgeareMTBV2MondrakerB1.11.0.0H1.4.0.0_V8..cff2
• Path: C:\ProgramData\eBikeApp\container\
• Profile: PerfLine CX, 25 km/h, derailleur, eMTB V2 mode, Mondraker
• The double period in the name (..cff2) is suspicious — it could be a naming error that prevents it from opening

• OEM mode active + communication OK with the BDU → load the .cff2 → modify drivetrain parameters → flash

• Is there a plugins/ or lib/ folder containing authentication-related files? (look for names containing security, seedkey, auth, token)
• In the container/ folder, are there any other .cff2 or .bpc files?
• The tokenfakeibd file that you modified — which folder is it located in exactly, and what is its content?

1. Right-click your file explorer (or cmd/PowerShell) → Run as administrator, then copy the files from that elevated window.
2. If that doesn't work, right-click the target folder → Properties → Security tab → Edit → select your user → tick Full control → Apply.
3. Check if the folder is set to Read-only: Properties → General tab → uncheck "Read-only" → Apply to all subfolders.
4. On Windows 10/11, temporarily disable Controlled Folder Access (ransomware protection) in Windows Security → Virus & threat protection → Ransomware protection. This silently blocks file copies even with admin rights.