Vida CEM swapping

jcdillin · Post by **jcdillin** » 17 Feb 2021, 17:13

Ok, i'll try it on my bench unit when I get back to the office in the morning.

vtl wrote: ↑17 Feb 2021, 16:20 I have the CAN-L Teensy's pin wired to a real CAN-L, in any configuration. Not sure why Mark (who wrote the doc) thinks RX line is better, besides it is 3.3v safe. I tried it once and it worked, however the SNR (signal-to-noise ratio) was worse.

Post by **vtl** » 17 Feb 2021, 17:14

I'm actually thinking of building a Gerber model for PCB to order. EasyEDA has it all integrated. However I have no experience in it, plus our usual "no free time" in adult life.

jcdillin · Post by **jcdillin** » 17 Feb 2021, 17:40

Yeah, I was thinking the same thing. I design PCB's as a side job so it would be easy to do. I was thinking it would be cool to have the oled display so it could display the pin without a PC.

Post by **vtl** » 17 Feb 2021, 17:43

Sure, design one - I'll solder and program it.

paddy0174 · Post by **paddy0174** » 19 Feb 2021, 19:47

vtl wrote: ↑17 Feb 2021, 17:43 Sure, design one - I'll solder and program it.

And I would love to buy one!

jcdillin · Post by **jcdillin** » 22 Feb 2021, 05:02

Alright, I've been doing some research. While the teensy is nice, it's not cost effective to put into a finished design. The CPU alone is $12 in qty and it's BGA.

I found this CPU which has 2 CAN channels and gets down to $4.80 in qty 25 and there is Arduino support already as it's the CPU in some Adafruit feather products.

https://www.digikey.com/en/products/det ... UT/7390305

I put together a quick schematic

Thoughts? Would this be fast enough?

Post by **abscate** » 22 Feb 2021, 05:07

CANBUS is running under 1Mhz so any CPU will be fast enough , nowadays.

Warning, lead time in this stuff is insane right Now, like 36 weeks

Post by **vtl** » 22 Feb 2021, 06:50

Honestly I don't think cost is the problem. People were paying $300 10+ years ago for the first DiCE knock-offs, in order to maintain their only Volvo. And they were happy they didn't have to pay $1500 for the blue box DiCE. Often these $300 paid off in the very first use or two.

The real cost will be hidden in design, soldering, board bringup and porting the software, all done in countries with high wages. The fair cost of the cracker as it is known today is over $50k - because many smart people had to spent a lot of second shifts working on it. All done for free, for people, because we are generous, plus open collaboration pays off in more ways than making little secrets out of air and forcing people to pay for know-how. Mind you, if you have to pay a security research firm to do this job, the price will go exorbitant, far into six digits. Chipping off $7 from MCU price is like saving cash for those silent lurkers who will start selling the cracker on ebay and aliexpress en masse.

Ok, enough whining. Back to the real thing...

The CPU needs to have enough guts to sample 500 KHz CAN-bus and detect transitions. That one is probably fine. 240 MHz ESP32 didn't make it, because conditional jumps were taking 2 us. I didn't went far enough in figuring out why, maybe it was running from flash and fetching a cache line for mispredicted branch take that long.

jcdillin, could you also add a 12v level shifter for K-Line? Earlier MYs need K-line communication in order to open CAN. It is one way (out).

Post by **vtl** » 22 Feb 2021, 07:00

Btw, I've got a feedback that using a proper gauge for the power and signal wiring radically increases the crack success.

Also if your CAN wires are long, make sure to match the pair length and twist them slightly - CAN uses a differential signalling.

jcdillin · Post by **jcdillin** » 22 Feb 2021, 07:05

Do you need something like this to talk to it serially?

https://www.nxp.com/products/interfaces ... ce:MC33660

Or just toggle it?

Vida CEM swapping

Re: Vida CEM swapping