Vida CEM swapping

Post by **vtl** » 17 Feb 2024, 14:24

rkam wrote: 17 Feb 2024, 14:22 The ones I've checked have flashing pin codes set.
Two had the same pin, and one had +1 on all bytes.

How did you read them? IIRC Renesas erases the flash when the read operation is attempted on a locked down flash.

rkam · Post by **rkam** » 17 Feb 2024, 16:05

Changed firmware to read itself.

xanthefin · Post by **xanthefin** » 18 Feb 2024, 10:18

rkam wrote: 17 Feb 2024, 16:05 Changed firmware to read itself.

Are talking of M32C and its password?

rkam · Post by **rkam** » 18 Feb 2024, 11:36

Yes, but only in DiCE, not CEM.

xanthefin · Post by **xanthefin** » 18 Feb 2024, 11:55

rkam wrote: 18 Feb 2024, 11:36 Yes, but only in DiCE, not CEM.

Oh i missed that part of discussion yes.
I already thought Volvo started using else than default password on some CEMs.

vitalik2134 · Post by **vitalik2134** » 19 Feb 2024, 08:56

If anyone is interested, here is a flash DICE@000000 read by orange5 for experiments

Post by **vtl** » 19 Feb 2024, 09:09

vitalik2134 wrote: 19 Feb 2024, 08:56 If anyone is interested, here is a flash DICE@000000 read by orange5 for experiments

It has no flash pin code, so it can be read in boot mode.

Kravi80 · Post by **Kravi80** » 19 Feb 2024, 10:42

Skavac wrote: 02 Feb 2024, 22:02 Anyone knows if CEM-L can be read with Orange5? I can see it supports M30855F, but I can't find a wiring diagram to connect the CEM to the orange 5. Reason I am asking because failed write with IOTerminal. Now CEM is dead

http://www.ddmauto.ru/programmatoryi/st ... c-m30855fw
Clk, busy, p50, p60 no need to be connected in M32C UART mode (in M32C SPI must be connected).
Chips adm... and 93c86 must be desoldered.

MrP · Post by **MrP** » 26 Feb 2024, 04:45

Hi guys I was wondering if the "brick" cem is possible to Crack yet? I read you need to keep the k line active but I haven't seen it being cracked yet and I read a lot. Through the posts.

WhizzMan · Post by **WhizzMan** » 26 Feb 2024, 07:28

MrP wrote: 26 Feb 2024, 04:45 Hi guys I was wondering if the "brick" cem is possible to Crack yet? I read you need to keep the k line active but I haven't seen it being cracked yet and I read a lot. Through the posts.

No. You need to remove it from the car and directly read the content on the bench and find the PIN in there. There is no known vulnerability in these that will make it doable to find the PIN in a reasonable time.