Vida CEM swapping

[jcdillin]

Try to increase this: https://github.com/vtl/volvo-cem-cracke ... r.ino#L716

Also do you connect to both CAN-buses?

CAN_L_PIN is connected to CAN-HS- or transceiver's RX pin?

Yes, I have both busses connected, I can tell it's shutting everything down because the car becomes unresponsive. If the cracker doesn't finish you have to pull the battery to reset everything. May be worth having some sort of a push button that cancels the process and sends the wakeup command to get the car back working agaiIn.

I have CAN_L connected directly to CAN-HS-LOW

[jcdillin]

Ok, so i've been playing around with this a bit more.

Couple observations.

1. As soon as you start the teensy the whole car shuts down, even before you turn the key to pos II, i'm not sure if that is affecting things.
2. After turning the key to POSII it gives the output below, but no matter if you have the key or off it keeps going. Possible another ECU is getting confused and answering back as the CEM?

If I let it keep going it will come back with 99 or 00's and then finally wake the car back up.

Code: Select all

CPU Maximum Frequency:   600000000
CPU Frequency:           180000000
Execution Rate:          180 cycles/us
Minimum CEM Reply Time:  30us
Platform:                P2
PIN bytes to measure:    3
Number of samples:       30
Number of loops:         1000

CAN high-speed init done.
CAN low-speed init done.
Initialization done.

Putting all ECUs into programming mode.
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50
---> ID=000ffffe data=50 88 00 00 00 00 00 00
<--- ID=00000003 data=50 8e 00 00 30 76 51 48
Part Number: 000030765148
Calculating bytes 0-2
1000 pins in 657 ms, 1522 pins/s, average response: 271
[ 00 -- -- -- -- -- ]: 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 : 597000
[ 01 -- -- -- -- -- ]: 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 : 596949
[ 02 -- -- -- -- -- ]: 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 : 596949

[vtl]

Alright, time to try it myself in-car. Wife's XC60 is repaired, XC70 comes to stall. I'll report back when the problem has a fix in git.

P.S.: I'll be using built-in CANs from now on (no MCP).

[efe09]

Hello friends,

Are there any new findings??

[MaxDenisov]

Hi!
As typical user I am a bit lazy for removing CEM from car to try to get pin directly on my bench.

Very cold weather one of the reason for continue finding PIN inside my car through OBDII.

I have tried different setup using Teensy 4.0 internal and external CAN bus interfaces many times through OBDII on XC90.

No luck yet.

It seems that not all modules in my car went into programming mode.

@Vitaliy, any success with your try?

[RickHaleParker]

Possible another ECU is getting confused and answering back as the CEM?

You can rule that out. The only control unit on the OBDII port is the CEM. Everything else is behind the CEM.

[vtl]

No luck yet.

What do you see?

@Vitaliy, any success with your try?

Nope, laying out 1500 sq.ft of hardwood and painting walls

[MaxDenisov]

No luck yet.

What do you see?

I just sent you logs by email last week.

all logs similar to:
"Candidate PIN 0x40 0x91 0x96 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 657 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 1914.96 seconds
done"
It seems that some modules still in operating mode( not in programming mode) and making some "noise" during pin finding procedure

[jcdillin]

PCB's came in! Just waiting for the final parts from digikey to build up a prototype.

[vtl]

Nice!