Welcome to the world's #1 Volvo forum!

Volvo Fixes & Advice since 2001.

Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America).
Post Reply
scaro
Posts: 16
Joined: Thu Apr 22, 2021 1:13 am
Year and Model: Volvo&Audi
Location: Sweden
Has thanked: 5 times

Re: Vida CEM swapping

Post by scaro »

Ok some of you already know this but want to contribute with something to begin with.

This is for P1 V50/S40 06-07 think other MY is the same...
Maybee some +12V isnt needed on CEM. Havnt tested with can termination yet. On my bench harness for old P2 its needed.
Think this will work dont blame me if something burns up :)

A=COCKPIT1 (BLUE)
B=COCKPIT2 (BLUE)
C=FLOOR1 (ORANGE)
D=ROOF1 (BLACK)
E=FRONT1 (GREEN)
F=FLOOR2 (ORANGE)
G=FRONT2 (GREEN)
H=ROOF2 (GREY)

CEM:
FRONT-1:20 -> +12v 30+
FRONT-1:21 -> +12v 30+
FRONT-1:22 -> +12v 30+
FRONT-1:23 -> +12v 30+
COCKPIT-1:28 -> GND
COCKPIT-1:14 -> GND
COCKPIT-1:16 -> +12v X+ Out Dont exist on my connector

SCU:
COCKPIT-1:17 -> +12v 15+ SCU B:3
COCKPIT-1:30 -> +12v X+ SCU B:1
COCKPIT-1:42 -> +12v 50+ SCU B:2
COCKPIT-1:15 -> +12v S+ SCU B:5
COCKPIT-2:13 -> Keylock SCU B:8

SCL:
COCKPIT-2:10 -> +12V Pin2
GND -> GND Pin3

RRX:
GND -> GND Pin3
COCKPIT-1:41 -> Pin1

OBD:
COCKPIT-2:11 -> CAN-HS H OBD 6
COCKPIT-2:12 -> CAN-HS L OBD 14
COCKPIT-2:15 -> CAN-LS H OBD 3
COCKPIT-2:16 -> CAN-LS L OBD 11
+12V 30+ -> OBD 16
GND -> OBD 4&5

LIN:
COCKPIT-2:17 -> LIN SCU A:2 / SCL Pin4
COCKPIT-1:35 -> LIN RRX Pin5

Lowspeed CAN:
FRONT-2:16 -> CAN-LS H "Out" CPM A:4 (120 ohm needed?) Dont exist on my connector
FRONT-2:32 -> CAN-LS L "Out" CPM A:5 ----------------- Dont exist on my connector
COCKPIT-2:8 -> CAN-LS H "Out" CCM 11 -> CCM 10 -> ICM A:7 -> ICM A: 9 -> DIM 10 (120 ohm needed when no DIM)
COCKPIT-2:9 -> CAN-LS L "Out" CCM 9 -> CCM 8 -> ICM A:8 -> ICM A:10 -> DIM 9 ------------------------------------
COCKPIT-2:24 -> CAN-LS H "Out" PHM A:12 (120 ohm needed?) Dont exist on my connector
COCKPIT-2:25 -> CAN-LS L "Out" PHM A:11 ----------------- Dont exist on my connector
FLOOR-2:30 -> CAN-LS H "Out" (120 ohm needed)
FLOOR-2:15 -> CAN-LS L "Out" -----------------

Highspeed CAN:
FRONT-2:15 -> CAN-HS H "Out" (120 ohm needed)
FRONT-2:14 -> CAN-HS L "Out" -----------------
FLOOR-2:16 -> CAN-HS H "Out" (120 ohm needed)
FLOOR-2:14 -> CAN-HS L "Out" -----------------
Last edited by scaro on Tue May 11, 2021 12:13 pm, edited 3 times in total.
244 Turbo (86K miles) 1983
242 B230FK, Rollcage, LSD 1984
244 B21A with R-Sport Turbo-kit 1980
A5 2.0TFSI Quattro Conv. 2012
A4 1.9TDI 1997 BV43, 11mm vp37, 0.26 nozzels, 6speed, A8 brakes front, S4 discs/calibers rear
A4 1.9TDI 1998 Daily

solitaire
Posts: 18
Joined: Fri Mar 19, 2021 11:33 am
Year and Model: v40 2016
Location: Jonava
Has thanked: 3 times
Been thanked: 4 times

Post by solitaire »

15 Volt from power supply, different voltage - different result

Platform: P2
PIN bytes to measure: 4
Number of samples: 30
Number of loops: 1000

Candidate PIN 0x47 0x12 0x68 0x69 -- -- : brute forcing bytes 4 to 5 (2 bytes), will take up to 6 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..done

found PIN: 0x69 0x12 0x25 0x47 0x98 0x68
PIN is cracked in 783.55 seconds
Validating PIN
PIN verified.
done
Attachments
30-sample_15volt.rar
(9.02 KiB) Downloaded 23 times

