Vida CEM swapping

[unicast]

Hi all, thank you for creating this project, it's amazing! I've been monitoring it for a while but today I finally got my Teensy-powered breadboard assembled and I run it on my car. Unfortunately I got "PIN is NOT cracked" message at the end and I'm a bit puzzled what to do next. Any recommendations?
My CEM P/N is 31254317 which is in the list.
Here is the monitor output:

Code: Select all

CPU Maximum Frequency:   600000000
CPU Frequency:           180000000
Execution Rate:          180 cycles/us
PIN bytes to measure:    3
CAN low-speed init done.
Reading part number from ECU 0x40 on CAN_LS
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS <--- ID=03c3f7fc data=fd 00 00 19 40 26 3f 15
CAN_LS <--- ID=04a0409e data=00 01 18 00 00 00 02 9e
CAN_LS <--- ID=05704000 data=40 20 00 00 00 00 00 00
CAN_LS <--- ID=12404002 data=16 16 00 00 8b 00 80 00
CAN_LS <--- ID=080030ae data=80 00 07 01 11 01 50 e9
CAN_LS <--- ID=0c505226 data=40 3a 00 00 00 00 00 b0
CAN_LS <--- ID=0730302e data=00 00 00 01 00 00 50 e8
CAN_LS <--- ID=0fb2509e data=00 00 00 00 00 07 c0 00
CAN_LS <--- ID=00600005 data=8f 40 f9 f0 00 31 25 43
CAN_LS <--- ID=08e2300e data=c0 02 28 a9 2f 0e 00 80
CAN_LS <--- ID=04301090 data=00 00 00 00 00 00 27 e0
CAN_LS <--- ID=09c050b8 data=6f 00 86 40 00 bf 00 4c
CAN_LS <--- ID=19f010f8 data=99 3c 00 60 81 d8 de 50
CAN_LS <--- ID=1320400a data=00 00 00 00 00 00 40 1c
CAN_LS <--- ID=02120498 data=10 00 00 00 00 00 00 00
CAN_LS <--- ID=03c3f7fc data=fd 00 00 19 40 26 3f 15
CAN_LS <--- ID=00600005 data=09 17 20 20 20 31 26 46
Part Number: 31254317
Searching P/N 31254317 in 50 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 0 1 2 3 4 5
CAN high-speed init done.
Putting all ECUs into programming mode.

<CUT>

...
pin[2] choose candidate: 99
Candidate PIN 26 86 99 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 702 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 2258.71 seconds
done
Resetting all ECUs.
CAN_HS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00

Ok, I tried clocking my Teensy back to 600MHz and it didn't help. I also tried manually brute forcing the top 6 pin candidates by latency from the last round (byte 3), also no luck. It seems the only option for me is a 20h brute force of the last 4 bytes.
Will try as soon as I find a place with a wall socket.

[vtl]

Ok, I tried clocking my Teensy back to 600MHz and it didn't help. I also tried manually brute forcing the top 6 pin candidates by latency from the last round (byte 3), also no luck. It seems the only option for me is a 20h brute force of the last 4 bytes.
Will try as soon as I find a place with a wall socket.

Up to 18ish hours in the worst case. Average time is half of that.

You could also try to run it with the old election algorithm. Check out commit e17beb1220ac6d63322b85916a158062df6c6f52 or download https://github.com/vtl/volvo-cem-cracke ... 6c6f52.zip if you're not working with git.

Could also try cem_freq_align branch, some folks reported they got better results with it. git checkout cem_freq_align or download https://github.com/vtl/volvo-cem-cracke ... _align.zip

[unicast]

Ok, I tried clocking my Teensy back to 600MHz and it didn't help. I also tried manually brute forcing the top 6 pin candidates by latency from the last round (byte 3), also no luck. It seems the only option for me is a 20h brute force of the last 4 bytes.
Will try as soon as I find a place with a wall socket.

Up to 18ish hours in the worst case. Average time is half of that.

You could also try to run it with the old election algorithm. Check out commit e17beb1220ac6d63322b85916a158062df6c6f52 or download https://github.com/vtl/volvo-cem-cracke ... 6c6f52.zip if you're not working with git.

Could also try cem_freq_align branch, some folks reported they got better results with it. git checkout cem_freq_align or download https://github.com/vtl/volvo-cem-cracke ... _align.zip

No luck with either of the options. `cem_freq_align` showed a bigger latency difference between the pins, but still didn't work.
I think I'll take the CEM out and run it on the bench. I probably should have started with a programmer in the first place

[vtl]

No luck with either of the options. `cem_freq_align` showed a bigger latency difference between the pins, but still didn't work.
I think I'll take the CEM out and run it on the bench. I probably should have started with a programmer in the first place

Do you have 120 Ohm terminating resistors in your CAN shields? They must be disconnected when cracking in car.

