Vida CEM swapping

[ZRimaZ]

But anyway, if you need biaries from any volvo cem, let me know. Or other questions, just pm me. I know something a little bit

[RickHaleParker]

But anyway, if you need biaries from any volvo cem, let me know. Or other questions, just pm me. I know something a little bit

You you have the location of the P3 PIN and have a sufficient number of P3 binaries?

I have a faint memory of reading someplace that one weakness of the P3 CEM is that Ford/Volvo only used a subset of all the possible PINs. If this is the case and we knew the pattern of the subset. It could be used as a initial shortlist for the P3 crack. Speeding up the time it takes to crack a P3.

VTL has a P3 crack but it has not be moved to the main. You can find it as a branch of VTL's main on Github. As is, the maximum crack time is 31.5 hours to crack.

[ZRimaZ]

I have a lot of p3 bins. I do not know where then pin is located - there was no need for me until now to analyse it, but I can extract pin from flash in other ways...

[RickHaleParker]

I have a lot of p3 bins. I do not know where then pin is located - there was no need for me until now to analyse it, but I can extract pin from flash in other ways...

If you can, figure out the location of the PIN in .bin. Then parse the .bin files to extract the PINS. Publish the list of PINs. Perhaps we can spot a pattern.

[RickHaleParker]

Can anybody find some Secondary Boot loaders in the VIDA database or some clues on how to read and flash the .bin through the OBDII port?

[matija0610]

let's search by scripts. you are free to join, there are a lot of them.

most likely we will not find it in a database that has never downloaded any SW from the official server.

it would be good if there is someone with a licensed version of Vida and at least one upgrade, to compare the data.

I don't think we have it pre-installed

[ZRimaZ]

I have a lot of p3 bins. I do not know where then pin is located - there was no need for me until now to analyse it, but I can extract pin from flash in other ways...

If you can, figure out the location of the PIN in .bin. Then parse the .bin files to extract the PINS. Publish the list of PINs. Perhaps we can spot a pattern.

Never checked it, but not I have done it ant -very strange -, but it looks very easy - P3 models with R32C processors R5F64525/R5F64524 have PIN located jus at the start of DataFlash, they are just swapped:

2021-12-08_113710.jpg (175.86 KiB) Viewed 1152 times

2021-12-08_113912.jpg (156.21 KiB) Viewed 1152 times

P3 CEM with M30882FJ processor has different system - it needs more deep analyzing. Attached are few flash files with PINs in their names.

P3 CEM M30882FJ with PINs.rar

(707.22 KiB) Downloaded 167 times

[RickHaleParker]

they are just swapped:

Transposition cipher. Same thing in P1s & P2s. In the Teensy code VTL calls it Shuffle order.

What is the Hex editor you are using? ... I like how the search will find permutations.

[RickHaleParker]

most likely we will not find it in a database that has never downloaded any SW from the official server.

Vida stores software on a remote server. A SBL is software so it would stand to reason a SBL are downloaded from a remote server when needed and are not in the local database.

[ZRimaZ]

What is the Hex editor you are using? ... I like how the search will find permutations.

no, it is just simple winhex and it does not do such a sophisticated search. I just tried to search for this string, but accidentally looked at first bytes in this file and my search engine found what I was going to search with winhex