Ahh yes thank you sir! I got it, but could have RTFM'd first It's actually 0x726 then, 1830 in decimal. Volvo is not consistent at all in where they use decimal and hex for referring to ECUs. I'm clear now anyways.

I forgot to ask, and I may have this wrong...what is the CEM address on P3? I believe it's '726' from VIDA Logs and searching around. That doesn't seem to translate to 11 bit CAN ECU ID hex the way SPA does from 29 bit (CEM is 0x1A01, or 6657 in decimal).

I have updated PINMagic to deal with the DiCE session log files, this should work for P3 now since DOIP is not an option with VIDA. If you have a VIDA log file with a CEM unlock in it, you can get your PIN in seconds. If anyone tries it out let me know if you have problems, I had an extremely ...

That's something like what I said to Rick when he didn't buy the "3-bytes of PIN" theory. But we are in agreement after testing it out.

I don't see anything that proves anything, not that you are required to share it! I guess if you start with 100 million PINs, it's true some are more likely than ...

While going over all 100^4 possible PIN BCD values, there's a 1:8 chance of hitting the right KEY. This gives a PIN match probability of 1 to 100^4 * 1:8 = 1:12.5M. This probability is actually not constant, as the weighted average of 1:8 is really a 1:1 to 1:23 spread.

What makes a PIN more ...

While pin range of 100^4 is 6 times more than 256^3, the right key will be hit with 1 in 100^4/8=12500000 probability for BCD, while for HEX it is 1 in 256^3. BCD is 1:12.5M, HEX is 1:16.7M.

I think that may be it. If the range of PINs is known to be limited to BCD on the P3, then you only have ...

One does not follow from another.

From the hash properties, iterating over 3 bytes in HEX gives you 1:1 match, i.e. only one combination of PIN bytes produces a valid KEY for a given SEED.

Iterating over 4 bytes in BCD gives you match variability from 1:1 to 1:23. I calculated it as follow:

As ...

Couple of example of the real pin from flash and seed/key from the real session.

Got you. One thing I don't have is the PIN from flash, have not read the CEM, not a hardware guy ;-) So what I don't know is what Volvo has set the CEM 01 PIN to. I've been using the cracked PINs to test and program ...

My P3 CEM hits the first collision 30% faster in BCD than in HEX, going up starting with all zeroes. I spent a few days looking at how this can be accelerated, like pick up a better starting point, but wasn't able to come up with something meaningful.

Isn't that probability though? You happen to ...

Not until I write a tool, can I get the timeout worked out, doing it in DSA is too slow clicking a button..