Vida CEM swapping

[swital]

150 for an annual subscription is fine, certainly better than 99 for a single change. However, the P1 issue persists, so only vdash remains.

[Treur]

150 for an annual subscription is fine, certainly better than 99 for a single change. However, the P1 issue persists, so only vdash remains.

Well, someday I won't be too lazy and there will be p1....

For now, 150 is p2 (read/write + keys + remote) and p3 (coding) together.

And, if need I can add used remote too.

[dikidera]

I would be very happy for a dump of that 2008 updated ECM, and if you have, an ETM dump too.

Here is the dump from the ecu's I have. Have not dumped the ETM yet. To long thread, is there any tool to do that out there?
The spare files is from a ecu I got from ebay, other one is the one in my car. Have not dumped the internal cpu flash from that one yet.

I believe you once asked for DTC disabling. I have made some progress on this, but not verified without reflashing my ECM. I believe I have found a table that if zeroed out will disable DTCs.

Additionally each DTC is stored in a 128 entry table, with 66 bytes struct size. One of these is our regular ECM-<XXX> format code (just XXX) and followed by entries describing or rather identifiers for the failure type e.g Signal missing, signal low etc.

[ghettob]

The pin printed to the display is far from the one i got in p3tool. Am i getting the hash numbers on the display or am i missing something?

Check your source code for the two missing bytes.
These can be whatever you want, but will result in a different working pin code.

Guess, they were 00 00. Or he's printing seed or key, not the pin.

You were right. Those were seed keys. I now did a comparison using the original p3 file and the file i managed to get working with the screen.

I was able to get hash collision to print same results on both files, but i'm too confused where the pin should be.

I'll attach few pics if someone could help me.

[vtl]

00 00 16 c6 d4 is your pin (hash collision). It is in HEX. Some software may dislike it as the real pin is BCD-coded. If you take the seed and key to seed-gen in the utility directory of the cracker, you'll get all the possible BCD pin codes.

Code: Select all

$ gcc -Ofast -o seed-gen seed-gen.c
$ ./seed-gen --seed "1c f6 ec" --key "c8 41 a0"
Searching all hash collisions for SEED 1c f6 ec, KEY c8 41 a0 at 866 tries per second
   0.88 hrs [      1] PIN 00 02 74 30 62
   4.08 hrs [      2] PIN 00 12 71 22 70
   6.12 hrs [      3] PIN 00 19 08 36 04
   9.32 hrs [      4] PIN 00 29 07 00 32
  12.52 hrs [      5] PIN 00 39 02 12 20
...
3194.71 hrs [    647] PIN 99 59 84 32 80
3196.48 hrs [    648] PIN 99 65 34 51 63
3199.68 hrs [    649] PIN 99 75 31 43 71
3203.27 hrs [    650] PIN 99 86 51 20 72
3206.49 hrs [    651] PIN 99 96 54 32 60
3207.24 hrs [    652] PIN 99 98 89 91 03

One of these BCD hash collision will be real pin in CEM, but they all work.

[ghettob]

i know this is frustrating for you all, but hopefully helpful to atleast someone later on.

How and where do i run the seed gen? Do i merge it with the cracker? Do i run it somewhere online?

I am fairly new in the whole arduino/coding scene and trying my Best to learn

Do the pins from seedgen work in vdash?

[Treur]

i know this is frustrating for you all, but hopefully helpful to atleast someone later on.

How and where do i run the seed gen? Do i merge it with the cracker? Do i run it somewhere online?

I am fairly new in the whole arduino/coding scene and trying my Best to learn

Do the pins from seedgen work in vdash?

When I need it quickly, I search Google for C online compiler, paste the code there, and run it.

[rkam]

In vtls post you can see the two command lines used at the top.
He is using gcc to compile seed-gen.c source code into a program called seed-gen.
In the second command line he is running this program from the current directory (.) with a known good pair of seed and key to get a list of all the pin codes that would create the same key for this seed.
Linux with gcc is one alternative.
You can run linux as a sub system in windows 10.
In windows I can recommend tcc. Tiny C Compiler.

[radziuC30]

I agree with this, I am also a beginner in programming
Can you explain a little better how to do it?
This is my reading, I tried on different websites but I don't know how to do it

SEED 85 29 80, PIN 00 00 0d 34 1c, KEY b2 fe 3e, 75 pins/s
SEED ba 0e 98, PIN 00 00 0d 35 d8, KEY 24 bf 89, 444 pins/s
SEED 6a de 98, PIN 00 00 0d 37 94, KEY 81 cc f0, 444 pins/s
SEED 18 cd f9, PIN 00 00 0d 39 50, KEY 00 96 6e, 444 pins/s
reply: 02 67 02 00 00 00 00 00
hash collision found
SEED fa 6e b8, PIN 00 00 0d 3a 93, KEY 2d d3 8c, 323 pins/s
Resetting all ECUs.

[vtl]

I agree with this, I am also a beginner in programming
Can you explain a little better how to do it?
This is my reading, I tried on different websites but I don't know how to do it

SEED 85 29 80, PIN 00 00 0d 34 1c, KEY b2 fe 3e, 75 pins/s
SEED ba 0e 98, PIN 00 00 0d 35 d8, KEY 24 bf 89, 444 pins/s
SEED 6a de 98, PIN 00 00 0d 37 94, KEY 81 cc f0, 444 pins/s
SEED 18 cd f9, PIN 00 00 0d 39 50, KEY 00 96 6e, 444 pins/s
reply: 02 67 02 00 00 00 00 00
hash collision found
SEED fa 6e b8, PIN 00 00 0d 3a 93, KEY 2d d3 8c, 323 pins/s
Resetting all ECUs.

Your HEX pin that caused a hash collision is "00 00 0d 3a 93". Can use it directly as pin. Or, if software required BCD pin, can take any of 600+ ones found with seed-gen:

Code: Select all

$ ./seed-gen --seed "fa 6e b8" --key "2d d3 8c"
Searching all hash collisions for SEED fa 6e b8, KEY 2d d3 8c at 866 tries per second
   3.23 hrs [      1] PIN 00 10 08 28 81
  10.75 hrs [      2] PIN 00 33 51 81 48
  13.24 hrs [      3] PIN 00 41 28 09 80
  15.73 hrs [      4] PIN 00 49 02 90 19
  39.05 hrs [      5] PIN 01 21 73 73 81
  39.49 hrs [      6] PIN 01 23 11 85 37
  41.28 hrs [      7] PIN 01 28 68 91 43
  42.27 hrs [      8] PIN 01 31 76 61 93
  42.71 hrs [      9] PIN 01 33 14 97 25
  47.95 hrs [     10] PIN 01 49 47 86 74
  51.14 hrs [     11] PIN 01 59 42 94 66
  51.50 hrs [     12] PIN 01 60 56 40 92
  53.86 hrs [     13] PIN 01 67 90 01 33
  54.70 hrs [     14] PIN 01 70 53 52 80
  57.08 hrs [     15] PIN 01 77 95 13 21
  58.81 hrs [     16] PIN 01 83 33 31 83
...