static uint8_t EmitEvent(UDSServer_t *srv, UDSServerEvent_t evt, void *data) {
    if (srv->fn) {
        return srv->fn(srv, evt, data);
    } else {
        UDS_DBG_PRINT("Unhandled UDSServerEvent %d, srv.fn not installed!\n", evt);
        return kGeneralReject;
    }
}
static inline uint8_t NegativeResponse(UDSReq_t *r, uint8_t response_code) {
    r->send_buf[0] = 0x7F;
    r->send_buf[1] = r->recv_buf[0];
    r->send_buf[2] = response_code;
    r->send_len = UDS_NEG_RESP_LEN;
    return response_code;
}

static uint8_t _0x27_SecurityAccess(UDSServer_t *srv, UDSReq_t *r) {
    uint8_t subFunction = r->recv_buf[1];
    uint8_t response = kPositiveResponse;

    if (UDSSecurityAccessLevelIsReserved(subFunction)) {
        return NegativeResponse(r, kIncorrectMessageLengthOrInvalidFormat);
    }

    if (!UDSTimeAfter(UDSMillis(), srv->sec_access_boot_delay_timer)) {
        return NegativeResponse(r, kRequiredTimeDelayNotExpired);
    }

    if (!(UDSTimeAfter(UDSMillis(), srv->sec_access_auth_fail_timer))) {
        return NegativeResponse(r, kExceedNumberOfAttempts);
    }

    r->send_buf[0] = UDS_RESPONSE_SID_OF(kSID_SECURITY_ACCESS);
    r->send_buf[1] = subFunction;
    r->send_len = UDS_0X27_RESP_BASE_LEN;

    // Even: sendKey
    if (0 == subFunction % 2) {
        uint8_t requestedLevel = subFunction - 1;
        UDSSecAccessValidateKeyArgs_t args = {
            .level = requestedLevel,
            .key = &r->recv_buf[UDS_0X27_REQ_BASE_LEN],
            .len = r->recv_len - UDS_0X27_REQ_BASE_LEN,
        };

        response = EmitEvent(srv, UDS_SRV_EVT_SecAccessValidateKey, &args);

        if (kPositiveResponse != response) {
            srv->sec_access_auth_fail_timer =
                UDSMillis() + UDS_SERVER_0x27_BRUTE_FORCE_MITIGATION_AUTH_FAIL_DELAY_MS;
            return NegativeResponse(r, response);
        }

        // "requestSeed = 0x01" identifies a fixed relationship between
        // "requestSeed = 0x01" and "sendKey = 0x02"
        // "requestSeed = 0x03" identifies a fixed relationship between
        // "requestSeed = 0x03" and "sendKey = 0x04"
        srv->securityLevel = requestedLevel;
        r->send_len = UDS_0X27_RESP_BASE_LEN;
        return kPositiveResponse;
    }

    // Odd: requestSeed
    else {
        /* If a server supports security, but the requested security level is already unlocked when
        a SecurityAccess ‘requestSeed’ message is received, that server shall respond with a
        SecurityAccess ‘requestSeed’ positive response message service with a seed value equal to
        zero (0). The server shall never send an all zero seed for a given security level that is
        currently locked. The client shall use this method to determine if a server is locked for a
        particular security level by checking for a non-zero seed.
        */
        if (subFunction == srv->securityLevel) {
            // Table 52 sends a response of length 2. Use a preprocessor define if this needs
            // customizing by the user.
            const uint8_t already_unlocked[] = {0x00, 0x00};
            return safe_copy(srv, already_unlocked, sizeof(already_unlocked));
        } else {
            UDSSecAccessRequestSeedArgs_t args = {
                .level = subFunction,
                .dataRecord = &r->recv_buf[UDS_0X27_REQ_BASE_LEN],
                .len = r->recv_len - UDS_0X27_REQ_BASE_LEN,
                .copySeed = safe_copy,
            };

