Corrupt CEM Non Start Investigation and Repair Tutorial

[vtl]

I love the deep dive circuit diagnostics and repair. Just wish I had more time for my C++ programming.

C, you need just C.

[dikidera]

I love the deep dive circuit diagnostics and repair. Just wish I had more time for my C++ programming.

C, you need just C.

C can have a lot of undefined behaviour though

[imaV70Rdriver]

And I thought I had electrical issues! I got frustrated just reading this post. All this nonsense to stop someone from stealing a car? Why not just remove the fuel injection fuse instead? Replace it with a bad fuse so there isn’t an empty space, if anyone thinks a thief might check the fuse panel. That would surely cause a thief to move on to another car.
You must be one of the few people on the planet who could figure this out.
I’m seriously considering getting rid of my 2004 M66 V70R now, and going back to my analog “VR”, my 1978 TVR!
Good write up though.

[stevedi]

Amazing writeup! Fascinating read and a real insight on how a lot of this stuff works. Thank you for this.

Why not just remove the fuel injection fuse instead?

More convenient to rewrite part of the ECU code so it wont start unless you input a specific sequence of buttons. Brake, cruise etc.

[scaro]

Have tried in the past to get into cem with DHA and pincode but never got it working as i want/belive it should work. Got new spark to look at it again after reading this. But same as before it will not work for me... dont know what i do wrong.

I have tried "part" of code (immo) 3bytes to gain security access to cem thru dha. I use 3bytes (tried many bytes of the code) get response "E3 02" i belive is ok. But when trying to read block by offset to see IDs or full immodode or similair i get response "wrong security access"

Cem is connected on bench with a Ecm. I can get faultcodes on both but not login. I can see on Vida that the keys for it is the correct ones but sync Cem-Ecu its not approved. I dont have the "correct" *.Ddb file for cem/ecm i have the earlie Cem 2005 00004xxx use common .ddb for 2006. Earlie cem have another eeprom encryption but think it would work anyway? When using other tool to check if sync is ok it show that it is but want DHA to work and i can check if it truly is.

[stevedi]

the 3-byte pin you need is actually hex-coded decimal, in other words digits 0-9 and never using A-F, and will appear in hexadecimal exactly how they would be entered. the 3-byte pin for the cem is located in encrypted cem eeprom, and also located in ecu eeprom. if you read the ecu bin using a tool like openmoose, it will create a ram dump. inside this dump your pin should be located around 0x345E

to log into the cem using this pin:
50 A3 02 0E XX XX XX

[scaro]

Yes i have it in encrypted eeprom. Have decrypt it and its in my case 008328. Its in ecu also and i can read it there too.
Tick "security access" in DHA and write pin, get answer "E3 02". Then tick "read block with offset" choose "immo code" get answer "wrong security access" ? Maybee i should use "0E" before pin if its not included when ticking, havnt thought about it.

[scaro]

Thanks that did it, i know i had read about the "0E" somewhere before and even if i check more on pics its there to, but have forgot about it. Anyway now i can check on bench

[scaro]

When is syncrocheck between Cem/Ecm happen? What i mean if it is when in pos2 or pos3 or other? Belive it should only be needed with these two moduls. Have it on bench but cant get it to be OK. Have tried in car too without success but cant trust car wiring at the moment

I have all the files and think sync and keys in cem should be OK (keys i get all OK in Vida but not sync)
Ecm code is written in cem, but i cant trust if all the other info is correct i ECM eeprom.

[scaro]

It should syncrocheck when turn ignition on i read. But i dont know if it will be OK without correct keys? I know that it will not start without correct keys but just the sync maybee will be ok?

In my case i think the keys are ok (its say "OK" on everything in Vida) but cant be sure.
Im a bit stuck cant figure it out. Today i tried with a newer CEM. Moved Vin, Config, 6pin pass and decrypted both eeproms and moved part with keys and sync. Crypted again and soldered. Didnt care about mileage (havnt figure out algo for it yet) It didnt work. Still say keys ok but not sync

Will try change all syncro to 111111111 in CEM/ECM see whats happening.

One more thing the sync should happen over HS can (500kbs this case) i think? Dont work in car either think wiring is good.