Vida CEM swapping

[ZRimaZ]

23 15 92 67 72 Shuffle {3,1,0,2,4} = 92 15 67 23 72 .
00 01 02 03 04 ....... Placement ...... 00 01 02 03 04


00 01 02 03 04 */ Placement /*
23 15 92 67 72 */ PIN in .bin /*
03 01 00 02 04 */ Shuffle /*
92 15 67 23 72 */ PIN /*

Rick, is your shuffle order ok? I'm not really sure. Result is OK. You have counting of bytes 00...04 in top-row, so it has to be written as

00 01 02 03 04 <--- Byte order
23 15 92 67 72 <--- BIN PIN
02 01 03 00 04 <--- Shuffle order
92 15 67 23 72 <--- PIN

Or I'm wrong again?


EDIT: I see, you corrected shuffle order in latest messages.

to matthew1 - sorry, I was little bit off, but I see Rick helped you.

EDIT2: Sorry, you are right. I did it again ( (C) Britney Spears ) - I used wrong direction shuffle direction again. Sorry...

[RickHaleParker]

EDIT2: Sorry, you are right. I did it again ( (C) Britney Spears ) - I used wrong direction shuffle direction again. Sorry...

I hope that's not contagious.

[ZRimaZ]

I hope that's not contagious.

I also hope. But just in case, stay away from me!

[RickHaleParker]

First of all, thank you, I forgot to say, that this is an CEM module mounted on an XC 60/2015

Have you built a Teensy CEM cracker? If so, load it with VTL's P3 branch and see if it cracks the PIN.

Warning the P3 branch can take up to 32 hours and the key needs to be on. You need to use a charger to to keep the battery up. At least 12 amps is the word on the street. Currently the P3 branch does not have a resume function. So if the process is interrupted you got to start all over again.

Bench cracking would be a good idea if you have some P3 CEMs laying around. Somebody needs to work out how to wire a P3 on the bench and post the wiring schematic.

[mariom598]

First of all, thank you, I forgot to say, that this is an CEM module mounted on an XC 60/2015

Have you built a Teensy CEM cracker? If so, load it with VTL's P3 branch and see if it cracks the PIN.

Warning the P3 branch can take up to 32 hours and the key needs to be on. You need to use a charger to to keep the battery up. At least 12 amps is the word on the street. Currently the P3 branch does not have a resume function. So if the process is interrupted you got to start all over again.

Bench cracking would be a good idea if you have some P3 CEMs laying around. Somebody needs to work out how to wire a P3 on the bench and post the wiring schematic.

No, I used XProg for reading Code Flash and Data Flash from CEM

[ZRimaZ]

Tried today to crack PIN from P2 Cem-L 30765149 - no luck What could be the reason not to crack it?

PIN NOT CRACKED.txt

(121.52 KiB) Downloaded 162 times

[RickHaleParker]

Tried today to crack PIN from P2 Cem-L 30765149 - no luck What could be the reason not to crack it?

Could be a lot of things.
Do you have the PIN and/or .bin for that one? Knowing what the PIN is can help see what is going wrong.

If you go back and read through this whole thread you will find a lot of times the hardware quality is an issue.

What cracker hardware version did you use? Hardware construction method? ... Dupont ribbon cables, Solderless breadboard, Soldered breadboard, Wire Wrap breadboard or PCB?

3.3V or 5V CAN transceivers?

A schematic and some pictures of your hardware might help.

[vtl]

Tried today to crack PIN from P2 Cem-L 30765149 - no luck What could be the reason not to crack it?

PIN NOT CRACKED.txt

First two bytes are 87 35 for real. The third is 95 most likely, however your CEM is one of those with the third byte hard to crack. I have a theory/speculation why some CEMs are harder than others, explained with more details in this comment: viewtopic.php?f=10&t=85611&p=577956&hil ... nt#p577956

[RickHaleParker]

Anybody know which CEMs are D2 protocol-based and which ones are GGD protocol-based ?

[matija0610]

Anybody know which CEMs are D2 protocol-based and which ones are GGD protocol-based ?

Vida

cem DIAG number.txt

(8.59 KiB) Downloaded 225 times