Vida CEM swapping

[rkam]

Looks like the Denso has its own way of storing CAN IDs in the signal configuration.

Stored - CAN-ID
401E 020A - 0042 401E
401E 030A - 0062 401E
0021 0808 - 0100 0021
0002 0A08 - 0140 0002
0014 1008 - 0200 0014
0006 1408 - 0280 0006
0012 1708 - 02E0 0012

[vtl]

Hi all, just a quick question if I may, got myself a teensy for cem pin cracking, I bought the PCB but couldn't find the Bosch CF160 so went with the SN65HVD230DR's instead. Cracked my P2 XC90 no problem in just under 35 minutes.

So the question is regarding time and resistors. I've read that the teensy should be pretty quick, is the time mines taken right or a bit longer than expected? What I wondered is if the resistors I added may have slowed the process? Being as I used the SN65HVD230DR's instead of the CF160's I added the 2 10k resistors from pin 8 to ground and wondering if maybe I didn't need to?....

The algo consists of two parts: timing attack on first 3 bytes of the PIN and brute force on the last 3 bytes.

Brute force goes over numerical space of 3 BCD bytes (from 000000 to 999999), so the time it takes to crack really depends on your CEMs PIN.

The first part (timing attack) used to be much faster initially, but with more CEMs supported and often subpar cracker hardware implementation we learned the algo has to operate often on a very thin signal-to-noise margin, so it works extra hard now and takes more time. The algo can be tuned to a specific CEM model, and it can crack it, for example, in anecdotal 8 seconds, like sirloin did for his P1 CEM, but I don't want to make the software even more complicated for handling such edge cases. Overall, most of the cracker users only do it once in life, for their own CEM, so it really does not matter how much time it spends on cracking the pin, if it's not hours or days.

I've been asked many times to speed the algo up, but such requests usually come from folks, who use the cracker in their private business. Given that my time is not infinite and testing a new version for compatibility even among my 4 CEMs is a nightmare, I'm more than happy with what we have now. In any case, it is an opensource project, so if anybody feels it worth it to burn his time on tuning the algo and cutting the cracking time from 40 minutes to 30, or maybe 20, yet keeping the codebase compatible with everything we support now - go ahead and do it.

[T5Luke]

This is how it is in Denso as well, the SH7055 controller splits the can id and ext id between some bytes, but I always assumed they were re-assembled in the can ID we see in the logs with no extra bits or bytes.

For instance my bench ECU replies with 0x0080021 for 000FFFFE. And this is what I assume to be the real can ID, but if it is BCD encoding, then only 4 bits for 0-9 but the ID is 29 bits, so one bit is not needed.

However if the can ID is not reassembled and is output directly then maybe it needs re-ordering.

In Denso even the order of the bits is different.

It is not that complicated, just change the cems engine type, buy an ECM that fits to your cars MY and match to CEM. Here are some people who can help you free but often have less time.

If you get the engine with harness in, the last fixes shouldnt be a problem. The CEM software is full and supports all engine types, even if you configure your cem to v8 it changes from p2 to UDS protocol, so everything is already in there...

[dikidera]

This is how it is in Denso as well, the SH7055 controller splits the can id and ext id between some bytes, but I always assumed they were re-assembled in the can ID we see in the logs with no extra bits or bytes.

For instance my bench ECU replies with 0x0080021 for 000FFFFE. And this is what I assume to be the real can ID, but if it is BCD encoding, then only 4 bits for 0-9 but the ID is 29 bits, so one bit is not needed.

However if the can ID is not reassembled and is output directly then maybe it needs re-ordering.

In Denso even the order of the bits is different.

It is not that complicated, just change the cems engine type, buy an ECM that fits to your cars MY and match to CEM. Here are some people who can help you free but often have less time.

If you get the engine with harness in, the last fixes shouldnt be a problem. The CEM software is full and supports all engine types, even if you configure your cem to v8 it changes from p2 to UDS protocol, so everything is already in there...

The people in this thread said that the signal configuration in the Bosch EDC will be different, and all the modules that talk to the ECM that were configured for Denso will not be able to if I do it. Otherwise I can procure the block for very little as well as engine harness.

The people in this thread or do you have someone else in mind?

[rkam]

I/We could be overthinking this.

The signal configuration as stored in Bosch will be different from Denso. Meaning you cannot flash a Denso signal configuration onto a Bosch.

But if they already need and supply the same signals/data on the bus, you don't have to.

As mentioned earlier, things might be easier if you have a different engine that already matches your car.

[dikidera]

The engines are pretty much the same, block wise. Almost all of them except a few instances, are interchangeable. The most important difference is, that the good blocks have a bore of 81mm, much thicker walls and when shimmed, have been verified to withstand over 650hp at the wheels, so at the crank likely more. The guy that did it, spent around $1000 on all of the things.
Well, over 250-300hp is not good for FWD, torque steer takes over.

But yes, it's really the software compatibility. I do not have a lot of modules simply because of the circumstances so less issues?

[T5Luke]

The people in this thread said that the signal configuration in the Bosch EDC will be different, and all the modules that talk to the ECM that were configured for Denso will not be able to if I do it. Otherwise I can procure the block for very little as well as engine harness.

The people in this thread or do you have someone else in mind?

Yes but if you change engine type in CEM it configures all other to talk to a turbo ecm.
The software of this modules is in each case full for every engine type. The CEM sends out its own configuration every few seconds on the bus and all modules do the setup for each engine type. For example if the cem sends out it has a diesel heater, the dim will show you the diesel heater menu, if not it will hide it for you. This happens nearly the same for every module...

[dikidera]

Makes sense. It will become apparent soon...ish. I have a S40 p1 that needs to be repaired and then when I manage to fix it I will start with the s60.

[rkam]

That was new to me. I didn't know the other modules could adapt to changes without new programming!!

[T5Luke]

Yes, but on the engine bus he also won't have much. The CEM, big soft for all variants setup by config bytes, the ABS module is only specific with DSTC and STC. ETM electronics was build into the ECM in MY2002 and yes if he wants to drive a automatic car he needs a matching TCM module...