Vida CEM swapping

[mikeak2001]

Hi all.

Happy new year to you all.

I've been away for a while but not away from the volvo hacking scene.

With the help of this Pin Code retriever I managed to repair a corrupt CEM eeprom and bring the car back to life recently.
The repair needed the use of this teensy project, IOterminal, DHA, DICE and a key programmer.

The vehicle was a V70 2006 with a dreaded "start prevented error on the screen" and a CEM-6C49 DTC,

Would the work help anyone and if I do a write up? should I post it here or start a thread under P2?

[dikidera]

Happy new year to all. I am excited to work on my personal and acquaintance projects once more.

[mikeak2001]

A thread I put up earler in reference to this project and showing what can be done when you start aquiring tools.

viewtopic.php?t=105847

[vtl]

Don't need a flipper, just use an SDR dongle and SDR#. record the audio from the frequency that matches the remote, open it in audacity, zoom all the way in, and decode your 1s and 0s manually.

Thats how I broke direktstart FM remotes 15 years ago.

Cheap pocket oscilloscope works on antenna just as good.

[stevedi]

Don't need a flipper, just use an SDR dongle and SDR#. record the audio from the frequency that matches the remote, open it in audacity, zoom all the way in, and decode your 1s and 0s manually.

Thats how I broke direktstart FM remotes 15 years ago.

Cheap pocket oscilloscope works on antenna just as good.

Just tried my volvo fobs with the oscilloscope, very easy to see the data but with the PSK my scope wont decode, i used my RTLSDR and an app called Universal Radio Hacker, set it to Manchester II, reversed the bits, and the Key ID showed right up. now i can identify my bucket of spare fobs

[dikidera]

Because I made a mistake in reprogramming my ETM, I unfortunately bricked the 2020 model ETM. It may still end up bricked, but at the very least I can attempt to salvage it.

Here are my findings:

The MCU as pictured below is very likely an MC68376 model because it and MC68F375, MC68F396 are the only ones with a TouCAN CAN controller but only the MC68376 fits pin-wise perfectly, the memory is likely an AM29F200 memory or similar.

It is clocked by a 4Mhz crystal that is phase lock looped to achieve 8mhz.

I have potentially identified the BDM pins and as such it *may* be possible to reprogram the ETM. Of course skepticism should be exercised if I have mistaken the pins.

You can see I've marked a via called DSO as it produces a similar output as DSI, since they are both the IFETCH and IPIPE pins.

DSCLK I've not found yet but is essential to clock data and actually enter the processor in BDM mode.


https://i.imgur.com/UnSFSxu.jpeg

The exposed die while making things harder actually helped me in identifying the physical structures of the MCU and equating them to the block diagram(s) I found online, making it much easier to find out the pin positions.

The ETM was bricked after I patched the SBL to be able to delete the bootloader and reflash it with the one from my own ETM, at which point it stopped working. My theory is that the deletion of the bootloader at block 0x2000 actually also deleted block 0x0-0x1FFF where the initial PC and stack were held.

In retrospect it was all in the datasheet and the SBL header.



The memory was likely configured in x8 mode during programming or maybe all the time. Where I assumed it was in x16 mode. In hindsight, the SBL header presented the information, it just didn't ciick until after.

[scaro]

Is it 2020 ETM? Havent take any of them apart. Have a couple old MMs but havnt taken them apart yet. I was just thinking that the chips you talked about is "old". Is these inside really?

I now that i should have files for "upgraded" ETM (Magnetti Marelli) for the Brick P2 somewhere. Upgraded them with SDA long time ago.
Not that it will help you in this case.

[dikidera]

Yes it is a 2020 construction ETM with the fixed contactless sensor from Volvo dealer. I also have a dump of the firmware it had.

And yes it is hard bricked, cannot be recovered unless my experiment works.

[dikidera]

I have created a special custom made fixture to hold custom made probes. Fancy words, in reality the fixture was a prototyping PCB with through-holes and the probes were needles.

I had managed to connect to all 4 important pins, unfortunately two of the pins just couldn't keep permanent contact to the VIAs, owing to the fact that the probes are just regular needles without weight.
The prototyping PCB works wonders as it allows me to maneuver the needles at a slight angle to avoid them touching, however because it is so thin, the movement is excessive.

I believe for v2 of my fixture, I could buy 2 or 3 more PCBs and create sandwich of two to create more rigidity and add some space with another one, about 1cm to limit the amount of play of the needles which themselves need more weight.

On the other hand I managed to control the RESET pin with an Arduino and observe tiny changes in the IPIPE pin, indicating that for a moment, I did reset the ETM processor.

[scaro]

Nice, i use magnetic holder and different pogopins, but usually solder instead. In your case its very small and soldering is a bit more trickier.