Vida CEM swapping

[mikeak2001]

Can anyone else please check files from 2010 on in a p1? It appears to me the pin code is not in that position in the 2010 on files. I can't crack any of the files from 2010 on.

The full dump is rather long, but you may want to look at it if none of the above sequences are your pin.

Thanks VTL, The cracking process regularly finds 15 00 29 xx xx xx, where it fails on the last 3 bytes.
Will run your script and take a look through.

Thanks.

[WhizzMan]

As long as no solution has been found for < 2005 CEM-B, maybe someone could put in a fall back brute force algorithm? At least there would be some way for us to get our pin code.

2,204.586 weeks / 52 = 42.396 years.
If you lose power you will need to start over again.

Hmm, so that's not an option. Special bootloader and read it with that? Or will I have to take my CEM out and read the EEPROM?
Haven't put the CAN logger in yet or I might spend money to have a dealer do a readout and sniff the pin that way.

[vtl]

Will run your script and take a look through.

This is Linux program, not Arduino sketch. Compile and run on Linux box (or adapt to OS of your choice).

[mikeak2001]

This is Linux program, not Arduino sketch. Compile and run on Linux box (or adapt to OS of your choice).

I apologise, I understood, I write a little C code myself. I shouldn't have use the word "script"

[vtl]

This is a Linux program, not Arduino sketch. Compile and run on Linux box (or adapt to OS of your choice).

I apologise, I understood, I write a little C code myself. I shouldn't have use the word "script"

I see, and apology for myself, for the darn, ever forgotten a =) Me speak English little, sigh.

[RickHaleParker]

The cracking process regularly finds 15 00 29 xx xx xx, where it fails on the last 3 bytes.

If 15 00 29 is correct and the transposition order is the problem. You might be able to brute force with it one of the 6 Permutations.

Permutations

15 00 29 xx xx xx
00 15 29 xx xx xx
29 15 00 xx xx xx
15 29 00 xx xx xx
00 29 15 xx xx xx
29 00 15 xx xx xx

You could run through the 720 possible transposition orders, It should find it in under 10 days on CAN-LS if 15 00 29 is correct.
Under 5 days if cracking on CAN-HS .

Transposition order ( Shuffle ) Permutations.

