Vida CEM swapping

[hampus10699]

Hi all.
Does anyone know where I can get T5Lukes cem cracking software?

[Dudde]

Hi all.
Does anyone know where I can get T5Lukes cem cracking software?

Page 223

[xanthefin]

You need go another way if you want add used remote in UEM.

This way only good if you get UEM + remotes as you already noticed SEED Key is rolling one.



You need program they remote itself if want make it as a new specially when UEM is missing or sniff it all via radio.

Can you tell me more? You can program the remote if UEM is missing? Can the long UEM code be sniffed from radio?

Sure i can tell more as i get finished with project i started last year. I have programming ready and all how i just need finish one last piece and make then it clean after mess as into one usable thing.

[ricked]

Hi all.
Does anyone know where I can get T5Lukes cem cracking software?

Page 223

its gone...
here you can get it again:

30 days valid

https://easyupload.io/15802z

[oscilloscope]

You need go another way if you want add used remote in UEM.

This way only good if you get UEM + remotes as you already noticed SEED Key is rolling one.



You need program they remote itself if want make it as a new specially when UEM is missing or sniff it all via radio.

Can you tell me more? You can program the remote if UEM is missing? Can the long UEM code be sniffed from radio?

Sure i can tell more as i get finished with project i started last year. I have programming ready and all how i just need finish one last piece and make then it clean after mess as into one usable thing.

sounds interesting...

[oscilloscope]

Anyone knows if CEM-L can be read with Orange5? I can see it supports M30855F, but I can't find a wiring diagram to connect the CEM to the orange 5. Reason I am asking because failed write with IOTerminal. Now CEM is dead

http://www.ddmauto.ru/programmatoryi/st ... c-m30855fw
Clk, busy, p50, p60 no need to be connected in M32C UART mode (in M32C SPI must be connected).
Chips adm... and 93c86 must be desoldered.

i attempted to message the guy who is selling these legacy programmers in ru but i never received a reply. mind you it was quite some time ago i messaged. ( somthing like 2-3 years ago)

[vtl]

i attempted to message the guy who is selling these legacy programmers in ru but i never received a reply. mind you it was quite some time ago i messaged. ( somthing like 2-3 years ago)

You can read M32C for free with m16c-flasher.de software and $2 USB-UART adapter. Search for m16c-flasher.de in this topic for config and instructions.

[sanjurjo]

Hi everybody,
I have a V70R MY2004 with a brick-style CEM (30657629).
What I want is to crack the PIN and upload it to d5t5 so I can enjoy VDASH even more.

What would be the right procedure here? As i understand, the only way to go with this CEM is to read it directly f.e. with an arduino nano using the code in this post (viewtopic.php?p=609357#p609357) from T5Luke. After that I would have the CEM-image as .bin. At what offset should I look for the PIN and how many bytes is it long? Or can T5Luke's tool (CEMtool) be used for finding it as well?

I'm completely new in this and I appreciate the work done here very much, as well as the patience with guys like me

[vtl]

Hi everybody,
I have a V70R MY2004 with a brick-style CEM (30657629).
What I want is to crack the PIN and upload it to d5t5 so I can enjoy VDASH even more.

What would be the right procedure here? As i understand, the only way to go with this CEM is to read it directly f.e. with an arduino nano using the code in this post (viewtopic.php?p=609357#p609357) from T5Luke. After that I would have the CEM-image as .bin. At what offset should I look for the PIN and how many bytes is it long? Or can T5Luke's tool (CEMtool) be used for finding it as well?

I'm completely new in this and I appreciate the work done here very much, as well as the patience with guys like me

At offset 0x4000 or 0x6000. CEM CPU is 16 bit big endian, on x86 you may need to swap the bytes to little endian, like:

00 11 22 33 44 55 -> 11 00 33 22 55 44

I don't now if T5Luke's software does it. When I desoldered the flash and read it in the programmer I had to swap bytes.

[dikidera]

Hi everybody,
I have a V70R MY2004 with a brick-style CEM (30657629).
What I want is to crack the PIN and upload it to d5t5 so I can enjoy VDASH even more.

What would be the right procedure here? As i understand, the only way to go with this CEM is to read it directly f.e. with an arduino nano using the code in this post (viewtopic.php?p=609357#p609357) from T5Luke. After that I would have the CEM-image as .bin. At what offset should I look for the PIN and how many bytes is it long? Or can T5Luke's tool (CEMtool) be used for finding it as well?

I'm completely new in this and I appreciate the work done here very much, as well as the patience with guys like me

At offset 0x4000 or 0x6000. CEM CPU is 16 bit big endian, on x86 you may need to swap the bytes to little endian, like:

00 11 22 33 44 55 -> 11 00 33 22 55 44

I don't now if T5Luke's software does it. When I desoldered the flash and read it in the programmer I had to swap bytes.

For byte swapping I recommend https://github.com/rgrahamh/byte-swapper

Has prebuilt binaries for Windows and is great for this.