Vida CEM swapping

Post by **RickHaleParker** » 04 May 2021, 14:58

vtl wrote: 04 May 2021, 13:39 Do you have a dump?

I don't have the equipment to extract a bin file.

T5Luke · Post by **T5Luke** » 04 May 2021, 15:56

The minimum basic arduino or some 5V arduino or some USB TTL is enough for this task...

Post by **vtl** » 04 May 2021, 18:10

RickHaleParker wrote: 04 May 2021, 14:58 I don't have the equipment to extract a bin file.

You probably do. It only needs a USB-serial converter (the one with RX/TX lines). T5Luke taught me how to read/write Renesas flash with such adapter and m16c-flasher.de software.

Post by **vtl** » 04 May 2021, 18:13

RickHaleParker wrote: 04 May 2021, 13:44 What happens if you exclude 00 as a candidate? say measure 01 - 99 rather then 00 - 99.

It always picks 0 even if bytes go down from 99 to 0.

May need to power on the oscilloscope once again.

Post by **RickHaleParker** » 04 May 2021, 18:31

vtl wrote: 04 May 2021, 18:10 You probably do. It only needs a USB-serial converter (the one with RX/TX lines). T5Luke taught me how to read/write Renesas flash with such adapter and m16c-flasher.de software.

I seen that someplace before but never gathered enough information and software to do it.
You assumed correctly, I do have a FTDI USB <=> RS-232 DB9 adapter.

Got a link or a file? ... enlighten me.

Got four platforms to work on. Ubuntu 20.04, Windows 10, OS X Leopard PPC and MorphOS 3.15 .

Found this in a yard sale for $1.00.
Had no use for it at the time but figured I would end up kicking myself in the rear if I did not buy it.

: Screenshot from 2021-05-04 19-47-19.png (50.91 KiB) Viewed 1845 times

: 2021-05-04.png (43.67 KiB) Viewed 1849 times

Post by **RickHaleParker** » 04 May 2021, 20:03

Got the software and the manual but, the manual is mute on how to connect the serial cable to the Microcontroller.

: 2021-05-04 (1).png (63.98 KiB) Viewed 1842 times

solitaire · Post by **solitaire** » 05 May 2021, 03:15

vtl wrote: 03 May 2021, 04:35
solitaire wrote: 03 May 2021, 01:21 Part Number: 30795115
Searching P/N 30795115 in 49 known CEMs

Candidate PIN 94 53 06 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 640 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 1220.88 seconds
done
Resetting all ECUs.

first two ok, third - no

94 53 85 25 40 55
Thanks. Do you have a dump for that CEM?

ATTACHED

blasaab · Post by **blasaab** » 05 May 2021, 08:46

Is it possible to read cem with m16c flasher software without pin?

Post by **vtl** » 05 May 2021, 08:48

blasaab wrote: 05 May 2021, 08:46 Is it possible to read cem with m16c flasher software without pin?

Yes. Renesas has its own flash access protection countermeasure, but they are not enabled in Volvo CEMs.

blasaab · Post by **blasaab** » 05 May 2021, 09:00

vtl wrote: 05 May 2021, 08:48
blasaab wrote: 05 May 2021, 08:46 Is it possible to read cem with m16c flasher software without pin?
Yes. Renesas has its own flash access protection countermeasure, but they are not enabled in Volvo CEMs.

Im not able to crack my pin so looking at other way. I should have m32c in my car. Is there a guide how to connect throu wires in car or on bench