Vida CEM swapping

[vtl]

Any internet is fine. The databases are stored on google's servers as PAD, Payload assisted delivery. As such it will download a few files. The diagrams are optional and are around 6.7GBs in size. Any one on a metered plan must pay attention so they are not billed excessively.

I was thinking more about having a VIDA-like diag in good places. And good places have no cellular network.

As soon as the db is downloaded, its all offline. Always on the device regardless of whether you have internet or not. Its just the initial download.
As of now diagnostics dont work, they could nothing prevents us, except...we need a device that can read HiSpeed and LoSpeed can, over wifi or bluetooth that is documented(protocol and stuff), cheap and supports pin switching.
Such devices are CFE(not cheap) and custom devices we use e.g RPI and Teensy(with the appropriate modules).

And K-Line for P2's first couple of years.

[dikidera]

I am very very unfamiliar of K-line.

[LAV70R]

I made a few extra boards and picked up a few additional transceivers if anyone wants to build their own cem tool: https://ebay.io/m/IAtnnn

[dikidera]

I always wondered for my B5244SG engine, why there was a stray P1176 OBD code that did not match one from the VIDA DTC codes.

Turns out P1176 on Bifuel models is actually related to the Stepper Motor for the CNG/LPG installation.

[Arty]

Any internet is fine. The databases are stored on google's servers as PAD, Payload assisted delivery. As such it will download a few files. The diagrams are optional and are around 6.7GBs in size. Any one on a metered plan must pay attention so they are not billed excessively.

I was thinking more about having a VIDA-like diag in good places. And good places have no cellular network.

I finally managed to connect Mongoose to my Android smartphone. I had to completely abandon the driver and control the device via serial, sending binary command packets directly (a pseudo-driver). All of this works without an internet connection. I'd also like to extract various diagnostic commands, but that would take a lot of time.

[mikeak2001]

Hi all,
So my latest system works like a charm.
I've been working on a new sketch which cut's down the time to crack P3 pins.
so far it's working well. a p3 cem taking 4 hours to crack before is now taking less than 30 mins.

if anyone fancies supplying some known good seed/pin/key combo's I can further prove the code before i waste anyone's time releasing it.

[vtl]

Hi all,
So my latest system works like a charm.
I've been working on a new sketch which cut's down the time to crack P3 pins.
so far it's working well. a p3 cem taking 4 hours to crack before is now taking less than 30 mins.

if anyone fancies supplying some known good seed/pin/key combo's I can further prove the code before i waste anyone's time releasing it.

https://github.com/vtl/volvo-cem-cracke ... seed-gen.c

Fairly easy to modify to swipe over 3 bytes in HEX, not BCD.

[mikeak2001]

Fairly easy to modify to swipe over 3 bytes in HEX, not BCD.

Yes it is, but i'm not cycling through all 5 bytes for the collision.
If we set pin[0] and pin[1] in that script we still have 255^3 combinations to check.

My setup reads a seed. With an unknown key, i set pin[0] and pin[1]

I've thrown together an algorithm that doesn't check all 255^3 for pin[2-4]
fully checking al 3 bytes makes 16,581,375 combinations taking roughly 10.5 hours at 440 pins/s.

I eliminate bytes that definitely wouldn't cause a collision leaving roughly 150^3.
totalling 3,375,000 possible collisions cutting the max time down to roughly 3 hours for a full sweep.

Checking 0-99 still gives 100^5 combinations resulting in 10,000,000,000 combinations. If my maths is right.

[vtl]

I eliminate bytes that definitely wouldn't cause a collision leaving roughly 150^3.
totalling 3,375,000 possible collisions cutting the max time down to roughly 3 hours for a full sweep.

Have you (or AI) found a defect in hash distribution? Otherwise I don't see how can you reliably filter out 40% of distribution space. In HEX encoding there's just one collision per 0xFF^3.

[kaptensea]

Someone got a diagram for reading/writing to CEM-L with a raspberry and the cem L sbl flasher?