Vida CEM swapping

[oscilloscope]

I managed to brick my CEM. Be careful.

What did you do ?

[NuovoRecord]

I was foolish! Feel free to mock me. I have some experience soldering audio equipment, LED's, simpler things. This was much harder, and I rushed it.

The short story: I tried to hook up an Arduino Nano to my CEM to run T5Luke's CEM reader. It didn't seem to work - I let the program run for over half an hour with no results or feedback - and decided to give up for the day. I cut the wires, reinstalled the CEM in car, and there were problems: No DIM, no keyless entry, no start.

More detail: There were two attempts at running the CEM reader yesterday. On the first, I lifted a pad (BKPT on T5uLuke's diagram). I "fixed" this by removing insulating material in the via hole until I could see a pin to solder to. The CEM seemed to still work after this, but the CEM reader didn't give me any results. I took another look at the board, and after probing with a multimeter, decided that I needed to also scrape away material in the via hole going to RESET and resolder. This time, I had to scrape much more to find the pin. This may have been what killed the CEM. Hooking back up to the Arduino and 12vpower, the CEM seemed to behave differently - no "clicking" - when running the CEM reader.

I've attached pictures of the damage I've done to the board. I'm planning to check the junkyard for a CEM with a matching part #, and will probably have to send this to Xemodex. Any advice appreciated.

One question: is there any possibility the CEM is stuck in a programming mode, or something similar? could it be "reset?"

[oscilloscope]

I was foolish! Feel free to mock me. I have some experience soldering audio equipment, LED's, simpler things. This was much harder, and I rushed it.

The short story: I tried to hook up an Arduino Nano to my CEM to run T5Luke's CEM reader. It didn't seem to work - I let the program run for over half an hour with no results or feedback - and decided to give up for the day. I cut the wires, reinstalled the CEM in car, and there were problems: No DIM, no keyless entry, no start.

More detail: There were two attempts at running the CEM reader yesterday. On the first, I lifted a pad (BKPT on T5uLuke's diagram). I "fixed" this by removing insulating material in the via hole until I could see a pin to solder to. The CEM seemed to still work after this, but the CEM reader didn't give me any results. I took another look at the board, and after probing with a multimeter, decided that I needed to also scrape away material in the via hole going to RESET and resolder. This time, I had to scrape much more to find the pin. This may have been what killed the CEM. Hooking back up to the Arduino and 12vpower, the CEM seemed to behave differently - no "clicking" - when running the CEM reader.

I've attached pictures of the damage I've done to the board. I'm planning to check the junkyard for a CEM with a matching part #, and will probably have to send this to Xemodex. Any advice appreciated.

One question: is there any possibility the CEM is stuck in a programming mode, or something similar? could it be "reset?"

Omfg!

I was under the impression the brick style cem which that looks like one. The cracker is not able to work on it (yet)
Now it looks like you have ablitarated the via's!! Now you maybe able to still clone this module. You could try and use usbjtag which can connect to these via the microprocessor. , what you will have to do is connect from the top apposed to the vias on the back side. Then you will probably have to source check if IOT can decode the code via dump or Possibly SMOK.

[vtl]

I was under the impression the brick style cem which that looks like one. The cracker is not able to work on it (yet)
Now it looks like you have ablitarated the via's!! Now you maybe able to still clone this module. You could try and use usbjtag which can connect to these via the microprocessor. , what you will have to do is connect from the top apposed to the vias on the back side. Then you will probably have to source check if IOT can decode the code via dump or Possibly SMOK.

Hot air + TL866a.

[NuovoRecord]

I was foolish! Feel free to mock me. I have some experience soldering audio equipment, LED's, simpler things. This was much harder, and I rushed it.

The short story: I tried to hook up an Arduino Nano to my CEM to run T5Luke's CEM reader. It didn't seem to work - I let the program run for over half an hour with no results or feedback - and decided to give up for the day. I cut the wires, reinstalled the CEM in car, and there were problems: No DIM, no keyless entry, no start.

More detail: There were two attempts at running the CEM reader yesterday. On the first, I lifted a pad (BKPT on T5uLuke's diagram). I "fixed" this by removing insulating material in the via hole until I could see a pin to solder to. The CEM seemed to still work after this, but the CEM reader didn't give me any results. I took another look at the board, and after probing with a multimeter, decided that I needed to also scrape away material in the via hole going to RESET and resolder. This time, I had to scrape much more to find the pin. This may have been what killed the CEM. Hooking back up to the Arduino and 12vpower, the CEM seemed to behave differently - no "clicking" - when running the CEM reader.

I've attached pictures of the damage I've done to the board. I'm planning to check the junkyard for a CEM with a matching part #, and will probably have to send this to Xemodex. Any advice appreciated.

One question: is there any possibility the CEM is stuck in a programming mode, or something similar? could it be "reset?"

