Vida CEM swapping

[RickHaleParker]

That's a good data point, Rick, thanks!

CEM-L #1 Does crack @ 600 MHz, Samples = 100. Does crack @180MHz, Samples = 2

Code: Select all

180MHz,  Samples = 2
.
.

Candidate PIN 55 28 90 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 645 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..done

found PIN: 50 28 37 55 52 90
PIN is cracked in 378.78 seconds
Validating PIN
PIN verified.
done

CEM-L #2 Does not crack @ 600 MHz, Samples = 100. Does crack @180MHz, Samples = 2

Code: Select all

180MHz,  Samples = 2
.
.

Candidate PIN 55 20 00 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 645 seconds
Progress: 0%..5%..10%..15%..20%..done

found PIN: 85 20 47 55 20 00
PIN is cracked in 172.70 seconds
Validating PIN
PIN verified.
done

[vtl]

I wonder if pin order is different for this part number.

[bosse]

8690720 p1 cem is possible.

[RickHaleParker]

I wonder if pin order is different for this part number.

He knows the PIN on the 08690720. Cracker is not getting any of them correct. But this is the only one he has tried on the bench. We don't know that the bench setup is correct.

08690720 (2005): Correct PIN : 15 82 06 59 81 62
.
.
Candidate PIN 53 27 33 -- -- -- :

AA2020 could you test your bench setup with a already cracked CEM?

[AA2020]

I wonder if pin order is different for this part number.

He knows the PIN on the 08690720. Cracker is not getting any of them correct. But this is the only one he has tried on the bench. We don't know that the bench setup is correct.

08690720 (2005): Correct PIN : 15 82 06 59 81 62
.
.
Candidate PIN 53 27 33 -- -- -- :

AA2020 could you test your bench setup with a already cracked CEM?

Yes, 31254903 cracked on bench (and on car too) without any problem, every time.
08690720 Not cracked on bench, not cracked on car.
I/O Terminal connecting OK with Pin - 158206598162
Vida connected Ok on bench.

[RickHaleParker]

I/O Terminal connecting OK with Pin - 158206598162

And not a single one make the best candidates by latency or std .... Odd!

What you think VTL ... real fast chips? Are his latency times typical of a P1 CEM or on the fast side?

What hardware interfaces work with which I/O Terminal software ? I have two J2534 interfaces. KKL, ELM327. USB to TTL ... almost forgot Odin.

[bosse]

Ioterminal have it's own hardware.
Not possible to use other tools.

[vtl]

What you think VTL ... real fast chips? Are his latency times typical of a P1 CEM or on the fast side?

P1 is ancient Motorola running at turtle's speed, two of them. Could be something simple, like one MCU sits on CAN-HS, other one CAN-LS, and CAN-LS one is handling the pin routine check, while CAN-HS peer only forwards a request and reply. The cracker may be working there if the pin interrogation is done on CAN-LS. I think someone here had mentioned that, that his cracker started to work with his P1 CEM once he had hw/sw fixed to work on CAN-LS. Or maybe in email thread, I forgot.

[RickHaleParker]

Ioterminal have it's own hardware.
Not possible to use other tools.

A direct answer .... cool!

[alevol]

Hi. Got CEM-L 2007 with serial 700xxx. Tried samples from 40 to 100, tried LAT only and LAT+STD modes. No luck to crack it. Today will try to downclock the Teensy to 180MHz. I got the CEM on bench, so i can read the software with programmer.
Is there a way to disassemble the file or send it to somebody to disassemble it and check the PIN byte order?
Thanks