Vida CEM swapping

[scaro]

Here this is minimum connection to CEM on bench.



On D connector:
Green: HS CAN-L to pin 14 OBD
White: HS CAN-H to pin 6 OBD

Grey (pin 6 ): GND
Yellow (pin 8 ): +12V
Blue (pin 15 ): +12V

Also it needs +12V on the both big connectors (big green power socket)

I just have 1 x 100 Ohm between both can lines, on bench, that is enough for me...

Pin 8 and 15 in this pic a belive is for key pos. 1&2

Guys, is there some diagram how to connect teensy to CEM 30765643 on the bench?

I used only these pins to crack with Teensy:
Pin 48 (OBD14) and 33(OBD6) as HS can (120ohm)
Pin 55 (OBD11) and 40(OBD3) as LS can (120ohm)
Pin 6 (OBD4-5) GND
2 big pins on other side to +12V

[danthe88]

Tnx, I will try for the weekend, I have tried using OBD but after decoding first 3 bytes it failed to bruteforce the rest... I don't have a garage so I will have to remove CEM and to let it run for 24hrs or so...

[rkam]

So far I have only one idiotic idea in my head - to add the j2534 protocol to your cracker.

J2534 is pass-through, nothing fancy. I use it in a similar hw: https://github.com/vtl/volvo-ddd And there's a "teensy" branch. And the PCB https://oshwlab.com/v.mayatskih/volvo-ddd2_copy which looks somewhat similar to the cracker. Adding J2534 support is mostly writing a driver for OS of your choice.

J2534 is not just driver. The device must process driver commands.

But I don't think it's don't worth it. If we need a real PIN so much, we can use dice to find a PIN by UDS, download SBL, download flash and get it. The question is - why do we need it if we can already log in by UDS!?)))

P.S. How can I access this forum by PC? Cloudflare can't check me)))

As VTL mentioned, J2534 is the communication protocol between a software application and a driver. The communication between the driver and the interface can be whatever the hardware designer wants.

Some time ago Olaf started making a driver to use an Arduino as a J2534 device in Vida. Since I already had a Lawicel CANUSB, he started using the Lawicel protocol between the device and the driver. This way the same driver could be used for the Arduino and the Lawicel.

https://github.com/hackingvolvo/SardineCAN-Win32

[dikidera]

rkam, do you personally know Olaf or perhaps know why he disappeared? He was my inspiration to make my own tools, maybe even the catalyst to start digging into the cars.

In the late 2022 I started making my own version of Sardine-can to support ethernet proxy between RPI and VIDA. I dropped the project due to timing constraints(VIDA has a 60ms timeout).

[vtl]

Same for Olaf. Sardine-can was a lot of inspiration.

[rkam]

Sadly, the last email I got from him was mid january 2013.
I only knew him as Olaf.

[Treur]

J2534 is pass-through, nothing fancy. I use it in a similar hw: https://github.com/vtl/volvo-ddd And there's a "teensy" branch. And the PCB https://oshwlab.com/v.mayatskih/volvo-ddd2_copy which looks somewhat similar to the cracker. Adding J2534 support is mostly writing a driver for OS of your choice.

J2534 is not just driver. The device must process driver commands.

But I don't think it's don't worth it. If we need a real PIN so much, we can use dice to find a PIN by UDS, download SBL, download flash and get it. The question is - why do we need it if we can already log in by UDS!?)))

P.S. How can I access this forum by PC? Cloudflare can't check me)))

As VTL mentioned, J2534 is the communication protocol between a software application and a driver. The communication between the driver and the interface can be whatever the hardware designer wants.

Some time ago Olaf started making a driver to use an Arduino as a J2534 device in Vida. Since I already had a Lawicel CANUSB, he started using the Lawicel protocol between the device and the driver. This way the same driver could be used for the Arduino and the Lawicel.

https://github.com/hackingvolvo/SardineCAN-Win32

What does Lawicel have to do with it? It's a primitive protocol based on AT commands. I used to program Volvo units with a homemade cable on Atmega8 with this protocol.

[rkam]

What does Lawicel have to do with it?

I could have used Kvaser or Peak Can as example, but I chose Lawicel because:

It's a primitive protocol based on AT commands.

And I do not fully agree with your comment below:

J2534 is not just driver. The device must process driver commands.

Yes, the device must process driver commands, but they do not have to be J2534 commands.
They can be Lawicel commands or other commands over serial, bluetooth (serial), USB, TCP or something else.

[scaro]

I managed to read the older CEML with M30835FJ using TTL and FDT4.09. But the flash is corrupt (not from the reading)
Parts with logincode, encryptioncode, Vin and config is intact in flash it looks like.
Think its the only thing that needs transfering to a working flash?
External EEprom is also corrupt it has loosen part with keys and sync.

Someone have a flash from a CEML with number 30728356 to share? Or both Flash and xEeprom.

[scaro]

The Flash isnt corrupted as i stated before. I have got some to compare with and looks good.
The "only" thing now is to fix the sync and keys in xEeprom.

Want to thank you that sent me files to compare with, you know who you are.