Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Re: Vida CEM swapping

Post by RickHaleParker »

Shoot I just realize with nothing on the back side, I should be able to use a 90° J1962M connector and still get it to fit in a standard OBDII plug. Looks like JLCPB might not be able to supply the J1962. You would need to source the 90° J1962M and solder it on yourself.

I think I will create a second version with a 90° J1962M .
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

RickHaleParker wrote: 15 Jan 2022, 13:14 I would like to take a look a Girl V1.0.1 ( Guss is Swedish slang for girl. Borrowed from Turkish kız. ).
Can you pack it in a zip file and attach it or host it someplace and provide a link.
Here you go: https://drive.google.com/file/d/1LkhP6V ... sp=sharing
Have a nice day,

ZRimaZ

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

It is reading the PIN at Offset 4E000 - 4E005 and applying the transposition cipher ( Shuffle ) decode or encode depending on which you consider to be clear text .
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

RickHaleParker wrote: 17 Jan 2022, 14:17
It is reading the PIN at Offset 4E000 - 4E005 and applying the transposition cipher ( Shuffle ) decode or encode depending on which you consider to be clear text .
Hmm. I know it and you know it already - PIN position we cleared already some time ago... ;) Or am I wrong again? :)
Have a nice day,

ZRimaZ

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

ZRimaZ wrote: 17 Jan 2022, 14:23 PIN position we cleared already some time ago... ;) Or am I wrong again? :)
Guss is for the CEM-L & CEM-H. VTL posted the addresses and how to do the shuffle way back on page 7.

Man that sounds like dancing lessons. :lol:

⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

I think this one is a better. It is designed for a 90° J1962. Ordered one so I can make sure it works and no mistakes. Will know in 2 - 3 weeks.

Gave up on trying to get it to fix the smaller cases. The smaller cases don't have the right dimensions for a 90° J1962.
My new target case is the rectangular case that most USB ELM327 devices use.
2022-01-17.png
2022-01-17 (1).png
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

askrobek
Posts: 11
Joined: 18 January 2022
Year and Model: 2007 S60R
Location: USA, CT
Has thanked: 2 times

Post by askrobek »

Hello everyone,

I tried to build the cracker, but I'm not a professional electronic. Last time I dealt with uC in my high school > 20 years ago. But I have some basic knowledge.

The device was connected to a car and to a laptop, all from batteries. In the serial window it says:

Reading part number from ECU 0x40 on CAN_LS
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS <--- ID=0131726c data=00 0c 35 52 00 00 00 3f
CAN_LS <--- ID=01e0162a data=40 10 00 60 07 00 99 00
....
CAN_HS <--- ID=11220028 data=03 40 f3 3e 86 00 33 1f
CAN_HS <--- ID=01000020 data=00 00 00 01 b0 04 c0 00
CAN_HS ---> ID=000ffffe data=cb 50 b9 f0 00 00 00 00
Unknown CEM part number 0. Don't know what to do.

and stops. I have the most recent version of the software. I checked all connections and I think they are ok.
I tried key in position 0 and 1.
When the cracker was connected to OBD2 and key in position 1, there was weird knocking in gear shifter (it is automatic 6 speed).

I used Teensy 4.0, and 2 x "Waveshare SN65HVD230". I use 3.3 volt power only, from laptop usb. Is there something obviously wrong I'm doing? Thank you for any help.

Adrian
Attachments
log.txt
(14.12 KiB) Downloaded 80 times

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

askrobek wrote: 18 Jan 2022, 19:38 wrong I'm doing? Thank you for any help.
Year and model of car.

Post some close up high resolution pictures of you Cracker. Perhaps we can spot some issues with the build.

How is the battery in the car? Measure the voltage drop.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

askrobek wrote: 18 Jan 2022, 19:38When the cracker was connected to OBD2 and key in position 1, there was weird knocking in gear shifter (it is automatic 6 speed).

I used Teensy 4.0, and 2 x "Waveshare SN65HVD230". I use 3.3 volt power only, from laptop usb. Is there something obviously wrong I'm doing? Thank you for any help.
Clicking solenoids is a sign of some problem in CAN communication. Do you have common ground between Teensy and OBD connector?

Also you can try to disable CEM_PN_AUTODETECT (remove line 14: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14), in a hope your car has 500 and 125 Kbps buses.

askrobek
Posts: 11
Joined: 18 January 2022
Year and Model: 2007 S60R
Location: USA, CT
Has thanked: 2 times

Post by askrobek »

Thanks for all the responses.

It is 2007 S60R. I attached 2 pictures of the cracker.
I will check the battery and try other things after work in the evening.
I do not have the common ground between OBD2 and Teensy. I will try that too. And I will try to comment out the code and let you know in any of these helped.

Thanks!
Adrian
Attachments
20220119_074643.jpg
20220119_074623.jpg

Post Reply
  • Similar Topics
    Replies
    Views
    Last post