Vida CEM swapping

[RickHaleParker]

here you go

[ZRimaZ]

Yes, I saw it - hw pn is in 2 forms - open text as you pointed and in binary format, just few lines below @ 5FEB4

[RickHaleParker]

usually I write HWPN from cem unit in file name....Maybe it's just mistake or kind of mistype...

An idea: Use the VIN number for the file names. VinNumber_XX.bin where XX is FF for Flash File, FD for Flash Data. EP for EeProm. Then a VinNumber.readme file, which is a text file, to contain all information you been putting in the file name and room for notes also. To find something you do a search in .readme files.

[swinokur]

It was a while ago in this thread, but my P1 CEM did crack with the teensy code:

Part Number: 31327215
Searching P/N 31327215 in 49 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 2 4 5 0 3 1

Done pull request issued.
P1 owners can download from my fork and try it or you can wait until VTL approves it and merges it with his.

Please report successful cracks and failures.

The new P1 list:

// P1
{ 8690719, CAN_500KBPS, 2 }, /* Confirmed */
{ 8690720, CAN_500KBPS, 2 }, /* Confirmed */
{ 8690721, CAN_500KBPS, 2 }, /* Unconfirmed */
{ 8690722, CAN_500KBPS, 2 }, /* Confirmed */
{ 30765471, CAN_500KBPS, 2 }, /* Confirmed */
{ 30728906, CAN_500KBPS, 2 }, /* Unconfirmed */
{ 30765015, CAN_500KBPS, 2 }, /* Confirmed */
{ 31254317, CAN_500KBPS, 2 }, /* Confirmed */
{ 31327215, CAN_500KBPS, 3 }, /* Assumed Confirmed */
{ 31254749, CAN_500KBPS, 3 }, /* Assumed Confirmed */
{ 31254903, CAN_500KBPS, 2 }, /* Confirmed */
{ 31296881, CAN_500KBPS, 2 }, /* Unconfirmed */

[RickHaleParker]

It was a while ago in this thread, but my P1 CEM did crack with the teensy code:

Part Number: 31327215
Searching P/N 31327215 in 49 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 2 4 5 0 3 1

I now know where 31327215 came from. Change it to confirmed.
Did you do a 31254749?

[swinokur]

31254749? That was not me.

I now know where 31327215 came from. Change it to confirmed.
Did you do a 31254749?

[mariom598]

I have a lot of p3 bins. I do not know where then pin is located - there was no need for me until now to analyse it, but I can extract pin from flash in other ways...

If you can, figure out the location of the PIN in .bin. Then parse the .bin files to extract the PINS. Publish the list of PINs. Perhaps we can spot a pattern.

Never checked it, but not I have done it ant -very strange -, but it looks very easy - P3 models with R32C processors R5F64525/R5F64524 have PIN located jus at the start of DataFlash, they are just swapped:
2021-12-08_113710.jpg
2021-12-08_113912.jpg

P3 CEM with M30882FJ processor has different system - it needs more deep analyzing. Attached are few flash files with PINs in their names.
P3 CEM M30882FJ with PINs.rar

Hi, in my case what would be the right pin? Thanks!

[RickHaleParker]

Hi, in my case what would be the right pin? Thanks!

23 15 92 67 72 Shuffle {3,1,0,2,4} = 92 15 67 23 72 .
00 01 02 03 04 ....... Placement ...... 00 01 02 03 04


00 01 02 03 04 */ Placement /*
23 15 92 67 72 */ PIN in .bin /*
03 01 00 02 04 */ Shuffle /*
92 15 67 23 72 */ PIN /*

[mariom598]

Hi, in my case what would be the right pin? Thanks!

23 15 92 67 72 Shuffle {3,1,0,2,4} = 92 15 67 23 72 .
00 01 02 03 04 ....... Placement ...... 00 01 02 03 04


00 01 02 03 04 */ Placement /*
23 15 92 67 72 */ PIN in .bin /*
03 01 00 02 04 */ Shuffle /*
92 15 67 23 72 */ PIN /*

First of all, thank you, I forgot to say, that this is an CEM module mounted on an XC 60/2015

[RickHaleParker]

Another way to write a shuffle, which I think is better is: B:P 0:3 1:1 2:0 3:2 4:4 ( .bin to Pin, 0 to 3, 1 to 1, 2 to 0, 3 to 2, 4 to 4 ).
The advantages are:

• 1. It is easier to read and work with.
  2. If you want to the reverse shuffle to get Pin to .bin:
  • A. Flip each set, P:B 3:0 1:1 0:2 2:3 4:4
    B. Re-sequence the numeric sets P:B 0:2 1:1 2:3 3:0 4:4 { 2,1,3,0,4 }
  .