Code: Select all

0,1,2,3,4,5
1,0,2,3,4,5
2,0,1,3,4,5
0,2,1,3,4,5
1,2,0,3,4,5
2,1,0,3,4,5
2,1,3,0,4,5
1,2,3,0,4,5
3,2,1,0,4,5
2,3,1,0,4,5
1,3,2,0,4,5
3,1,2,0,4,5
3,0,2,1,4,5
0,3,2,1,4,5
2,3,0,1,4,5
3,2,0,1,4,5
0,2,3,1,4,5
2,0,3,1,4,5
1,0,3,2,4,5
0,1,3,2,4,5
3,1,0,2,4,5
1,3,0,2,4,5
0,3,1,2,4,5
3,0,1,2,4,5
4,0,1,2,3,5
0,4,1,2,3,5
1,4,0,2,3,5
4,1,0,2,3,5
0,1,4,2,3,5
1,0,4,2,3,5
1,0,2,4,3,5
0,1,2,4,3,5
2,1,0,4,3,5
1,2,0,4,3,5
0,2,1,4,3,5
2,0,1,4,3,5
2,4,1,0,3,5
4,2,1,0,3,5
1,2,4,0,3,5
2,1,4,0,3,5
4,1,2,0,3,5
1,4,2,0,3,5
0,4,2,1,3,5
4,0,2,1,3,5
2,0,4,1,3,5
0,2,4,1,3,5
4,2,0,1,3,5
2,4,0,1,3,5
3,4,0,1,2,5
4,3,0,1,2,5
0,3,4,1,2,5
3,0,4,1,2,5
4,0,3,1,2,5
0,4,3,1,2,5
0,4,1,3,2,5
4,0,1,3,2,5
1,0,4,3,2,5
0,1,4,3,2,5
4,1,0,3,2,5
1,4,0,3,2,5
1,3,0,4,2,5
3,1,0,4,2,5
0,1,3,4,2,5
1,0,3,4,2,5
3,0,1,4,2,5
0,3,1,4,2,5
4,3,1,0,2,5
3,4,1,0,2,5
1,4,3,0,2,5
4,1,3,0,2,5
3,1,4,0,2,5
1,3,4,0,2,5
2,3,4,0,1,5
3,2,4,0,1,5
4,2,3,0,1,5
2,4,3,0,1,5
3,4,2,0,1,5
4,3,2,0,1,5
4,3,0,2,1,5
3,4,0,2,1,5
0,4,3,2,1,5
4,0,3,2,1,5
3,0,4,2,1,5
0,3,4,2,1,5
0,2,4,3,1,5
2,0,4,3,1,5
4,0,2,3,1,5
0,4,2,3,1,5
2,4,0,3,1,5
4,2,0,3,1,5
3,2,0,4,1,5
2,3,0,4,1,5
0,3,2,4,1,5
3,0,2,4,1,5
2,0,3,4,1,5
0,2,3,4,1,5
1,2,3,4,0,5
2,1,3,4,0,5
3,1,2,4,0,5
1,3,2,4,0,5
2,3,1,4,0,5
3,2,1,4,0,5
3,2,4,1,0,5
2,3,4,1,0,5
4,3,2,1,0,5
3,4,2,1,0,5
2,4,3,1,0,5
4,2,3,1,0,5
4,1,3,2,0,5
1,4,3,2,0,5
3,4,1,2,0,5
4,3,1,2,0,5
1,3,4,2,0,5
3,1,4,2,0,5
2,1,4,3,0,5
1,2,4,3,0,5
4,2,1,3,0,5
2,4,1,3,0,5
1,4,2,3,0,5
4,1,2,3,0,5
4,1,2,3,5,0
1,4,2,3,5,0
2,4,1,3,5,0
4,2,1,3,5,0
1,2,4,3,5,0
2,1,4,3,5,0
2,1,3,4,5,0
1,2,3,4,5,0
3,2,1,4,5,0
2,3,1,4,5,0
1,3,2,4,5,0
3,1,2,4,5,0
3,4,2,1,5,0
4,3,2,1,5,0
2,3,4,1,5,0
3,2,4,1,5,0
4,2,3,1,5,0
2,4,3,1,5,0
1,4,3,2,5,0
4,1,3,2,5,0
3,1,4,2,5,0
1,3,4,2,5,0
4,3,1,2,5,0
3,4,1,2,5,0
5,4,1,2,3,0
4,5,1,2,3,0
1,5,4,2,3,0
5,1,4,2,3,0
4,1,5,2,3,0
1,4,5,2,3,0
1,4,2,5,3,0
4,1,2,5,3,0
2,1,4,5,3,0
1,2,4,5,3,0
4,2,1,5,3,0
2,4,1,5,3,0
2,5,1,4,3,0
5,2,1,4,3,0
1,2,5,4,3,0
2,1,5,4,3,0
5,1,2,4,3,0
1,5,2,4,3,0
4,5,2,1,3,0
5,4,2,1,3,0
2,4,5,1,3,0
4,2,5,1,3,0
5,2,4,1,3,0
2,5,4,1,3,0
3,5,4,1,2,0
5,3,4,1,2,0
4,3,5,1,2,0
3,4,5,1,2,0
5,4,3,1,2,0
4,5,3,1,2,0
4,5,1,3,2,0
5,4,1,3,2,0
1,4,5,3,2,0
4,1,5,3,2,0
5,1,4,3,2,0
