Calibration Verification Number (CVN)

Updated 2010-12-23: corrected CVN for Impreza JZ2F401A, added Forester JP3F501A.

CVN and other things can be retrieved live using OBD-II protocol.

Boxer Diesel models have 8 byte/16 hex-character CVNs.
The ECU calculates this CVN and stores the result in RAM (like int64, big endian).

2009 Impreza Turbo Diesel 2.0 6MT EDM 110 kW / 150 PS 6644D87107 JZ2F302A 4E671CC4 5C4A2744 0xFFFF7668
2009/2010 Impreza Turbo Diesel 2.0 6MT EDM 110 kW / 150 PS 6644D87207 JZ2F401A F5AD7142 FB841734 0xFFFF767C
2009/2010 Forester Turbo Diesel 2.0 6MT EDM 108 kW / 147 PS 6144D87207 JP3F501A EC987843 9084856B 0xFFFF767C

Here’s the main C# code to calculate CVN out of a ROM (file). The used CalcSum method just adds all integers (int32) from given range, exactly like in other 32bit (petrol) ROMs.

/// <summary>
/// Calculates Calibration Verification Number of 8-byte-type..
/// This type of CVN is being used on diesel models.
/// </summary>
/// <returns>
/// A <see cref="System.Int64"/>.
/// To get CVN standard string "XXXXXXXX XXXXXXXX" use .ToString ("X16").Insert (8, " ");
/// </returns>
public long CalcCVN8 ()
  const int ChecksumTablePos = 0xFFB80;
  const int RecordsCount = 17;

  RomChecksum checksumming = new RomChecksum (fs);
  var records = checksumming.ReadTableRecords (ChecksumTablePos, RecordsCount);

  // Could derive #3 from record.Checksum: sum3 = 0x5AA5A55A - record.Checksum
  // Must not extend as signed for return-line below to work correctly.
  ulong sum3 = (ulong)(uint)checksumming.CalcSum (records[3]);

  // #4: Actual sum needed, record.Checksum is different!
  ulong sum4 = (ulong)(uint)checksumming.CalcSum (records[4]);

  // Use return type long (CLS-compliant) instead of ulong as it doesn't matter.
  return (long)((sum3 << 32) | sum4);


2 responses to “Calibration Verification Number (CVN)

  1. is CVN is unique across all cars


    • Yes, in theory it is kind of a hash or fingerprint of the ROM. Since each model and software version have a few differing bytes at least (including ROMID, CALID), the CVN will be different as well.
      Note that such simple sum based algorithm is very weak compared to real Wikipedia: Cryptographic hash function i.e. MD5, SHA-1 etc. Hence modifying a ROM such that CVN matches a previous or other target value is relatively easy to achieve. IMHO if you do the reflash yourself and/or use original OEM software and data, it’s good enough.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.