Vida CEM swapping

[dikidera]

Have you compared dumps to verify data integrity?

@vtl
I just tried with a handy 12v battery I had lying around with a special dc-dc converter that steps the voltage down from 12v to 5 for RPI, no transmission issues at all!!
The problem lies in the RPI power supply I use(not the computer power supply).

[vtl]

@vtl
I just tried with a handy 12v battery I had lying around with a special dc-dc converter that steps the voltage down from 12v to 5 for RPI, no transmission issues at all!!
The problem lies in the RPI power supply I use(not the computer power supply).

I have flashed 3 or 4 dumps deemed uncrackable into my CEM, and they were all cracked. Some folks then had their hw problems corrected and they finally could crack their CEMs.

[dikidera]

Do you flash the CEM via obd and sbl or on the bench?

[vtl]

On the bench.

[rednasdees]

I need some help getting my IMMO code and i got some information that you can retreive the code if you have the CEM flash and the eeprom?

So i hope someone is able to help or explain me how this can be done with the unit still in the car.

I did see some stuff in the past on youtube, off people reading the eeprom, using a dice. but i have no clue what software the used or who they are so i cant ask

thanks in advance for any help !

[brobert]

Dikidera,

Really great work and idea to share your SBL (and the matching .bin file).
I take it that you work with your bench CEM. Is it the same p/n as your S60 CEM?
I don't have a spare unit so I have to be careful with what I try on my (perfectly working) V70 CEM.
I'm waiting for my local junkyard to get an S60,V70,XC70 with a CEM (30728542) that I can use for testing.
Since I'm only trying to backup my unit, I could always use my Orange-5 to read it but I need to remove the CEM first!

A couple of questions about your SBL:
I get that you want it to dump fast but what about data integrity? Multiple dumps and compare?
If you have the same processor, how much variation (i.e. memory models) between CEMs of different p/n?

Thank you rkam, so it looks like we both have had signal interference, what luck! So this means my code(SBL) works just fine.

This is great as it means we can conduct work faster, dumping memory in seconds is much better than waiting 30 full minutes.

Here is an updated version of the code with a reduced sleep of just 10 microseconds.

Ideally I would've attached the .c and .bin files, but they are forbidden attachments types, so I have zipped them.

[rkam]

There is a CEM L reader on page 226 (post 2259) that can be used when you know the 6-byte PIN.

It doesn't work on my 32-bit XP computer. The two first bytes in the pin becomes 00 00, and therefore fails.
On my Windows 7 machine, the DiCE is too slow to get all the data.

Setting LogLevel to 0 in the registry didn't make any difference.

[dikidera]

Dikidera,

Really great work and idea to share your SBL (and the matching .bin file).
I take it that you work with your bench CEM. Is it the same p/n as your S60 CEM?
I don't have a spare unit so I have to be careful with what I try on my (perfectly working) V70 CEM.
I'm waiting for my local junkyard to get an S60,V70,XC70 with a CEM (30728542) that I can use for testing.
Since I'm only trying to backup my unit, I could always use my Orange-5 to read it but I need to remove the CEM first!

A couple of questions about your SBL:
I get that you want it to dump fast but what about data integrity? Multiple dumps and compare?
If you have the same processor, how much variation (i.e. memory models) between CEMs of different p/n?

Thank you rkam, so it looks like we both have had signal interference, what luck! So this means my code(SBL) works just fine.

This is great as it means we can conduct work faster, dumping memory in seconds is much better than waiting 30 full minutes.

Here is an updated version of the code with a reduced sleep of just 10 microseconds.

Ideally I would've attached the .c and .bin files, but they are forbidden attachments types, so I have zipped them.

Haha, actually all my posts so far have been for an ECM dumper, but don't be mistaken, my next target is the CEM. I have to reverse the order of the fuel gauges, enable BLISS, change my language etc.

As for data integrity, I could possibly finish with a CRC32 message at the end?

[brobert]

ECU, ECM, CEM - what a soup of acronyms
I think that I've seen Volvo refer to *any* module in the car as "ECU".
Egg on face for sure but glad that we got this cleared up.

@rkam
Yes, T5Luke wrote a CEM dumper but you need a DICE and I only have a Mongoose cable (DICE clones are stupid expensive).
Now that I think of it, I might be able to edit the embedded DICE string and make it use my Mongoose cable.

[bobbik]

Is there any configuration tool for P1 ? Because i am currently working on one.