Vida CEM swapping

[vtl]

is codewarriror used too decompile the micro's ?

https://onlinedisassembler.com/odaweb/

[urosm]

I have PIN from this CEM because I read it with SMOK and found a PIN. So if you need it, I'll send it to you.

I thought smok" reads only P3 platform.. you use UDS option in smok ?

I forgot to write... I read it with SMOK JTAG on the bench.
P3 platform can be read with UHDS SMOK.

[oscilloscope]

is codewarriror used too decompile the micro's ?

https://onlinedisassembler.com/odaweb/

thanks

[oscilloscope]

is codewarriror used too decompile the micro's ?

https://onlinedisassembler.com/odaweb/

thanks

hmm doesn't seem to find the micro mask 1L15Y. , i'll continue to ticker with the disassembler.

[postoak]

Have any insights into modifying/hacking transmission software (would this be the TCM?) been made as a result of the extensive work done around the CEM? Specifically, modifying torque converter lock-up and slip parameters for TF-80SC's and their respective valve bodies. Pls forgive any repetitiveness of my question if this has already been covered. I'm slowly making my way through the pages/posts in this thread to see if this was discussed in the past.

[matthew1]

search.php?keywords=tcm&t=85611&sf=msgonly


Hello postoak and welcome. You can search within topics using this. This is what it looks like on desktop, mobile is similar.

search-within-topic.png (69.05 KiB) Viewed 710 times

[alevol]

Testing P3 branch. On the bench works well, but today i have tried it on car.
Every 5-6 seconds or so there is something that interrupts the process.

p3_cem_get_seed: what? ID 95, 03 ff 00 40 00 60 60 00
p3_cem_get_seed: what? ID c5, 30 00 00 3f ff 18 00 00

One time there is problem with ID95 the other is with C5, Then Teensy is putting modules to prog mode and after 5-6 seconds there is a relay click or smth and the cycle repeats. Seems, that something is not in prog mode or wakes up. Does anybody have the same problem?

Code: Select all

canMsgReceive timed out, start 3606919898, now 3607519931, diff 600033
SEED 3c 04 36, PIN 00 00 c7 11 23, KEY 87 f9 d7, 63 pins/s
SEED 12 65 79, PIN 00 00 c7 14 80, KEY 41 bf 43, 861 pins/s
SEED 18 da cc, PIN 00 00 c7 17 dd, KEY 37 56 70, 861 pins/s
SEED 0b 79 7c, PIN 00 00 c7 1b 3a, KEY 44 49 8d, 861 pins/s
SEED ad 37 94, PIN 00 00 c7 1e 97, KEY 41 ad 73, 861 pins/s
p3_cem_get_seed: what? ID 95, 03 ff 00 40 00 60 60 00 
Putting all ECUs into programming mode.

 === CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 2397663910, now 2398263938, diff 600028
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 1103936080, now 1104536091, diff 600011
SEED 41 24 6b, PIN 00 00 c7 1f 0d, KEY 06 46 9a, 118 pins/s
SEED 0d 51 52, PIN 00 00 c7 22 6e, KEY d9 e9 e5, 865 pins/s
SEED 55 3e 65, PIN 00 00 c7 25 cf, KEY 81 98 33, 865 pins/s
SEED a6 b0 18, PIN 00 00 c7 29 30, KEY 77 1d ae, 865 pins/s
SEED ad e8 4b, PIN 00 00 c7 2c 91, KEY 88 eb 6a, 865 pins/s
p3_cem_get_seed: what? ID c5, 30 00 00 3f ff 18 00 00 
Putting all ECUs into programming mode.

 === CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 4189969794, now 4190569814, diff 600020
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 2896241815, now 2896841849, diff 600034
SEED 95 25 be, PIN 00 00 c7 2d 07, KEY ec d4 22, 118 pins/s
SEED d7 1c c5, PIN 00 00 c7 30 64, KEY e6 14 a2, 861 pins/s
SEED 9d 22 b1, PIN 00 00 c7 33 c1, KEY d5 57 22, 861 pins/s
SEED b4 dc 66, PIN 00 00 c7 37 1e, KEY 3c 2b 34, 861 pins/s
SEED b3 62 df, PIN 00 00 c7 3a 7c, KEY 4c 2b 96, 862 pins/s
p3_cem_get_seed: what? ID c5, 30 00 00 3f ff 18 00 00 
Putting all ECUs into programming mode.

 === CEM-on-the-bench users: you have 5 seconds to apply CEM power! ===

canMsgReceive timed out, start 1687471856, now 1688071896, diff 600040
CAN_HS ---> ID=000007df data=02 10 82 00 00 00 00 00
CAN_LS ---> ID=000007df data=02 10 82 00 00 00 00 00
canMsgReceive timed out, start 393744005, now 394344048, diff 600043
SEED a6 20 88, PIN 00 00 c7 3a f3, KEY 0e 6a 57, 119 pins/s
SEED 9a 73 e7, PIN 00 00 c7 3e 53, KEY 42 46 3d, 864 pins/s
SEED c4 9d 57, PIN 00 00 c7 41 b4, KEY c8 40 06, 865 pins/s
SEED fb 45 b0, PIN 00 00 c7 45 15, KEY d3 71 3f, 865 pins/s
SEED 4a 6b 2f, PIN 00 00 c7 48 76, KEY e7 f7 9d, 865 pins/s
p3_cem_get_seed: what? ID 95, 03 ff 00 40 00 60 60 00 
Putting all ECUs into programming mode.

Thanks

[oscilloscope]

hi i have an s80 2002 euro brick style CEM , is there a way to decode the VIN from a brick style VIN ? i have a dump file , but kinda struggling with what i'm looking at

[ZRimaZ]

VIN is located at 0x8000+

[oscilloscope]

VIN is located at 0x8000+

thank you. , is there a way of decoding it to look like a VIN instead of ML?