Omfg!

I was under the impression the brick style cem which that looks like one. The cracker is not able to work on it (yet)
Now it looks like you have ablitarated the via's!! Now you maybe able to still clone this module. You could try and use usbjtag which can connect to these via the microprocessor. , what you will have to do is connect from the top apposed to the vias on the back side. Then you will probably have to source check if IOT can decode the code via dump or Possibly SMOK.

Thanks. This is a difficult learning experience. I should have first tried with a junkyard CEM. This will probably be sent to Xemodex, and they can connect from the top if necessary.

One thing that confuses me: I don't see any traces on the underside of the board that the (now obliterated) pads connected to. It seemed they were just there to help secure the main surface mount processor. In which case, the pads lifting / vias being damaged wouldn't seem to have any effect (as long as they weren't shorting to ground, which they don't seem to be). Is this wrong?

[vtl]

Brick-shaped CEM has a dedicated flash ROM chip, along with EEPROM. All what you need is a hot air station to desolder the chips and TL866a or other programmer to read the dumps.

[oscilloscope]

I was under the impression the brick style cem which that looks like one. The cracker is not able to work on it (yet)
Now it looks like you have ablitarated the via's!! Now you maybe able to still clone this module. You could try and use usbjtag which can connect to these via the microprocessor. , what you will have to do is connect from the top apposed to the vias on the back side. Then you will probably have to source check if IOT can decode the code via dump or Possibly SMOK.

Hot air + TL866a.

If I could do a shiver emoji for removing the 28f rom chip. What a ball ache

[vtl]

If I could do a shiver emoji for removing the 28f rom chip. What a ball ache

/me remembers myself at the age of 16 desoldering 72-pin SIMM sockets from dead motherboard in order to solder them to the donor motherboard, which had only landing holes for those sockets. No hot air back then, had to use a dish with burning isopropyl alcohol. Desoldering 28F SMD chip with hot air is by far less challenging

[oscilloscope]

If I could do a shiver emoji for removing the 28f rom chip. What a ball ache

/me remembers myself at the age of 16 desoldering 72-pin SIMM sockets from dead motherboard in order to solder them to the donor motherboard, which had only landing holes for those sockets. No hot air back then, had to use a dish with burning isopropyl alcohol. Desoldering 28F SMD chip with hot air is by far less challenging

i have a question. i have a CEM & sid803a ecu which needed synchronization performed but the ABS ID doesn't appear to be correct. is there a way of decoding the eeprom file to see what the ABS that was inputted?

[5ft24]

I was foolish! Feel free to mock me. I have some experience soldering audio equipment, LED's, simpler things. This was much harder, and I rushed it.

The short story: I tried to hook up an Arduino Nano to my CEM to run T5Luke's CEM reader. It didn't seem to work - I let the program run for over half an hour with no results or feedback - and decided to give up for the day. I cut the wires, reinstalled the CEM in car, and there were problems: No DIM, no keyless entry, no start.

More detail: There were two attempts at running the CEM reader yesterday. On the first, I lifted a pad (BKPT on T5uLuke's diagram). I "fixed" this by removing insulating material in the via hole until I could see a pin to solder to. The CEM seemed to still work after this, but the CEM reader didn't give me any results. I took another look at the board, and after probing with a multimeter, decided that I needed to also scrape away material in the via hole going to RESET and resolder. This time, I had to scrape much more to find the pin. This may have been what killed the CEM. Hooking back up to the Arduino and 12vpower, the CEM seemed to behave differently - no "clicking" - when running the CEM reader.

I've attached pictures of the damage I've done to the board. I'm planning to check the junkyard for a CEM with a matching part #, and will probably have to send this to Xemodex. Any advice appreciated.

One question: is there any possibility the CEM is stuck in a programming mode, or something similar? could it be "reset?"

Omfg!

I was under the impression the brick style cem which that looks like one. The cracker is not able to work on it (yet)
Now it looks like you have ablitarated the via's!! Now you maybe able to still clone this module. You could try and use usbjtag which can connect to these via the microprocessor. , what you will have to do is connect from the top apposed to the vias on the back side. Then you will probably have to source check if IOT can decode the code via dump or Possibly SMOK.

Thanks. This is a difficult learning experience. I should have first tried with a junkyard CEM. This will probably be sent to Xemodex, and they can connect from the top if necessary.

One thing that confuses me: I don't see any traces on the underside of the board that the (now obliterated) pads connected to. It seemed they were just there to help secure the main surface mount processor. In which case, the pads lifting / vias being damaged wouldn't seem to have any effect (as long as they weren't shorting to ground, which they don't seem to be). Is this wrong?

The board is multi-layer. Scratching through more than just the insulation can break internal traces that the Via intersects with. Not sure if Xemodex can fix that...