Vida CEM swapping

[vtl]

Wish list: Abort command which can be sent from the serial terminal. So when cracking in car and you know it is not going to crack. You can abort the crack and reset the CEM. Saving ten + minutes per attempt or the need to disconnect the battery cables in order to get the CEM out of program mode.

Add:
progModeOff();
delay(5000);
before can_prog_mode();

[vtl]

I have the eeprom dumps already as I tried to fill the eeprom on the replacement CEM with FF and resoldered to the CEM in the hope that VIDA would think the CEM was new but no go....

So with IOTerminal and the eeprom dump do I need CEM cracker at all? Maybe I should be asking IOTerminal but as mentioned on their website the CEM R/W procedure is vague other than mentioning the pin codes will be needed.

Here is the dump from the original CEM 93c86 if any use to anyone?

Eeprom in CEM-L in encrypted. It does not have a PIN code, PIN is in the flash. Also you should not be erasing EEPROM. What you need to do for a "fresh" CEM is to replace the PIN with 00 (or FF, I forgot).

[RickHaleParker]

Add:
progModeOff();
delay(5000);
before can_prog_mode();

I know I am the tiny C grasshopper but I don't think that will do what I want.

I might be completely off off the track but, perhaps something like:

• UserInput = Serial.read();
  If ( UserInput = Abort )
  progModeOff();

This would need to be executed periodically throughout the execution of the Sketch.

For example when experimenting or testing a hardware build on my XC90. I know what the pin number is. If I see it is not getting the correct bytes. I could enter Abort [send] in the terminal and the Sketch would jump to progModeOff and reset the control units then quit.

[5ft24]

Wouldn't having the code poll for an abort sequence disturb the timing of the sampling and interfere with the cracking?

[RickHaleParker]

Wouldn't having the code poll for an abort sequence disturb the timing of the sampling and interfere with the cracking?

Grasshopper don't know. But I would think a user input would be stored in a buffer and it could be read at times it when it would not create interference.

[ricked]

I have the eeprom dumps already as I tried to fill the eeprom on the replacement CEM with FF and resoldered to the CEM in the hope that VIDA would think the CEM was new but no go....

So with IOTerminal and the eeprom dump do I need CEM cracker at all? Maybe I should be asking IOTerminal but as mentioned on their website the CEM R/W procedure is vague other than mentioning the pin codes will be needed.

Here is the dump from the original CEM 93c86 if any use to anyone?

