Vida CEM swapping

[oscilloscope]

Github question?

Red is removed, Green is added.

Example:

Commits on Feb 22, 2022

Remove canMsgReceive, affects the latency data as it disables interru…

Showing 1 changed file with 2 additions and 4 deletions.

4 red lines
2 green lines

red line 392 is removed: } while (TSC < limit && !canMsgReceive(CAN_HS, &id, reply, 0, false));

was that a little cheeky coding joke there?

[pawelstanislaw]

...

Assuming you assembled and connected it right, try to comment CEM_PN_AUTODETECT. Also you CEM may use shuffle order 3. The code has 0.

Hi again,
Unfortunately, the changes you suggested did not work out. Ran out of ideas, but my friend, a BMW guy, suggested that I should reset the car by disconnecting the battery or try to plug in something else to the OBD port before trying to crack CEM.

Disconnecting the battery did not work, then I plugged in some ELM327 Bluetooth interface laying in the car. Plugged in, erased DTCs, plugged my PIN cracker, and it started to crash the car electronics (key in position II). Brake failure, some pump went on, wipers started, etc. Still a bunch of 00s in output but it was the sign that it is talking with the car, even if it's talking trash.
Disconnected the battery, plugged in ELM327, and tried with the key in the position I - wipers started.
Disconnected the battery, plugged in ELM327, and tried with the key in position 0 - it started to decode the PIN.
Tried again without the key - nothing happened.

Not sure if that's the rule for 31254903 CEM, but if something not working right try to connect something else to the OBD port. And key in position 0 - probably will be safer for that pump and your wiper blades.

Thanks a lot for the project and for the help that I got. I was planning a visit to Volvo Service Center, but then I found this hack. Coded the cruise control and it works fine.

[vtl]

Disconnecting the battery did not work, then I plugged in some ELM327 Bluetooth interface laying in the car. Plugged in, erased DTCs, plugged my PIN cracker, and it started to crash the car electronics (key in position II). Brake failure, some pump went on, wipers started, etc. Still a bunch of 00s in output but it was the sign that it is talking with the car, even if it's talking trash.
Disconnected the battery, plugged in ELM327, and tried with the key in the position I - wipers started.
Disconnected the battery, plugged in ELM327, and tried with the key in position 0 - it started to decode the PIN.
Tried again without the key - nothing happened.

Wiring to CAN bus(es) is wrong, double check it. The car does weird stuff when you reverse L and H wires or simply plug high speed CAN to low speed or vice versa.

[dikidera]

I have a question. In the CEM config you can specify if you have the extended trip computer for instant and avg fuel consumption. Does the CEM then issue a CAN command telling the DIM I have it enabled?

If so, doesn't this mean that one can issue the CAN command and enable it albeit temporarily on each car start?

The reason I think so, is because the PHM module can and does write to the DIM screen, and advertises itself via a single CAN command.

Although a bit different, in DHA on DIM I have a Write data block by offset, and under it Tripcomputer, unit. I have a hunch it may be related. But I am not sure.

UPDATE:
After googling it's apparent that Volvo did not enable the fuel trip computer for BIFUEL models, probably because of the hybrid modes of petrol and lpg/cng. Now the question is, if the functionality is still there and could be forcefully enabled or is the code entirely absent from my Denso unit.

[Bekirebu]

Hello everyone
I would like to thank all the participants who prepared and supported this magnificent project.
My English is not very good so I use google translate. Please forgive me if I have any errors in expression.
I prepared my circuit as in the picture. I connected it to my 2012 model XC90. It calculated the first 3 PIN codes, but could not calculate the last 3 codes with brute force. The transaction file is attached. can you help me?
thanks.

[vtl]

Hello everyone
I would like to thank all the participants who prepared and supported this magnificent project.
My English is not very good so I use google translate. Please forgive me if I have any errors in expression.
I prepared my circuit as in the picture. I connected it to my 2012 model XC90. It calculated the first 3 PIN codes, but could not calculate the last 3 codes with brute force. The transaction file is attached. can you help me?
thanks.

You are running an old version of the code, pull the latest from github.

Also I see a few problems with your hardware:

- not soldered (a lot of resistance in those pads that is particularly bad for high frequency signals)
- thick aluminum wires (I think they are aluminum or copper plated aluminum?)
- CAN pairs are not twisted... (must for differential signalling, which CAN is)
- ... and seems to have a different length (must for differential signalling)
- how noisy is your DC-DC converter?

Here's for example my cracker, which I'm not very proud of, but it cracked every uncrackable dump other folks have sent to me: copper PCB, CAT 6A Ethernet twisted pairs (500 MHz), short AWG30 (0.25 mm) wires to run signals to Teensy, very tight DIP socket. CEM and the cracker are both powered by a low noise lab power supply.

1.png (1.3 MiB) Viewed 1078 times

2.png (1.32 MiB) Viewed 1078 times

Also your model year can be cracked in a P3 way, via DiCE: viewtopic.php?p=608430#p608430

[Bekirebu]

thank you so much @vtl
I have the necessary circuit elements ready. I wanted to give it a try with the simplest method, I was happy thinking it would be successful after passing the first 3 steps. I followed this thread from the first page. I knew about the cable and other features you mentioned.
Now I will immediately prepare the new circuit on the copper PCB and try again. I will share the result.
The UDS programs on the page you suggested for P3 are not available. Can it be shared again?
Respects.

[vtl]

Try the latest code first: https://github.com/vtl/volvo-cem-cracker

Also if you run it a few times do you get the same first 2 bytes? If only the third byte differs you could change CALC_BYTES to 2 https://github.com/vtl/volvo-cem-cracke ... er.ino#L13 and leave it running for up to 18 hours (worst case). It will brute force the rest 4 bytes.

[Bekirebu]

great. I will try all.

[Divxet]

Hi!
Can anybody please help me with the problem to get the DICE to work with the Volvo DHA software.
I have Vida installed and the DICE is working perfect with that on my laptop but with the DHA i can´t find a way to connect the DICE to the software.