            response = EmitEvent(srv, UDS_SRV_EVT_SecAccessRequestSeed, &args);

            if (kPositiveResponse != response) {
                return NegativeResponse(r, response);
            }

            if (r->send_len <= UDS_0X27_RESP_BASE_LEN) { // no data was copied
                return NegativeResponse(r, kGeneralProgrammingFailure);
            }
            return kPositiveResponse;
        }
    }
    return NegativeResponse(r, kGeneralProgrammingFailure);
}

enum UDSServerEvent {
    UDS_SRV_EVT_DiagSessCtrl,         // UDSDiagSessCtrlArgs_t *
    UDS_SRV_EVT_EcuReset,             // UDSECUResetArgs_t *
    UDS_SRV_EVT_ReadDataByIdent,      // UDSRDBIArgs_t *
    UDS_SRV_EVT_ReadMemByAddr,        // UDSReadMemByAddrArgs_t *
    UDS_SRV_EVT_CommCtrl,             // UDSCommCtrlArgs_t *
    UDS_SRV_EVT_SecAccessRequestSeed, // UDSSecAccessRequestSeedArgs_t *
    UDS_SRV_EVT_SecAccessValidateKey, // UDSSecAccessValidateKeyArgs_t *
    UDS_SRV_EVT_WriteDataByIdent,     // UDSWDBIArgs_t *
    UDS_SRV_EVT_RoutineCtrl,          // UDSRoutineCtrlArgs_t*
    UDS_SRV_EVT_RequestDownload,      // UDSRequestDownloadArgs_t*
    UDS_SRV_EVT_RequestUpload,        // UDSRequestUploadArgs_t *
    UDS_SRV_EVT_TransferData,         // UDSTransferDataArgs_t *
    UDS_SRV_EVT_RequestTransferExit,  // UDSRequestTransferExitArgs_t *
    UDS_SRV_EVT_SessionTimeout,       // NULL
    UDS_SRV_EVT_DoScheduledReset,     // enum UDSEcuResetType *
    UDS_SRV_EVT_Err,                  // UDSErr_t *
    UDS_EVT_IDLE,
    UDS_EVT_RESP_RECV,
};

enum UDSSecurityAccessType {
    kRequestSeed = 0x01,
    kSendKey = 0x02,
};

typedef struct UDSServer {
    UDSTpHandle_t *tp;
    uint8_t (*fn)(struct UDSServer *srv, UDSServerEvent_t event, const void *arg);

    /**
     * @brief \~chinese 服务器时间参数（毫秒） \~ Server time constants (milliseconds) \~
     */
    uint16_t p2_ms;      // Default P2_server_max timing supported by the server for
                         // the activated diagnostic session.
    uint32_t p2_star_ms; // Enhanced (NRC 0x78) P2_server_max supported by the
                         // server for the activated diagnostic session.
    uint16_t s3_ms;      // Session timeout

    uint8_t ecuResetScheduled;            // nonzero indicates that an ECUReset has been scheduled
    uint32_t ecuResetTimer;               // for delaying resetting until a response
                                          // has been sent to the client
    uint32_t p2_timer;                    // for rate limiting server responses
    uint32_t s3_session_timeout_timer;    // indicates that diagnostic session has timed out
    uint32_t sec_access_auth_fail_timer;  // brute-force hardening: rate limit security access
                                          // requests
    uint32_t sec_access_boot_delay_timer; // brute-force hardening: restrict security access until
                                          // timer expires

    /**
     * @brief UDS-1-2013: Table 407 - 0x36 TransferData Supported negative
     * response codes requires that the server keep track of whether the
     * transfer is active
     */
    bool xferIsActive;
    // UDS-1-2013: 14.4.2.3, Table 404: The blockSequenceCounter parameter
    // value starts at 0x01
    uint8_t xferBlockSequenceCounter;
    size_t xferTotalBytes;  // total transfer size in bytes requested by the client
    size_t xferByteCounter; // total number of bytes transferred
    size_t xferBlockLength; // block length (convenience for the TransferData API)

    uint8_t sessionType;   // diagnostic session type (0x10)
    uint8_t securityLevel; // SecurityAccess (0x27) level

    bool RCRRP;             // set to true when user fn returns 0x78 and false otherwise
    bool requestInProgress; // set to true when a request has been processed but the response has
                            // not yet been sent

