Vida CEM swapping

danthe88 · Post by **danthe88** » 27 Nov 2024, 15:18

OK, thank you, I'll try to find non-Chinese

rkam · Post by **rkam** » 28 Nov 2024, 03:41

BRK is 0x00 in Hex, so it is just an empty space.

Treur · Post by **Treur** » 28 Nov 2024, 04:24

Today I tried UDScrack..... Impressive, ~64pin/s, my own software can do 290pin/s. Also tried UDSread - more impressive, memory leak (0 free disk space), read ~128 bytes, then error. Tries to read the whole flash as 1 part.

dikidera · Post by **dikidera** » 29 Nov 2024, 10:17

You said this binary dump sends over a value. Does it send it over CAN ? And if so what CAN ID? And can you also post the value?

Treur · Post by **Treur** » 29 Nov 2024, 13:36

dikidera wrote: ↑29 Nov 2024, 10:17 You said this binary dump sends over a value. Does it send it over CAN ? And if so what CAN ID? And can you also post the value?

I don't think it's a good idea to discuss this in public. Do you have a Telegram?

scaro · Post by **scaro** » 01 Dec 2024, 10:39

Have read but not write anything here for some time. I have a 2005 Cem-L that have lost sync and keys when changed battery. Cracked the pin (works excellent as usual thanks again for that). It has 93LC86 eeprom and a M30835 processor. 93LC86 i can read but not the processor. Read M30855 on bench before but this M30835 dont want to respond as Uart or SPI. Dont think UDSread (Thanks T5Luke) work because its the earlier CEM-L? I have just connected 2xcanbus H/L, ground and 2 big power, maybee its needed more connections for it to work with this program? Is there another way to read it on bench or tru "obd"?

Treur · Post by **Treur** » 01 Dec 2024, 23:33

scaro wrote: ↑01 Dec 2024, 10:39 Have read but not write anything here for some time. I have a 2005 Cem-L that have lost sync and keys when changed battery. Cracked the pin (works excellent as usual thanks again for that). It has 93LC86 eeprom and a M30835 processor. 93LC86 i can read but not the processor. Read M30855 on bench before but this M30835 dont want to respond as Uart or SPI. Dont think UDSread (Thanks T5Luke) work because its the earlier CEM-L? I have just connected 2xcanbus H/L, ground and 2 big power, maybee its needed more connections for it to work with this program? Is there another way to read it on bench or tru "obd"?

For me, UDSread did not read either cem L or cem H. As far as I can see, the reading process in SBL is not organized correctly. Immediately after starting SBL, cem starts giving the entire contents of the flash without requests and checks, in one block.

scaro · Post by **scaro** » 02 Dec 2024, 03:30

Ok thanks, shouldnt it, when its 2006 an upwards anyway? Mine is 2005 4xxxx earlier Cem-L. As i try to say, right now only have it connected as needed when crack password with Teensy. Maybee that is not enough? If it somehow should be possible to read it this way that is. When cracking with teensy relay inside cem "clicks". When trying to read or crack with udstool nothing happens no "click" except programs try to connect. Using 6byte udsread says wrong pin. Two first bytes show 00 00 xx xx xx xx all the others are correct when trying?

Would be nice to read it to get key for eeprom decrypt. As i said i noticed that the sync, keys are gone in file.
Next problem will be decrypt but seen here some info about it will try to make it work.

Treur · Post by **Treur** » 02 Dec 2024, 04:38

UDS pin is not real pin. You can’t read with this version of UDSread. Use version for real pin.

Treur · Post by **Treur** » 02 Dec 2024, 04:53

I'm really interested in whether it's possible to implement a timing attack via dice

Vida CEM swapping

Re: Vida CEM swapping