Vida CEM swapping

[oscilloscope]

I can see where you're coming from, but I respectfully disagree.

In what part ?

[oscilloscope]

all who might know , was there a developer from Russia called Oleg who seemed to of disappeared from the "scene" ?

[volvofrank]

Yeah, I finally managed to crack my CEM PIN code. It worked when I bruteforced the last 4 pairs, instead of 3!

I am on a Volvo C70 P1.
Now I need to remove ITP / MOST Security. If I want to do that through VDASH it needs an IMMO code.

What is the best way to proceed?
How can I crack that code as well?

[dikidera]

I am quite excited. I removed my DIM from the car, cause I will soon be assembling it, and wanted to do a few changes/fixes. One is, the DIM's gauges are not centered and always show lower than actual values, e.g temp, rpm and speed. Next is language, it is my understanding that the DIM stores the language/translations.

Goal is to dump firmware, cause I also want to analyze it some day, but also write. That will be a challenge.

[dikidera]

There is the flashing documentation for Renesas M16/M32 chips
https://www.renesas.com/us/en/document/ ... -m32c-r32c
Also code for flash/erase functions are available. I'll write tools for flash CEM-L/H over j2534 device. But need some help with getting data from CAN for such MCUs.

What do you need? I have a spare CEM-L lying for experimentation. I bought it for such cases, I want to enable my extended trip data and needed a way to experiment. I have it opened and ready to be probed.

[prometey1982]

What do you need? I have a spare CEM-L lying for experimentation. I bought it for such cases, I want to enable my extended trip data and needed a way to experiment. I have it opened and ready to be probed.

Hi! I have SBL for CEM-L. So I'll implement CEM write tool when will have time for it.

[dikidera]

Does the CEM have a command in the original bootloader to write data to RAM, e.g to upload SBL?

[prometey1982]

Same as other modules. But security access should be acquired.

[dikidera]

Security access means that the pin should be cracked, correct?

[prometey1982]

Security access means that the pin should be cracked, correct?

Here is getting security access for my CEM. PIN is 69 91 29 60 01 84

Sent 0x00, 0xf, 0xff, 0xfe, 0x50, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
Received 0x00, 0x00, 0x00, 0x03, 0x50, 0x8e, 0x00, 0x00, 0x31, 0x31, 0x44, 0x68
Is it CEM hardware check?
Then PIN code is sent:
0x00, 0xf, 0xff, 0xfe, 0x50, 0xbe, 0x69, 0x91, 0x29, 0x60, 0x01, 0x84
And answer from CEM:
0x00, 0x00, 0x00, 0x03, 0x50, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

Code: Select all

17:30:34,717 0103 000000 PassThruWriteMsgs() enter
17:30:34,717 0100 000001 PassThruWriteMsgs() In parameter ChannelID = 1
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].ProtocolID = CAN
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].RxStatus = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].TxFlags = 256
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].Timestamp = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].ExtraDataIndex = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].DataSize = 12
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].Data = [0x00, 0xf, 0xff, 0xfe, 0x50, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
17:30:34,717 0100 000001 PassThruWriteMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruWriteMsgs() In parameter Timeout = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0104 000001 PassThruWriteMsgs() exit
17:30:34,717 0103 000000 PassThruReadMsgs() enter
17:30:34,717 0100 000001 PassThruReadMsgs() In parameter ChannelID = 1
17:30:34,717 0100 000001 PassThruReadMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruReadMsgs() In parameter Timeout = 5
17:30:34,717 0000 000000 CommandThread() CommandThread() started
17:30:34,717 0000 000000 CanChannel::Handle() Message received
17:30:34,717 0100 000001 PassThruReadMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].ProtocolID = CAN
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].RxStatus = 256
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].TxFlags = 0
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].Timestamp = 1179893800
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].ExtraDataIndex = 0
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].DataSize = 12
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].Data = [0x00, 0x00, 0x00, 0x03, 0x50, 0x8e, 0x00, 0x00, 0x31, 0x31, 0x44, 0x68]
17:30:34,717 0104 000001 PassThruReadMsgs() exit
17:30:34,717 0103 000000 PassThruIoctl() enter
17:30:34,717 0100 000001 PassThruIoctl() In parameter ChannelID = 1
17:30:34,717 0100 000001 PassThruIoctl() In parameter IoctlID = CLEAR_RX_BUFFER
17:30:34,717 0104 000001 PassThruIoctl() exit
17:30:34,717 0103 000000 PassThruWriteMsgs() enter
17:30:34,717 0100 000001 PassThruWriteMsgs() In parameter ChannelID = 1
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].ProtocolID = CAN
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].RxStatus = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].TxFlags = 256
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].Timestamp = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].ExtraDataIndex = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].DataSize = 12
17:30:34,717 0100 000001 PassThruWriteMsgs() msg[0].Data = [0x00, 0xf, 0xff, 0xfe, 0x50, 0xbe, 0x69, 0x91, 0x29, 0x60, 0x01, 0x84]
17:30:34,717 0100 000001 PassThruWriteMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruWriteMsgs() In parameter Timeout = 0
17:30:34,717 0100 000001 PassThruWriteMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0104 000001 PassThruWriteMsgs() exit
17:30:34,717 0103 000000 PassThruReadMsgs() enter
17:30:34,717 0100 000001 PassThruReadMsgs() In parameter ChannelID = 1
17:30:34,717 0100 000001 PassThruReadMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruReadMsgs() In parameter Timeout = 5000
17:30:34,717 0000 000000 CanChannel::Handle() Message received
17:30:34,717 0100 000001 PassThruReadMsgs() In/out parameter pNumMsgs = 1
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].ProtocolID = CAN
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].RxStatus = 256
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].TxFlags = 0
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].Timestamp = 1179897100
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].ExtraDataIndex = 0
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].DataSize = 12
17:30:34,717 0100 000001 PassThruReadMsgs() msg[0].Data = [0x00, 0x00, 0x00, 0x03, 0x50, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
17:30:34,717 0104 000001 PassThruReadMsgs() exit