Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Re: Vida CEM swapping

Post by vtl »

rkam wrote: ↑17 Feb 2024, 14:22 The ones I've checked have flashing pin codes set.
Two had the same pin, and one had +1 on all bytes.
How did you read them? IIRC Renesas erases the flash when the read operation is attempted on a locked down flash.
Top
rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

Changed firmware to read itself.
Top
User avatar
xanthefin
Posts: 444
Joined: 4 May 2019
Year and Model: 1997 850
Location: Pluto
Has thanked: 106 times
Been thanked: 130 times

Post by xanthefin »

rkam wrote: ↑17 Feb 2024, 16:05 Changed firmware to read itself.
Are talking of M32C and its password?
Top
rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

Yes, but only in DiCE, not CEM.
Top
User avatar
xanthefin
Posts: 444
Joined: 4 May 2019
Year and Model: 1997 850
Location: Pluto
Has thanked: 106 times
Been thanked: 130 times

Post by xanthefin »

rkam wrote: ↑18 Feb 2024, 11:36 Yes, but only in DiCE, not CEM.
Oh i missed that part of discussion yes.
I already thought Volvo started using else than default password on some CEMs.
Top
vitalik2134
Posts: 4
Joined: 17 December 2022
Year and Model: Volvo XC90 2006
Location: Belarus
Has thanked: 1 time
Been thanked: 1 time

Post by vitalik2134 »

If anyone is interested, here is a flash DICE@000000 read by orange5 for experiments
Attachments
DICE flash 000000.rar
(62.04 KiB) Downloaded 131 times
Top
vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

vitalik2134 wrote: ↑19 Feb 2024, 08:56 If anyone is interested, here is a flash DICE@000000 read by orange5 for experiments
It has no flash pin code, so it can be read in boot mode.
Top
Kravi80
Posts: 2
Joined: 7 October 2022
Year and Model: S60 my09
Location: Izhevsk
Has thanked: 2 times
Been thanked: 2 times

Post by Kravi80 »

Skavac wrote: ↑02 Feb 2024, 22:02 Anyone knows if CEM-L can be read with Orange5? I can see it supports M30855F, but I can't find a wiring diagram to connect the CEM to the orange 5. Reason I am asking because failed write with IOTerminal. Now CEM is dead
http://www.ddmauto.ru/programmatoryi/st ... c-m30855fw
Clk, busy, p50, p60 no need to be connected in M32C UART mode (in M32C SPI must be connected).
Chips adm... and 93c86 must be desoldered.
Top
MrP
Posts: 1
Joined: 25 February 2024
Year and Model: V70 2.4T '02
Location: Netherlands

Post by MrP »

Hi guys I was wondering if the "brick" cem is possible to Crack yet? I read you need to keep the k line active but I haven't seen it being cracked yet and I read a lot. Through the posts.
Top
WhizzMan
Posts: 33
Joined: 21 February 2021
Year and Model: 2001 XC70
Location: Göteborg
Has thanked: 8 times
Been thanked: 2 times

Post by WhizzMan »

MrP wrote: ↑26 Feb 2024, 04:45 Hi guys I was wondering if the "brick" cem is possible to Crack yet? I read you need to keep the k line active but I haven't seen it being cracked yet and I read a lot. Through the posts.
No. You need to remove it from the car and directly read the content on the bench and find the PIN in there. There is no known vulnerability in these that will make it doable to find the PIN in a reasonable time.
Top
Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “XC90 1st gen 2003-2014”