Vida CEM swapping

Post by **RickHaleParker** » 28 Nov 2021, 20:43

matija0610 wrote: ↑28 Nov 2021, 12:31 I have a bit of a problem with the language barrier, I understand you all, but I don't know how much you understand my writing.

Your English is better then many Americans. English grammar is not a problem for you. Vocabulary ... is a never ending lesson in any language.

urosm · Post by **urosm** » 29 Nov 2021, 00:42

RickHaleParker wrote: ↑22 Nov 2021, 01:46
urosm wrote: ↑22 Nov 2021, 00:41 Is it possible to somehow implement this P/N to be supported and to be able to read the PIN via OBD? I am willing to help if I can somehow, since I have a car with that CEM

CEM P/N: 30728356
That is a P/N we have not encountered before.

Find the section the code below and add a line for it as highlighted. Save it then upload to your cracker. Let us know if it cracks the CEM or not.

Or you can download from my fork and try it. I made the changes for you. If it works, I'll do a pull request so VTL can add it to his master and get me some hands on experience doing a pull request with github.

You might want to make a folder named VTL and move all the files from VTL to that folder. Then on the same level as the VTL folder make another folder named RHP. Download from my fork to the RHP folder and work from there. That way you can keep the two separate and avoid overwriting one with the other.

// P2 CEM-L (L shaped and marked L 2005-2014)
{ 30682981, CAN_500KBPS, 1 },
{ 30682982, CAN_500KBPS, 1 },
{ 30728356, CAN_500KBPS, 1 },
{ 30728542, CAN_500KBPS, 1 },
{ 30765149, CAN_500KBPS, 1 },
{ 30765646, CAN_500KBPS, 1 },
{ 30786475, CAN_500KBPS, 1 },
{ 30786889, CAN_500KBPS, 1 },
{ 31282457, CAN_500KBPS, 1 },
{ 31314468, CAN_500KBPS, 1 },
{ 31394158, CAN_500KBPS, 1 },

Yesterday, I have tested a cracker on a 2005 Volvo V70 and PIN is cracked without problems.
I just add highlighted line to code in my cracker and that's it

Post by **RickHaleParker** » 29 Nov 2021, 01:32

urosm wrote: ↑29 Nov 2021, 00:42 Yesterday, I have tested a cracker on a 2005 Volvo V70 and PIN is cracked without problems.
I just add highlighted line to code in my cracker and that's it

30728356 verified. Pull request issued.

Post by **vtl** » 29 Nov 2021, 08:47

RickHaleParker wrote: ↑29 Nov 2021, 01:32 30728356 verified. Pull request issued.

Merged, thanks.

matija0610 · Post by **matija0610** » 29 Nov 2021, 13:45

today i took one CEM from the trash, read the flash and analyzed it a bit.
I finally move on.

Rick, Ignore my questions about addresses. I figured I was mixing terms. hex and bits. i replaced the logic and now everything makes sense, keep working on tools.

: Screenshot_1.png (58.61 KiB) Viewed 694 times

What do you think about this data for chksum? today I found this information on the swedespeed forum, it seems the right thinking !?

: Screenshot_3.png (58.26 KiB) Viewed 694 times

ZRimaZ · Post by **ZRimaZ** » 29 Nov 2021, 14:02

True, checksum is simple 8 bit checksum of the block, starting from 0x8102 with block lenght, which is at 0x8100

Post by **RickHaleParker** » 30 Nov 2021, 09:25

matija0610 wrote: ↑29 Nov 2021, 13:45 What do you think about this data for chksum? today I found this information on the swedespeed forum, it seems the right thinking !?

The highligted position for the VIN number is off by 11 bytes. They did not include the offset when they did the highlight.
The VIN number is: YV1TS7202Y1082366.
The VIN Hex string is: 59 56 31 54 53 37 32 30 32 59 31 30 38 32 33 36 36.
It is a 2000 S80 with a D5252T MSA 15.8, manual transmission, built at the Torslanda Plant.

First byte of the VIN is located at:
8000₁₆ + ( 88₁₀ / 8₁₀ ).
11₁₀ = B₁₆.
8000₁₆ + B₁₆ = 8000B₁₆ ( 0x800B ) .

matija0610 · Post by **matija0610** » 30 Nov 2021, 10:00

everything is exactly as you wrote.
you put my thinking in mathematical expression.

thx

Post by **RickHaleParker** » 30 Nov 2021, 10:11

matija0610 wrote: ↑30 Nov 2021, 10:00 everything is exactly as you wrote.
you put my thinking in mathematical expression.
thx

Full range of the VIN is 0x800B to ( 0x800B + 0xB ) = 0x800B to 0x8016 .

You have trouble ferreting out the equations or writing a mathematical expression?

matija0610 · Post by **matija0610** » 30 Nov 2021, 10:30

no, everything is fine!

currently marking the fields in .bin, where what is, I'll post tomorrow.
I really have a lot of work to implement the hex editor in my tool at the moment, lack of knowledge, too, I would have to spend a lot of time reading the internet but the winter is long, who knows ..

Until then HEX workshop is good, supports bookmarks.

Vida CEM swapping

Re: Vida CEM swapping