Vida CEM swapping

[sanjurjo]

Hi everybody,
I have a V70R MY2004 with a brick-style CEM (30657629).
What I want is to crack the PIN and upload it to d5t5 so I can enjoy VDASH even more.

What would be the right procedure here? As i understand, the only way to go with this CEM is to read it directly f.e. with an arduino nano using the code in this post (viewtopic.php?p=609357#p609357) from T5Luke. After that I would have the CEM-image as .bin. At what offset should I look for the PIN and how many bytes is it long? Or can T5Luke's tool (CEMtool) be used for finding it as well?

I'm completely new in this and I appreciate the work done here very much, as well as the patience with guys like me

At offset 0x4000 or 0x6000. CEM CPU is 16 bit big endian, on x86 you may need to swap the bytes to little endian, like:

00 11 22 33 44 55 -> 11 00 33 22 55 44

I don't now if T5Luke's software does it. When I desoldered the flash and read it in the programmer I had to swap bytes.

Thanks for your reply vtl. So we're talking about a 6-byte long value, right?
Is it really necessary to desolder the flash memory chip? My idea was to connect pins at the board-locations shown in T5Luke's post I mentioned previously

[vtl]

Thanks for your reply vtl. So we're talking about a 6-byte long value, right?
Is it really necessary to desolder the flash memory chip? My idea was to connect pins at the board-locations shown in T5Luke's post I mentioned previously

It is 6 bytes in BCD. No need to desolder if you do what T5Luke did. Back in years I desoldered the chip, because I have a programmer and it was the easiest.

[sanjurjo]

Thanks for your reply vtl. So we're talking about a 6-byte long value, right?
Is it really necessary to desolder the flash memory chip? My idea was to connect pins at the board-locations shown in T5Luke's post I mentioned previously

It is 6 bytes in BCD. No need to desolder if you do what T5Luke did. Back in years I desoldered the chip, because I have a programmer and it was the easiest.

OK, 4-bit-BCD encoded 6 bytes value => 12 decimal digits.
Tell me if this would be right:
1) following values at 0x4000 or 0x6000: 06 36 22 17 36 76
2) byte-swap: 36 06 17 22 76 36
3) PIN: 360617227636

[vtl]

OK, 4-bit-BCD encoded 6 bytes value => 12 decimal digits.
Tell me if this would be right:
1) following values at 0x4000 or 0x6000: 06 36 22 17 36 76
2) byte-swap: 36 06 17 22 76 36
3) PIN: 360617227636

Yes.

[sanjurjo]

OK, 4-bit-BCD encoded 6 bytes value => 12 decimal digits.
Tell me if this would be right:
1) following values at 0x4000 or 0x6000: 06 36 22 17 36 76
2) byte-swap: 36 06 17 22 76 36
3) PIN: 360617227636

Yes.

Very helpful. Thank you very much

[BlackBart]

Do you guys realize there are 339 pages of people swapping their CEM's.

[vtl]

Do you guys realize there are 339 pages of people swapping their CEM's.

Here, yes. Perhaps in order of magnitude more in other places and languages

[dikidera]

Not super beautiful setup, but I have soldered jumper cables in-circuit to a backup Denso ECU's 93C56 EEPROM and connected to Arduino to read EEPROM.

semi-successful dump! I need to pull-down the GND pin to get x8 ordering as my library is expecting that.

After getting a reasonable 256 byte dump I shall attempt to dump the EEPROM from my car's Denso 93C56 and write to the test ECU, which is 1:1 to mine down to the last part number digit. Then I will copy over Sh7055 ROM and Flash to the test ECU and install in my car. Goal is to get a working VVT as the traces are damaged to the PWM/Injection driver IC.

I am not expecting much issues. The procedure should be non-destructible as the original ECU will still work. The only thing is while my SBL can read/write to the SH7055 internal ROM, I have never actually attempted this before. If the SH7055 internal rom is 1:1 to mine I will obviously not attempt writing, just the maps(which I have heavily modified for my car)

Addendum: This is much more difficult than I thought.

This is a 93c56 dump I found online, and it is specifically for a bifuel model such as mine


And this is what I managed to read from a donor bifuel Denso ECM



I would say they match up more or less. If there is a difference, I would say endianness

For anyone interested in reading Volvo Denso 93C56 using Arduino in-circuit I recommend this library https://github.com/tim0s/MicrowireEEPROM/tree/master

The 93C56 has left the ORG pin unconnected as such it operates in x16 organization

[sanjurjo]

Do you guys realize there are 339 pages of people swapping their CEM's.

I see here a lot of potential for many more people and pages!

[dikidera]

Good news everyone. The ROM on my replacement ECU is 1:1 to the one from my own S60's Denso ECM which means I dont have to reflash the SH7055 ROM.

I have also successfully read my car's EEPROM and transferred the contents to the replacement ECM. Since the ROM is 1:1 match I will only flash the maps(since they are heavily modified for myself) on chip 29LV200BC and be on my merry way with a working VVT. This is of course if I have truly managed to read the 93C56 correctly and transfer to contents correctly to the new ECM's 93C56. I am confident it is correct, but still, sometimes we can be surprised.

Addendum: Bad news. I made a mistake. Upon diffing the two roms I failed to see that I compared two identical dumps as in the same file. Upon flashing my maps to 29LV200BC chip the ECM stopped responding because of mismatch between SH7055 ROM and maps(flash chip). So now I have to rescue the 29LV200BC chip aka my replacement ECM is bricked. Luckily my original ECM is intact, thus the damage is minimal.
Now I have to solder many wires to 29lv200bc chip and find and modify an existing Arduino sketch to write back the old data to the flash chip AND then re-do everything by flashing the SH7055 rom. Sigh, if only I had been more careful.

My Arduino mega has all necessary pins without a shift register, however the biggest issue is logic levels. The address/data pins can function at no more than 4.0v max, whereas the digital pins are 5v on the Arduino.