Vida CEM swapping

[RickHaleParker]

It will work slower than sirloin's code, because I don't want to fork cracking routines for different CEMs and have to support them ever since. Anyways, for most of people, cracking their CEM is a one time in life effort.

Sirlion's faster code cracks my bench CEM-L as long as PERCENT_DIFF_THRESHOLD is 0.7 or higher. Keeping Sirlion's code compatible with all CEMs appears to be a matter of determining the minimum threshold that will work for all CEMs.

If Sirlion's faster code is not cracking your CEM-L or CEM-H increase the value of PERCENT_DIFF_THRESHOLD.

[vtl]

Sirlion's faster code cracks my bench CEM-L as long as PERCENT_DIFF_THRESHOLD is 0.7 or higher. Keeping Sirlion's code compatible with all CEMs appears to be a matter of determining the minimum threshold that will work for all CEMs.

It does not crack mine (difficult third byte).

[RickHaleParker]

It does not crack mine (difficult third byte).

How high of threshold have you tried?

[vtl]

How high of threshold have you tried?

Whatever was there (0.7?)

[RickHaleParker]

Whatever was there (0.7?)

It is set at 0.7 because that what it took to crack my Bench CEM-L. At 0.5 my Bench CEM-L would not get the third byte. However we don't know 0.7 is high enough for all. Try bumping up the threshold to something like 1.0 and see if it gets your third and fourth byte.

You will find it right at the top of his code.

/* tunable parameters */

#define CALC_BYTES 4 /* how many PIN bytes to calculate (1 to 4), the rest is brute-forced */
#define SAMPLES 1 /* how many hundreds of samples to attempt per pin digit */
#define PERCENT_DIFF_THRESHOLD 0.7 /* percentage difference between top two pins */
#define MAX_ROUNDS 3 /* max number of filter rounds before picking top entry */

[RickHaleParker]

We could move the tunable parameters to the CEM parameters, that way each CEM could have it's own tune.

[vtl]

Try bumping up the threshold to something like 1.0 and see if it gets your third and fourth byte.

It never goes higher than 0.03%, 0.04% at best.

[RickHaleParker]

It never goes higher than 0.03%, 0.04% at best.

You could try dropping the threshold back to 0.7 and increasing MAX_ROUNDS. A fourth round might be enough to bring out the correct byte.

#define MAX_ROUNDS 4 /* max number of filter rounds before picking top entry */
This will produce 1000 samples per pin total instead of 600 per pin total.

[RickHaleParker]

Sirlions threshold detect works on my Bench CEM-L with these parameters.

It appears that the P2s need a much larger minimum samples before it is reliable.
At a initial 1000 samples per pin, it get the first 4 bytes on the first pass.

/* tunable parameters /

#define CALC_BYTES 4 / how many PIN bytes to calculate (1 to 4), the rest is brute-forced /
#define SAMPLES 10 / how many hundreds of samples to attempt per pin digit /
#define PERCENT_DIFF_THRESHOLD 0.7 / percentage difference between top two pins /
#define MAX_ROUNDS 3 / max number of filter rounds before picking top entry */

pin[3] choose candidate: 50
Candidate PIN 55 28 90 50 -- -- : brute forcing bytes 4 to 5 (2 bytes), will take up to 20 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..done

found PIN: 50 28 37 55 52 90
PIN is cracked in 814.62 seconds
Validating PIN
PIN verified.
done

[gnalan]

Does that mean the P2 CEM pin is now able to be found? If so, will it only work on the bench or can it be done through the OBD port (or possibly through the CAN bus connections from the radio)?