1,5,4,3,2,0
1,3,4,5,2,0
3,1,4,5,2,0
4,1,3,5,2,0
1,4,3,5,2,0
3,4,1,5,2,0
4,3,1,5,2,0
5,3,1,4,2,0
3,5,1,4,2,0
1,5,3,4,2,0
5,1,3,4,2,0
3,1,5,4,2,0
1,3,5,4,2,0
2,3,5,4,1,0
3,2,5,4,1,0
5,2,3,4,1,0
2,5,3,4,1,0
3,5,2,4,1,0
5,3,2,4,1,0
5,3,4,2,1,0
3,5,4,2,1,0
4,5,3,2,1,0
5,4,3,2,1,0
3,4,5,2,1,0
4,3,5,2,1,0
4,2,5,3,1,0
2,4,5,3,1,0
5,4,2,3,1,0
4,5,2,3,1,0
2,5,4,3,1,0
5,2,4,3,1,0
3,2,4,5,1,0
2,3,4,5,1,0
4,3,2,5,1,0
3,4,2,5,1,0
2,4,3,5,1,0
4,2,3,5,1,0
1,2,3,5,4,0
2,1,3,5,4,0
3,1,2,5,4,0
1,3,2,5,4,0
2,3,1,5,4,0
3,2,1,5,4,0
3,2,5,1,4,0
2,3,5,1,4,0
5,3,2,1,4,0
3,5,2,1,4,0
2,5,3,1,4,0
5,2,3,1,4,0
5,1,3,2,4,0
1,5,3,2,4,0
3,5,1,2,4,0
5,3,1,2,4,0
1,3,5,2,4,0
3,1,5,2,4,0
2,1,5,3,4,0
1,2,5,3,4,0
5,2,1,3,4,0
2,5,1,3,4,0
1,5,2,3,4,0
5,1,2,3,4,0
5,1,2,0,4,3
1,5,2,0,4,3
2,5,1,0,4,3
5,2,1,0,4,3
1,2,5,0,4,3
2,1,5,0,4,3
2,1,0,5,4,3
1,2,0,5,4,3
0,2,1,5,4,3
2,0,1,5,4,3
1,0,2,5,4,3
0,1,2,5,4,3
0,5,2,1,4,3
5,0,2,1,4,3
2,0,5,1,4,3
0,2,5,1,4,3
5,2,0,1,4,3
2,5,0,1,4,3
1,5,0,2,4,3
5,1,0,2,4,3
0,1,5,2,4,3
1,0,5,2,4,3
5,0,1,2,4,3
0,5,1,2,4,3
4,5,1,2,0,3
5,4,1,2,0,3
1,4,5,2,0,3
4,1,5,2,0,3
5,1,4,2,0,3
1,5,4,2,0,3
1,5,2,4,0,3
5,1,2,4,0,3
2,1,5,4,0,3
1,2,5,4,0,3
5,2,1,4,0,3
2,5,1,4,0,3
2,4,1,5,0,3
4,2,1,5,0,3
1,2,4,5,0,3
2,1,4,5,0,3
4,1,2,5,0,3
1,4,2,5,0,3
5,4,2,1,0,3
4,5,2,1,0,3
2,5,4,1,0,3
5,2,4,1,0,3
4,2,5,1,0,3
2,4,5,1,0,3
0,4,5,1,2,3
4,0,5,1,2,3
5,0,4,1,2,3
0,5,4,1,2,3
4,5,0,1,2,3
5,4,0,1,2,3
5,4,1,0,2,3
4,5,1,0,2,3
1,5,4,0,2,3
5,1,4,0,2,3
4,1,5,0,2,3
1,4,5,0,2,3
1,0,5,4,2,3
0,1,5,4,2,3
5,1,0,4,2,3
1,5,0,4,2,3
0,5,1,4,2,3
5,0,1,4,2,3
4,0,1,5,2,3
0,4,1,5,2,3
1,4,0,5,2,3
4,1,0,5,2,3
0,1,4,5,2,3
1,0,4,5,2,3
2,0,4,5,1,3
0,2,4,5,1,3
4,2,0,5,1,3
2,4,0,5,1,3
0,4,2,5,1,3
4,0,2,5,1,3
4,0,5,2,1,3
0,4,5,2,1,3
5,4,0,2,1,3
4,5,0,2,1,3
0,5,4,2,1,3
5,0,4,2,1,3
5,2,4,0,1,3
2,5,4,0,1,3
4,5,2,0,1,3
5,4,2,0,1,3
2,4,5,0,1,3
4,2,5,0,1,3
0,2,5,4,1,3
2,0,5,4,1,3
5,0,2,4,1,3
0,5,2,4,1,3
2,5,0,4,1,3
5,2,0,4,1,3
1,2,0,4,5,3
2,1,0,4,5,3
0,1,2,4,5,3
1,0,2,4,5,3
2,0,1,4,5,3
0,2,1,4,5,3
0,2,4,1,5,3
2,0,4,1,5,3
4,0,2,1,5,3
0,4,2,1,5,3
2,4,0,1,5,3
4,2,0,1,5,3
4,1,0,2,5,3
1,4,0,2,5,3
0,4,1,2,5,3
4,0,1,2,5,3
1,0,4,2,5,3
0,1,4,2,5,3
2,1,4,0,5,3
1,2,4,0,5,3
4,2,1,0,5,3
2,4,1,0,5,3
1,4,2,0,5,3
