Vida CEM swapping

[dikidera]

@vtl

If we need a Teensy with fast clocks to detect CAN line jitter and side channel brute force the pin for CEM. How can VDASH do the same with a simple Mongoose JLR?

MY2006+ supports UDS.

So my P2 MY2005 (facelift) is excluded?

[vtl]

So my P2 MY2005 (facelift) is excluded?

My P2 MY2005 as well

[Treur]

Hi friends. Can anyone help with SBL files for P2 and P3 platforms. I need for CEM, BCM P2 and all for P3. If anyone can help, I promise not to distribute.

For what do you need them if you mind me asking?

To read and write modules.

[Treur]

@vtl

If we need a Teensy with fast clocks to detect CAN line jitter and side channel brute force the pin for CEM. How can VDASH do the same with a simple Mongoose JLR?

MY2006+ supports UDS.

5 bytes via UDS?))) tryied, 1pin/s, can’t faster (dice, skanmatic, Mongoose)

[V70user]

According to a post below
viewtopic.php?p=609357#p609357

I can confirm that T5Luke's method works. Tested with Arduino Uno and Nano. Both read CEM flash without errors. Because CEM cracker still doesn't crack Brick CEMs so...
I tried it on three brick shape CEMs:
1- CEM 8645171 - 2000MY 07week
2- CEM 8645171 - 2000MY 11week
3- CEM 8688434 - 2002MY 36week

I used 12v from power supply. 12V connected to CEM pins as showed at picture and as an external power to Arduino. Ground from CEM and Arduino connected together.

In cases 1 and 2 You have to connect 5 wires. I used a sharp probing needles and scratched delicately connecting points on CEM's pcb
.

20241119_203815_A.jpg (199.83 KiB) Viewed 365 times

20241119_204746_A.jpg (197.21 KiB) Viewed 365 times

The whole readout takes 6 minutes. After this You can copy the entire readout and using for example HxD program create a new file with .bin extension and paste this readout.
Both CEMs 1 & 2 have PIN at 0x4000 therefore if You are going to use CEMTool , You have to copy this PIN and for CEMTool needs
paste it at 0x6000, otherwise CEMTool will show wrong PIN, because program search PIN at 0x6000.
.

CEM_8645171_SWD_PIN_A.jpg (37.32 KiB) Viewed 365 times

.

CEM_8645171_PIN0x6000.JPG (40.3 KiB) Viewed 365 times

.
In case 3 You have to connect only 4 wires (without RESET), otherwise the flash memory won't be read. Maybe it is only at that CEM, but it was read this way.
.

20241121_143223_A.jpg (130.38 KiB) Viewed 288 times

.
In this CEM (2002MY 36week) PIN is placed at 0x6000 so there is no need to changing anything

And a cherry at the top of the cake
.

CEM_8645171_SWD_write.jpg (124.76 KiB) Viewed 365 times

.
Changes were made and have been successfully written back to CEM's flash memory.

Thank You all guys, and special thanks to T5Luke for his effort put in this project

[shxc]

Has anyone successfully made changes to CEM (L-shaped) flash memory on a MY2007? Any help would be greatly appreciated!

[Dudde]

Has anyone successfully made changes to CEM (L-shaped) flash memory on a MY2007? Any help would be greatly appreciated!

What do you need help with?

[shxc]

Has anyone successfully made changes to CEM (L-shaped) flash memory on a MY2007? Any help would be greatly appreciated!

What do you need help with?

Basically, I want to modify some configurations in the CEM, such as adding a sound amplifier. From what I understand, all information about configuration parameters should be available in the VIDA database.

Currently, I lack the knowledge of how to:

1. Read the flash memory for that specific CEM.
2. Correctly hex-edit the configuration (I’ve read that the configuration starts at the 8100 offset).
3. Write the updated flash back to the CEM.

Thanks.

[wxp73]

Both CEMs 1 & 2 have PIN at 0x4000

In my CEM at 0x4000 I have FFFFFFFFFFFF, so I need to copy that in 0x6000?

[vtl]

Both CEMs 1 & 2 have PIN at 0x4000

In my CEM at 0x4000 I have FFFFFFFFFFFF, so I need to copy that in 0x6000?

Brick CEM has pin either at offset 0x4000 or 0x6000. Yours is at 0x6000. Don't forget your dump can be byte swapped or not, depending on how your read it. Plus regular shuffle.