Vida CEM swapping

urosm · Post by **urosm** » 23 Nov 2021, 09:44

Okay, I understand that part.
Just tell me, do you know, if I want to read flash and eeprom CEM with IO Terminal, do I have to convert the PIN to some other form?

bosse · Post by **bosse** » 23 Nov 2021, 23:18

I have read p1,p2 with ioterminal.
No need to change anything.

urosm · Post by **urosm** » 24 Nov 2021, 09:14

Great!
I know for P2 that can be read with IO, but I didn't know for P1

Thanks!

bosse · Post by **bosse** » 24 Nov 2021, 09:22

P1 is not official on ioterminal, only p2,p3.

matija0610 · Post by **matija0610** » 28 Nov 2021, 03:58

I made a .net form that searches on vida database,, some kind of "damos" to change the configuration on eg. CEM.

but, can't figure out, what is the starting address for the offset in .bin file ? Is there any regularity, or stored value in the flash.

: flashadresss.png (124.14 KiB) Viewed 802 times

does this screenshot have anything to do with what i am asking?

: flash.png (18.48 KiB) Viewed 802 times

thx

Post by **RickHaleParker** » 28 Nov 2021, 04:39

matija0610 wrote: 28 Nov 2021, 03:58 but, can't figure out, what is the starting address for the offset in .bin file ? Is there any regularity, or stored value in the flash.

↓↓↓ This is from page 7 and it is for the P2 CEM-L & CEM-H. ↓↓↓

vtl wrote: 01 Oct 2020, 11:20 So the PIN is located at address 0xFFE000. Flash starts at address 0xFB0000, so when you get the dump the PIN is at offset 0x4E000 in the file. The PIN byte sequence in dump is not linear.

For example, this is PIN from my dump:

offset __ B3 B1 B5 B0 | B2 B4 XX XX |
0004E000| 53 38 03 21 │ 18 02 FF FF │

PIN = B0 B1 B2 B3 B4 B5
PIN is 21 38 18 53 02 03

This way you don't have to rely on the windows software to dig out the PIN.

matija0610 · Post by **matija0610** » 28 Nov 2021, 05:04

thank you.
yes, i read that earlier. and compared to some bin's.
but what I'm trying to figure out is:
is there a rule that the address is exactly right there, or should it be searched around the flash ?

Post by **RickHaleParker** » 28 Nov 2021, 05:59

matija0610 wrote: 28 Nov 2021, 05:04 what I'm trying to figure out is: is there a rule that the address is exactly right there, or should it be searched around the flash ?

VTL was instructing us on how to find the PIN in the .bin. If the addresses where not a constant the instructions would be useless to the rest of us. Logic tell me the addresses are a constants. Do you concur? Am I missing something?

FFE000 - FB0000 = 4E000.

VTL checks in almost daily. Perhaps he will enlighten us.

Looks like you got a good handle on the VIDA database.

Post by **RickHaleParker** » 28 Nov 2021, 06:38

urosm wrote: 22 Nov 2021, 23:34 Thanks, RHP!
I will try it later today or tomorrow and I'll let you know what I did

Tomorrow was 4 days ago. Did you get sidetracked?

matija0610 · Post by **matija0610** » 28 Nov 2021, 06:42

i don't think they are at constant addresses, if i understood correctly, teensy doesn't know where the pin is but knows how to "attack" the CEM to find out the pin.
in any case, I still have a lot to learn and explore