Vida CEM swapping

[Yariy]

Considering I am also working on an MC683XX chip, I used this Arduino library https://github.com/psobot/arduino-coldfire-bdm

It won't work out of the box as it uses Python 3.6 features which have been disabled in Python 3.7 and onwards, specifically nullcontext from contextlib package. However the code itself is useable.

The 28f400 is a standard memory chip, has nothing to do with K-line or whatever. The only caveat with the 28X, 29X chips is that they do not use any sort of serial communication but each data and address pin needs to be connected for a total of 32(maybe 33) pins, which is why BDM helps here. I have been crazy enough to solder 32 pins however and successfully read a 29LV200BC chip off a Denso board with an Arduino.

You are lucky to have such easy access to those chips.

I on the other hand have to be creative

Rereading this topic, I came across a message from dikidera on restoring the ETM Magneti Marelli bootloader. I also restored ETM, but I used a tool to repair SD cards. It is convenient to aim the needles under the microscope.

[dikidera]

The ETM was the module that helped me crack CAN signal configuration, understanding how the CAN ids were calculated in the entire P2 Volvo lineup. Really good learning experience.

[Yariy]

Here is the pinout of the mc68376 + M29F200BB microcontroller in ETM.

[Yariy]

Has anyone tried to decrypt the Hopping code from the keychain using the 64-bit key that lies on the UEM eeprom?

[Dragoz001]

OM?

OpenMoose

Yes!
I got the PIN in about 1 minute with it.
I needed it just because I want to remove the Infotainment Theft Protection with VDASH to make my MOST input module work (more than a few seconds...). I still have to do that.
Thanks to all for replying.

[radziuC30]

Hello, I'm having trouble reading the PIN.
I connect the programmed TEENSY 4.0 disc to a Volvo C30 and nothing happens.
What should I do to get it to read?

I'm from Poland, translate on Google

[Yariy]

Not trying to threadjack, a lot of people here are experts on Volvo modules, and maybe can help me with this.

We know key information is in CEM, and we can program new key by reading 28F400 or 93C86 and adding key ID to dump, and write crypt key to the transponder. However the remote is a bit more challenging.

A remote for P2 Volvos come with 2 codes, the short code and the long code.

In the first remote
Short: 0D7D101F
Long: 0A1C 2366 63D9 816D

In UEM Eeprom, short code goes to address
0x0C to 0x0F
However, the long code is changed from
0A1C 2366 63D9 816D to 2070 68DD 100D 1014
This code goes to address 0x4C to 0x53

Another remote
Short: 0084B4EA
Long: 0980 E5AC 2BDB 57E7

Short code is unchanged
Long code in UEM: CE78 E54B A06B 622E

I would like to know how to translate long code from the key's seed to the UEM code so the remote can work.

Remote 1.png
Compare 1.png
Remote 2.png
Compare 2.png

Is there any progress in this matter? Has anyone been able to remove logs from the CAN bus during remote control training? According to them, it would be possible to understand where the conversion of one number into another takes place.

[vtl]

Hello, I'm having trouble reading the PIN.
I connect the programmed TEENSY 4.0 disc to a Volvo C30 and nothing happens.
What should I do to get it to read?

I'm from Poland, translate on Google

Insert key, press the small button on teensy.

[radziuC30]

Hello, I'm having trouble reading the PIN.
I connect the programmed TEENSY 4.0 disc to a Volvo C30 and nothing happens.
What should I do to get it to read?

I'm from Poland, translate on Google

Insert key, press the small button on teensy.

And the Arduino program is supposed to be open?

[vtl]

And the Arduino program is supposed to be open?

You need to compiled it and upload to Teensy (Ctrl-U). Serial console opened. Attach to OBD, press the small button on Teensy.