Vida CEM swapping

[liamstears]

Hi all, just a quick question if I may, got myself a teensy for cem pin cracking, I bought the PCB but couldn't find the Bosch CF160 so went with the SN65HVD230DR's instead. Cracked my P2 XC90 no problem in just under 35 minutes.

So the question is regarding time and resistors. I've read that the teensy should be pretty quick, is the time mines taken right or a bit longer than expected? What I wondered is if the resistors I added may have slowed the process? Being as I used the SN65HVD230DR's instead of the CF160's I added the 2 10k resistors from pin 8 to ground and wondering if maybe I didn't need to?....

The algo consists of two parts: timing attack on first 3 bytes of the PIN and brute force on the last 3 bytes.

Brute force goes over numerical space of 3 BCD bytes (from 000000 to 999999), so the time it takes to crack really depends on your CEMs PIN.

The first part (timing attack) used to be much faster initially, but with more CEMs supported and often subpar cracker hardware implementation we learned the algo has to operate often on a very thin signal-to-noise margin, so it works extra hard now and takes more time. The algo can be tuned to a specific CEM model, and it can crack it, for example, in anecdotal 8 seconds, like sirloin did for his P1 CEM, but I don't want to make the software even more complicated for handling such edge cases. Overall, most of the cracker users only do it once in life, for their own CEM, so it really does not matter how much time it spends on cracking the pin, if it's not hours or days.

I've been asked many times to speed the algo up, but such requests usually come from folks, who use the cracker in their private business. Given that my time is not infinite and testing a new version for compatibility even among my 4 CEMs is a nightmare, I'm more than happy with what we have now. In any case, it is an opensource project, so if anybody feels it worth it to burn his time on tuning the algo and cutting the cracking time from 40 minutes to 30, or maybe 20, yet keeping the codebase compatible with everything we support now - go ahead and do it.

That's all perfectly fine, I'm more than happy with the amount of time it took I just wanted to check that is how it's designed and it wasn't the resistors putting the can chips into a different mode slowing it down as most posts suggest this should be quick like 10-20mins

I'm very happy and glad it worked so I'm not complaining at all, thanks for all the work and the clarification , happy chap here

[vtl]

That's all perfectly fine, I'm more than happy with the amount of time it took I just wanted to check that is how it's designed and it wasn't the resistors putting the can chips into a different mode slowing it down as most posts suggest this should be quick like 10-20mins

I'm very happy and glad it worked so I'm not complaining at all, thanks for all the work and the clarification , happy chap here

Yeah, it used to be much faster, but didn't work everywhere. My very first pin crack happened in about 10 minutes or so. Now it works everywhere or almost everywhere, if the hardware was properly assembled.

[dikidera]

Yes, but on the engine bus he also won't have much. The CEM, big soft for all variants setup by config bytes, the ABS module is only specific with DSTC and STC. ETM electronics was build into the ECM in MY2002 and yes if he wants to drive a automatic car he needs a matching TCM module...

I do have an automatic. But I am not sure if it needs to be replaced or keep it as-is? My ABS module is strictly STC.

[vtl]

I do have an automatic. But I am not sure if it needs to be replaced or keep it as-is? My ABS module is strictly STC.

Final drive gear ratio can be different for N/A and 2.5T engines, need to check that, or it can throw errors.

Looks like the same 2.65:1 across the engines: https://www.volvoclub.org.uk/tech/s60-05-specs.shtml

[jgtbazandianne]

HI Everyone,
So so so happy to come across this forum thread.
I am in the process of building the setup now and also tinkering with the code to add a 2.5" touch screen. Thus hopefully enabling the selection of P1/P2 on the fly in one standalone unit.

However. My question to you all is, what softwares are you planning to use to modify flash/code?

I have a little present for you all if it is helpful, It can be used with Dice for individual module programming as long as you have 3 items.
1) pin code
2) SBL (secondary boot loader)
3) the file you wish to flash.

This is the latest version used from P80 Chassis types all the way to the new SPA/CMA platform.
The software comes with an example for programming your own application along with SDK and information in PDF format.

If posting this is in violation of any terms please let me know.

Hello,

Can anyone tell me where can I obtain a copy of the Car Config Edit software?

Cheers

[dikidera]

Not even VIDA or DHA know what param A6 20 0B does on Denso, anyone have information as it is listed as "Info missing in FD" which isn't very descriptive? It seems to be a True/False flag or 0/1 related to fueling and other things. Sometimes it ignores large swaths of code depending on it's value. That is to say, if the value is either true or false, it seems to skip complex computation and almost no RAM variables are updated.

[volvofrank]

It is not working for me unfortunately. I scrapped my breadboard version in favor of a PCB with 2 CF160's. But I get the same result.
It always resolves to the same first two bytes, and after that it just fails.

Is there anything I can improve on?

[vtl]

It is not working for me unfortunately. I scrapped my breadboard version in favor of a PCB with 2 CF160's. But I get the same result.
It always resolves to the same first two bytes, and after that it just fails.

Is there anything I can improve on?

Your circuit has no common ground with the car.

What car are you trying to crack?

[volvofrank]

Your circuit has no common ground with the car.

What car are you trying to crack?

A Volvo C70 2006

I think I have these schematic: https://github.com/vtl/volvo-cem-cracke ... ersion.pdf
(This PCB: https://www.pcbway.com/project/sharepro ... 037d5.html )

That doesn't include ground. Do you mean I should connect OBDII pin 4 and 5 to the Teensy GND?

[vtl]

Your circuit has no common ground with the car.

What car are you trying to crack?

A Volvo C70 2006

I think I have these schematic: https://github.com/vtl/volvo-cem-cracke ... ersion.pdf
(This PCB: https://www.pcbway.com/project/sharepro ... 037d5.html )

That doesn't include ground

Try to add ground first.



You may want to try one of sirloin's branch, he was tweaking it for P1.

What CEM P/N your car has by the way?