Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
mikeak2001
Posts: 29
Joined: 30 March 2021
Year and Model: S70 1998 T5
Location: Wales
Has thanked: 3 times
Been thanked: 28 times

Re: Vida CEM swapping

Post by mikeak2001 »

Hi All,
Haven't been on for a while, lifes been keeping me very busy.
I want to open up the question of "what pin codes have people found, especially default ones stored in eeproms or standard keys used with P1/P3/SPA/CMA vehicles?"
Some attached below, but i've blanked them for now.
I'm not to bothered about peoples individual CEM codes, we have the cracker for that.
Maybe we could set up a shared database?

I have taken quite a few out, Admins please delete if this breaks any rules. I'm not too sure.

Code: Select all

id |code      |description                            |
---+----------+---------------------------------------+
  1|F********F|Send key                               |
  2|F********F|MECU key                               |
  4|F********F|MECU key                               |
  5|F********F|Immo PIN code                          |
  6|0********0|ECM Cruice Control PIN-code EDC15C     |
  7|F********F|Melco 2 Immobilizer PIN code           |
  8|F********F|Melco 2 Cruisecontrol PIN code         |
  9|0********0|Remote PIN code                        |
 10|0********F|Remote PIN code                        |
 14|A********B|UEM PIN code                           |
 15|F********F|Remote identity code #1                |
 21|0********F|SEED code remote #1                    |
 33|F********F|MECU Key code, Y2                      |
 45|F********F|KVM KEY, Y2                            |
 60|F********F|CEM PIN code, Y2                       |
 69|1********3|DDM, Y2                                |
 70|4********4|DEM, Y2                                |
 71|1********1|DIM, Y2                                |
 72|1********4|EPB, Y2                                |
 73|A********5|FSM, Y2                                |
 74|0********5|HCM, Y2                                |
 75|4********F|HLDF, Y2                               |
 86|3********5|PHM, Y2                                |
 87|4********D|TCM F21, Y2                            |
 88|1********6|TRM, Y2                                |
 89|A********E|AUU, Y2                                |
 90|5********F|POT, Y2                                |
 91|1********3|PDM, Y2                                |
 92|3********4|ECM, Read memory by address, Y2        |
 93|1********7|ECM, Vehicle speed limitation, Y2      |
 94|5********4|ECM, Other functionality, Y2           |
 95|0********9|CEM, Other functionality, Y2           |
 96|4********1|CPM, Y2                                |
104|F********F|TCM, 20V8/SI6                          |
105|F********F|CEM, 20V8/SI6                          |
106|F********F|SUM, 20V8/SI6                          |
107|5********8|SODL, Y2                               |
108|5********8|SODR, Y2                               |
109|4********1|TCM MPS6, Y2                           |
110|5********4|ECM Denso, Vehicle speed limitation    |
111|2********6|ECM Siemens, Vehicle speed limitation  |
112|4********5|ECM Visteon, Vehicle speed limitation  |
129|F********F|Immo PIN code, P2 GGD                  |
130|1********6|ECM Conti, Vehicle speed limitation    |
132|F********F|BECM SWDL Key                          |
133|4********1|IEM SWDL Key                           |
134|4********1|IGM SWDL Key                           |
141|4********2|BCM, Y2, Fixed Key.                    |
142|F********F|BECM SWDL Key, Fixed Key.              |
143|3********5|BPM, Y2, Fixed Key.                    |
144|4********1|CCM, Y2, Fixed Key.                    |
153|4********F|HLDF, Y2, Fixed Key.                   |
154|0********E|IAM, Y2, Fixed Key.                    |
155|F********F|ICM, Y2, Fixed Key.                    |
158|4********4|MMM, Y2, Fixed Key.                    |
160|4********4|PAC, Y2, Fixed Key.                    |
161|D********6|PAM, Y2, Fixed Key.                    |
162|1********3|PDM, Y2, Fixed Key.                    |
163|3********5|PHM, Y2, Fixed Key.                    |
175|5********3|SUM, Y2, Fixed Key.                    |
176|4********D|TCM F21, Y2, Fixed Key.                |
177|4********1|TCM MPS6, Y2, Fixed Key.               |
178|1********6|TRM, Y2, Fixed Key.                    |
194|4********5|OBC, ReadMemoryByAddress               |
195|4********5|DDM, SPA, Other Services               |
196|4********5|PDM, SPA, Other Services               |
197|4********1|IHU SWDL Key, Default Key.             |
198|5********1|SWM, SPA, SWDL Key, Default Key.       |
199|5********1|TRM, SPA, SWDL Key, Default Key.       |
200|5********1|SAS, SPA, SWDL Key                     |
211|4********1|AEMM, SPA, SWDL Key                    |
212|5********5|RML, SPA, Other Services               |
213|5********5|RMR, SPA, Other Services               |
220|5********5|SRS, SPA, Other Services               |
221|5********1|SRS, SPA, VCC Development diagnostics  |
222|5********3|SRS, SPA, Supplier diagnostics.        |
224|4********1|DIM, SPA, SWDL Key                     |
232|5********1|POT, SPA, SWDL Key                     |
233|5********1|PSMD, SPA, SWDL Key                    |
234|5********1|PSMP, SPA, SWDL Key                    |
235|5********1|WAM, SPA, SWDL Constant                |
236|5********5|WAM, SPA, Other Services               |
237|4********1|DEM, SPA, SWDL Constant                |
245|4********1|AUD, SPA. SWDL Constant                |
264|4********1|BECM, SPA, SWDL Key                    |

rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

Codes newer than found in 2014D could be nice to have.

al1Volvo
Posts: 34
Joined: 22 March 2024
Year and Model: Volvo V50 2011
Location: France
Has thanked: 3 times
Been thanked: 13 times

Post by al1Volvo »

Dear all,

Many thanks for your work and for sharing your knowledge !
Like some users on this forum, I tried the cem cracker on a Volvo V50 2011 (CEM 31327215) using VP230 as CAN transceiver and a Teensy 4.0.
Unfortunately, without success. I have tried with and without the clock line set to 180MHz. I've got 3 different first pin all the time.

Any idea why ?

I followed the main schematic on the github page.
No 120 Ohms Terminator on my transceiver side.
I use external DC-DC Bulk converter connected to 12V OBD, VIN to USB line cutted on Teensy.

Code: Select all

Part Number: 31327215
Searching P/N 31327215 in 50 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 2 4 5 0 3 1
CAN high-speed init done.
Putting all ECUs into programming mode.
CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50 on CAN_HS
CAN_HS ---> ID=000ffffe data=50 88 00 00 00 00 00 00
CAN_HS <--- ID=00000003 data=50 8e 00 00 31 32 72 15
Part Number: 31327215
Initialization done.
----
1000 pins in 570 ms, 1754 pins/s, average response: 22 us, histogram 11 to 33 us 
range 100, samples 10
candidates short list: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49  (+ 50 more)

                   us:    14    15    16    17    18    19    20    21    22    23    24    25    26    27    28    29    30    31    32    33 
[ 00 -- -- -- -- -- ]:     0     0     0     0     0     0     0   258   742     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21742; std 154.06
[ 01 -- -- -- -- -- ]:     0     0     0     0     0     0     0   225   695     0     0     0     0     0     0     0     0     0     0 964969020 : latency      20895; std 142.63
[ 02 -- -- -- -- -- ]:     0     0     0     0     0     0     0   261   616     0     0     0     0     0     0     0     0     0     0 964969020 : latency      20386; std 129.72
[ 03 -- -- -- -- -- ]:     0     0     0     0     0     0     0   334   666     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21666; std 144.62
[ 04 -- -- -- -- -- ]:     0     0     0     0     0     0     0   316   684     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21684; std 146.58
[ 05 -- -- -- -- -- ]:     0     0     0     0     0     0     0   314   686     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21686; std 146.81
[ 06 -- -- -- -- -- ]:     0     0     0     0     0     0     0   323   677     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21677; std 145.80
[ 07 -- -- -- -- -- ]:     0     0     0     0     0     0     0   320   680     0     0     0     0     0     0     0     0     0     0 964969020 : latency      21680; std 146.13
----
pin[2] choose candidate: 10
Candidate PIN 27 34 10 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 570 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 1842.50 seconds
done
Resetting all ECUs.
----
----
pin[2] choose candidate: 78
Candidate PIN 09 30 78 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 569 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 1845.51 seconds
done
Resetting all ECUs.
Can you help me please ?
20240322_115004.jpg
20240322_115004.jpg (320.77 KiB) Viewed 1833 times
20240322_115011.jpg
20240322_115011.jpg (298.95 KiB) Viewed 1833 times

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

al1Volvo wrote: 22 Mar 2024, 05:14 Dear all,

Many thanks for your work and for sharing your knowledge !
Like some users on this forum, I tried the cem cracker on a Volvo V50 2011 (CEM 31327215) using VP230 as CAN transceiver and a Teensy 4.0.
Unfortunately, without success. I have tried with and without the clock line set to 180MHz. I've got 3 different first pin all the time.

