Vida CEM swapping

[RickHaleParker]

This is an example of previously uncrackable pin, byte 3 (2 from 0) is problematic.

This is just an off the wall idea based on previous hard knock experiences.
Have you tried exiting programing mode the re-entering programing mode before measuring the next byte. Sometimes things like that reset favorable conditions.

[RickHaleParker]

Try 9600.

Tried them all, 9600 - 56000.
At the speeds that do communicate, it always fails version check.

Frankenstein is being a monster.

[RickHaleParker]

Today I verified that the holes on the pads are through holes. Here is the proof. That is a PCB/CNC drill bit.
A little twist with my fingers and the conformal coating cleared out.

[5ft24]

Playing with Max's design and the latest code.
My 2005 XC90 V8 wont find the PIN in the vehicle if I start it while the key is in Position 2.
Only way it gets the correct pin is if I do it with just the key in, but position 0. finds it no issues.
Also requires the terminating resistors to be in the circuit

[PowerMatz]

If you come across a CEM part number not on this list let me know.

Hi, here is a new part number:

6:51:55.850 -> Part Number: 30786579
16:51:55.850 -> Searching P/N 30786579 in 49 known CEMs
16:51:55.850 -> CAN HS baud rate: 500000
16:51:55.850 -> PIN shuffle order: 3 1 5 0 2 4
16:51:55.850 -> CAN high-speed init done.
16:51:55.850 -> Putting all ECUs into programming mode.
16:51:55.850 -> CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
16:51:55.850 -> CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
16:52:00.868 -> Reading part number from ECU 0x50 on CAN_HS
16:52:00.868 -> CAN_HS ---> ID=000ffffe data=50 88 00 00 00 00 00 00
16:52:00.868 -> CAN_HS <--- ID=00000003 data=50 8e 00 00 30 78 65 79
16:52:00.868 -> Part Number: 30786579
16:52:00.868 -> Initialization done.


Hope that helps.

Can not crack PIN because of latency issues

Matthias

[vtl]

What your latency issue is?

Have you tried it with key in position 0?

[PowerMatz]

Hi, no just in position II. Should i try it in Position 0?
Latency is not different for lets say 5 positions. There is no clear favorite, there are some:

Example:

17:11:18.712 -> best candidates ordered by latency:
17:11:18.712 -> 0: 43 lat = 210001
17:11:18.712 -> 1: 95 lat = 210000
17:11:18.712 -> 2: 74 lat = 210000
17:11:18.712 -> 3: 23 lat = 210000
17:11:18.712 -> 4: 64 lat = 210000
17:11:18.712 -> ...
17:11:18.712 -> 95: 21 lat = 209956
17:11:18.712 -> 96: 77 lat = 209956
17:11:18.712 -> 97: 20 lat = 209956
17:11:18.712 -> 98: 19 lat = 209956
17:11:18.712 -> 99: 17 lat = 209956
17:11:18.712 ->
17:11:18.712 -> best candidates ordered by std:
17:11:18.712 -> 0: 58 std = 2080.52
17:11:18.712 -> 1: 42 std = 2080.52
17:11:18.712 -> 2: 39 std = 2080.52
17:11:18.712 -> 3: 71 std = 2080.52
17:11:18.712 -> 4: 72 std = 2080.52
17:11:18.712 -> ...
17:11:18.712 -> 95: 64 std = 2073.07
17:11:18.712 -> 96: 23 std = 2073.07
17:11:18.712 -> 97: 74 std = 2073.07
17:11:18.712 -> 98: 95 std = 2073.07
17:11:18.712 -> 99: 28 std = 2073.07
17:11:18.712 ->
17:11:18.712 -> lat_k 0-1 0.00%, lat_k 98-99 0.00%, lat_k 0-99 0.02%
17:11:18.712 -> std_k 0-1 0.00%, std_k 98-99 0.00%, std_k 0-99 0.36%
17:11:18.712 -> STD has more deviation than latency
17:11:18.712 -> STD[99] deviates more than STD[0]
17:11:18.712 -> pin[1] choose candidate: 28 based on std

[vtl]

Try in pos 0 and attach the full log.

[PowerMatz]

OK, will try tomorrow and send full log. Thanks!

[goonerm3]

Can anyone tell me what would be best to run the cracker with cem in car?

CANBed - Arduino CAN-BUS Development Kit (ATmega32U4 with MCP2515 and MCP2551)
https://www.seeedstudio.com/CANBed-Ardu ... -4365.html

or something like this and a teensy 4.0 to run the cracker code?
OBD-II CAN-BUS Development Kit

https://www.seeedstudio.com/OBD-II-CAN- ... -2993.html