Vida CEM swapping

Post by **RickHaleParker** » 27 Apr 2021, 14:06

3r1k wrote: 27 Apr 2021, 13:12 Are you planning to interface via the diagnostic-canbus lines on the CEM (pins 11,12,15,16) without any other can-devices attached? When I tried to do this I never got it to work when no other canbus nodes where connected to the network, instead I had to hook up my canbus-shield to any of the other "real" canbus lines on the CEM and add 120 ohm termination.

Bench testers take note of that.

sparacis · Post by **sparacis** » 27 Apr 2021, 14:21

Just got a 2008 p1 cem from the local pick and pull to play with as well, really want to be able to pull CEM dumps from the OBD2 port if possible but working with an xprog now to pull the dumps via solder connections

T5Luke · Post by **T5Luke** » 27 Apr 2021, 14:22

When you have P2 on bench, connect pin 8 to +12V and pin 15 to +12V, this makes CEM stay in lock pos 1 and doesn't fall asleep, guess you need to find the same pins in P1.

T5Luke · Post by **T5Luke** » 27 Apr 2021, 14:24

sparacis wrote: 27 Apr 2021, 14:21 Just got a 2008 p1 cem from the local pick and pull to play with as well, really want to be able to pull CEM dumps from the OBD2 port if possible but working with an xprog now to pull the dumps via solder connections

You need to write your own bootloader for this, when the problems are solved with P2 i will give it a try with P1 but the CPUs of this both CEMs are very different as the brands are...

Post by **RickHaleParker** » 28 Apr 2021, 04:07

T5Luke wrote: 27 Apr 2021, 14:22 When you have P2 on bench, connect pin 8 to +12V and pin 15 to +12V, this makes CEM stay in lock pos 1 and doesn't fall asleep, guess you need to find the same pins in P1.

Do you mean pins D:8 & D:15 which are power from the Ignition switch?

If so: A:17 & A:42 on the P1 are the equivalent to D:5 & D:15 on the P2-L & P2-H.

T5Luke · Post by **T5Luke** » 28 Apr 2021, 04:26

Yes, i mean D connector. I would give it a try at P1.

Post by **RickHaleParker** » 28 Apr 2021, 05:47

Project name?
ODIN ( Open Diagnostic INterface ).

Post by **vtl** » 28 Apr 2021, 05:57

RickHaleParker wrote: 28 Apr 2021, 05:47 Project name?
ODIN ( Open Diagnostic INterface ).

I like it!

Post by **vtl** » 28 Apr 2021, 08:36

P1 CEM with P2 code path, but no shuffle:

Code: Select all

CPU Maximum Frequency:   600000000
CPU Frequency:           600000000
Execution Rate:          600 cycles/us
Platform:                P2
PIN bytes to measure:    3
Number of samples:       30
CAN high-speed init done.
CAN low-speed init done.
Initialization done.

Putting all ECUs into programming mode.
K-Line keep alive
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
---> ID=000ffffe data=ff 86 00 00 00 00 00 00
K-Line keep alive
K-Line keep alive
K-Line keep alive
K-Line keep alive
Reading part number from ECU 0x50
---> ID=000ffffe data=50 88 00 00 00 00 00 00
<--- ID=00000003 data=50 8e 00 00 31 25 49 03
Part Number: 000031254903
...

found PIN: 0x24 0x99 0x68 0x94 0x27 0x69
PIN is cracked in 945.54 seconds
Validating PIN
PIN verified.
done
Resetting all ECUs.
---> ID=000ffffe data=ff c8 00 00 00 00 00 00
---> ID=000ffffe data=ff c8 00 00 00 00 00 00

In the very first pass. I'm killing the dedicated P1 code.

Post by **vtl** » 28 Apr 2021, 08:41

P1 CEM on the bench pins required:

FRONT-1:23 -> +12v
COCKPIT-1:14 -> GND
COCKPIT-2:11 -> CAN-HS H
COCKPIT-2:12 -> CAN-HS L