Vida CEM swapping

[vtl]

Because of what it says in the code:

Code: Select all

comment out for P2 CEM-L on the bench w/o DIM

I'm sorry, I'm trying to understand.

The cracker was started as P2 2004+ (CEM-L) project.

[Yariy]

Hello! I'm new here. I have a CEM-B(Volvo V70 2003) from which I subtracted the 28F400 and want to change the configuration. The CEMB unit is disassembled. I use the CEMtool program of the respected T5Luke. The program shows the correct configuration and PIN code. I am trying to write the configuration using Dice to CEM-B, which is connected on the table and goes out for diagnostics, but the program responds with "wrong code". The PIN code is located at #6000. The CEMtool PIN code is determined correctly.
What am I doing wrong? Maybe the conditions for allowing access to the "Security access mode" are not met? The unit is connected on the table, but the ECU and the immobilizer antenna with the key are not connected, maybe this is the case? I recorded the CAN Bus parcels over the HS and LS bus. I see the package #000FFFFE 40 BE 12 24 32 38 21 94 from CEMtool to CEMB, what should be the answer?
Sorry for my poor English.

[vtl]

Hello! I'm new here. I have a CEM-B(Volvo V70 2003) from which I subtracted the 28F400 and want to change the configuration. The CEMB unit is disassembled. I use the CEMtool program of the respected T5Luke. The program shows the correct configuration and PIN code. I am trying to write the configuration using Dice to CEM-B, which is connected on the table and goes out for diagnostics, but the program responds with "wrong code". The PIN code is located at #6000. The CEMtool PIN code is determined correctly.
What am I doing wrong? Maybe the conditions for allowing access to the "Security access mode" are not met? The unit is connected on the table, but the ECU and the immobilizer antenna with the key are not connected, maybe this is the case? I recorded the CAN Bus parcels over the HS and LS bus. I see the package #000FFFFE 40 BE 12 24 32 38 21 94 from CEMtool to CEMB, what should be the answer?
Sorry for my poor English.

CEM on the bench needs nothing more to accept pin. What's your 6 bytes of pin code at #6000, and what is your CEM part number? Also when you read the flash chip, did you do byte swap to change endianness?

[Yariy]

CEM_B_XC70_HW08688513_08696035_28F400B5_stend.zip

(234.25 KiB) Downloaded 65 times

Thanks for the reply. Yes, I do swap the large and small sequence numbers, but if I had made a mistake somewhere, the block would not have been diagnosed and the configuration would have been incorrect in CEMtool.

[vtl]

Thanks for the reply. Yes, I do swap the large and small sequence numbers, but if I had made a mistake somewhere, the block would not have been diagnosed and the configuration would have been incorrect in CEMtool.

For you P/N the shuffle order is nr.2 in array:

https://github.com/vtl/volvo-cem-cracke ... er.ino#L96
https://github.com/vtl/volvo-cem-cracke ... 85-L63C102

I.e. 5, 2, 1, 4, 0, 3

Shuffling your pin by hands give this:

Code: Select all

0  1  2  3  4  5  <- shuffle order
24 12 38 32 94 21 <- pin in flash

21 38 12 94 24 32 <- pin to send over CAN

[Yariy]

Thank you very much, I overlooked somewhere, reading this forum, mistakenly thought that the direct order was from 0 to 5. Then it is unclear why CEMtool issues a direct order as in a dump compatible with the order of VIN reflection.

[Yariy]

I figured it out, just CEM-B with HW 8688513 is the only block from CEM-B that has a different order and CEMtool apparently did not take this into account.

[dikidera]

I am curious for input. Remember how I said those overwrites seemed like bugs? What if they are not?



Notice how the code writes r5 to the solenoids flags. But a few instructions later it overwrites it with another flag.

@(r0,r3) means r0[r3] = value

[nikemen]

Almost any digital electric circuit needs a common ground between its parts.

Try it with door open, but without key. With key in position 0, 1 or 2. Remove CEM_PN_AUTODETECT: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14 (in that case you may need to tweak LS/HS speed according to what your vehicle has: https://github.com/vtl/volvo-cem-cracke ... .ino#L1354)

Well, I did that (first commenting the line out, then deleting it). Here's what I got:

Code: Select all

CPU Frequency:           180000000
Execution Rate:          180 cycles/us
PIN bytes to measure:    3
CAN low-speed init done.
CAN high-speed init done.
Putting all ECUs into programming mode.
CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50 on CAN_HS
CAN_HS ---> ID=000ffffe data=50 88 00 00 00 00 00 00
Part Number: 0
Unknown CEM part number 0. Don't know what to do.
Resetting all ECUs.
CAN_HS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00

Would it be any use to go and look for the CEM part number under the dash?
Thanks in advance!

[vtl]

Almost any digital electric circuit needs a common ground between its parts.

Try it with door open, but without key. With key in position 0, 1 or 2. Remove CEM_PN_AUTODETECT: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14 (in that case you may need to tweak LS/HS speed according to what your vehicle has: https://github.com/vtl/volvo-cem-cracke ... .ino#L1354)

Well, I did that (first commenting the line out, then deleting it). Here's what I got:

Code: Select all

CPU Frequency:           180000000
Execution Rate:          180 cycles/us
PIN bytes to measure:    3
CAN low-speed init done.
CAN high-speed init done.
Putting all ECUs into programming mode.
CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50 on CAN_HS
CAN_HS ---> ID=000ffffe data=50 88 00 00 00 00 00 00
Part Number: 0
Unknown CEM part number 0. Don't know what to do.
Resetting all ECUs.
CAN_HS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00

Would it be any use to go and look for the CEM part number under the dash?
Thanks in advance!

Teensy does not see any CAN traffic on the high speed bus. Check your circuit, I guess? The code is supposed to print any CAN message it receives when waiting for the part number response. You should be getting something if hw is right.