Not trying to threadjack, a lot of people here are experts on Volvo modules, and maybe can help me with this. We know key information is in CEM, and we can program new key by reading 28F400 or 93C86 and adding key ID to dump, and write crypt key to the transponder. However the remote is a bit more ...

Has anyone tried to decrypt the Hopping code from the keychain using the 64-bit key that lies on the UEM eeprom?

Here is the pinout of the mc68376 + M29F200BB microcontroller in ETM.

Considering I am also working on an MC683XX chip, I used this Arduino library https://github.com/psobot/arduino-coldfire-bdm It won't work out of the box as it uses Python 3.6 features which have been disabled in Python 3.7 and onwards, specifically nullcontext from contextlib package. However the ...

Hello everyone. I am trying to reverse engineer the firmware of the mc9s12 microcontroller in Ghidra. It uses paged memory access. I do not know how to download the firmware in Ghidra. Does anyone have any experience working with these microcontrollers in Ghidra?

How do I add a key to CEM before 2004? I know the startup code "send key" (40 A3 02 70 70) and it passes successfully (E3 02). I know the access code "send key" (40 A3 42 A5 A5) and it also passes successfully (E3 42). But if you send the command "ID1 - ID code transponder 1...

Please try the J2534 tool, for now works on Hispeed bus(so do not choose anything else), be sure to click 29 bit extended ID. Platform also does nothing useful quite yet. Sources in the near future when everything works correctly. I am happy with the way the monitor works, please test with Mongoose...

Так бесполезно читать в диагностической сессии, ну прочитали, а записать всё равно в ней не можем. Вот если мы можем переписать кусок с пином/пропатчить основную программу и PBL, то был бы смысл. Я не особо даже рассматриваю уже этот металлолом ибо тачки на них уже в стадии вымирания. По части терм...

And that's why I'm leaning towards SBL for CEMB, because for example, in diagnostic mode, you can read the entire flash (512Kbytes), but it takes at least 20 minutes, and reading from the address in programm mode takes many times more. My test SBL reads the flash in 1 minute and 20 seconds, but so ...

Так бесполезно читать в диагностической сессии, ну прочитали, а записать всё равно в ней не можем. Вот если мы можем переписать кусок с пином/пропатчить основную программу и PBL, то был бы смысл. Я не особо даже рассматриваю уже этот металлолом ибо тачки на них уже в стадии вымирания. По части терм...