    // UDS-1 2013 defines the following conditions under which the server does not
    // process incoming requests:
    // - not ready to receive (Table A.1 0x78)
    // - not accepting request messages and not sending responses (9.3.1)
    //
    // when this variable is set to true, incoming ISO-TP data will not be processed.
    bool notReadyToReceive;

    UDSReq_t r;
} UDSServer_t;

uint8_t fn(UDSServer_t *srv, UDSServerEvent_t ev, const void *arg) {
    switch (ev) {
    case UDS_SRV_EVT_SecAccessRequestSeed: {
        UDSSecAccessRequestSeedArgs_t *r = (UDSSecAccessRequestSeedArgs_t *)arg;
        const uint8_t seed[] = {0x36, 0x57};
        TEST_INT_NE(r->level, srv->securityLevel);
        return r->copySeed(srv, seed, sizeof(seed));
        break;
    }
    case UDS_SRV_EVT_SecAccessValidateKey: {
        UDSSecAccessValidateKeyArgs_t *r = (UDSSecAccessValidateKeyArgs_t *)arg;
        const uint8_t expected_key[] = {0xC9, 0xA9};
        if (memcmp(r->key, expected_key, sizeof(expected_key))) {
            return kSecurityAccessDenied;
        } else {
            return kPositiveResponse;
        }
        break;
    }
    default:
        assert(0);
    }
    return kPositiveResponse;
}

_0x27_SecurityAccess -> Odd: requestSeed -> EmitEvent(srv, UDS_SRV_EVT_SecAccessRequestSeed, &args); -> 
EmitEvent ->  srv->fn(srv, evt, data) -> 
typedef struct UDSServer {... uint8_t (*fn)(struct UDSServer *srv, UDSServerEvent_t event, const void *arg); ...}
-> uint8_t fn(UDSServer_t *srv, UDSServerEvent_t ev, const void *arg)  

#include <stdio.h>
#include "defs.h"
unsigned char data[1000] = { 0x1,0x13,0x2,0x96,0x88,0x0,0x12,0xb0,0x14,0xa6,0x91,0xfe,0xb9,0xd7,0x41,0xaf,0x82,0xcc,0x4e,0xe9,0x47,0x47,0x28,0x4f,0xd1,0x42,0x10,0x52,0x1,0x58,0x90,0xd0,0x3,0x0,0x90,0xd0,0x3,0x2,0x18,0x1 };

unsigned char encvin[1000] = { 0 };
int __fastcall initfunc(char* from_addr, _BYTE* to_addr, int start_index)
{
    _BYTE* v3; // r4
    unsigned int v4; // r2
    unsigned int v5; // t1
    int v6; // r3
    int v7; // t1
    unsigned int v8; // r2
    unsigned int v9; // t1
    char v10; // t1

    v3 = &to_addr[start_index];
    do
    {
        v5 = *from_addr++;
        v4 = v5;
        v6 = v5 & 0xF;
        if ((v5 & 0xF) == 0)
        {
            v7 = (unsigned __int8)*from_addr++;
            v6 = v7;
        }
        v8 = v4 >> 4;
        if (!v8)
        {
            v9 = (unsigned __int8)*from_addr++;
            v8 = v9;
        }
        while (--v6)
        {
            v10 = (unsigned __int8)*from_addr++;
            *to_addr++ = v10;
        }
        while (--v8)
            *to_addr++ = 0;
    } while (to_addr < v3);
    return 0;
}

int main() {

    initfunc(data, encvin, 0x194);
    return 0;
}