Vida CEM swapping

[RickHaleParker]

Dang! .... Another CEM that won't talk to me.

This is from a 2008 S80.

Code: Select all

CPU Maximum Frequency:   600000000
CPU Frequency:           600000000
Execution Rate:          600 cycles/us
Cracking P3
CAN low-speed init done.
CAN high-speed init done.
Putting all ECUs into programming mode.

 === CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 2031414699, now 2032014746, diff 600047
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 738436987, now 739037529, diff 600542
Initialization done.

canMsgReceive timed out, start 739045386, now 1339045701, diff 600000315
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 1939057731, now 2539058313, diff 600000582
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 3139070307, now 3739070829, diff 600000522
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 44115631, now 644115997, diff 600000366
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 1244127579, now 1844127829, diff 600000250
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 2444140255, now 3044140817, diff 600000562
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 3644152815, now 4244152901, diff 600000086
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 549197567, now 1149197745, diff 600000178
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 1749209515, now 2349210041, diff 600000526
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff
canMsgReceive timed out, start 2949222139, now 3549222341, diff 600000202
p3_cem_get_seed: ugh...
CAN_HS ---> ID=00000726 data=ff ff ff ff ff ff ff ff

[aaivar]

Poland user Cracking PIN 29sec P1 V50/S40/C30.

[Evautos]

Hello,
Sorry for the stupid question . I’ve read through the whole thread with great interest and thought I’d try giving it a go and try cracking a CEM L on an xc70.
My first mistake is probably that I should have bought a Teensy 4.0 instead of a 4.1
I thought that it would work, but am very new to doing something like this and usually use pre-made programmers.
So can you advise please if the 4.1 should work?
I have managed to connect in vehicle and read the part number from two CEM’s pn 30728542
I’ve only connected high speed CAN as I’m still waiting for the transceivers that I ordered to arrive and instead used one from an old scrap engine ecu.
The CAN signals don’t look right when viewing with an oscilloscope, yet it is obviously putting it into programming mode and reading the part number. My setup is only temporary at the moment using a small breadboard and a soic clamshell adaptor holding the CAN transceiver and using a obd breakout box .
I have tried reading the replacement cem on the bench , but get no response at all ( I haven’t tried adding terminating resistors and think I read that they’re not needed on this cem and also if anything the amplitude of the signal is too small anyway).
The reason for me trying this is because I can’t get a read using my vvdi prog (genuine) or a clone Orange 5.
I have successfully read the P1 type with vvdi prog in the past.
I have Ioterminal and was planning to clone the original cem
The original cem does have high speed CAN communication issues and will only occasionally allow communication to the engine pcm, so that is what I initially thought the reason it was failing was.. The replacement cem reads the part number the same when trying it.
I have tried adding a stabilised 5 volt with it on the bench, but still couldn’t get a read.
This is part of the text I’m getting on the monitor ( I haven’t even figured out how to save it yet either )
PU Maximum Frequency: 600000000
CPU Frequency: 180000000
Execution Rate: 180 cycles/us
PIN bytes to measure: 3
CAN low-speed init done.
Reading part number from ECU 0x40 on CAN_LS
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
Can't find part number on CAN-LS, trying CAN-HS at 500 Kbps
CAN high-speed init done.
Reading part number from ECU 0x50 on CAN_HS
CAN_HS ---> ID=000ffffe data=cb 50 b9 f0 00 00 00 00
CAN_HS <--- ID=0042406c data=80 a8 00 00 60 00 80 00
CAN_HS <--- ID=01000020 data=00 00 00 01 b0 04 c0 00
CAN_HS <--- ID=01200003 data=8f 50 f9 f0 00 30 72 85
CAN_HS <--- ID=0042406c data=c0 8a 00 00 60 00 80 00
CAN_HS <--- ID=01000020 data=00 00 00 01 b0 04 c0 00
CAN_HS <--- ID=01200003 data=09 42 20 20 41 30 68 20
Part Number: 30728542
Searching P/N 30728542 in 50 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 3 1 5 0 2 4
Putting all ECUs into programming mode.
CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Initialization done.