4,1,2,0,5,3
4,1,3,0,5,2
1,4,3,0,5,2
3,4,1,0,5,2
4,3,1,0,5,2
1,3,4,0,5,2
3,1,4,0,5,2
3,1,0,4,5,2
1,3,0,4,5,2
0,3,1,4,5,2
3,0,1,4,5,2
1,0,3,4,5,2
0,1,3,4,5,2
0,4,3,1,5,2
4,0,3,1,5,2
3,0,4,1,5,2
0,3,4,1,5,2
4,3,0,1,5,2
3,4,0,1,5,2
1,4,0,3,5,2
4,1,0,3,5,2
0,1,4,3,5,2
1,0,4,3,5,2
4,0,1,3,5,2
0,4,1,3,5,2
5,4,1,3,0,2
4,5,1,3,0,2
1,5,4,3,0,2
5,1,4,3,0,2
4,1,5,3,0,2
1,4,5,3,0,2
1,4,3,5,0,2
4,1,3,5,0,2
3,1,4,5,0,2
1,3,4,5,0,2
4,3,1,5,0,2
3,4,1,5,0,2
3,5,1,4,0,2
5,3,1,4,0,2
1,3,5,4,0,2
3,1,5,4,0,2
5,1,3,4,0,2
1,5,3,4,0,2
4,5,3,1,0,2
5,4,3,1,0,2
3,4,5,1,0,2
4,3,5,1,0,2
5,3,4,1,0,2
3,5,4,1,0,2
0,5,4,1,3,2
5,0,4,1,3,2
4,0,5,1,3,2
0,4,5,1,3,2
5,4,0,1,3,2
4,5,0,1,3,2
4,5,1,0,3,2
5,4,1,0,3,2
1,4,5,0,3,2
4,1,5,0,3,2
5,1,4,0,3,2
1,5,4,0,3,2
1,0,4,5,3,2
0,1,4,5,3,2
4,1,0,5,3,2
1,4,0,5,3,2
0,4,1,5,3,2
4,0,1,5,3,2
5,0,1,4,3,2
0,5,1,4,3,2
1,5,0,4,3,2
5,1,0,4,3,2
0,1,5,4,3,2
1,0,5,4,3,2
3,0,5,4,1,2
0,3,5,4,1,2
5,3,0,4,1,2
3,5,0,4,1,2
0,5,3,4,1,2
5,0,3,4,1,2
5,0,4,3,1,2
0,5,4,3,1,2
4,5,0,3,1,2
5,4,0,3,1,2
0,4,5,3,1,2
4,0,5,3,1,2
4,3,5,0,1,2
3,4,5,0,1,2
5,4,3,0,1,2
4,5,3,0,1,2
3,5,4,0,1,2
5,3,4,0,1,2
0,3,4,5,1,2
3,0,4,5,1,2
4,0,3,5,1,2
0,4,3,5,1,2
3,4,0,5,1,2
4,3,0,5,1,2
1,3,0,5,4,2
3,1,0,5,4,2
0,1,3,5,4,2
1,0,3,5,4,2
3,0,1,5,4,2
0,3,1,5,4,2
0,3,5,1,4,2
3,0,5,1,4,2
5,0,3,1,4,2
0,5,3,1,4,2
3,5,0,1,4,2
5,3,0,1,4,2
5,1,0,3,4,2
1,5,0,3,4,2
0,5,1,3,4,2
5,0,1,3,4,2
1,0,5,3,4,2
0,1,5,3,4,2
3,1,5,0,4,2
1,3,5,0,4,2
5,3,1,0,4,2
3,5,1,0,4,2
1,5,3,0,4,2
5,1,3,0,4,2
5,2,3,0,4,1
2,5,3,0,4,1
3,5,2,0,4,1
5,3,2,0,4,1
2,3,5,0,4,1
3,2,5,0,4,1
3,2,0,5,4,1
2,3,0,5,4,1
0,3,2,5,4,1
3,0,2,5,4,1
2,0,3,5,4,1
0,2,3,5,4,1
0,5,3,2,4,1
5,0,3,2,4,1
3,0,5,2,4,1
0,3,5,2,4,1
5,3,0,2,4,1
3,5,0,2,4,1
2,5,0,3,4,1
5,2,0,3,4,1
0,2,5,3,4,1
2,0,5,3,4,1
5,0,2,3,4,1
0,5,2,3,4,1
4,5,2,3,0,1
5,4,2,3,0,1
2,4,5,3,0,1
4,2,5,3,0,1
5,2,4,3,0,1
2,5,4,3,0,1
2,5,3,4,0,1
5,2,3,4,0,1
3,2,5,4,0,1
2,3,5,4,0,1
5,3,2,4,0,1
3,5,2,4,0,1
3,4,2,5,0,1
4,3,2,5,0,1
2,3,4,5,0,1
3,2,4,5,0,1
4,2,3,5,0,1
2,4,3,5,0,1
5,4,3,2,0,1
4,5,3,2,0,1
3,5,4,2,0,1
5,3,4,2,0,1
4,3,5,2,0,1
3,4,5,2,0,1
0,4,5,2,3,1
4,0,5,2,3,1
5,0,4,2,3,1
0,5,4,2,3,1
4,5,0,2,3,1
5,4,0,2,3,1
5,4,2,0,3,1
4,5,2,0,3,1
2,5,4,0,3,1
5,2,4,0,3,1
4,2,5,0,3,1
2,4,5,0,3,1
