Vida CEM swapping

Post by **RickHaleParker** » 05 Sep 2021, 21:52

swinokur wrote: 05 Sep 2021, 19:30 After reading more of this thread, I found the strong suggestion to not power the teensy with USB power and switched over to a buck transformer that I had in a parts bin:

Teensy 4.0 100mA Max
SN65HVD230 17mA max

100mA + 2 x 17mA = 134mA Max. Unless you got a real old USB 1.X. V-USB has enough power.

UBS 1.X ??? mA
USB 2.0 500 mA
USB 3.0 900 mA
BC 1.2 1500 mA
USB-C 3000 mA
PD Up to 5000 mA

The SN65HVD230 is a 3.3V transceiver. There been reports that a lot of 3.3v transceivers are junk and don't work. If you replace the transceivers switch to 5V transceivers. Make sure you power them off 5V not the 3.3V out.

Nilsson · Post by **Nilsson** » 06 Sep 2021, 13:55

Anybody know if it's possible to crack the Volvo SPA CEM Modules? Im open to testing on my own car so any information is welcome. I dont know much about car computers but im willing to learn and test my way forward.

Post by **RickHaleParker** » 06 Sep 2021, 15:31

Nilsson wrote: 06 Sep 2021, 13:55 Anybody know if it's possible to crack the Volvo SPA CEM Modules?

Cannot crack a P6 through the OBD port. There is some way to do it on the bench.
We have not even begun to look into the P3, P5 & P6.

Volvo P1 = Ford Global C-car Platform, Mazda BK platform.
Volvo P2 = Ford D3 platform
Volvo P3 = Ford EUCD platform
Volvo P4 was a collaboration with Renault never finished or produced.
Volvo P5 = CMA ( Compact Modular Architecture ) Volvo/Geely.
Volvo P6 = SPA ( Scalable Product Architecture ) Volvo/Polestar.

Nilsson · Post by **Nilsson** » 06 Sep 2021, 15:37

RickHaleParker wrote: 06 Sep 2021, 15:31
Nilsson wrote: 06 Sep 2021, 13:55 Anybody know if it's possible to crack the Volvo SPA CEM Modules?
Cannot crack a P6 through the OBD port. There is some way to do it on the bench.
We have not even begun to look into the P3, P5 & P6.

Do you think it would be possible to sniff the information sent throught vida when updating/connecting the car? then trying to decrypt it and maybe find something usefull?

Post by **RickHaleParker** » 06 Sep 2021, 15:57

Nilsson wrote: 06 Sep 2021, 15:37 Do you think it would be possible to sniff the information sent throught vida when updating/connecting the car? then trying to decrypt it and maybe find something usefull?

The newer cars ( P3 - P6 ) use a randomly generated challenge to gain access. Any data you sniff out will be unless you know the algorithm to solve the challenge. Each challenge will be a different set of numbers. The correct response for each set is different. The only way to get the challenge-response algorithm is to dig through the firmware dump and decode it.

It not a simple password, you cannot just parrot what you sniff out.

Post by **vtl** » 07 Sep 2021, 08:21

RickHaleParker wrote: 06 Sep 2021, 15:31 Volvo P2 = Ford D3 platform

I think P2 was pure Swede. Designed before Ford's take over of Volvo. Compared to Fords and later, Ford-influenced Volvos, P2 is so unFord.

Post by **vtl** » 07 Sep 2021, 08:24

Anyone with uncrackable P1 is willing to share his CEM flash files? I may have some time to disassemble it and find the pin compare routine.

Post by **RickHaleParker** » 07 Sep 2021, 08:43

vtl wrote: 07 Sep 2021, 08:21 I think P2 was pure Swede. Designed before Ford's take over of Volvo. Compared to Fords and later, Ford-influenced Volvos, P2 is so unFord.

It was developed by Volvo before the 1999 acquisition by Ford Motor Company. The Ford D3 platform is the Volvo P2 platform with some modifications. One could say they Forded it.

swinokur · Post by **swinokur** » 07 Sep 2021, 10:56

vtl wrote: 07 Sep 2021, 08:24 Anyone with uncrackable P1 is willing to share his CEM flash files? I may have some time to disassemble it and find the pin compare routine.

Hey there,
I'd be happy to - although I'd first need some guidance on how to grab those flash files. (I'm comfortable with soldering, jtags, etc...)

swinokur · Post by **swinokur** » 07 Sep 2021, 10:58

I also need to go outside today or tomorrow and try re-running the software using the other two shuffle orders. I haven't done that yet.