Vida CEM swapping

[dikidera]

I'll see if I can port vtl's code to the Raspberry. I do have an Arduino mega, but I will see which method I will go for cracking the pin.

[vtl]

I'll see if I can port vtl's code to the Raspberry. I do have an Arduino mega, but I will see which method I will go for cracking the pin.

I don't think Raspberry Pi running Linux is real time enough to crack the pin. We failed to get enough precision with ESP32 running it's own tiny OS, because conditional jump opcode is emulated in microcode or something like that. Linux is a general purpose OS with a lot of background noise. Even running your task under RT scheduler is not enough. It basically has to detect latency deviation as low as 100 ns.

[dikidera]

I figured as much. Well then the Mega should help(hopefully its fast enough).

[vtl]

I figured as much. Well then the Mega should help(hopefully its fast enough).

Highly doubt. Even with Teensy, which has much more advanced CPU architecture, it is sometimes required to increase clock frequency from 180 to 600 MHz.

[dikidera]

Jesus. So cracking it is out of my reach without a high clock speed device which can execute in real time?

[vtl]

Jesus. So cracking it is out of my reach without a high clock speed device which can execute in real time?

It is called a timing attack for a reason. I'm actually happy we have a cheap, high speed MCUs now, so that effort didn't end up as a FPGA design.

[dikidera]

The RPI Pico seems like a comparable device, can be overclocked to 400mhz but is several times cheaper. The issue is it doesn't have integrated CAN so it needs two modules(which I have), do you happen to know how much latency adding those shields might add?

[vtl]

The RPI Pico seems like a comparable device, can be overclocked to 400mhz but is several times cheaper. The issue is it doesn't have integrated CAN so it needs two modules(which I have), do you happen to know how much latency adding those shields might add?

None if CAN_L_PIN connected directly to CAN L.

https://github.com/vtl/volvo-cem-cracke ... 82ac5c8689

[kailash9999]

I have a little present for you all if it is helpful, It can be used with Dice for individual module programming as long as you have 3 items.
1) pin code
2) SBL (secondary boot loader)
3) the file you wish to flash.

This is the latest version used from P80 Chassis types all the way to the new SPA/CMA platform.
The software comes with an example for programming your own application along with SDK and information in PDF format.

If posting this is in violation of any terms please let me know.

Nice! Is it written by you?

This software is written by Volvo, when volvo technicians (not dealer technicians) need to sort cars on the side of the road (warranty vehicles) they can take the SBL/Firmware with them along with pin codes and programme the vehicle without using Vida.

This is why normal technicians can get hold of the software but not the files. This is because regional techs are supposed to delete all files when finished.

Wish I knew more about coding but I'm a part timer and only code things when needed, this unfortunately means I have to refresh my C knowledge everytime.

If we can make our own SBL's we may be in with a chance using this software.

I also have other software packages that may be helpful such as car config editor. Again though some files are missing but I do have sample files.



Pictures from the car config editor:
Main folder:

Open File image:

Vehicle details image:

Changing car configuration image:


This is all OEM software, used along with Vida by Volvo regional technicians to diagnose/test/repair vehicles with the minimum of fuss.

This thread has helped me a lot so far in regards to pins. So I would like to give something back to contributors only at the moment. The reason for this is I believe we can maybe make our own software. interface with teensy or something alike. To crack pin, read vehicle config. Read all vehicle module firmwares for backup in case of future failure. Also changing configs would not require the use of other software such as Vida/ Vdash. Saving a lot of people a lot of time and money.

Hi I'v been searching for SDA, Car Config editor & VBF files for my Volvo S80 V8 for ages, could you kindly share a download link please ? Thanks.

[volvofrank]

@vtl: Do you know if it's possible to retrieve / brute force / time attack the Immobilizer Code as well?
Or do you know the steps needed....?

I am on a Volvo P1.