I found the key order and code on the P1 CEM. I will post the disassembly, but I ended up finding a function (as you described) that was comparing 6 bytes. A bunch of cmp, bne etc. Details: It is still BCD as with the P2 CEM. (so each pin byte is 0x00->0x99) It is located at ROM address 0xFBEF8 The ...

Bought 719 locally. Awesome! Here it is $30 + $10 core fee (CDN) at the pick 'n pull for one. Here is my experimental branch if you want to take a look https://github.com/cmolson/volvo-cem-cracker/tree/faster-attempt It has all the changes I've made so far, not ideal for a pull request I don't thin...