CEM 11 PIN

[roema]

Hi!

The immobilizer PIN isn't stored in the EEPROM or data area. Retrieving the immobilizer PIN requires a few tricks. First, the CEM PIN has to be cracked. After that, it takes another 2–5 minutes to get the immobilizer PIN. There are plenty of tools—like VDASH and P3Tool—that crack the CEM and immobilizer PINs. I found that whole process too tedious, though, so I wrote my own tool in Python. You don't need a DICE unit or anything like that; a simple USB-to-CAN adapter running as SocketCAN on Linux is sufficient. My adapter manages around 270 keys per second, and the CEM PIN should be discovered after about 8 hours.

From there, it takes roughly 2–5 minutes to calculate the immobilizer PIN.

I was able to program a new key from AliExpress this way, and everything works great. Additionally, I wrote a Python-based SBL loader to modify the CEM and DIM configurations. The whole thing is still in the testing phase.