Vida CEM swapping

Post by **RickHaleParker** » 08 Dec 2021, 11:18

ZRimaZ wrote: 08 Dec 2021, 11:09 no, it is just simple winhex and it does not do such a sophisticated search. I just tried to search for this string, but accidentally looked at first bytes in this file and my search engine found what I was going to search with winhex

Oh darn! ... it was all in your head.

Find permutations would be a nice feature for a Hex editor.

Post by **RickHaleParker** » 08 Dec 2021, 12:24

ZRimaZ wrote: 08 Dec 2021, 02:44 P3 CEM with M30882FJ processor has different system - it needs more deep analyzing. Attached are few flash files with PINs in

Found all three at offset 0007E001 - 0007E005. Transposition cipher applies.

Post by **RickHaleParker** » 08 Dec 2021, 20:24

I have only been able to find four Volvo part numbers for P3 CEMs.
Can anybody confirm the processor(s) for part numbers 31327994 & 31412971 ?

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
31327994 : ?
31412971 : ?

ZRimaZ · Post by **ZRimaZ** » 09 Dec 2021, 01:54

RickHaleParker wrote: 08 Dec 2021, 20:24 I have only been able to find four Volvo part numbers for P3 CEMs.
Can anybody confirm the processor(s) for part numbers 31327994 & 31412971 ?

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005
31327994 : ?
31412971 : ?

Here you go!

Post by **RickHaleParker** » 09 Dec 2021, 08:38

ZRimaZ wrote: 09 Dec 2021, 01:54 Here you go!

The M30882FJ files look like processor flash files.
The R5F64524/R5F64525 files look like EEprom data files not processor flash files.
Not finding the part number in the R5F64524/R5F64525 EEprom files.
Got any processor flash files for the R5F64524/R5F64525 ?

ZRimaZ · Post by **ZRimaZ** » 09 Dec 2021, 09:36

RickHaleParker wrote: 09 Dec 2021, 08:38
The M30882FJ files look like processor flash files.
The R5F64524/R5F64525 files look like EEprom data files not processor flash files.
Not finding the part number in the R5F64524/R5F64525 EEprom files.
Got any processor flash files for the R5F64524/R5F64525 ?

Yes ,that's true - R32C has flash, DataFlash and EEPROM. PN is located in flash as open text at 0xBFC48:

: 2021-12-09_183543.jpg (157.21 KiB) Viewed 1281 times

Here is one of the Flash files from the car from previous DataFlash collection:

CEM R5F64524 Flash S80_2010_B6324S2_YV1960AR1A1124349 AG9T-14C256-GC_H5PLA_31254838AC_ser93290800 ori US.rar: (344.33 KiB) Downloaded 202 times

P3 CEM with M30882FJ processor has Flash in processor and separate EEPROM 25LC320, which is encrypted

Post by **vtl** » 09 Dec 2021, 09:40

I wonder whether pin is generated based on some data from car's configuration?

ZRimaZ · Post by **ZRimaZ** » 09 Dec 2021, 09:43

vtl wrote: 09 Dec 2021, 09:40 I wonder whether pin is generated based on some data from car's configuration?

No idea...

Post by **RickHaleParker** » 09 Dec 2021, 10:43

ZRimaZ wrote: 09 Dec 2021, 09:36 Yes ,that's true - R32C has flash, DataFlash and EEPROM. PN is located in flash as open text at 0xBFC48:

The 31254838 datapoint was useful. It lead me to four more P3 CEM part numbers. 31314511, 31314116, 31254838, 31254837

30765624 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005, Both in Flash.
30786819 : M30882FJ processor. Part number @ offset 0007FE30 - 0007FE38. PIN @ 0007E001 - 0007E005, Both in Flash
31327994 : ?
31412971 : ?
31314511 : ?
31314116 : ?
31254838 : R5F64524 processor. Part number @ offset 0000BFC48 in Flash. PIN @ 00000001 - 00000005 in DataFlash.
31254837 : ?

Post by **RickHaleParker** » 09 Dec 2021, 10:48

vtl wrote: 09 Dec 2021, 09:40 I wonder whether pin is generated based on some data from car's configuration?

His known PINs are data matching what is found in the files. Shuffled like the P1 & P2. I am working off the assumption that his known PINs will solve the challenge and gain him access.