Vida CEM swapping

[vtl]

I don't know what the CEM prices are in your country but overhere they're like €1000 excl vat.

When I started in 2020 a new CEM installed by dealer was $1600 + tax + a couple of hours at $270/h rate + cost of software reload, which is like $100.

[Scoloo]

Jup, ridiculously high in my opinion. If I need a bsi for psa (almost the same) it's like €250.

[dikidera]

Thanks to rkam I managed to revive my bricked ECM.

I have a question about IMMO. My replacement ECM's software is slightly newer than my original ECM, I was thinking of using it as-is IF the CAN signal configuration is the same(and other things too; a software diff will tell me as much).
I have copied over the entire 93c56 EEPROM contents from my original ECM to the replacement ECM. I didn't give it much thought but is this the correct procedure or should I have only copied over the mileage and immo sync data? If I did ROM+maps+immo this would 100% be the correct solution. But maybe the EEPROM is storing other data maybe related to the software?

UPDATE:
Well this is unrelated but by diffing the two roms I discovered accidentally more information about where the ECU's ID is stored and furthermore additional information on how IDs are formulated.
The IDs as stored in Denso look like this

406C020A
402A0608

The parts 406c and 402a exist in the lowest significant bytes. But 020a and 0608 are important. They are equivalent to (020A >> 3) but sometimes with +1 or -1

So 406C020A == 0042406C (20a >> 3) + 1
402A0608 == 00C0402A (608 >> 3) - 1

00014 | 00224024 | 18 48 02 00 1B FF 00 00 .H......
00009 | 0042406C | 40 88 00 00 60 00 C0 0F @...`...
00011 | 0062401E | 02 0C 63 CA EA 0B 6C 00 ..c...l.
00008 | 0080401E | 1E 01 82 F2 00 4F 32 00 .....O2.
00768 | 00A20016 | 07 ED 8C 00 00 96 70 00 ......p.
00010 | 00C0402A | 1E 64 00 00 07 4A C7 FF .d...J..
00010 | 00D00022 | 00 00 00 00 00 00 00 00 ........
00013 | 00E24026 | 00 01 60 40 8F 00 00 00 ..`@....
00080 | 01000020 | 00 00 00 01 B0 05 C0 00 ........
00020 | 01600012 | C0 11 8B B0 88 20 4F F9 ..... O.
00012 | 10004002 | 80 00 00 00 C0 00 C0 00 ........
00029 | 10400020 | 40 23 47 60 03 FE 0F 09 @#G`....
00244 | 10600020 | 01 10 51 28 B1 9E FE F5 ..Q(....
00098 | 10800006 | 00 80 00 7F 00 00 00 00 ........
00020 | 10900020 | 03 41 00 13 03 C8 00 00 .A......
00279 | 10A2407C | 20 18 02 01 01 01 01 02 .......
00038 | 10C00002 | 00 00 15 E0 00 00 00 00 ........
00056 | 10E24000 | 00 00 00 00 00 00 00 00 ........
01190 | 11000022 | 01 BB CC 00 00 93 03 FF ........
00048 | 11100024 | 00 00 00 04 7E A4 80 00 ....~...
00120 | 11220028 | 27 40 0F F0 01 44 36 00 '@...D6.
00120 | 11420006 | 00 00 00 0F 00 00 D0 00 ........
00097 | 11600002 | FE 0C 62 ED 00 00 00 00 ..b.....
00097 | 11800002 | 00 00 03 01 00 00 00 00 ........
00149 | 11A00020 | 80 00 C8 00 C2 8D 00 00 ........
00270 | 11C00002 | 00 00 20 00 40 00 00 00 .. .@...
00069 | 11D00022 | 00 00 00 00 02 00 AA AA ........
00072 | 11E00010 | 0B C0 80 00 AA AA 00 00 ........

I realized about the shift possibility due to my interaction with the flash chip and Arduino and browsing various forums and PDFs on how to flash it which were discussing how sometimes addresses are shifted based on how the address line is wired up. It was unrelated but did give me the idea to try shifting by one bit to see where it goes.

[chriskross02]

Hi, i read Delphi CEM with r5f64524 XC60 2013 D-flash and p-flash with i/o terminal, but data in D-flash is encrypted.

is there a way to decrypt it ? anyone can help maybe

thanks

[matija0610]

Hello guys, has anyone experienced any issues when unlocking the CEM in the car? Specifically, the PIN was cracked, desired configuration changed (only Fog light OFF), but afterwards my colleague tells me that the engine is not running as it did before, it's not performing as it used to.
He has tried changing several parts in and around the engine, but there remains a suspicion that something went wrong during the unlocking process.
my plan is check the components with an oscilloscope in the coming days... but let me ask if anyone has had a similar problem so I know what to expect.
I don't have the CEM numbers with me right now, but I think it will be clear: S80(II) D5 2008.

[vtl]

Hello guys, has anyone experienced any issues when unlocking the CEM in the car? Specifically, the PIN was cracked, desired configuration changed (only Fog light OFF), but afterwards my colleague tells me that the engine is not running as it did before, it's not performing as it used to.

Never heard of such problems as a consequence of cracking the CEM pin. The cracker does not do anything special that goes against CAN bus principles of operation. More to say, I'm driving for almost 8 years with a very chatty Arduino module connected to both CAN buses all the time (https://github.com/vtl/volvo-ddd), never experienced any problems.

[matija0610]

Hello guys, has anyone experienced any issues when unlocking the CEM in the car? Specifically, the PIN was cracked, desired configuration changed (only Fog light OFF), but afterwards my colleague tells me that the engine is not running as it did before, it's not performing as it used to.

Never heard of such problems as a consequence of cracking the CEM pin. The cracker does not do anything special that goes against CAN bus principles of operation. More to say, I'm driving for almost 8 years with a very chatty Arduino module connected to both CAN buses all the time (https://github.com/vtl/volvo-ddd), never experienced any problems.

I agree with you. I'm not even sure if the problem started then or coincidentally.
This is the first time I've used SMOK. unfortunately, I didn't use Cracker because I needed a quick solution to modify the configuration.
Usually, I have the flash dump file , and change config block the way I want, calculate the checksum, and it always behaves exactly as I intended.
This is an exception now, because I don't have insight into the dump file, and I don't know what kind of mess SMOK has made or not.
The fact is that the front parking sensors (not fog lamp, mistake in first post) are turned off in the configuration, exactly what I requested from Smoke. I don't believe that something was write incorrectly, I guess chksum would be the problem in that case ?

I went to do a favor for a friend, and it looks like a lot of crap came out after that..
feel sorry for him, he changed and checked a bunch of components, the engine still runs erratically, sometimes it wants to turn off, sometimes it pulls, sometimes it doesn't, when it's cold it shakes , chatters at certain rpm.. friend tells me that it all started in the period, when we were changing the configuration in the CEM.

[al1Volvo]

Are they any error code raising on ECM at the diagnostic ? If the CEM was unplugged, this can be a wrong contact on a connector pin on the CEM.

[matija0610]

nothing that would worry me too much, I think part of it is solved after taking this screenshot..

Screenshot_1.png (109.1 KiB) Viewed 2910 times

I am concerned about the DIM-U210. (DIM doesn't seem very happy with the CEM config block change)
CEM was not removed from the car, I did not remove it, maybe someone did before me.
CEM config change was done via OBD, with the battery charger connected.

[al1Volvo]

Have you already tried to survey all motor's sensor with VIDA (using the vehicle communication on the ECM) ? is the RPM sensor ok ?