[unicast]

No luck with either of the options. `cem_freq_align` showed a bigger latency difference between the pins, but still didn't work.
I think I'll take the CEM out and run it on the bench. I probably should have started with a programmer in the first place

Do you have 120 Ohm terminating resistors in your CAN shields? They must be disconnected when cracking in car.

Yup, I had them on the board initially, I unsoldered them for the in-car crack, now I'll solder them back again and give it a try.
Just took the CEM out of the car.
Looking into VIDA, I need to give +12 to E20-E23 (Front-1)
GND goes to A28 (Cockpit-1)
Sig GND A14 (Cockpit-1)

All cans go to diag can
HS-H B11
HS-L B12
LS-L B15
LS-H B16

I hope I won't mess it up

[vtl]

No luck with either of the options. `cem_freq_align` showed a bigger latency difference between the pins, but still didn't work.
I think I'll take the CEM out and run it on the bench. I probably should have started with a programmer in the first place

Do you have 120 Ohm terminating resistors in your CAN shields? They must be disconnected when cracking in car.

Yup, I had them on the board initially, I unsoldered them for the in-car crack, now I'll solder them back again and give it a try.
Just took the CEM out of the car.
Looking into VIDA, I need to give +12 to E20-E23 (Front-1)
GND goes to A28 (Cockpit-1)
Sig GND A14 (Cockpit-1)

All cans go to diag can
HS-H B11
HS-L B12
LS-L B15
LS-H B16

I hope I won't mess it up

I forgot, are you cracking a P1? Try Christian's branch: https://github.com/cmolson/volvo-cem-cr ... s/one_pass Or one of his other branches. His no-interrupt change seems to work better on some of P1 CEMs.

[unicast]

Do you have 120 Ohm terminating resistors in your CAN shields? They must be disconnected when cracking in car.

Yup, I had them on the board initially, I unsoldered them for the in-car crack, now I'll solder them back again and give it a try.
Just took the CEM out of the car.
Looking into VIDA, I need to give +12 to E20-E23 (Front-1)
GND goes to A28 (Cockpit-1)
Sig GND A14 (Cockpit-1)

All cans go to diag can
HS-H B11
HS-L B12
LS-L B15
LS-H B16

I hope I won't mess it up

I forgot, are you cracking a P1? Try Christian's branch: https://github.com/cmolson/volvo-cem-cr ... s/one_pass Or one of his other branches. His no-interrupt change seems to work better on some of P1 CEMs.

Yup, `one_pass` cracked it from the first shot under 800s on the bench.
@vtl, thanks a million for the help and creating this project. Do you have a donation jar or something?

[vtl]

Yup, `one_pass` cracked it from the first shot under 800s on the bench.
@vtl, thanks a million for the help and creating this project. Do you have a donation jar or something?

Well, maybe Christian's change needs to be incorporated. I forgot why it didn't go in the first place, perhaps other platforms regressed.

I'm doing fine, but anyone is more than welcome to help Matthew with keeping his site up and running: https://www.matthewsvolvosite.com/donate/ Thanks!

[swappeds60r]

Hello All!

I swapped my gearbox from AW51-55 to M66 AWD. My ECM reconfigured by the Contrast Works. So the car is running fine, but I need to reflash my CEM. I have succesfully cracked my CEM pin (by VTL, many thanks, the only issue was the freq align method worked only), and i found these programs:
- DHA,
- SDA4.2.0,
- CarConfigEdit v2.5.
- VBFtool 2.2
Now, something is not clear right now...
How can I reflash my CEM via OBDII?

[oscilloscope]

Do you have 120 Ohm terminating resistors in your CAN shields? They must be disconnected when cracking in car.

Yup, I had them on the board initially, I unsoldered them for the in-car crack, now I'll solder them back again and give it a try.
Just took the CEM out of the car.
Looking into VIDA, I need to give +12 to E20-E23 (Front-1)
GND goes to A28 (Cockpit-1)
Sig GND A14 (Cockpit-1)

All cans go to diag can
HS-H B11
HS-L B12
LS-L B15
LS-H B16

I hope I won't mess it up

I forgot, are you cracking a P1? Try Christian's branch: https://github.com/cmolson/volvo-cem-cr ... s/one_pass Or one of his other branches. His no-interrupt change seems to work better on some of P1 CEMs.

What do the colours represent?