Vida CEM swapping
-
Yariy
- Posts: 48
- Joined: 01 Jul 2024, 03:21
- Year and Model: XC90
- Location: Moskow
- Has thanked: 16 times
- Been thanked: 10 times
Test the `ShimTSDiCE32` shim — a native 32‑bit DLL (C++, MSVC, Win32/x86) that exports the standard 14 J2534 v4.04 functions (`PassThruOpen` … `PassThruIoctl`) and passes them through to the actual Volvo DiCE driver — `TSDiCE32.dll`. The purpose of the shim is to selectively translate protocol identifiers that the DiCE driver does not understand: the J2534-2 protocol `CAN_PS` (`0x8004`) is replaced with the proprietary `LS-CAN` DiCE (`0x10000001`).
Call chain:
```
Application (J2534)
│ PassThru* (__stdcall)
▼
ShimTSDiCE32.dll (interception + translation of ProtocolID/Flags)
│ PassThru* (__stdcall)
▼
TSDiCE32.dll (real Volvo DiCE driver)
▼
Volvo DiCE equipment
Run the file register-shim.bat to copy the DLL and add the device “Volvo DiCE (ShimTSDiCE32)” to the registry.
In your program, choose the "Volvo DiCE (ShimTSDiCE32)" device.
Call chain:
```
Application (J2534)
│ PassThru* (__stdcall)
▼
ShimTSDiCE32.dll (interception + translation of ProtocolID/Flags)
│ PassThru* (__stdcall)
▼
TSDiCE32.dll (real Volvo DiCE driver)
▼
Volvo DiCE equipment
Run the file register-shim.bat to copy the DLL and add the device “Volvo DiCE (ShimTSDiCE32)” to the registry.
In your program, choose the "Volvo DiCE (ShimTSDiCE32)" device.
- Attachments
-
- ShimTSDiCE32.zip
- (48.59 KiB) Downloaded 5 times
Last edited by Yariy on 15 Sep 2026, 07:39, edited 3 times in total.
-
Arty
- Posts: 17
- Joined: 09 May 2024, 05:39
- Year and Model: 2006 S60
- Location: Russia, Krasnodar
- Has thanked: 7 times
- Been thanked: 5 times
I actually did something pretty much like that. Just a bridge. The main thing is that the software thinks it’s using DICE.Yariy wrote: 15 Sep 2026, 04:26 Test the `ShimTSDiCE32` shim — a native 32‑bit DLL (C++, MSVC, Win32/x86) that exports the standard 14 J2534 v4.04 functions (`PassThruOpen` … `PassThruIoctl`) and passes them through to the actual Volvo DiCE driver — `TSDiCE32.dll`. The purpose of the shim is to selectively translate protocol identifiers that the DiCE driver does not understand: the J2534-2 protocol `CAN_PS` (`0x8004`) is replaced with the proprietary `LS-CAN` DiCE (`0x10000001`).
Call chain:
```
Application (J2534)
│ PassThru* (__stdcall)
▼
ShimTSDiCE32.dll (interception + translation of ProtocolID/Flags)
│ PassThru* (__stdcall)
▼
TSDiCE32.dll (real Volvo DiCE driver)
▼
Volvo DiCE equipment
Copy ShimTSDiCE32.dll next to the driver: C:\Program Files (x86)\DiCE\Tools\
Run the registry file register-shim.reg to add the device "Volvo DiCE (ShimTSDiCE32)".
In your program, choose the "Volvo DiCE (ShimTSDiCE32)" device.
- RickHaleParker
- Posts: 7195
- Joined: 25 May 2015, 14:30
- Year and Model: See Signature below.
