Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Re: Vida CEM swapping

Post by RickHaleParker »

ZRimaZ wrote: ↑08 Dec 2021, 11:09 :D no, it is just simple winhex and it does not do such a sophisticated search. I just tried to search for this string, but accidentally looked at first bytes in this file and my search engine ;) found what I was going to search with winhex :) :)
Oh darn! ... it was all in your head. :wink:
Find permutations would be a nice feature for a Hex editor.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

ZRimaZ wrote: ↑08 Dec 2021, 02:44 P3 CEM with M30882FJ processor has different system - it needs more deep analyzing. Attached are few flash files with PINs in
Found all three at offset 0007E001 - 0007E005. Transposition cipher applies.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

I have only been able to find four Volvo part numbers for P3 CEMs.
Can anybody confirm the processor(s) for part numbers 31327994 & 31412971 ?

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
31327994 : ?
31412971 : ?
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

RickHaleParker wrote: ↑08 Dec 2021, 20:24 I have only been able to find four Volvo part numbers for P3 CEMs.
Can anybody confirm the processor(s) for part numbers 31327994 & 31412971 ?

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
31327994 : ?
31412971 : ?
Here you go!
Attachments
P3 R32F.rar
(7.25 KiB) Downloaded 179 times
Have a nice day,

ZRimaZ
Top
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

ZRimaZ wrote: ↑09 Dec 2021, 01:54 Here you go!
The M30882FJ files look like processor flash files.
The R5F64524/R5F64525 files look like EEprom data files not processor flash files.
Not finding the part number in the R5F64524/R5F64525 EEprom files.
Got any processor flash files for the R5F64524/R5F64525 ?
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

RickHaleParker wrote: ↑09 Dec 2021, 08:38
The M30882FJ files look like processor flash files.
The R5F64524/R5F64525 files look like EEprom data files not processor flash files.
Not finding the part number in the R5F64524/R5F64525 EEprom files.
Got any processor flash files for the R5F64524/R5F64525 ?
Yes ,that's true - R32C has flash, DataFlash and EEPROM. PN is located in flash as open text at 0xBFC48:
2021-12-09_183543.jpg
2021-12-09_183543.jpg (157.21 KiB) Viewed 727 times
Here is one of the Flash files from the car from previous DataFlash collection:
CEM R5F64524 Flash S80_2010_B6324S2_YV1960AR1A1124349 AG9T-14C256-GC_H5PLA_31254838AC_ser93290800 ori US.rar
(344.33 KiB) Downloaded 180 times
P3 CEM with M30882FJ processor has Flash in processor and separate EEPROM 25LC320, which is encrypted ;)
Have a nice day,

ZRimaZ
Top
vtl
Posts: 4723
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 603 times

Post by vtl »

I wonder whether pin is generated based on some data from car's configuration?
Top
ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

vtl wrote: ↑09 Dec 2021, 09:40 I wonder whether pin is generated based on some data from car's configuration?
No idea... :(
Have a nice day,

ZRimaZ
Top
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

ZRimaZ wrote: ↑09 Dec 2021, 09:36 Yes ,that's true - R32C has flash, DataFlash and EEPROM. PN is located in flash as open text at 0xBFC48:
The 31254838 datapoint was useful. It lead me to four more P3 CEM part numbers. 31314511, 31314116, 31254838, 31254837

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005, Both in Flash.
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005, Both in Flash
31327994 : ?
31412971 : ?
31314511 : ?
31314116 : ?
31254838 : R5F64524 processor. Part number @ offset 0000BFC48 in Flash. PIN @ 00000001 - 00000005 in DataFlash.
31254837 : ?
Last edited by RickHaleParker on 09 Dec 2021, 11:01, edited 1 time in total.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

vtl wrote: ↑09 Dec 2021, 09:40 I wonder whether pin is generated based on some data from car's configuration?
His known PINs are data matching what is found in the files. Shuffled like the P1 & P2. I am working off the assumption that his known PINs will solve the challenge and gain him access.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Top
Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “XC90 1st gen 2003-2014”