@vtl: Do you know if it's possible to retrieve / brute force / time attack the Immobilizer Code as well?
Or do you know the steps needed....?

I am on a Volvo P1.

Yeah, I finally managed to crack my CEM PIN code. It worked when I bruteforced the last 4 pairs, instead of 3! I am on a Volvo C70 P1. Now I need to remove ITP / MOST Security. If I want to do that through VDASH it needs an IMMO code. What is the best way to proceed? How can I crack that code as well?

Try to add ground first. Do you mean I should connect OBDII pin 4 and 5 to the Teensy GND? The other schematic is basically the same as my "breadboard" version, that had the same result basically, found the first two bytes consistent but did not crack the code. I can do live testing again...

Your circuit has no common ground with the car. What car are you trying to crack? A Volvo C70 2006 I think I have these schematic: https://github.com/vtl/volvo-cem-cracker/blob/master/doc/Volvo%20CEM%20PIN%20Cracker.%20Bosh%20CF160%20version.pdf (This PCB: https://www.pcbway.com/project/shareprojec...

It is not working for me unfortunately. I scrapped my breadboard version in favor of a PCB with 2 CF160's. But I get the same result.
It always resolves to the same first two bytes, and after that it just fails.

Is there anything I can improve on?

Hi there, I am a total electronics noob here, lurking this entire thread. I am trying to make an "easier breadboard" version of vtl's work (which is awesome!). So this is my take. I am worried about how I handle the GND. (I put some colors in the lines to make it a bit easier to see, they ...