Regards, Simon

Code: Select all

ffffffffffffffffffffffffffffffffffffffffffffffff73eecb7a0945c1dfc98436566b83650dffffffffffffffffffffffff784faa20cd5377b73de8ea2becaae6b13a4adf2cc9f031771a8cb7f1a13b2852e0bf817cff8707288ca7abc04059ae6dffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff006845d9695c282389f5f4467c2b9636f793288124b7f17dcfd2ee1bd32ee57058920f5d3e1cf8fa398f8b500bcaf740616ed802620372ae97f261f254305ef0e4998f1c8440fbf6e8b6d6b1e66b36c4ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffecc279f9d752aa8461849508e383ace3cd374b754b6522bae78ced47ae153781e0db80ed9895733e81055bc6a6f0144749063f0c3146206ef40db62ffb429b445e94e852e359781611e2fa6b39a5e6c46dc3e04087cb1eec0c074492d217e5e89a8e1777ffffffffffffffff0e1ce5134d34846b042826fd4abfd94793aa897c41d67a4ffb619059bde23d73d9fc60efd209f59e1a178a14085bf7cd97fa8e82672895144af577990654628c2dee2354356fe51ca831e45da2bb759bdd80f7486925c08beb792ab6f4d77fd1f15196da08fa1b115385c400f3fe8b9e2086a3e8de9bea415cbc1c0e16535c2548142b0609d2649082dda29bb84dcf623cc9c852403ba6dc4a9dbd383f4ce193123a4d319a2239fcc6fc2d7bbdb0561ba22751e9215d62903527167cccf86a41fd229996d56c183a46a9c5bf64f50fc063cddc15cc13a6e06ee6c7f0a0ec39cb032c22ebf732e9c11d2346417f53e9f714fc1693152138ea720b5905131b589cd30cc538e184ae02b26649d9f84457bb98c7f804d6d66dde0aaf31a99facfbc77a75d0b3644ac8a06e05bdaf67fa9bcc017667b5fd40ef6b1c52cc595b80397da798572efaa5d76d652e365930235d9dd6982354d474b797fb4bc63156a6e6b52e235643d457d23ffd396592860bb8731b1de3f88df6c873ea3186734e3455f1a32ac40edf46ff2695dc137fdb656e29aba206bb214acad378c3c608d5931a2a563769677fc8ec42683edb8b87c9f1c2d684ff2cc05f2ce934e1a7fc924f0b54269e00f6d7243dafff6220028209370aa389943ad3b54eda3bcc3f324750516fd3a210570e8185fe2e508b9393866c73daf1fc2690677629566cf2f38710c83d14aaa14185b64beb165f422f1c313f55d4cf40dec595844a703964c3fadc0fd68077a9bccd9b90dfe6d7e99ffbb625d9a6dde51f4d7097d2487c6582abaf16a61387d04c0f2f852a0ba8662f3e2e226bd25d37006d46e6648fa8c49326f310bba746ecfa278026f9812f9bd5b032afa8245df7592f5b9021f69102988bf14f14eff0a320af735d156c2074fa2c3db7a408706805777ab5dc44264ca00715f8c4717d6c34baea5b8243351fc613e8554c9c731f64366a7f60a01706f811cea5ec05e818bc890574c5f4fa4b5c48b18a766277530891dca71101aa2e33ffffffffffffffff29e8f7ce22998e3d5289ff450101c06b12069b10ff3710b3309ab36cffffffffffffffffffffffffffffffffffffffffffffffffd2bfb3fcc5d8cbbca6e87a83fb8021253f70b17ad41c3703b29cef484ce3b32f6c60e7496ece014d5b4bde69ce4e00e1f8624ed5fb1df3d65602aa4bd7245d058194fa14e0ecb308a17a26392b74e33013e6391d956183aae8d0277841bc6f6fd567b2953b0c84f1c419a7c06d570d621418fb890accd04d3264a8dfcf1c556af5deb391b30917ba6ed72833ff11513178c201dc8d7e85a6a43981d0f15e8456ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc0e4b368cba938672ba153afcd5a97f476eccd05316e51a35470d1fe5872721a9e81089583d862462b4e3036d09d78d3fe63025bb3e0eba59fad9ce889c15fa5138241e61607c327623d1287cbbbb44f5ac6960a576bca6c40ec3666af41a0aae73171b45a4b87b08a32a0d9672c5ef5f708a1bbafe6f491df9fa08d855ee91c1350968d30c1496bb14658deccb79b5d7e9e7940e5cbdf454a3da1a429b7b55c5668875f2827de8f36b374700d46bef0ffb038ba9cf78edc46bf1d3e73f00f16ce36732ff7e7c6a8ad5c46d4841b587adf7250f23279f45884b4f62077a5575986398721b9ca7b3e4ce4f819bcadb7f0f8868c8eb69b944ff63e1d423d0429e1ee78a15455cfdca6ecb38d708aaf0b247f54a7ce4c55db455f0d938ac0acd8d5337ec6421b86e6b05507094780b37104632db44df76f8812a8f07e91d48bf9436d0304f7ee7e2cb1abaaa1aded06dd875afcdacd51c6c702f0fd889d24821869db9cec4603c1c2720a041778222ad2e2417c0af6ecb3ccf5c93c01964ebbbb203248fda29c6198bc187ef1b5921f5e4eca544f1cb78dd7bacfc22569d0540a97f7a147141a1d0e526115733fa55cf37ea41de2fb34db9bc1ae08354740b360396af640a43d90b311d69a5bbd5b5113c58540b7bfd7de7cc65c2d55dbaa01e8cff101417242b89a257c

read it with xprog and load flash in iotherminal and you have the pincode
use pin to read eeprom and flash and do what you need to do

[raikonen]

P1 cem 30756015 Always find same candidate. 23 74 43 no matter what version i use.
But it's not getting the pin. So that one is tricky.
I'll se if i can find the time to open it up and read it.

is this right number of cem??? as I have 30765015 on my c70 mk2 and I get pin after disconnecting battery
without any changes in programm, and without external power supply

[bosse]

P1 cem 30756015 Always find same candidate. 23 74 43 no matter what version i use.
But it's not getting the pin. So that one is tricky.
I'll se if i can find the time to open it up and read it.

is this right number of cem??? as I have 30765015 on my c70 mk2 and I get pin after disconnecting battery
without any changes in programm, and without external power supply

Ok, i have it on bench, ill try in a differt way, disconecting power to cem.

[RickHaleParker]

disconecting power to cem.

He meant no secondary power to the cracker. That is the cracker is powered by V-USB only. You got to have power to the CEM or else it will be deaf and mute.

[raikonen]

Ok, i have it on bench, ill try in a differt way, disconecting power to cem.

I was doing it on car , and as it's said cracker was powered by usb only