User avatar
vtl
Posts: 2338
Joined: Thu Aug 16, 2012 1:35 pm
Year and Model: 2005 XC70
Location: Boston
Has thanked: 9 times
Been thanked: 112 times

Post by vtl »

It was said multiple times that a good power source is mandatory. I flashed my bench CEM with a few dumps that people claimed uncrackable and got the pin in the very first pass.
05 XC70, 16 XC60, 19 Tundra
P1+P2 CEM PIN-code retrieval DIY thread: viewtopic.php?f=10&t=85611

scaro
Posts: 16
Joined: Thu Apr 22, 2021 1:13 am
Year and Model: Volvo&Audi
Location: Sweden
Has thanked: 5 times

Post by scaro »

With termination the wiring works good on bench using Vida/Dice.
Wiring isnt finished will add more stuff to it DIM, ECU, DEM... as i have on the P2 one.
Have Teensy4 at home. Just waiting for can transceivers ordered MAX3051 hope they will work?
The other ones wasnt easy to get. Was out of stock and long waiting time.
Attachments
V50 CEM.jpg
V50 CEM.jpg (391.2 KiB) Viewed 523 times
244 Turbo (86K miles) 1983
242 B230FK, Rollcage, LSD 1984
244 B21A with R-Sport Turbo-kit 1980
A5 2.0TFSI Quattro Conv. 2012
A4 1.9TDI 1997 BV43, 11mm vp37, 0.26 nozzels, 6speed, A8 brakes front, S4 discs/calibers rear
A4 1.9TDI 1998 Daily

solitaire
Posts: 18
Joined: Fri Mar 19, 2021 11:33 am
Year and Model: v40 2016
Location: Jonava
Has thanked: 3 times
Been thanked: 4 times

Post by solitaire »

scaro wrote: Tue May 11, 2021 12:34 pm .... Just waiting for can transceivers ordered MAX3051 hope they will work?
...
They will :)
7EE9F3C8-E225-482E-99EA-9187B4B69901.jpeg

User avatar
vtl
Posts: 2338
Joined: Thu Aug 16, 2012 1:35 pm
Year and Model: 2005 XC70
Location: Boston
Has thanked: 9 times
Been thanked: 112 times

Post by vtl »

solitaire wrote: Tue May 11, 2021 1:46 pm They will :)
Will you charge for your cracker firmware update? :lol:
05 XC70, 16 XC60, 19 Tundra
P1+P2 CEM PIN-code retrieval DIY thread: viewtopic.php?f=10&t=85611

solitaire
Posts: 18
Joined: Fri Mar 19, 2021 11:33 am
Year and Model: v40 2016
Location: Jonava
Has thanked: 3 times
Been thanked: 4 times

Post by solitaire »

No
I’m not sell now have just one for my self, all is here in forum for free in my post :)

viewtopic.php?p=569763#p569763

scaro
Posts: 16
Joined: Thu Apr 22, 2021 1:13 am
Year and Model: Volvo&Audi
Location: Sweden
Has thanked: 5 times

Post by scaro »

solitaire wrote: Tue May 11, 2021 1:46 pm
scaro wrote: Tue May 11, 2021 12:34 pm .... Just waiting for can transceivers ordered MAX3051 hope they will work?
...
They will :)
Thanks, have read thru whole thread but must have missed that :)
244 Turbo (86K miles) 1983
242 B230FK, Rollcage, LSD 1984
244 B21A with R-Sport Turbo-kit 1980
A5 2.0TFSI Quattro Conv. 2012
A4 1.9TDI 1997 BV43, 11mm vp37, 0.26 nozzels, 6speed, A8 brakes front, S4 discs/calibers rear
A4 1.9TDI 1998 Daily

User avatar
RickHaleParker
Posts: 5677
Joined: Mon May 25, 2015 2:30 pm
Year and Model: See Signature below.
Location: Kansas
Has thanked: 4 times
Been thanked: 716 times

Post by RickHaleParker »

T5Luke wrote: Wed Apr 28, 2021 4:26 am Yes, i mean D connector. I would give it a try at P1.
Did you ever get around to trying the hard wire stay alive on the P1?
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

User avatar
RickHaleParker
Posts: 5677
Joined: Mon May 25, 2015 2:30 pm
Year and Model: See Signature below.
Location: Kansas
Has thanked: 4 times
Been thanked: 716 times

Post by RickHaleParker »

vtl wrote: Sun Apr 25, 2021 8:10 am I used MC33290D
Anybody have a source for the MC33290D that does not have a 1000 pcs min order and does not take 8 weeks for delivery.
A order from Florida never arrived.

Also looking for a source for the TJA1048T SO14 .
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

Post Reply