- Location: Kansas
- Has thanked: 8 times
- Been thanked: 977 times
Code: Select all
Software poll Hardware capture
Valid samples 1024 1024
Invalid samples 0 0
Minimum (us) 84.030 0.107
Maximum (us) 90.087 0.213
Range (max-min) 6.057 0.107
Mean (us) 87.077 0.171
MAD (us) 1.945 0.000
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
-
Yariy
- Posts: 48
- Joined: 01 Jul 2024, 03:21
- Year and Model: XC90
- Location: Moskow
- Has thanked: 16 times
- Been thanked: 10 times
Could you please explain what this is?RickHaleParker wrote: 16 Sep 2026, 22:50Code: Select all
Software poll Hardware capture Valid samples 1024 1024 Invalid samples 0 0 Minimum (us) 84.030 0.107 Maximum (us) 90.087 0.213 Range (max-min) 6.057 0.107 Mean (us) 87.077 0.171 MAD (us) 1.945 0.000
- RickHaleParker
- Posts: 7195
- Joined: 25 May 2015, 14:30
- Year and Model: See Signature below.
- Location: Kansas
- Has thanked: 8 times
- Been thanked: 977 times
Working on using the Cortex-M7 PWM hardware timer peripherals and DMA as a co-processor.Yariy wrote: 17 Sep 2026, 05:36Could you please explain what this is?RickHaleParker wrote: 16 Sep 2026, 22:50Code: Select all
Software poll Hardware capture Valid samples 1024 1024 Invalid samples 0 0 Minimum (us) 84.030 0.107 Maximum (us) 90.087 0.213 Range (max-min) 6.057 0.107 Mean (us) 87.077 0.171 MAD (us) 1.945 0.000
The idea is to wean the jitters out of the latency measurements.
The above is a comparison between the current version of the "co-processor" vs the current the Software polling method in the Volvo CEM Cracker.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
-
vtl
- Posts: 4926
- Joined: 16 Aug 2012, 13:35
- Year and Model: 2005 XC70
- Location: Boston
- Has thanked: 129 times
- Been thanked: 686 times
87 us in your table is the average response latency from CEM. One loop in software on Teensy is under 100 ns.RickHaleParker wrote: 17 Sep 2026, 05:47 Working on using the Cortex-M7 PWM hardware timer peripherals and DMA as a co-processor.
The idea is to wean the jitters out of the latency measurements.
The above is a comparison between the current version of the "co-processor" vs the current the Software polling method in the Volvo CEM Cracker.
- RickHaleParker
- Posts: 7195
- Joined: 25 May 2015, 14:30
- Year and Model: See Signature below.
- Location: Kansas
- Has thanked: 8 times
- Been thanked: 977 times
I need to find a different arming trigger for RX. The CAN transceiver mirroring is tripping this one up.vtl wrote: 17 Sep 2026, 05:59 87 us in your table is the average response latency from CEM. One loop in software on Teensy is under 100 ns.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
-
vtl
- Posts: 4926
- Joined: 16 Aug 2012, 13:35
- Year and Model: 2005 XC70
- Location: Boston
- Has thanked: 129 times
- Been thanked: 686 times
I don't think more precision will help. The problem is the slowest domain clock - the CAN-bus. 500 KHz hides all the variability happening on the 30 MHz (CEM) side. P1 CEMs are running at 4 MHZ - only 8 MCU clocks per 1 CAN clock, and they are much easier to crack.RickHaleParker wrote: 17 Sep 2026, 07:44I need to find a different arming trigger for RX. The CAN transceiver mirroring is tripping this one up.vtl wrote: 17 Sep 2026, 05:59 87 us in your table is the average response latency from CEM. One loop in software on Teensy is under 100 ns.
If ARM code execution gives a lot of jitter then what may help is turning off the speculations in ARM core, so it would execute the code slower, but with linear timing. Speculative execution and power saving.
-
- Similar Topics
- Replies
- Views
- Last post
-
- 1 Replies
- 8839 Views
-
Last post by RickHaleParker
-
- 6 Replies
- 8631 Views
-
Last post by abscate
-
- 27 Replies
- 27347 Views
-
Last post by cn90
-
- 10 Replies
- 10027 Views
-
Last post by jonesg
-
- 7 Replies
- 5305 Views
-
Last post by RickHaleParker






