Vida CEM swapping

[Dudde]

Hi all.

Quite massive page count on this topic..

Have a question, and maybe someone can answer directly without need to go through 430 pages
Just read the CEM on a V70, 2001 and looking for the PIN. (And IMMO code of course if it is possible to decode from there)
I used the kaev´s Arduino BDM soft, the only problem is that you can not save the read binary with that software.
https://volvo-tech.com/en/793-2/ (Used Arduino UNO for this, as it was easily available).

Going through the peoples replys, I found info that the PIN should be located in address 0x04E000 is this right?
Do not see any sense to buy expensive programmer just for getting one remote programmed to otherwise cheap car.

Anyone able to help on this?

Oh, the CEM unit is HW-PN: 9452596
Other markings: 8645697/01W075

For remote programming you don't need to touch CEM (only if you going to add another transponder aswell).

And for saving the bin just use copy paste

CEM pin 0x4000 or 0x6000

[vtl]

Hi all.

Quite massive page count on this topic..

Have a question, and maybe someone can answer directly without need to go through 430 pages
Just read the CEM on a V70, 2001 and looking for the PIN. (And IMMO code of course if it is possible to decode from there)
I used the kaev´s Arduino BDM soft, the only problem is that you can not save the read binary with that software.
https://volvo-tech.com/en/793-2/ (Used Arduino UNO for this, as it was easily available).

Going through the peoples replys, I found info that the PIN should be located in address 0x04E000 is this right?
Do not see any sense to buy expensive programmer just for getting one remote programmed to otherwise cheap car.

Anyone able to help on this?

Oh, the CEM unit is HW-PN: 9452596
Other markings: 8645697/01W075

0x4000 or 0x6000. You may need to change the endianness (swap the bytes in 16 bit integer - bswap_16 in C)..

[poteroa]

Thank you @vtl @Dudde

Yes, i have new key with blank id48 in it.
Also remote needs to be done, but that i have already sorted out.

What hex editor do you recommend to use for the copy paste? ( sorry for dumb question but did not work for me on HxD).
Any guidance how to make that would also help a lot.

I'll take a look at 4000 & 6000 ...

EDIT:

4000: I think is not correct: 0x040000 00 00 00 00 04 00 00 04 04 00 34 E3 04 00 34 E3

6000: Might be? 0x060000 E3 00 00 82 C1 13 FF 00 B9 EA F9 08 03 00 FF 00 = PIN 82 00 C1 E3 13 00 ?

[poteroa]

I made copy paste to excel.

Any help is surely welcome

EDIT: that did not work, excel deleted double zero values.

edit 2.0: Finally.

HEX file attached. (added as .txt as could not add it otherwise).

By the hint: 0x006000 67 95 26 38 88 11 = PIN = 38 95 88 67 11 26 (byte swap?)

[radziuC30]

Hello.
I connected my 2008 S80 to the cracker, it read eleven hours and this is the result.
I entered it into VDASH and it works.

=== CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 2289602222, now 2290202252, diff 600030
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 995870736, now 996470776, diff 600040
SEED 41 f2 74, PIN 00 00 64 4e 14, KEY dc cf 3b, 40 pins/s
SEED f1 41 77, PIN 00 00 64 4f d0, KEY 32 eb c2, 444 pins/s
SEED 1c c8 13, PIN 00 00 64 51 8c, KEY 5f ec 2c, 444 pins/s
SEED 7f 99 21, PIN 00 00 64 53 48, KEY 8c 55 88, 444 pins/s
SEED f9 1b 25, PIN 00 00 64 55 04, KEY 79 41 a7, 444 pins/s
p3_cem_get_seed: what? ID 72e, 03 7f 27 35 00 00 00 00
Putting all ECUs into programming mode.

=== CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 4054661800, now 4055261822, diff 600022
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 2760929882, now 2761529923, diff 600041
SEED c9 21 2f, PIN 00 00 64 55 2c, KEY 4b 3c cf, 40 pins/s
SEED 8e 92 db, PIN 00 00 64 56 e8, KEY 9a 63 11, 444 pins/s
SEED d8 95 8a, PIN 00 00 64 58 a4, KEY b4 49 f0, 444 pins/s
SEED b7 30 40, PIN 00 00 64 5a 60, KEY a8 36 c5, 444 pins/s
reply: 02 67 02 00 00 00 00 00
hash collision found
SEED df 10 08, PIN 00 00 64 5b 3b, KEY 9f 8f 6f, 219 pins/s
Resetting all ECUs.
CAN_HS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00

[vtl]

I made copy paste to excel.

Any help is surely welcome

EDIT: that did not work, excel deleted double zero values.

edit 2.0: Finally.

HEX file attached. (added as .txt as could not add it otherwise).

By the hint: 0x006000 67 95 26 38 88 11 = PIN = 38 95 88 67 11 26 (byte swap?)

0x4000/0x6000, not 0x40000/0x60000.

Pin is either 67 95 26 38 88 11 or 95 67 38 26 11 88, depending if byte swap was done during reading or not.

[vtl]

Hello.
I connected my 2008 S80 to the cracker, it read eleven hours and this is the result.
I entered it into VDASH and it works.

...

hash collision found

Congrats!

[poteroa]

I made copy paste to excel.

Any help is surely welcome

EDIT: that did not work, excel deleted double zero values.

edit 2.0: Finally.

HEX file attached. (added as .txt as could not add it otherwise).

By the hint: 0x006000 67 95 26 38 88 11 = PIN = 38 95 88 67 11 26 (byte swap?)

0x4000/0x6000, not 0x40000/0x60000.

Pin is either 67 95 26 38 88 11 or 95 67 38 26 11 88, depending if byte swap was done during reading or not.

You seem to have soo good info on these, so maybe you happen to know how to get the IMMO from the file too?

I just tried to pair used remote that I have, read the 8-digit code + SEED from UEM that was with the keys.. VDASH fails in 0x12 and the remote is not added.. For key programming, not there yet. (Here in Finland the winter blocks a bit to do these outside).

[vtl]

You seem to have soo good info on these, so maybe you happen to know how to get the IMMO from the file too?

I just tried to pair used remote that I have, read the 8-digit code + SEED from UEM that was with the keys.. VDASH fails in 0x12 and the remote is not added.. For key programming, not there yet. (Here in Finland the winter blocks a bit to do these outside).

Contrary to believes, I know nothing about Volvo.

[poteroa]

You seem to have soo good info on these, so maybe you happen to know how to get the IMMO from the file too?

I just tried to pair used remote that I have, read the 8-digit code + SEED from UEM that was with the keys.. VDASH fails in 0x12 and the remote is not added.. For key programming, not there yet. (Here in Finland the winter blocks a bit to do these outside).

Contrary to believes, I know nothing about Volvo.

Well, you helped me to go the right way, thank you for it!
Now I am stuck with VDASH, remote fob can not be added and IMMO PIN is needed to enable adding new keys..

Back to searching from internet..