Any idea why ?
Christian's one_pass branch seems to be better with P1: https://github.com/cmolson/volvo-cem-cr ... e/one_pass

No need to cut anything on Teensy, it switches to external power automatically.

al1Volvo
Posts: 34
Joined: 22 March 2024
Year and Model: Volvo V50 2011
Location: France
Has thanked: 3 times
Been thanked: 13 times

Post by al1Volvo »

Thank you vtl for you reply, I will give it a try.

tsigane
Posts: 3
Joined: 6 May 2021
Year and Model: V50 '08 B5244S5 AW55
Location: Moscow

Post by tsigane »

al1Volvo wrote: 22 Mar 2024, 05:21 Thank you vtl for you reply, I will give it a try.
Write the VIN of your car, it’s possible in private messages, I think I know what the problem might be

al1Volvo
Posts: 34
Joined: 22 March 2024
Year and Model: Volvo V50 2011
Location: France
Has thanked: 3 times
Been thanked: 13 times

Post by al1Volvo »

Just succeed with Christian's branch !

Code: Select all

pin[2] choose candidate: 36
Candidate PIN 57 30 36 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 2012 seconds
Progress: 0%..done

found PIN: ** ** 57 ** 30 36
PIN is cracked in 602.38 seconds
Validating PIN
PIN verified.
done
Resetting all ECUs.
Do you know what tool should I use now to get a dump of the flash to edit the car config please ? using OBD if possible.
I saw the CEM config tool from T5Like but it seems to be dedicated to P2, is it right ?

Again many thanks for your great work !

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

Well after a while of soldering, programming and testing I finally managed to read the 29LV200bc chip on my test ECM. I am getting at times a few flipped bits, likely from crosstalk but not often. So far reads are 99-100% correct.

However because of the very long wires I believe it takes much longer for voltages to settle and because of that I have to introduce several millisecond delays between each address read resulting in half hour dumps. Still better than nothing

As soon as I complete all code changes to also erase and write the chip I will do all these mods to the actual bricked ECM and restore it to be reflashed once more.

The hw and software changes in Arduino mega were installing a 3.3v regulator for CMOS logic levels and downclocking the device to 8mhz. This means I could altogether avoid logic level shifters of which I would've needed several as the 29lv chip is not serially shifted for data and addresses and needs all pins connected.

Scoloo
Posts: 11
Joined: 24 March 2024
Year and Model: 2005 v70
Location: Under the hood
Has thanked: 1 time
Been thanked: 7 times

Post by Scoloo »

First of all, big thanks for the hard work everyone putted in this project. I don't have any programming knowledge but I have automotive knowledge (I'm a mechanic).

With the help from your beautiful project I accomplished to clone a damaged CEM for a customer what saved him a ton of money (and gave me some more knowledge =D)

Now, for the future, I like to turn my breadboard frankenstein creature into a nice solid piece with a LED screen. With a the info here that wouldn't be a problem.

Here is my question, I understand now a little bit how everything works. Also that for P3 I need to load my teensy with the other branch. But how is it possible that modunlock (who get the info from here) gets everything (p1, p2 and p3) from 1 device?

When I gonna build my device I'm gonna build another one for a friend of mine and I don't have any commercial meanings with the project but its just curiosity.

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

Scoloo wrote: 24 Mar 2024, 09:43 First of all, big thanks for the hard work everyone putted in this project. I don't have any programming knowledge but I have automotive knowledge (I'm a mechanic).

With the help from your beautiful project I accomplished to clone a damaged CEM for a customer what saved him a ton of money (and gave me some more knowledge =D)

Now, for the future, I like to turn my breadboard frankenstein creature into a nice solid piece with a LED screen. With a the info here that wouldn't be a problem.

Here is my question, I understand now a little bit how everything works. Also that for P3 I need to load my teensy with the other branch. But how is it possible that modunlock (who get the info from here) gets everything (p1, p2 and p3) from 1 device?

When I gonna build my device I'm gonna build another one for a friend of mine and I don't have any commercial meanings with the project but its just curiosity.
if (p1) { use p1 branch}
else if(p2) {use p2 branch};

To sum it up and ELI5 it.

Post Reply
  • Similar Topics
    Replies
    Views
    Last post