Vida CEM swapping

[RickHaleParker]

After reading more of this thread, I found the strong suggestion to not power the teensy with USB power and switched over to a buck transformer that I had in a parts bin:

Teensy 4.0 100mA Max
SN65HVD230 17mA max

100mA + 2 x 17mA = 134mA Max. Unless you got a real old USB 1.X. V-USB has enough power.

• UBS 1.X ??? mA
  USB 2.0 500 mA
  USB 3.0 900 mA
  BC 1.2 1500 mA
  USB-C 3000 mA
  PD Up to 5000 mA

The SN65HVD230 is a 3.3V transceiver. There been reports that a lot of 3.3v transceivers are junk and don't work. If you replace the transceivers switch to 5V transceivers. Make sure you power them off 5V not the 3.3V out.

[Nilsson]

Anybody know if it's possible to crack the Volvo SPA CEM Modules? Im open to testing on my own car so any information is welcome. I dont know much about car computers but im willing to learn and test my way forward.

[RickHaleParker]

Anybody know if it's possible to crack the Volvo SPA CEM Modules?

Cannot crack a P6 through the OBD port. There is some way to do it on the bench.
We have not even begun to look into the P3, P5 & P6.

Volvo P1 = Ford Global C-car Platform, Mazda BK platform.
Volvo P2 = Ford D3 platform
Volvo P3 = Ford EUCD platform
Volvo P4 was a collaboration with Renault never finished or produced.
Volvo P5 = CMA ( Compact Modular Architecture ) Volvo/Geely.
Volvo P6 = SPA ( Scalable Product Architecture ) Volvo/Polestar.

[Nilsson]

Anybody know if it's possible to crack the Volvo SPA CEM Modules?

Cannot crack a P6 through the OBD port. There is some way to do it on the bench.
We have not even begun to look into the P3, P5 & P6.

Do you think it would be possible to sniff the information sent throught vida when updating/connecting the car? then trying to decrypt it and maybe find something usefull?

[RickHaleParker]

Do you think it would be possible to sniff the information sent throught vida when updating/connecting the car? then trying to decrypt it and maybe find something usefull?

The newer cars ( P3 - P6 ) use a randomly generated challenge to gain access. Any data you sniff out will be unless you know the algorithm to solve the challenge. Each challenge will be a different set of numbers. The correct response for each set is different. The only way to get the challenge-response algorithm is to dig through the firmware dump and decode it.

It not a simple password, you cannot just parrot what you sniff out.

[vtl]

Volvo P2 = Ford D3 platform

I think P2 was pure Swede. Designed before Ford's take over of Volvo. Compared to Fords and later, Ford-influenced Volvos, P2 is so unFord.

[vtl]

Anyone with uncrackable P1 is willing to share his CEM flash files? I may have some time to disassemble it and find the pin compare routine.

[RickHaleParker]

I think P2 was pure Swede. Designed before Ford's take over of Volvo. Compared to Fords and later, Ford-influenced Volvos, P2 is so unFord.

It was developed by Volvo before the 1999 acquisition by Ford Motor Company. The Ford D3 platform is the Volvo P2 platform with some modifications. One could say they Forded it.

[swinokur]

Anyone with uncrackable P1 is willing to share his CEM flash files? I may have some time to disassemble it and find the pin compare routine.

Hey there,
I'd be happy to - although I'd first need some guidance on how to grab those flash files. (I'm comfortable with soldering, jtags, etc...)

[swinokur]

I also need to go outside today or tomorrow and try re-running the software using the other two shuffle orders. I haven't done that yet.