Vida CEM swapping

[RickHaleParker]

31327215 is different, because flash size is 384kb, it has HWPN @0x5FEB4, but I can't locate PIN within bin. The PIN 217108822803 is read by io terminal.

Yesterday I got rumors, that some newer P1 CEM probably have no PIN. I do not know whether is it true or not, it has to be checked and confirmed. 31327215 is from the car MY 2013

I could not find the PIN 217108822803 PIN in the .bin either.

No pin ... not possible, the protocol requires a PIN. Default PIN like 000000000000 is possible. Accept all PINs is possible.

I think somebody may of come across a P1 with a unencrypted PIN. That is Pin and Bin PIN are 1:1 ( Shuffle 0,1,2,3,4,5 ).

I will dig through the rest and let you know when I'm finished.

[RickHaleParker]

All the P1s I could confirm are Shuffle #2 {5,2,1,4,0,3}. I am going to set Shuffle #2 {5,2,1,4,0,3} as the default for all P1s. Comment all entries as confirmed or not confirmed.

HW PN, BIN PIN, PIN
8690719, 31 36 45 34 52 03, 03 45 36 52 31 34 , Shuffle 5,2,1,4,0,3 (2)
8690720, 54 61 99 29 40 20, 20 99 61 40 54 29 , Shuffle 5,2,1,4,0,3 (2)
8690722, 57 08 45 68 46 55, 55 45 08 46 57 68 , Shuffle 5,2,1,4,0,3 (2)
30765015, 34 71 64 28 13 22, 22 64 71 13 34 28 , Shuffle 5,2,1,4,0,3 (2)
30765471, 83 90 04 14 00 40, 40 04 90 00 83 14 , Shuffle 5,2,1,4,0,3 (2)
31254317, 57 78 76 72 05 61, 61 76 78 05 57 72 , Shuffle 5,2,1,4,0,3 (2)
31254749, ??? , ????, Processor mask 1M84E, HWPN @ 0xFBEB4
31254903, 22 89 14 56 28 88, 88 14 89 28 22 56 , Shuffle 5,2,1,4,0,3 (2)
31327215, ???, 217108822803, Processor mask 1L15Y, HWPN @ 0x5FEB4

[RickHaleParker]

31327215 is different, because flash size is 384kb, it has HWPN @0x5FEB4, but I can't locate PIN within bin. The PIN 217108822803 is read by io terminal.

31327215 is already set to shuffle #3 {2, 4, 5, 0, 3, 1} in the Teensy code. The string you should look for in the files is "820321287108" ( 217108822803 shuffle {2, 4, 5, 0, 3, 1} = 820321287108) .

[RickHaleParker]

Done pull request issued.
P1 owners can download from UpdateP1_Parm a branch on my fork and try it or you can wait until VTL approves it and merges it with his.

PS: Changes have been merged with VTL:Master. Branch UpdateP1_Parm has been deleted.

Please report successful cracks and failures.

The new P1 list:

// P1
{ 8690719, CAN_500KBPS, 2 }, /* Confirmed */
{ 8690720, CAN_500KBPS, 2 }, /* Confirmed */
{ 8690721, CAN_500KBPS, 2 }, /* Unconfirmed */
{ 8690722, CAN_500KBPS, 2 }, /* Confirmed */
{ 30765471, CAN_500KBPS, 2 }, /* Confirmed */
{ 30728906, CAN_500KBPS, 2 }, /* Unconfirmed */
{ 30765015, CAN_500KBPS, 2 }, /* Confirmed */
{ 31254317, CAN_500KBPS, 2 }, /* Confirmed */
{ 31327215, CAN_500KBPS, 3 }, /* Assumed Confirmed */
{ 31254749, CAN_500KBPS, 3 }, /* Assumed Confirmed */
{ 31254903, CAN_500KBPS, 2 }, /* Confirmed */
{ 31296881, CAN_500KBPS, 2 }, /* Unconfirmed */

[ZRimaZ]

31327215 is already set to shuffle #3 {2, 4, 5, 0, 3, 1} in the Teensy code. The string you should look for in the files is "820321287108" ( 217108822803 shuffle {2, 4, 5, 0, 3, 1} = 820321287108) .

No String not found Something wrong.

Have to check pin decoding with teensy, but there's no cars with this cem comming to my shop next week...

[RickHaleParker]

No String not found Something wrong.

Something different for sure. Could the PIN be stored in another chip?

Notes: Part Number: 31327215 Supersession(s): 31296881.

[ZRimaZ]

Something different for sure. You seems to have the same luck I have, end up with the odd ball builds.
Have you cracked it with our Teensy cracker?
Could the PIN be stored in another chip?

OK, nice -I'm not alone
P1 - no one yet .. Waiting P1 car coming to me, but as I wrote - there are no P1 cars planned to come to me for next week.

BTW, question outside P1 PIN cracking - I did few times P2 CEM-H PIN cracking and it took for me about 30 minutes. I read here it takes about 15min. What could be the reason? Of course, 30 min is also very nice result, but always is better to have it faster

[ZRimaZ]

Notes: Part Number: 31327215 Supersession(s): 31296881.

One note from me - one file which has 3137215 in bin is market by me in file name as 31268178 - usually I write HWPN from cem unit in file name....Maybe it's just mistake or kind of mistype...

[RickHaleParker]

One note from me - one file which has 3137215 in bin is market by me in file name as 31268178 - usually I write HWPN from cem unit in file name....Maybe it's just mistake or kind of mistype...

Not finding 31268178 in any of the file names you up loaded here.

[ZRimaZ]

Not finding 31268178 in any of the file names you up loaded here.

here you go

CEM_31268178_1L15Y_8MHz_flash OK.rar

(123.66 KiB) Downloaded 128 times