Vida CEM swapping

[duzi]

There are a lot of paid solutions...they are not worth advertising.

You are the last one whose opinion interests me.

Fair enough.
A professional opinion always cuts deep when it hits the mark.
Relax, this won't increase your sales anyway

[vtl]

I used the one_pass version with shuffle order 2. It didn't work. Further attempts with a different shuffle order.
LOG in attachment.

Christian sirloins (who wrote this one_pass) cracked his 720 on the bench. It works because it exploits a low power mode - CEM switches to it when it has nothing to do. The master branch can't crack it, because it bombs CEM with requests. CEM never goes into power saving mode. Time to serve a CAN request is not as linear as when it it has to wake up after low power mode. Since you are cracking it in the car, I wonder if something is not letting the CEM to go low power? You may need to pull the CEM out of the car and try it on the bench.

People with 719 or 720 P1 CEMs, how did you crack it? In car or on the bench?

[buruss]

5.0.1 only for MEGA2560, control via terminal.
Connect the Kaev library (add lib)
Power on > CEM.
Reads OK. Erase before writing.
R/W to SD card.

Thanks, i try to get one of those boards too.

[buruss]

google struggling even to find this version.
But i try to get another ardu because T5Luke's script also has a lot of questionmark and other garbage when i use it.
i have a dump from my original CEM. can i flash it with vdash or something? i can't verify if it is a good read but i hope because d5t5 got me pins from it. I read it with willem but i can't write with it. last option to flash it with xgecuT48 since i got one last week

You can do it with Volvo TechNest via CAN bus.

That soft looks like a powerful beast but this this car more of "fun" education project.
Anyways if i manage to fix cem and finally starts again i go to next issue like automatic transmission,battery drain, or the funny sidemirror that goes and clicking at the endpoint every time i open the passenger door...
Thanks for advice

[poteroa]

Hi all.

Been working with CEM and UEM for my 2001 v70.

Some info what I have already done:

- Purchased donor UEM and key from junkyard. (From a 2001 car also).
- Got CEM read and have the PIN now, great to get new ID48 paired later..
- Was able to read the donor UEM and have seed + 8 digit code extracted from there.
Chip is MC9S12DG128in the donor UEM.

Tried to pair key to the old mirror in VDASH, and that failed, the key never paired, VDASH got error 0x12.
Car even once went to "dead dash" state, but recovered with batt off for few mins.

Today took the original mirror out from the car to do this manually with taking dump and writing the pairing keys manually, and surprise, the MCU is not the same!
My old mirror has XC511301CPV8. And the flash + eeprom sizes are totally different, and as so address of the fob keys location.
This chip reads fine with mask 0k75F and MC912D60
Has anyone faced this, and does someone happen to know where to write the SEED+pairing keys?

Just my luck, and really need help here.

Old UEM first blocks from EEPROM are (Up to 3F0):

5A A5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 30 71 18 30 30 30 38 36 33 37 33 34 36 20 01 02 14 16 20 48 30 30 30 34 30 34 32 32 33 34 A0 1A 40 37 A0 1A 40 37 A0 1A 40 37 A0 1A 40 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF A5 5A 5A 07 30 AB 43 1E 0A 85 08 88 7D 3D 01 37 0C 2C 7B FE 6E DA E8 30 04 CD 88 00 00 00 00 00 00 00 37 00 00 6B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 37 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 37 02 01 01 02 13 00 04 01 77 A1 00 00 00 00 00 A5 58 FF FF FF FF FF FF FF

And after that blank lines (FF)

Donor UEM, 2 keys bolded, and seeds also (Up to 3F0):

FF FF 5A A5 00 2A B3 8A 00 2A B3 86 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 97 98 71 30 30 33 30 36 35 38 32 33 32 20 03 07 16 06 37 01 30 30 30 34 30 34 34 32 31 35 FF FF A4 42 47 16 0E DB 0C AF 20 FF 01 D4 D7 F9 75 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF A5 5A FF FF 5A 22 30 AB 43 1E 0A 5A 14 19 1E 23 28 2D 32 3C 46 4B 50 55 5A 5F 64 38 38 9E 19 0B 85 08 88 00 00 00 00 00 00 00 00 00 00 00 00 00 01 05 02 25 02 9F 00 B7 01 31 01 37 01 A8 01 B7 02 2C 01 00 00 00 1B 04 00 79 4B 29 80 B4 FC 04 81 A8 00 83 E8 03 E8 00 00 16 00 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 00 00

After these lines, there is still data, not just blank.

I have only hardkey for this car, and no previous fob..

[Dudde]

Hi all.

Been working with CEM and UEM for my 2001 v70.

Some info what I have already done:

- Purchased donor UEM and key from junkyard. (From a 2001 car also).
- Got CEM read and have the PIN now, great to get new ID48 paired later..
- Was able to read the donor UEM and have seed + 8 digit code extracted from there.
Chip is MC9S12DG128in the donor UEM.

Tried to pair key to the old mirror in VDASH, and that failed, the key never paired, VDASH got error 0x12.
Car even once went to "dead dash" state, but recovered with batt off for few mins.

Today took the original mirror out from the car to do this manually with taking dump and writing the pairing keys manually, and surprise, the MCU is not the same!
My old mirror has XC511301CPV8. And the flash + eeprom sizes are totally different, and as so address of the fob keys location.
This chip reads fine with mask 0k75F and MC912D60
Has anyone faced this, and does someone happen to know where to write the SEED+pairing keys?

Just my luck, and really need help here.

Just send pm, and i'll give you some hints

[poteroa]

Hi all.

Been working with CEM and UEM for my 2001 v70.

Some info what I have already done:

- Purchased donor UEM and key from junkyard. (From a 2001 car also).
- Got CEM read and have the PIN now, great to get new ID48 paired later..
- Was able to read the donor UEM and have seed + 8 digit code extracted from there.
Chip is MC9S12DG128in the donor UEM.

Tried to pair key to the old mirror in VDASH, and that failed, the key never paired, VDASH got error 0x12.
Car even once went to "dead dash" state, but recovered with batt off for few mins.

Today took the original mirror out from the car to do this manually with taking dump and writing the pairing keys manually, and surprise, the MCU is not the same!
My old mirror has XC511301CPV8. And the flash + eeprom sizes are totally different, and as so address of the fob keys location.
This chip reads fine with mask 0k75F and MC912D60
Has anyone faced this, and does someone happen to know where to write the SEED+pairing keys?

Just my luck, and really need help here.

Just send pm, and i'll give you some hints

PM sent, thank you Dudde!

[poteroa]

Big thanks to Dudde! @Dudde

Problem solved on older type UEM, with XC511301CPV8 chips.
It became quite obvious how to add the needed data to correct addresses. Remote is working!

[radziuC30]

P3 + LCD
https://github.com/radziu4512-sys/seed-and-key

[buruss]

Hello Guys!

Could someone help me with kaev's soft?
always getting timeout reception error during read.
sometimes 1 sec sometimes 5 sec. one time it worked 20sec before it stopped.
12v fine 5v fine. pins also fine i think because it can detect chip and also start comm.

Okay maybe someone else hit the same wall like me.
So my arduino uno is clone and i figured out that it was instable on 115200 baud.
so i edited the script to 38400.

Also edited serialbdm.exe with hxd: look for 00 C2 01 00 and modify it to 00 96 00 00.
Now the arduino and the soft both on 38400 baud and i don't get any timeout error.