2,0,5,4,3,1
0,2,5,4,3,1
5,2,0,4,3,1
2,5,0,4,3,1
0,5,2,4,3,1
5,0,2,4,3,1
4,0,2,5,3,1
0,4,2,5,3,1
2,4,0,5,3,1
4,2,0,5,3,1
0,2,4,5,3,1
2,0,4,5,3,1
3,0,4,5,2,1
0,3,4,5,2,1
4,3,0,5,2,1
3,4,0,5,2,1
0,4,3,5,2,1
4,0,3,5,2,1
4,0,5,3,2,1
0,4,5,3,2,1
5,4,0,3,2,1
4,5,0,3,2,1
0,5,4,3,2,1
5,0,4,3,2,1
5,3,4,0,2,1
3,5,4,0,2,1
4,5,3,0,2,1
5,4,3,0,2,1
3,4,5,0,2,1
4,3,5,0,2,1
0,3,5,4,2,1
3,0,5,4,2,1
5,0,3,4,2,1
0,5,3,4,2,1
3,5,0,4,2,1
5,3,0,4,2,1
2,3,0,4,5,1
3,2,0,4,5,1
0,2,3,4,5,1
2,0,3,4,5,1
3,0,2,4,5,1
0,3,2,4,5,1
0,3,4,2,5,1
3,0,4,2,5,1
4,0,3,2,5,1
0,4,3,2,5,1
3,4,0,2,5,1
4,3,0,2,5,1
4,2,0,3,5,1
2,4,0,3,5,1
0,4,2,3,5,1
4,0,2,3,5,1
2,0,4,3,5,1
0,2,4,3,5,1
3,2,4,0,5,1
2,3,4,0,5,1
4,3,2,0,5,1
3,4,2,0,5,1
2,4,3,0,5,1
4,2,3,0,5,1
1,2,3,0,5,4
2,1,3,0,5,4
3,1,2,0,5,4
1,3,2,0,5,4
2,3,1,0,5,4
3,2,1,0,5,4
3,2,0,1,5,4
2,3,0,1,5,4
0,3,2,1,5,4
3,0,2,1,5,4
2,0,3,1,5,4
0,2,3,1,5,4
0,1,3,2,5,4
1,0,3,2,5,4
3,0,1,2,5,4
0,3,1,2,5,4
1,3,0,2,5,4
3,1,0,2,5,4
2,1,0,3,5,4
1,2,0,3,5,4
0,2,1,3,5,4
2,0,1,3,5,4
1,0,2,3,5,4
0,1,2,3,5,4
5,1,2,3,0,4
1,5,2,3,0,4
2,5,1,3,0,4
5,2,1,3,0,4
1,2,5,3,0,4
2,1,5,3,0,4
2,1,3,5,0,4
1,2,3,5,0,4
3,2,1,5,0,4
2,3,1,5,0,4
1,3,2,5,0,4
3,1,2,5,0,4
3,5,2,1,0,4
5,3,2,1,0,4
2,3,5,1,0,4
3,2,5,1,0,4
5,2,3,1,0,4
2,5,3,1,0,4
1,5,3,2,0,4
5,1,3,2,0,4
3,1,5,2,0,4
1,3,5,2,0,4
5,3,1,2,0,4
3,5,1,2,0,4
0,5,1,2,3,4
5,0,1,2,3,4
1,0,5,2,3,4
0,1,5,2,3,4
5,1,0,2,3,4
1,5,0,2,3,4
1,5,2,0,3,4
5,1,2,0,3,4
2,1,5,0,3,4
1,2,5,0,3,4
5,2,1,0,3,4
2,5,1,0,3,4
2,0,1,5,3,4
0,2,1,5,3,4
1,2,0,5,3,4
2,1,0,5,3,4
0,1,2,5,3,4
1,0,2,5,3,4
5,0,2,1,3,4
0,5,2,1,3,4
2,5,0,1,3,4
5,2,0,1,3,4
0,2,5,1,3,4
2,0,5,1,3,4
3,0,5,1,2,4
0,3,5,1,2,4
5,3,0,1,2,4
3,5,0,1,2,4
0,5,3,1,2,4
5,0,3,1,2,4
5,0,1,3,2,4
0,5,1,3,2,4
1,5,0,3,2,4
5,1,0,3,2,4
0,1,5,3,2,4
1,0,5,3,2,4
1,3,5,0,2,4
3,1,5,0,2,4
5,1,3,0,2,4
1,5,3,0,2,4
3,5,1,0,2,4
5,3,1,0,2,4
0,3,1,5,2,4
3,0,1,5,2,4
1,0,3,5,2,4
0,1,3,5,2,4
3,1,0,5,2,4
1,3,0,5,2,4
2,3,0,5,1,4
3,2,0,5,1,4
0,2,3,5,1,4
2,0,3,5,1,4
3,0,2,5,1,4
0,3,2,5,1,4
0,3,5,2,1,4
3,0,5,2,1,4
5,0,3,2,1,4
0,5,3,2,1,4
3,5,0,2,1,4
5,3,0,2,1,4
5,2,0,3,1,4
2,5,0,3,1,4
0,5,2,3,1,4
5,0,2,3,1,4
2,0,5,3,1,4
0,2,5,3,1,4
3,2,5,0,1,4
2,3,5,0,1,4
5,3,2,0,1,4
3,5,2,0,1,4
2,5,3,0,1,4
5,2,3,0,1,4

