Vida CEM swapping

[vtl]

Looked at the first cracker proto (the one that worked with Renesas directly) - it was connecting the chip super-reliably, so here's the boot sequence:

1. Click "Settings", select your port and 57600 baud
2. Click "Terminal" and select 57600 baud
3. Click "Send" against any #00 byte, do it until the CEM replies "B0"
4. Click "Close"
5. Click "Connect"

[RickHaleParker]

Digital calipers decided to start working again. Looks like the holes are 0.40 mm (Drill #78, #11 Beading needle. AWG 26 or 27 ). Have not confirmed that it feeds all the way through.

Went all over town looking for Solder Wick or a Solder Vac to clean up the board. Nobody had any.

[vtl]

I use these wires to avoid any problems with PCB: https://www.amazon.com/gp/product/B07G2SWB19 Also solder with a Chinese 852D+ clone, it's not good, not bad in soldering stations world, but still much safer than a straight 40w iron.

[RickHaleParker]

I use these wires to avoid any problems with PCB: https://www.amazon.com/gp/product/B07G2SWB19 Also solder with a Chinese 852D+ clone, it's not good, not bad in soldering stations world, but still much safer than a straight 40w iron.

I'm using 8W 5V/USB soldering iron with variable heat control. Cut the end of one of the USB cords in the parts box and direct wired it to my power supply. I think what lifted the pad was bumping the soldered on pin not the heat. Was using the pins from a disassembled header.

[RickHaleParker]

3. Click "Send" against any #00 byte, do it until the CEM replies "B0"

Could you clarify that. Lot of options in terminal mode.

2021-05-28 (1).png (80.33 KiB) Viewed 1468 times

[vtl]

Press the very first "Send" button.

[RickHaleParker]

Press the very first "Send" button.

Displays the sends every second time I click send.

2021-05-28 (2).png (44.55 KiB) Viewed 1463 times

[vtl]

Pushed a few changes to master branch. Most interesting:

1. CEM autodetect is optional, can be reverted to old scheme by define. CEM-L on the bench goes silent within 20 ms after reset, autodetect does not work in such case.
2. The algo can pick the lowest std if it stands out.

This is an example of previously uncrackable pin, byte 3 (2 from 0) is problematic.

Code: Select all

best candidates ordered by latency:
0: 32 lat = 876149
1: 05 lat = 876117
2: 36 lat = 876062
3: 81 lat = 876050
4: 21 lat = 876041
...
95: 89 lat = 872992
96: 42 lat = 872966
97: 75 lat = 872876
98: 00 lat = 872715
99: 20 lat = 872500

best candidates ordered by std:
0: 20 std = 613.10
1: 00 std = 613.00
2: 01 std = 610.58
3: 95 std = 603.95
4: 71 std = 603.42
...
95: 35 std = 586.98
96: 50 std = 586.51
97: 03 std = 586.22
98: 70 std = 586.00
99: 91 std = 579.19

lat_k 0-1 0.00%, lat_k 98-99 0.02%, lat_k 0-99 0.42%
std_k 0-1 0.02%, std_k 98-99 1.18%, std_k 0-99 5.85%
STD has more deviation than latency
STD[99] deviates more than STD[0]
pin[2] choose candidate: 91 based on std
Candidate PIN 07 57 91 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 639 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..done

found PIN: 53 57 64 07 53 91
PIN is cracked in 2279.17 seconds
Validating PIN
PIN verified.
done

[RickHaleParker]

I can see it communicating with profile Generic M32C@0xFB0000 but always fails version check. Nothing on any other profile.

[vtl]

Try 9600.