Calculating bytes 0-2
1000 pins in 646 ms, 1547 pins/s, average response: 0 us, histogram 0 to 0 us
range 100, samples 10
candidates short list: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 (+ 50 more)

us: -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 11
[ 00 -- -- -- -- -- ]: 4260523454 2160714035 4294702243 270715079 1425401596 1247170651 1369138842 1017 3828899971 1349704140 3478526209 3985 2685168998 3198831097 3151951983 2189492487 1805318522 404001283 2996363259 2154302508 : latency 0; std nan
[ 01 -- -- -- -- -- ]: 4260523454 2160714035 4294702243 270715079 1425401596 1247170651 1369138842 2017 3828899971 1349704140 3478526209 3985 2685168998 3198831097 3151951983 2189492487 1805318522 404001283 2996363259 2154302508 : latency 0; std nan
[ 02 -- -- -- -- -- ]: 4260523454 2160714035 4294702243 270715079 1425401596 1247170651 1369138842 3017 3828899971 1349704140 3478526209 3985 2685168998 3198831097 3151951983 2189492487 1805318522 404001283 2996363259 2154302508 : latency 0; std nan
[ 03 -- -- -- -- -- ]: 4260523454 2160714035 4294702243 270715079 1425401596 1247170651 1369138842 4017 3828899971 1349704140 3478526209 3985 2685168998 3198831097 3151951983 2189492487 1805318522 404001283 2996363259 2154302508 : latency 0; std nan
[ 04 -- -- -- -- -- ]: 4260523454 2160714035 4294702243 270715079 1425401596 1247170651 1369138842 5

Sorry for the long winded post and for my lack of skill in attempting to get the cem code cracked.

I may attempt to get a read using a ttl device with the M16 programme that was mentioned on here too, but it seems like I might have to send both cems to somebody else to clone for me.
The transceiver I’m currently using is a NXP A82C50 and I suppose may be the problem as it lists minimum voltage as 4.5 volts . Hopefully I’ll receive the others soon and it will work.
Thank you for any responses
Sorry for intruding
Regards, Andrew

I’ve just realised that I think I’ve not connected the CAN receive data output pin to pin 4(2) on Teensy . Whoops.


After realising my mistake, I can confirm that 4.1 works fine and I almost got a code cracked.
It found the first three bytes and tried brute forcing the rest, but failed.
Hopefully I’ll get a chance tomorrow to try again with battery support connected and also hopefully find the original will crack too.
Then I’ve just got to hope that the CAN communication faults on the vehicle aren’t software related faults ( I’ve already confirmed the network on the pcm, bcm side of the cem as ok)

[charlie13]

Hello all. I have older programs that may help with less used functions.

[RickHaleParker]

Hello all. I have older programs that may help with less used functions.

The vbf files that look interesting are password protected. VADIS file.

[charlie13]

I have more older Volvo tools. If anyone is interested I can share. I do not want to clutter up files for volvo cars 99-2007. If anyone has a program to read and write cem 9s12 Delphi for S40, V50, C30, C70 using Dice or other interface please help

[charlie13]

In the morning I will throw in universal pins for different modules in different Volvo models. Maybe this will start work on replacing software in other modules such as CCM, PHM, TCM and others. In CEM modules there are pins for all modules responsible for security such as BCM, ECM, UEM, KVM

[gnalan]

I have more older Volvo tools. If anyone is interested I can share. I do not want to clutter up files for volvo cars 99-2007. If anyone has a program to read and write cem 9s12 Delphi for S40, V50, C30, C70 using Dice or other interface please help

It won't clutter anything. The focus seems to be on the newer P2 (2005+) and P3 chassis, but some of us with older models, like me, are looking for more info for the early P2 with the CEM-B.

[RickHaleParker]

If anyone has a program to read and write cem 9s12 Delphi for S40, V50, C30, C70 using Dice or other interface please help

I assume you mean C70 II which is a P1. We have the CEM PIN cracker which will get you the CEM PIN number.

There is a SBL that can read and flash P1 CEMs over CAN, it still alpha. The guy writing the application has had to break out his Xprog to recover a bricked CEM. Also progress in decrypting P1 config files and a P1 config editor. Stuff is being done on back channels because we don't want be getting side tracked dealing with bricked CEMs.

[charlie13]

Hello