Vida CEM swapping

[oscilloscope]

BKPT to D4
RESET to D5
FREEZE to D6
DSI to D7
DSO to D8

Sorry hijack but as you know best and i was testing.

Your UDS reader fail on CEM-B because...
.. wrong return address
...wrong can bus speed

Does it send port open command for CEM? As not much happens when it says it should.


P.S. Nice WinXP bug with pin code.

Need have a tool dump the brick.

Dump the brick cem using usbjtag works a treat.

[xanthefin]

BKPT to D4
RESET to D5
FREEZE to D6
DSI to D7
DSO to D8

Sorry hijack but as you know best and i was testing.

Your UDS reader fail on CEM-B because...
.. wrong return address
...wrong can bus speed

Does it send port open command for CEM? As not much happens when it says it should.


P.S. Nice WinXP bug with pin code.

Need have a tool dump the brick.

Dump the brick cem using usbjtag works a treat.

I have but i want easier way as i want be lazy.
P.S. Not requesting as i will end up writing own tool which i meant but wanted just share and if i end up doing PIN cracking on these i will share patches sure.

[oscilloscope]

Sorry hijack but as you know best and i was testing.

Your UDS reader fail on CEM-B because...
.. wrong return address
...wrong can bus speed

Does it send port open command for CEM? As not much happens when it says it should.


P.S. Nice WinXP bug with pin code.

Need have a tool dump the brick.

Dump the brick cem using usbjtag works a treat.

I have but i want easier way as i want be lazy.
P.S. Not requesting as i will end up writing own tool which i meant but wanted just share and if i end up doing PIN cracking on these i will share patches sure.

Lol , I understand.

[oscilloscope]

So I have been talking too a developer (allegedly) Who claims has was involved in making pretty much all the synchronisation applications. , I asked afew questions regarding source code , or implemention, on what tool , or device, is there any applications avaliable, so far i have had very few responses, although lots of claims I'll update when I know more

[tarbik]

Hi All! I just want to post here a confirmation that the vtl's brute force cracking procedure works on even one of the latest P3 V40's from May 2019. The in-car cracking process for the P3 is a bit tedious since it is constantly jumping out of the programming mode every 5 seconds. At the end it took 11h and 40 minutes and voila the PIN was there!

For the P3 cracking you just have to switch to the p3 branch in the git repo and build the tool itself. For the tool I've used the PCB from PCBWay here: https://www.pcbway.com/project/sharepro ... 037d5.html

And because of my laziness I didn't even bother to modify it to be compatible with latest schematics (this is the old version that is using the Bosch CF160). I've used SN65HVD230 transceiver which is a 3.3V version. You just have to cut the trace that goes to the 5V rail and connect it manually to 3.3V that Teensy provides. I didn't bother to use any sort of "special" power cables, just a straight connection to the laptop via 2m USB/A to micro cable. Monitored the USB voltage a bit and no significant drops at the end.

Thanks to everyone who contributed to this!

I've got 4 more boards and some spare parts, so if anyone is interested (preferably from CZ) I guess I can provide some assistance.

Here are some photos of my setup:

[alevol]

Whan if lower keep alive sending intervals?

[jeffbolem]

Hey y'all Im new to this. I was reading through the thread, and it seems that the only way to crack a brick cem (2004 P2) is using an Arduino microcontroller and putting the cem on the bench. I then came across this on GitHub, https://github.com/mdapoz/volvo-cem-cracker which says it supports P2 2001-2004. Would building this schematic allow me to crack via obd2, or am I tripping?

[vtl]

Hey y'all Im new to this. I was reading through the thread, and it seems that the only way to crack a brick cem (2004 P2) is using an Arduino microcontroller and putting the cem on the bench. I then came across this on GitHub, https://github.com/mdapoz/volvo-cem-cracker which says it supports P2 2001-2004. Would building this schematic allow me to crack via obd2, or am I tripping?

No, it would not work.

[vtl]

Whan if lower keep alive sending intervals?

It could be a countermeasure against brute forcing the pin.

[jeffbolem]

Hey y'all Im new to this. I was reading through the thread, and it seems that the only way to crack a brick cem (2004 P2) is using an Arduino microcontroller and putting the cem on the bench. I then came across this on GitHub, https://github.com/mdapoz/volvo-cem-cracker which says it supports P2 2001-2004. Would building this schematic allow me to crack via obd2, or am I tripping?

No, it would not work.

Okay, so the only way to get the pin off of the brick cem is to read the flash memory directly off of the chip? Like the diagram Luke posted on pages 218-220?