Vida CEM swapping

FullCircuitDiag · Post by **FullCircuitDiag** » 12 Jan 2023, 10:23

Hey everyone!
First off I want to thank all the awesome contributors to this thread that are far and above smarter than me. With your help I was able to pull a dump from my M30855FW MCU in my CEM L from a 2006 V70.
Now My question is, I am dealing with lost or corrupted key data for this vehicle. No crank no start, "start prevented try again" on the dash. Codes for transponder faulty signal in the CEM & ECM. 0 keys stored in memory of the CEM read out from the live data stream. So I'm assuming the key data just up and left. I am attempting to resynchronize the immobilizer and reprogram keys to the vehicle. I have it in my head that I read somewhere the key security data is stored in the EEPROM but the EEPROM data is encrypted and inside the MCU flash holds the encryption key? I can't remember where I read that or if I am mistaken. Anyone here have a guide for decoding the flash dump or the EEPROM data inside the CEM? I have dumps from the CEM MCU Flash, CEM EEPROM & the ECM EEPROM I can send if anyone needs.

Post by **vtl** » 12 Jan 2023, 12:00

Search for "eeprom decrypt" in this topic.

oscilloscope · Post by **oscilloscope** » 12 Jan 2023, 15:15

FullCircuitDiag wrote: ↑12 Jan 2023, 10:23 Hey everyone!
First off I want to thank all the awesome contributors to this thread that are far and above smarter than me. With your help I was able to pull a dump from my M30855FW MCU in my CEM L from a 2006 V70.
Now My question is, I am dealing with lost or corrupted key data for this vehicle. No crank no start, "start prevented try again" on the dash. Codes for transponder faulty signal in the CEM & ECM. 0 keys stored in memory of the CEM read out from the live data stream. So I'm assuming the key data just up and left. I am attempting to resynchronize the immobilizer and reprogram keys to the vehicle. I have it in my head that I read somewhere the key security data is stored in the EEPROM but the EEPROM data is encrypted and inside the MCU flash holds the encryption key? I can't remember where I read that or if I am mistaken. Anyone here have a guide for decoding the flash dump or the EEPROM data inside the CEM? I have dumps from the CEM MCU Flash, CEM EEPROM & the ECM EEPROM I can send if anyone needs.

HI

from time to time i have to deal with annoying issues like this , i use various tools to get the work done , unfortunately i don't know enough to just work it out. that being said you'll need xprog to be able to wire into the CEM which will then be able to take a dump from the microcontroller. , then you pass it through IOT with the appropriate Volvo authorisation , then take a dump file from the EEPROM , then pass EEPROM file through tango and check if its A not corrupt , B if the keys are gone , can you readd them , C readd them and then reupload via IOT and install in the car. , if they are still in there you WILL need to copy the transponder type from the EEPROM too the transponder CN6 is the ones tango likes for that action.

you maybe wondering why even bother with IOT ? and just use xprog to take a dump file from the EEPOM it is because there is a watchdog ic , and if that detects a error. it resets the system. which is NOT what you want during a read or a write! as it could render the eeprom silent and none responsive! and basically a brick and xprog "sometimes trips this IC " and no one can afford the "somtimes" ,so why IOT ? some how IOT has managed to circumvent the watchtimer and allows for successful reads of the eeprom. using xprog for the flash seems to work fine (so far) and allow too pass the flash.bin through the IOT software which allows for retrieving the pincode.

i am assuming that is what you ment?

FullCircuitDiag · Post by **FullCircuitDiag** » 12 Jan 2023, 16:53

I removed the watchdog IC before I read with AR-32 so I already have a good read of that dump

FullCircuitDiag · Post by **FullCircuitDiag** » 12 Jan 2023, 17:54

I skimmed through the sections of this thread pertaining to decryption. Problem is though.. they reference the key being at 7FFF0-7FF30. My dump file I pulled from my M32C ends at 4FFFF. Did I get a bad read? I read it twice and it came out the same both times.
NOTE
I used an Orange5 programmer to read the data. My specific chip is an M30855FW Renesas MCU

rkam · Post by **rkam** » 12 Jan 2023, 23:33

You probably have a good read. 320kB.
M30855FW ROM starts at FB0000.

Dudde · Post by **Dudde** » 13 Jan 2023, 01:19

Little of topic but does someone have software to read and write magneti marelli throttle body with Dice? Or does someone know the memory size and adresses to read?

dikidera · Post by **dikidera** » 13 Jan 2023, 03:45

After I am done with the ECM, I plan to start work on my CEM. Does the CEM need to be on the bench or can it be programmed/read via OBD? I would imagine it would also be multiple times more difficult, it is after all the brain of the car.

rkam · Post by **rkam** » 13 Jan 2023, 06:51

Knowing or cracking the pin code makes it possible to leave it in the car.

Post by **vtl** » 13 Jan 2023, 07:13

dikidera wrote: ↑13 Jan 2023, 03:45 After I am done with the ECM, I plan to start work on my CEM. Does the CEM need to be on the bench or can it be programmed/read via OBD? I would imagine it would also be multiple times more difficult, it is after all the brain of the car.

Can be done on bench with USB FTDI, free software and like 5 wires welded to PCB. For flash update over OBD you need a secondary boot loader (SBL) that can do it.

Vida CEM swapping

Re: Vida CEM swapping