Vida CEM swapping

[scaro]

Cemcracker get 6byte Cem 04b ->
Cemtool old p2 Cem-"B" 99->04a
UDSread with 3byte Cem 2006->
UDSread with 6byte Cem 2006->
UDScrack get 3byte Cem 2006->

This is what i think the programs is for but could be wrong

As said, want to get the data out of mcu try to decrypt eeprom

UDS pin is not real pin. You can’t read with this version of UDSread. Use version for real pin.

Tried UDSread with 6byte, is there another? I got the 6byte with Teensy (cemcracker says correct one). Know i have early 2005 CEM-L and it could be without UDS or its needed more connections for it to work.

I'm really interested in whether it's possible to implement a timing attack via dice

Think Dice will not do timing attack because its to slow??

[vtl]

I'm really interested in whether it's possible to implement a timing attack via dice

No, it's too slow. The cracker hw senses voltage level transitions on CAN wire directly.

[Treur]

I'm really interested in whether it's possible to implement a timing attack via dice

No, it's too slow. The cracker hw senses voltage level transitions on CAN wire directly.

It's interesting that Smok can. True, it works with its own cable, and somehow I doubt that they implemented this at the cable firmware level.

[vtl]

It's interesting that Smok can. True, it works with its own cable, and somehow I doubt that they implemented this at the cable firmware level.

When T5Luke and I started the project in 2020 there was no one cracking the pin via timing attack. Shortly after we opensourced the code and schematics, they suddenly all got it working. Draw the lines between points yourself

[Treur]

It's interesting that Smok can. True, it works with its own cable, and somehow I doubt that they implemented this at the cable firmware level.

When T5Luke and I started the project in 2020 there was no one cracking the pin via timing attack. Shortly after we opensourced the code and schematics, they suddenly all got it working. Draw the lines between points yourself

Well, this is not news, I know this very well. That is why I do not disclose my developments to strangers. I can help a smart person, but nothing more.

I also partially used your developments for searching for pins on the p3 platform by rewriting the function in C#, but you showed me the function itself personally on Drive2

[vtl]

Well, this is not news, I know this very well. That is why I do not disclose my developments to strangers. I can help a smart person, but nothing more.

I also partially used your developments for searching for pins on the p3 platform by rewriting the function in C#, but you showed me the function itself personally on Drive2

I have no problem with open source been doing it all my life. Knowledge and work sharing is the way to go for humanity.

[Treur]

Maybe yes, maybe not. That's philosophy.

Not all information can be shared. For example, if you share information about immobilizers, be prepared for guys in uniform to come to you and change your place of residence.

[Treur]

I'm really interested in whether it's possible to implement a timing attack via dice

No, it's too slow. The cracker hw senses voltage level transitions on CAN wire directly.

is the problem only in speed?

[vtl]

is the problem only in speed?

Anything doing timing attack needs to measure time between last bit sent and the first bit received, without internal buffering, etc. I don't know if DiCE is capable of precise timestamping that may constitute for missing CAN-L sensing that cracker has.

[Treur]

is the problem only in speed?

Anything doing timing attack needs to measure time between last bit sent and the first bit received, without internal buffering, etc. I don't know if DiCE is capable of precise timestamping that may constitute for missing CAN-L sensing that cracker has.

This is where things get more complicated. It is possible to measure only between the moment a message is sent to USB and the response from the receive buffer. I tried, and the numbers are in parrots. The response to the same request is ~950-1400ns. And this is in the range from μ to -2σ

So far I have only one idiotic idea in my head - to add the j2534 protocol to your cracker.