[RickHaleParker]

Hmm, so that's not an option. Special bootloader and read it with that? Or will I have to take my CEM out and read the EEPROM?

I think you need the PIN to load a bootloader. As far as I know, nobody here has found the location of the CEM-B PIN in the dump.

Haven't put the CAN logger in yet or I might spend money to have a dealer do a readout and sniff the pin that way.

If you go that route and can get the dump. You should be able to find the location of the PIN in the dump. Do share if you ferret it out.

[ricked]

for P1 CEM there is also a sync code between MCU 1 and MCU 2

[zajcis]

Can anyone else please check files from 2010 on in a p1? It appears to me the pin code is not in that position in the 2010 on files. I can't crack any of the files from 2010 on.

I have the same problem with the bin file from 2010 C30 1M84E. Maybe you can send me your flash file and I could try to compare them and find PIN hopefully?

[mscarrock]

100E6 = 1E12 possible pins.
1E12 / 750 pins per second = 1,333,333,333.333 seconds.
1,333,333,333.333 seconds / 60 = 22,222,222.222 minutes.
22,222,222.222 minutes / 60 = 370,370.370 hours.
370,370.370 hours / 168 = 2,204.586 weeks.
2,204.586 weeks / 52 = 42.396 years.
If you lose power you will need to start over again.

I would be only 84 by then

Maybe it has been discussed already but how do VDASH guys crack your P2 CEM-B < 2005 from the bin file?

"2/ For cars 1998-2004 purchase some BDM programmer for Motorola MC68386 chips and make full backup of your CEM and send the BIN file to us. We will add the PIN for your CEM into VDASH and then you can change configuration and remove/add ignition keys and security on MOST" Source

I wish there was an easier way