Vida CEM swapping

[RickHaleParker]

Does that mean the P2 CEM pin is now able to be found? If so, will it only work on the bench or can it be done through the OBD port (or possibly through the CAN bus connections from the radio)?

Which P2 CEM are you referring to? There are two basic types: CEM-B 1999 - 2004, ( CEM-L & CEM-H ) 2005+

[gnalan]

Which P2 CEM are you referring to? There are two basic types: CEM-B 1999 - 2004, ( CEM-L & CEM-H ) 2005+

2001 S60 is my car, but I'm not sure which CEM it uses.

[RickHaleParker]

2001 S60 is my car, but I'm not sure which CEM it uses.

Yours is a CEM-B. We have not cracked that one yet. I got some ideas based on a statement by VTL. Sirlion has been doing some work on the CEM-B but to test my idea for the CEM-B it going to take a major rewrite of the code. With the two main coders busy I don't see it happening soon.

[RickHaleParker]

Sirlion has confirmed my theory that you can access the CEM-B through the "back side" CAN Bus without K-Line hardware.

[RickHaleParker]

These work also and results in a one pass.

Code: Select all

/* tunable parameters */

#define CALC_BYTES  4  
#define SAMPLES   7      
#define PERCENT_DIFF_THRESHOLD  0.1       
#define MAX_ROUNDS  4

It looks like if the tunable parameters were to be merged with the CEM parameters we could setup tunes for each Hardware number and make the code work with all the CEMs right out of the box.

PS: Tested on a second CEM-L. The second one cracked also.

[vtl]

These work also and results in a one pass.

Code: Select all

/* tunable parameters */

#define CALC_BYTES  4  
#define SAMPLES   7      
#define PERCENT_DIFF_THRESHOLD  0.1       
#define MAX_ROUNDS  4

It looks like if the tunable parameters were to be merged with the CEM parameters we could setup tunes for each Hardware number and make the code work with all the CEMs right out of the box.

PS: Tested on a second CEM-L. The second one cracked also.

Per-CEM tunables not gonna work: who will tune them? The diff threshold would depend on so many things, like the components quality, workmanship and even cable length. Not to tell, we have about 20% of "difficult" CEMs, which would need a very low threshold just for byte 3 and high threshold for 1-2. It has to be autotuned and always work in every situation.

[RickHaleParker]

Per-CEM tunables not gonna work: who will tune them? The diff threshold would depend on so many things, like the components quality, workmanship and even cable length. Not to tell, we have about 20% of "difficult" CEMs, which would need a very low threshold just for byte 3 and high threshold for 1-2. It has to be autotuned and always work in every situation.

Cracked a third one with the above parameters. This one is a CEM-H. It cracked in one round for each byte. Which means the 0.1 threshold worked on all four bytes.

Could the initial samples be autotuned based on CEM type? Like the shuffle is.

Im finding that the difference threshold works very well on the P2 when, samples is above 700 total. Below that I get false detections.

Have you tried the above parameters on your problem CEM?


Would some of you guys try Sirlion's fast code with the above tune and report back.

[RickHaleParker]

Per-CEM tunables not gonna work: who will tune them?

Tune-able Per-Hardware part number. That way if a change is made to accommodate B it will not stop working for A.

I got the code changed you can download the branch here. If it is decided this is the way to go I'll issue a pull request.

This way we can preserve the blazing speed Sirlion is getting on the P1 without sacrificing reliability on the P2.

Code: Select all

int cem_clocks_per_us;
int CALC_BYTES;
int SAMPLES;
int PERCENT_DIFF_THRESHOLD;
int MAX_ROUNDS;

unsigned char  shuffle_orders[5][PIN_LEN] = { { 0, 1, 2, 3, 4, 5 }, { 3, 1, 5, 0, 2, 4 }, {5, 2, 1, 4, 0, 3}, { 2, 4, 5, 0, 3, 1} };
unsigned char *shuffle_order;


         
struct _cem_params {
  unsigned long part_number;
  int baud;       /* CAN Bus baud speed */ 
  int mhz;        /* MCU frequency */ 
  int shuffle;    /* shuffle order from list above */ 
  int calc;       /* how many PIN bytes to calculate (1 to 4), the rest is brute-forced */
  int samples;    /* how many hundreds of samples to attempt per pin digit */
  int threshold;  /* percentage difference between top two pins */
  int rounds;     /* max number of filter rounds before picking top entry */
  

/* Format:  CEM partnumber, CAN Bus baud speed, MCU frequency,  shuffle order, Calc Bytes, Samples, threshold percentage, Maxium rounds. */ 

} cem_params[] = {
// P1
  { 8690719,  CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 8690720,  CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 8690721,  CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 8690722,  CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 30765471, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 30728906, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 30765015, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 31254317, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 31327215, CAN_500KBPS, 8, 3, 4, 1, 0.1, 3 },
  { 31254749, CAN_500KBPS, 8, 3, 4, 1, 0.1, 3 },
  { 31254903, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },
  { 31296881, CAN_500KBPS, 8, 0, 4, 1, 0.1, 3 },

// P2 CEM-B (Brick shaped 1999-2004 with K-line)
  { 8645716, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8645719, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8688434, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8688436, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8688513, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 30657629, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 9494336, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 9494594, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8645171, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 9452553, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8645205, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 9452596, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8602436, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 9469809, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },
  { 8645200, CAN_250KBPS, 4, 0, 4, 1, 0.1, 3 },

// P2 CEM-L (L shaped and marked L 2005-2014)
  { 30682981, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30682982, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30728356, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30728542, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30765149, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30765646, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30786475, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30786889, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 31282457, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 31314468, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 31394158, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },

// P2 CEM-H (L shaped and marked H 2005 - 2007)
  { 30786476, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30728539, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30682982, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30728357, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30765148, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30765643, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30786476, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30786890, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30795115, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 31282455, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 31394157, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
  { 30786579, CAN_500KBPS, 30, 1, 4, 7, 0.1, 3 },
};

...
...

struct _cem_params hs_params;
  if (!pn || !find_cem_params(pn, &hs_params)) {
    printf("Unknown CEM part number %lu. Don't know what to do.\n", pn);
    return;
  }

  shuffle_order = shuffle_orders[hs_params.shuffle];
  cem_clocks_per_us = hs_params.mhz;
  CALC_BYTES = hs_params.calc; 
  SAMPLES = hs_params.samples;
  PERCENT_DIFF_THRESHOLD = hs_params.threshold;
  MAX_ROUNDS = hs_params.rounds;

[gnalan]

Has anyone tried this on the CEM-B to read the eeprom to get the pin from the .bin file?

[vtl]

I had the flash chip desoldered with hot air and read in TL866A.