Vida CEM swapping

5ft24 · Post by **5ft24** » 11 Apr 2021, 11:30

Going to be testing it this afternoon when my step-son gets home from work with my car.

T5Luke · Post by **T5Luke** » 11 Apr 2021, 12:10

I'm very certain it wont work. The V8 was some prototype for p3, it uses mixed protocolls of p2 and p3 already...

5ft24 · Post by **5ft24** » 11 Apr 2021, 12:30

I was under the impression that the CEM used the P2 protocols in the XC90 from 2003-2014. Since this is for the CEM PIN, and not the ECU, it should work

T5Luke · Post by **T5Luke** » 11 Apr 2021, 12:40

Yes the hardware is the same, but V8 is something special, the engine bus side was designed in the same protocol as P3, the interrior is p2 standard. The cracker tries to crack a p2 routine on the high speed engine bus but the V8 already uses a P3 routine. The V8 seems to be some small test platform for p3.

5ft24 · Post by **5ft24** » 11 Apr 2021, 12:51

If that was the case then the VDASH pin cracker routine for the P3's would work. Which it doesn't and says it's not compatible

T5Luke · Post by **T5Luke** » 11 Apr 2021, 12:55

I know it has the same security verification technic as p3, it doesnt use a fixed standard key and it has nothing together with p2 on high speed side. I just bought a V8 a few days ago, this would be the next project i will verify next. The guys from czech are not the limit, what they not offer won't be impossible. Maybe they didn't implent this car, because to rare in europe. On the other hand i dont know what i would implent in a full V8...

5ft24 · Post by **5ft24** » 11 Apr 2021, 13:01

I'll see what happens when I get on the car and see if the result is repeatable. If it's repeatable, would be nice to have a bit of teensy code that could use that pin to unlock and try a command or two to verify they respond properly

Post by **RickHaleParker** » 11 Apr 2021, 16:04

vtl wrote: ↑24 Jun 2020, 19:59 Wonder why VDASH cracks the ID for P3, but not for P2...

Came across a post where it was stated the P3 PIN is fewer bytes. It can be brute forced cracked in under 24 Hours. Post did not state the length but have seen indicators that the length is 5 bytes.

mikeak2001 · Post by **mikeak2001** » 11 Apr 2021, 16:55

Hi all,

I'm just wondering if anyone has had any trouble with the VP230 chips. In my setup (VTL's) the can LS will not transmit unless I pull the receive pin 4 to 3.3v.

So I did a little test. I disconnected the feedback from the high speed can (receive pin 4) and the chip stops communicating. Has anyone else actually checked that their low speed can is actually communicating?

I have swapped the 2 VP230's around in the breadboard to check and the test is repeatable. So for me unless I add an extra line in to pull the receive pin on the low speed can high. It will not work.

Any advice would be a great help.

T5Luke · Post by **T5Luke** » 11 Apr 2021, 17:20

It seems there are a lot of counterfeight transceivers on the marked, 5V ICs which are sold as 3,3V ICs, they can only receive but not send by this voltage. If you use resistors (something around 2k) to pull up the rx line to 3,3V sending starts to work in some cases. I also had this fault in first tries, i even bought mcps and VP230 from big US distributor resoldered them and trouble was gone...

Yes P3 code is much shorter, so it is possible to bruteforce by slow dice within 24h, but it is not static as in P2. You send the cem a request and the cem responds with a random value, you calculate this random value by a special formula and put somewhere in this formular your pin inside and send the result back, if your pin was right the cem responds positive. So cracking in p3 askes for value and each time it increases pin by 1 from 0 to ... till it gets a positive response...

Vida CEM swapping

Re: Vida CEM swapping