Bought 719 locally.


Awesome! Here it is $30 + $10 core fee (CDN) at the pick 'n pull for one.

Here is my experimental branch if you want to take a look https://github.com/cmolson/volvo-cem-cracker/tree/faster-attempt

It has all the changes I've made so far, not ideal for a pull request I don ...

Ok, I almost bought it, but ebay showed me an ad w/ cheap DSLogic Pro knock-off, so I bought one instead ;) I feel my 8MHz Saleae knock-off limits me and for sure I need a 400 MHz logic analyzer that works with sigrok ;)


I have 3 P1 CEMs. I am sending one away, and I can send you one as well if ...

Checked that hypothesis, the interrupt comes in about 35 us after the last (ACK) bit of the reply.


Interesting, sorry today I decided to get my K-line working so I could try this on my P2. (the keep alive worked great!)

If I disable the check for intr here:


@@ -375,7 +373,7 @@ bool ...

vtl wrote: 20 Feb 2022, 10:05 Brick CEM analysis: viewtopic.php?p=582635#p582635 The dump sent to your email found in git commit.

Thank you!

I did wire up a TJA1020 to try this in my 2004 CEM-B. Part number is 30657629.

If anyone has a flash dump for this model I would like to take a look. Thanks!

blasaab, regarding the patch above, it contains the lines that were removed (- sign) and ones that I replaced them with (+ sign).

I'm not really convinced there is a difference between the 719 I have and the 720, but I can do more comparisons.

I can mail you one of my 719 or the 720. The 720 is just the single CPU board now, I removed the fuse/relay boards.

This patch also works, so my thought is that the FlexCAN_T4 ...

I do not have CAN_LS connected to this CEM on my bench, so I don't think it is that. I also logged messages in the can interrupt routine that set intr = 1. All messages were just responses to the unlock routine...

I also disable the LS can init, no change.

Update: Deleted the diff I attached ...

I do have something like that I can use.

I tried the delayMicroseconds, no luck.

Another piece of information, disabling interrupts on your branch makes it work:

@@ -375,6 +375,7 @@ bool cemUnlock (uint8_t *pin, uint8_t *pinUsed, uint32_t *latency, bool verbose)
canMsgSend (CAN_HS, 0xffffe ...

Yes, I can try that change. Will take a few minutes as I soldered the board together in order to test in my car last night. I'll add jumpers to pick CANL or CRX.

Just to make it a bit clearer, I am confused as to why this does not work:


limit = TSC + 2 * 1000 * clockCyclesPerMicrosecond() / 4 ...

I pulled the changes, but it did not work. I will run it with more logging but I am still trying to better understand why my change works. If I take your change, and just add the "limit = TSC + 2 * 1000 * clockCyclesPerMicrosecond() / 4;" then it works...

As I mentioned, with my change. We exit out ...