Vida CEM swapping

[V702T5]

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

[vtl]

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

Oh, does it use the P3 proto?

[MiclMacl]

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

Hi there,

Newbie here! Fantastic thread and work on here by everyone. I’ve been following this thread for some time and while most of it I struggle to get to grips with, I can generally follow what’s happening.

I have a 2008MY XC90 V8, along with a clone DiCE unit if anyone would like me to test anything? VDASH isn’t an option to decode for my model and won’t work without their dongle anyway (which can’t be shipped to the UK). I’ve therefore been looking into all the alternatives for which there isn’t a great deal!

VIDA is reporting my CEM as being “Hardware Number” 30786890 A and “Diagnostic Number”31394163 AA. Reading around it seems as though the hardware ID seems to be allegedly a suitable candidate for decoding.

As I say, I’m nowhere near as technical as most on this thread but do know my around a computer so if anyone wants me to test anything on a basic DiCE setup, let me know!

[RickHaleParker]

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

This raises eyebrows but there are some discrepancies in the post.

1. That cannot be a P2 XC90 ( 2003 – 2016 ), P2 is not UDS. P2 requires a timing side attack to crack. The P2 PIN is 6 bytes not 5 bytes.
2. That would be a SPA ( also called P5 ) XC90 ( 2016–present ) if it is a XC90.

You have software that works through a J2534 interface ( ISO 15765 ). I been saying that is the way to go on the P3.
Is it something you wrote yourself? If it is a SPA XC90, how did you get around the SPA time out?

Open source?

P3, SPA (P5) and CMA (P6) use the same algorithm but P3 does not have a time out after failed attempts.
SPA and CMA does have a time out period after a number of failed attempts.

[loglofan]

2. That would be a SPA ( also called P5 ) XC90 ( 2016–present ) if it is a XC90.

SPA platform doesn't have V8 engine That screenshot looks like P3 or P4

[V702T5]

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

This raises eyebrows but there are some discrepancies in the post.

1. That cannot be a P2 XC90 ( 2003 – 2016 ), P2 is not UDS. P2 requires a timing side attack to crack. The P2 PIN is 6 bytes not 5 bytes.
2. That would be a SPA ( also called P5 ) XC90 ( 2016–present ) if it is a XC90.

You have software that works through a J2534 interface ( ISO 15765 ). I been saying that is the way to go on the P3.
Is it something you wrote yourself? If it is a SPA XC90, how did you get around the SPA time out?

Open source?

P3, SPA (P5) and CMA (P6) use the same algorithm but P3 does not have a time out after failed attempts.
SPA and CMA does have a time out period after a number of failed attempts.

Yeah you're a real professional, like always

You know the difference between the normal P2 (after 2005) with Time Attack and the P2 V8, 3.2? (XC90).

Youre explanation shows me that it does not seem so...

[RickHaleParker]

Youre explanation shows me that it does not seem so...

Timing side attack works on P1 and P2 ( CEM-H and CEM-L ) the L shaped CEMs , but not the early P2 CEM-B 1998 - 2004 which are shaped like a brick.

The software you posted a picture of is doing a UDS crack not a timing attack. UDS is P3 - P6.

All XC90s are either P2 or P5 ( SPA ).

Upload the software so we can take a look at it.

[V702T5]

Youre explanation shows me that it does not seem so...

Timing side attack works on P1 and P2 ( CEM-H and CEM-L ) the L shaped CEMs , but not the early P2 CEM-B 1998 - 2004 which are shaped like a brick.

The software you posted a picture of is doing a UDS crack not a timing attack. UDS is P3 - P6.

All XC90s are either P2 or P5 ( SPA ).

Upload the software so we can take a look at it.

I talk from beginning about the CEMs build in the XC90 3.2 and V8 P2s, nothing other.

a little hint for you

Does anybody would like to crack his p2 (XC90) V8 pin by dice?

Oh, does it use the P3 proto?

[5ft24]

So let me get this straight. Your harassing Rickhaleparker over a post and comment he didn't make, trying to say he doesn't know what he's talking about. Maybe go look in a mirror and tell us what you see...

[T5Luke]

Don't know why people so often post wrong information here without knowing anything about the topic.

How do they know which protocoll exists, they did not even can log the traffic on bus.

They put useless datasheets and "facts" into this topic without knowing any background.

YES, some CEMs of P2 cars can be cracked just useing DICE...