2000 S80 CEM corrupt KEYS lost

pudrik · Post by **pudrik** » 22 Sep 2014, 06:58

Hi i was wondering if someone had any information om the following things so i could fix my car
its a S80 T6 from 00.

My CEM is corrupted due too low battery voltage
Ive read the ECM and CEM flash using external hardware readers and can compare "sync" keys and see that they dont match i can also see that the Car keys are garbage.
My remotes do work still locking / unlocking the car so i guess these dont live in the CEM

I do have access to a DICE interface and a Keycode reader device

But what im missing is this.
A virgin full flash. my CEM is a 9494594
How to add my carkey codes to the CEM?, im guessing this could be done using a hex editor but i down know if the flash has somesort of Checksum in itself (would make sense)

Any information at all would be helpful

fn42 · Post by **fn42** » 23 Sep 2014, 14:12

Do you have a block of 00 00 00 00 that you can reverse-engineer the checksum from? I'm trying to think back to when I was doing this. I remember the checksum being pretty simple & based on row number somehow

I don't think you will find a virgin full flash anywhere. Anyone who has that can make $$$ from it. Xemodex or ARD *might* help you out here idk though

I'll look around for my stock CEM & ECM binary dumps

fn42 · Post by **fn42** » 23 Sep 2014, 14:14

I just thought of something, there's a smaller EEPROM on the ECM that has the immo + key stuff (I think...). It's stored on a physically separate chip than the maps

you can read it in bootmode, I'm sorry but all the details are escaping me now, I will have to take a look at my saved stuff since it's been years

Post by **doublebug** » 23 Sep 2014, 14:44

Unfortunatelly to restore keys you need to patch CEM flash and go to the dealer and make complete CEM reload.
Because crypto key piece of immo is lost and only dealer can restore it (info is taken from Volvo servers).
Or as alternative you have to make new keys (transponders) programmed with new crypto key.

pudrik · Post by **pudrik** » 24 Sep 2014, 03:01

Yes the ECM has the Sync keys or IMMO key as some say (can be changed as long as its the same in both CEM and ECM) so that one is no problem.
I also do have a dump of the "small chip" so someone said

Physical carkeys however the codes from the Transponders inside them is trashed.(or i guess so since it displays as DEDEDEDE on some.. in Volvo Syncro)

I do have a virgin flash however it seems to be 256k while the full flash is 512k?
On what location in the file is the checksum located?

As for the keys if i can read the unique key from (Megamos) its a 4 hex char string? do i only need to patch it into the CEM firmware at one location and fix the checksum?

As for going to a service shop thats kinda last resort as they want insane prices so it would be cheaper to buy a 3 day subscription to Vida and purchase the "reload" myself. But im not sure on how to do the keyreload ...

Post by **doublebug** » 24 Sep 2014, 05:09

The keys section is not protected by checksum.
Without restoring cryptokey for transponders your key IDs are useless.
So for cheaper solution you have to program new transponder and insert it's id to the dump.

pudrik · Post by **pudrik** » 24 Sep 2014, 14:39

Oki

Can the Crypto key be obtained from any unit inside the car or does it only live in the CEM?

Also wondering the 10 on / off power flip, what does that actually do? reload firmware to stock without overwriting key data?

Post by **doublebug** » 25 Sep 2014, 03:15

Crypto is stored only in CEM.
as for power flip it may clear some parameters in CEM or other modules and nothing do with firmware itself.

pudrik · Post by **pudrik** » 28 Sep 2014, 10:40

Oki thanks for the help so far, im sure ill have more questions once ive had time to analyze the flash closer.

My current reads give "random" data on some bits would indicate a bad solder but ive trippel checked everything so its probably a bad chip, im gonna try to reconstruct the data using Recursive dumping and probability comparision on what is most likely to be the correct byte from 10ish reads.