Vida CEM swapping

matija0610 · Post by **matija0610** » 23 Sep 2022, 10:17

exactly as VTl says, everything is in Vida db.
the parameters are attached.

param.txt: (3.33 KiB) Downloaded 284 times

for values, I need time to export, I have to clean up a bunch of nonsense to make it meaningful.

you can ask me the specific value, I'll get it right away.

bosse · Post by **bosse** » 23 Sep 2022, 11:51

Cem vmax on these old cars is not enough for a-traktor.
ECM limitation is needed.
I done hundreds of them.
But fact is that P3 cars have been approved with cem limitations from Volvo.
Transport mode on P3 models is 30kmh with normal funktion on the car.
But it's not legal due to loss of speed signal and loss of signal from throttle pedal signal that makes limp in 1500rpm.

prometey1982 · Post by **prometey1982** » 24 Sep 2022, 04:56

It's my test of ECM's speed limiter

bvrton · Post by **bvrton** » 27 Sep 2022, 06:36

vtl wrote: ↑23 Sep 2022, 07:37
Divxet wrote: ↑23 Sep 2022, 07:10 Is there anyone who can help me with the understanding/knowledge how to obtain information to fill in the list of parameters for T5Luke's program to change the configuration in the car's cem, I would like to contribute with my free time to complete the parameter list. I have Vida and Dice if that helps.
Can pull everything from MS-SQL database that comes with VIDA:

Screenshot at 2022-09-23 09-49-59.png

More than likely, need to run a much complex SQL query to carve out data for particular model/year.

Been lurking here for some time now, so I thought now is as good a time as ever to drop in with some things that hopefully may help things along.

I have attached a couple SQL Queries to my post that should be along the lines of that, I used them to collect extended PID's to use with the Torque app, but it pulls all blocks, including Car Config with descriptions.

Also, that UDS cracker worked well, now I have a bin file to play with thanks to T5Luke

The Diagnostic Number you feed these is found on the Diagnostics/Network tab in VIDA, just select your ECU on the left and you'll see the 'Diagnostic Number' in the list on the bottom right side. As far as I can tell these are specific to ONLY that ECU. (this will pull the blocks from *any* ECU in the database with matching id)

Hopefully these help you folks with narrowing down the Car Config data for different years/models of Volvo.

*Side note: The "Diagnostic Number" is always 11 characters, just padded out with spaces when it ends in a single letter instead of a double.*

Keep up the good work guys, you have made some serious progress in tweaking things in our Volvos!

bvrton · Post by **bvrton** » 27 Sep 2022, 07:01

One other thing I have been curious about is: do all the ECU's have a pin like the CEM, or can they just be dumped with the right CAN Commands/SBL?

Having bin dumps would be handy for a few of the little ideas I have that would likely require some reverse-engineering to figure out.

I would also love to figure out how to upload a modified config/bin to the CEM (and other ECU's if I can) lots of ideas floating around in my head right now.

I should probably start with trying to figure out the positions in the BIN that all the goodies are at first mind you.

bvrton · Post by **bvrton** » 27 Sep 2022, 07:15

While these things are still on my mind, here is some info I had in a file regarding the diagnostic protocols for working with dtc's/activating things/reading some data that I have collected over time

Code: Select all

D2 Protocol
000FFFFE CB xx B9 F0 00 00 00 00
          |  |  |  |
          |  |  |  |
          |  |  |  '---- Identify (?)
          |  |  '----------------- Read Data Block By Offset
          |  '-------------------- Module id (list below)
          '----------------------- Message length
00 0F FF FE: The identifier VIDA (or any other diagnostic module) uses for messaging.
Message length: High nibble seems to be always 'C' in command message. Low nibble: Bit 3 is always on. Bits 0-2 is the actual message length (excluding the first byte). Hence A=2, B=3, C=4, D=5, E=6, F=7

Module ID's:
0F - CPM
29 - CCM
2E - PSM
40 - CEM
43 - DDM
45 - PDM
46 - REM
47 - UEM
51 - DIM
52 - AEM
54 - ICM
58 - SRS
64 - PHM
66 - MMM
67 - PAC
68 - SUB
6D - AUD
71 - RDAR
72 - GPS
75 - IAM
7B - AUU

A1 No Operation Performed (keep alive)
A3 Security Access Mode 
A5 Read Current Data By Offset 
A6 Read Current Data By Identifier
A7 Read Current Data By Address 
A8 Set Data Transmission
A9 Stop Data Transmission
AA Dynamically Define Record
AB Read Freeze Frame Data By Offset
AC Read Freeze Frame
AD Read Freeze Frame By DTC
AE Read DTC
AF Clear DTC

B0 Input Output Control By Offset
B1 Input Output Control By Identifier
B2 Control Routine By Offset 
B4 Define Read Write ECU data 
B8 Write Data Block By Offset 
B9 Read Data Block By Offset 
BA Write Data Block By Address
BB Read Data Block By Address 

---------------------------------------------------------------------------------------------------------------
GGD Protocol
Module ID's:
01 - BCM
1A - DEM
10 - ECM
18 - TCM
32 - SAS
50 - CEM
76 - HCM
some are 1902 mask  20
ecu 10 (ecm) seems to be 0C

xx is module id/address
18DAxxF1#22F1100000000000 //gets identifying info block (cmd 22) block f1 len 10?
18DAxxF1#1902200000000000 //gets dtc's by mask (20)?
18DAxxF1#1902000000000000 //gets supported dtc's
18DAxxF1#14FFFFFF00000000 //clears dtc's (ff may be unneeded)

responses look like
18DAF1xx#0000000000000000 // responses look similar to commands, xx is replying module id


activate TCM adaptation mode  (script: 'VCC-274892-2 1.0' title: 'Activating adaptation mode')
18DA18F1#3101F050    //command to activate adaptation
18DAF118#7101F05001  //reply from TCM, adaptation active

18DA18F1#22D904     // carstatus? (22D904) (mode 22, pid D904?)
18DAF118#62D904003F // reply from car (62 is mode 22 reply?) data returned is 003F

konielian · Post by **konielian** » 27 Sep 2022, 13:32

I am also interested on making an app which can write back by DiCE the modified flash into the car, thanks to T5Luke, on 28f400 cem that is possible but in the M32C CEM is still not solved.

Post by **vtl** » 27 Sep 2022, 16:35

konielian wrote: ↑27 Sep 2022, 13:32 I am also interested on making an app which can write back by DiCE the modified flash into the car, thanks to T5Luke, on 28f400 cem that is possible but in the M32C CEM is still not solved.

Solve it!

Register at Renesas web site, download M32C datasheet and development environment. Renesas E8/E8a is slightly over $100 on Ebay. You will need a donor CEM, too. Once you have a flash-writing SBL ready, you are basically done. The CAN proto is very simple and wouldn't take long to implement.

Divxet · Post by **Divxet** » 28 Sep 2022, 07:59

I made the parameter file to T5Lukes program after whats availble in vida for my car a v70 MY2003.
Maybe you need to adapt for your car.

parameter.txt: (11.03 KiB) Downloaded 212 times

many thanks to bvrton for the SQLQueries.zip so i could make this.

Divxet · Post by **Divxet** » 29 Sep 2022, 03:41

Is there any possibility to add new car keys now that I have read out the cem flash file (with T5Luke's help) and have the pin code for cem? Is there anyone who can advise me of a way to solve it other than via VDASH which is my last option.

Vida CEM swapping

Re: Vida CEM swapping