Vida CEM swapping

T5Luke · Post by **T5Luke** » 16 Apr 2021, 17:00

A few seconds ago, i reflashed my config block of my P2 cem by my own bootloader. The main thing it worked but i don't know how secure. I also had many other things to do, so progress took some longer as i thought. Tomorrow i will build a loader by dice for it and the first fearless people can test it. At the moment it just can flash some bins and only the config part which would be enough for most people here i guess.

Some people sent me pms about this bootloaders and how to write them.
At the moment i would say there are this 2 big CPU brands (P2 Renesas) with very nice IDEs which both have a nice debugger and a C compiler. BUT this bootloaders work on someones different hardware and software base. So it is not just writing up some easy c routines you can copy and paste somewhere. I tired it in C but got so many probs, with linker, with allocation, with resets. So i gave up and wrote all in assembly code, cause you can't come around it anyway. You have to understand the base the manufacture offered you with this CEM in assembly code and have to trick with this much to get a compatible c code working with it. From my opinion this is much more effort as writing the bootloader directly in assembly language cause you cant come around assembly anyway. Maybe someone like to write a bootloader for the P1 CEM, i began to like the 32bit space of Renesas instead of this pageing processor in P1...

Post by **vtl** » 16 Apr 2021, 17:13

Awesome, awesome news!

T5Luke · Post by **T5Luke** » 18 Apr 2021, 17:51

I'm a bit late but had much different things to do and didn't come so far with a normal user "useful" software. My idea was and is to release a windows soft this week, which allows to change the parameters of the car, like having fog lights, having this, having that. Beyond each parameter is one setting, like parameter 2, a 1 stands for LHD and and a 2 for RHD car. There are parameters which decide if you have a cruise control or a trip computer. With your pincode you can change your car with this tool how you like. I have heard there are companys outside takeing lots of cash just for changeing 1 parameter, so please be a bit patient with me

Maybe someones here can get out a parameter list out of some db or create it on other way for the others here, i just provide a parameter changer and dont want to be involved in this lists, i would like to load this lists as external txt file.

5ft24 · Post by **5ft24** » 18 Apr 2021, 19:56

VDASH charges $39 +vats to be able to change f I'm 12-24 hour time and minor settings that you can do with Vida and a DICE unit for free

Post by **RickHaleParker** » 18 Apr 2021, 20:25

T5Luke wrote: ↑18 Apr 2021, 17:51 Maybe someones here can get out a parameter list out of some db or create it on other way for the others here, i just provide a parameter changer and dont want to be involved in this lists, i would like to load this lists as external txt file.

People skilled in Microsoft SQL maybe able to extract parameter information from the VIDA SQL database.
Any database wizards here that want to take a crack at it? All kinds of skills will be need for this project to evolve .

Post by **RickHaleParker** » 18 Apr 2021, 21:59

Could the Interrupt Service Routines : USART1_RX_vect (USART Receive) & USART1_UDRE_vect ( USART Transmit Ready ) be used to measure latency without interference from the jitters?

PJRC Interrupt Service Routines.

Post by **vtl** » 18 Apr 2021, 23:05

With K-Line chip the cracker is able to talk to donated (thanks!) CEM-H:

CPU Maximum Frequency: 600000000
CPU Frequency: 600000000
Execution Rate: 600 cycles/us
Minimum CEM Reply Time: 30us
Platform: P2
PIN bytes to measure: 3
Number of samples: 10
CAN high-speed init done.
CAN low-speed init done.
Initialization done.

K-Line keep alive
Putting all ECUs into programming mode.
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50
---> ID=000ffffe data=50 88 00 00 00 00 00 00
<--- ID=00000003 data=50 8e 00 00 08 68 85 13
Part Number: 000008688513
Calculating bytes 0-2
1000 pins in 1386 ms, 721 pins/s, average response: 259 us

It can't find anything, of course.

ArnisAAA · Post by **ArnisAAA** » 18 Apr 2021, 23:17

For old CEM authorization please use LS CAN and ID: 40

Post by **vtl** » 18 Apr 2021, 23:22

Interesting. I'll try tomorrow.

Post by **RickHaleParker** » 19 Apr 2021, 00:03

vtl wrote: ↑18 Apr 2021, 23:05 With K-Line chip the cracker is able to talk to donated (thanks!) CEM-H:

Part Number: 000008688513

Thanks to a correction and a proof from T5Luke, Part Number: 000008688513 is what I am now calling a CEM-B for the lack of any better term. Pre-2005 P2 CEMs. CEM-B are Brick shaped not L shaped.

The CEM-H is one of two hardware flavors of the L shaped CEMs use post-2004, 2005 - 2014 depending on model .

If anybody has another idea for terminology, speak up. What matters the most is that we have a consensus on what terminology is used.

P2 CEM-B

P2 CEM-H

P2 CEM-L

Vida CEM swapping

Re: Vida CEM swapping