Vida CEM swapping

[vtl]

Someone got a diagram for reading/writing to CEM-L with a raspberry and the cem L sbl flasher?

search.php?keywords=m16c-flasher.de&t=85611&sf=msgonly

[dwappertam]

Hi everybody. I wrote SBL for CEMB to read the full contents of the flash. While in test mode, CAN packets are transmitted in uncontrolled mode with 8 bytes of data. 512 KB is transmitted in 1.3 minutes. The period between CAN packets is 1.192 milliseconds. I receive all data packets on the table without errors. And now I have some questions. 1. Isn't the time between data packets 1.192 milliseconds short if you read the block remotely via the Internet? 2. Is it necessary to make the transfer of controlled request-response type instead of uncontrolled data transfer?

Would you be willing to share your code so we can do our own dumps?

sbl source code for CEMB. The test version.

Can u tell me how to load the sbl or do i have to flash it? or how do i make use of it ?

[kaptensea]

I’m building my first CEM PIN Cracker, I have the Teensy and two canbus, but I’m confused about R1-R4. Do I need them? I’m gonna build adapters so I can crack the PIN both in car and on bench with CEM connector to OBD female adapter I built

No display, just connect to PC

[vtl]

I’m building my first CEM PIN Cracker, I have the Teensy and two canbus, but I’m confused about R1-R4. Do I need them? I’m gonna build adapters so I can crack the PIN both in car and on bench with CEM connector to OBD female adapter I built

No display, just connect to PC

CAN-bus shield has the resistors.

[dikidera]

Hi everybody. I wrote SBL for CEMB to read the full contents of the flash. While in test mode, CAN packets are transmitted in uncontrolled mode with 8 bytes of data. 512 KB is transmitted in 1.3 minutes. The period between CAN packets is 1.192 milliseconds. I receive all data packets on the table without errors. And now I have some questions. 1. Isn't the time between data packets 1.192 milliseconds short if you read the block remotely via the Internet? 2. Is it necessary to make the transfer of controlled request-response type instead of uncontrolled data transfer?

More bytes can be packed by including them in the space for the 29 bit id reducing the transmit time to even lower.

[kaptensea]

I’m building my first CEM PIN Cracker, I have the Teensy and two canbus, but I’m confused about R1-R4. Do I need them? I’m gonna build adapters so I can crack the PIN both in car and on bench with CEM connector to OBD female adapter I built

No display, just connect to PC

CAN-bus shield has the resistors.

I noticed it has both the 120 and 10k Ohm. Thanks for answer!

And the RS 10k ohm is already connected to GND on the CAN card so I don’t need a cable from RS to GND?

Using waveshare SN65HVD230

[vtl]

I noticed it has both the 120 and 10k Ohm. Thanks for answer!

And the RS 10k ohm is already connected to GND on the CAN card so I don’t need a cable from RS to GND?

Using waveshare SN65HVD230

Don't need to do anything extra with the existing off-the-shelf CAN shield, just wire it up. You may need to pull or put back the 120 Ohm jumper, depending on how the cracker is connected to CEM. On the bench cracking: need to terminate the bus, the jumper is on. In car cracking: no need to terminate, the jumper is off.

[kaptensea]

Anyone have SBL for DIM cloning on P2? Or some explanation for this?

[RickHaleParker]

Working on two new latency-measurement methods for the Volvo CEM PIN Cracker (VCPC).

"poll" is the current software-polling method.

"captureA" and "captureB" use the Teensy's timer peripherals as hardware-capture coprocessors.

Both hardware-capture methods reduced the measured spread from 112 ticks to 38 ticks—a reduction of 74 ticks in polling-related jitter.

Further same-edge testing produced zero spread across 2,048 captures. This tells us the remaining 38-tick spread is not capture quantization error. It comes from the M7-controlled event-generation path in the simulated test environment.

Code: Select all

             MIN     MAX   SPREAD      MEAN
poll       14963   15075      112   15017.803
captureA   14999   15037       38   15017.873
captureB   14999   15037       38   15017.847

Still in the lab, using a Teensy in a simulated environment. The next step is testing with hardware-timed events and then in the real CEM environment.

[dikidera]

Pleased to announce Moose Diag https://play.google.com/store/apps/deta ... .app&hl=en it can do what Vida can and more, free but with ads.


You can monitor the CAN bus like cansniffer whilst also logging it. You can read and clear DTCs, with additional information on them. You can also search the database for information on DTCs without reading the car, in case you need to cross reference from another scanner.

CSV logging, live data viewing of up to 15 params, live graphing so you can see things like lambda on a graph. Parts catalog, service information.

In the live data view I also expose all hidden params that were visible in DHA, but you have to scroll down a bit. You can also create quick lists so you can easily go back to logging instead of searching for params manually, which btw you can, there's an actual search available for quickly finding stuff.

More features to come, like custom scripts to passively read the can bus so we dont have to query it, this improves sample rate a ton.

Currently works with Mongoose JLR cable(with USB OTG adapter), but will likely support more stuff in the future.