Vida CEM swapping

sirloins · Post by **sirloins** » 18 Nov 2020, 23:04

Yes I meant microseconds not ms

whoops. Canbus speed is 500kbps.

Post by **RickHaleParker** » 19 Nov 2020, 00:17

sirloins wrote: ↑18 Nov 2020, 23:04 Canbus speed is 500kbps.

P1 CEM . : HS CAN 500 kbps, LS CAN 125 kbps. ( Motorola S12, 2005 - 2013 depending on model)
P2 CEM-H: HS CAN 250 kbps, LS CAN 125 kbps. ( Motorola MC68386, 1999 - 2004 )
P2 CEM-L: HS CAN 500 kbps, LS CAN 250 kbps. ( Renesas M32C, 2005-2014 )

Post by **vtl** » 19 Nov 2020, 04:33

Interesting. MY2005 XC70 has LS CAN 125 Kbps.

Post by **vtl** » 19 Nov 2020, 06:02

RickHaleParker wrote: ↑18 Nov 2020, 22:47
vtl wrote: ↑18 Nov 2020, 22:01 At 500 Kbps one clock is 2 us, even at 125 Kbps the resolution stays in a single digit us range, not ms.
Found this in the J2534 API: unsigned long Timestamp;/* receive message timestamp(in microseconds) */

Is it fast enough to do the crack?

Theoretically, yes. If the CAN receiver part of the DiCE works linearly and does not distort the latency even further, it probably can be used.

T5Luke · Post by **T5Luke** » 19 Nov 2020, 08:07

All P2 have interior CAN at 125 kbps.

Post by **RickHaleParker** » 19 Nov 2020, 08:30

T5Luke wrote: ↑19 Nov 2020, 08:07 All P2 have interior CAN at 125 kbps.

Interior CAN

... P2s don't have indoors plumbing.

Post by **vtl** » 19 Nov 2020, 08:41

All of the communication related to this research work happened outside of MVS or any other English-native forum or community, in a very broken English. Plumbin', schlumbin'... Ваапсче пофик...

sirloins · Post by **sirloins** » 19 Nov 2020, 08:48

I don't have much time in the next couple of days, so I submitted a pull request on that repo with what I have currently.

I tried to keep the defaults working for the P2, but I put a comment in about what settings I used for my P1.

My next goal is to write my own SBL for the unit to dump flash, and then add support for the other standard commands (Write/Checksum etc). I'll see if I can do it in C so it is portable maybe to the P2 platform? Was originally going to learn to write assembly, but it wouldn't be as portable. Any suggestions let me know.

With an C SBL it would be possible I think to make many versions in order to work with the different modules on the P1 platform at least (CCM, DIM and CEM all use MC9S12 chips).

Post by **vtl** » 19 Nov 2020, 09:18

Yes, I got your PR, thanks! Let me verify it.

Also, 2.5 more successful cracks on P2 were reported! 0.5 is for the failing detection of the third byte, which I know is troublesome. I'm gathering folk's data to tune the algo.

T5Luke · Post by **T5Luke** » 19 Nov 2020, 09:28

RickHaleParker wrote: ↑19 Nov 2020, 08:30
T5Luke wrote: ↑19 Nov 2020, 08:07 All P2 have interior CAN at 125 kbps.
Interior CAN ... P2s don't have indoors plumbing.

How should be right? Is dodge wrong?

CAN-Interior (also known as CAN Interior High Speed/IHS)
quote from: http://www.dodgia.com/docont-888.html

Vida CEM swapping

Re: Vida CEM swapping