Vida CEM swapping

[ricked]

Hi,

Is there anybody here who have a dump from both MCU (flash and eeprom) of a P1 CEM ref 31327215 please ?
I erased the left chip while doing some test and didn't backed up it before ...
It is not my CAR CEM, just a bench testing CEM, so no drama if you don't have it.

From what I found for now, both MCU are masked 1L15Y MC9S12XDT384MAL, left one at 4MHz, right one at 8MHz.
I tried first to read it with OSBM and true time debugger from codewarrior but it erased the left one while unsecuring it. Then I bought a R270 programmer that could read both chip nicely.

Car configuration seems to be at @7C100 on chip2 (right).

Thanks for the help !

you can not reprog a other mcu file for the fact that in boot of these mcus are sync codes between mcu and mcu 2 and to car
also these are "not" secured if someone never did mess with it before

[al1Volvo]

That's why I asked for both MCU, and regarding the sync between CEM and CAR, my next goal when my CEM will work nicely again will be to do real time debugging on it and check where are checked those sync and how.
The CEM is still working but partially, It power up, respond to some CAN messages but send a system error over the CAN.
It even drive the starter relay when the key is in start engine position.

The bootloader was dumped with the entire FLASH (and EEPROM) right ? If yes writing back both files from the same CEM to another would be just like a cloning right ?

[ricked]

so.. what you whant to do with other files? these have start data/config from other car
if you connect other cem with incorrect data your car will be dead

[al1Volvo]

The CEM is on bench test, it will never be connected to a car, I only make some research on it using debugger.
The files will only serve to make it work normally again !

By the what do you mean by "your car is dead" ? Other ECU will do into a locking mode ?

[xanthefin]

Question for everyone. What info do you know is stored in the CEM?
For now I know where VIN, Keys, Crypt Key, ECM Sync and PIN is. I am making a tool to make it easy to change any of these elements when you already have a CEM dump.

I am fairly certain there is a mileage stored as well as checksums for at least the ECM programming. Sorry, I would love to know where and I would be very happy to use your tool so I am looking forward to a release, but can't help you more than that right now.

Please support as many CEMs as possible since it is prohibitly expensive for the older cars (and it will be for the more modern ones when they age and devaluate more) to go to a dealer for a CEM replacement once they fail. I realize people currently make money providing this service but we will need a "stone soup" approach for these cars to remain driven in numbers that make commercial support by these people viable. No use sitting on a secret for a platform that isn't on the road anymore, there will always be people preferring a professional to handle something like a CEM replacement instead of doing a DIY.

Definitely! I will try to support the newer CEMs as well. But, right now, there is a lot of research that are still needs to be doing. I am more than happy to pay (a reasonable fee of course) to someone who can tell me more info about the data in these CEMs.

I think i wont see sense just keep this for me but the nasty guys propably does or not know of this as well.
Last years CEM bricks software did upgrade 2003 and 2004 and there was odometer saved now in CEM as well and not just pull info directly from DIM.

Location for .. KILOMETERS
0x0592D - F

Just translate directly hex to decimal and tadaa.

[ricked]

The CEM is on bench test, it will never be connected to a car, I only make some research on it using debugger.
The files will only serve to make it work normally again !

20240524_150200.jpg

By the what do you mean by "your car is dead" ? Other ECU will do into a locking mode ?

for one you cant use the key anymore, if you physically put a other cem in a car that dont belongs to it nothing works

anyway here is file set

31327215 2x 384 mcu.rar

(276.3 KiB) Downloaded 74 times

[duzi]

31327215_ 2x1L15Y

beat me by a few minutes
-----------------------------------------
add:
But what about the spa platform..
there are a couple of dumps with known pin codes, but their location in the flash is not clear.. does anyone have an understanding of this

[al1Volvo]

The CEM is on bench test, it will never be connected to a car, I only make some research on it using debugger.
The files will only serve to make it work normally again !

20240524_150200.jpg

By the what do you mean by "your car is dead" ? Other ECU will do into a locking mode ?

for one you cant use the key anymore, if you physically put a other cem in a car that dont belongs to it nothing works

anyway here is file set

31327215 2x 384 mcu.rar

One my bench pictured the key already come from another car, I don't have the CEM associated to this key, that's a point I'll try to figure out later. Many thanks for the files, you made my day !

[al1Volvo]

31327215_ 2x1L15Y

beat me by a few minutes

Many thanks !!

[dikidera]

I decided to put aside the Denso ECM and look at the Temic TCM, since we all want to change our transmission shifting strategy.

Well firstly I decided to look at my bifuel binary once more and saw that...the QuickShiftMode is entirely firmware disabled, the code isn't there to process it.

They store the state of the shifter from LINBUS, including gear shift request(when shifter is in M position and either + or - request), but beyond that the variable is never accessed for shift calculation. It could be accessed indirectly, but if it is it would be difficult to find. This is a bummer since I expected a shifter retrofit to enable this functionality, but code speaks a thousand words.

I wonder if there were any 170hp NA versions with the manual shifting. If so only a compatible TCM with firmware can enable this.