Vida CEM swapping

ZRimaZ · Post by **ZRimaZ** » 09 Apr 2022, 08:40

IO terminal knows where PIN code is located for all P1, P3 and for P2 CEM-L and CEM-H. CEM-B it also can read/write via OBD, but for this you need to modify flash, at addresses 0x4000 or 0x6000 - replace existing PIN with FF.
It can't crack PIN, but if you have already PIN or you have flash read by other means, it can extract it from file

Post by **vtl** » 09 Apr 2022, 08:42

ZRimaZ wrote: ↑09 Apr 2022, 08:40 IO terminal knows where PIN code is located for all P1, P3 and for P2 CEM-L and CEM-H. CEM it also can read/write via OBD, but for this you need to modify flash, at adresses 0x4000 or 0x6000 - replace ecisting PIN with FF.
It can't crack PIN, but if you have already PIN or you have flash read by other means, it can extract it from file

Well, yes, exactly what I thought.

Post by **charlie13** » 09 Apr 2022, 11:32

vtl wrote: ↑09 Apr 2022, 08:34
urosm wrote: ↑09 Apr 2022, 01:23 IO cannot get the PIN from MC68376, unfortunately.
But for P2 facelift working like charm!
What do you mean exactly? Does I/O Terminal crack pin code now? Or it knows where to look for the pin in the flash dump?

I/0 has it solved the other way around, you need to desolder flash and load the content with changed pin. Patch Button 28F400B5 Flash File.

Post by **gnalan** » 09 Apr 2022, 11:39

charlie13 wrote: ↑09 Apr 2022, 11:32 I/0 has it solved the other way around, you need to desolder flash and load the content with changed pin. Patch Button 28F400B5 Flash File.

What's the chance of bricking the CEM-B doing it this way?

Post by **vtl** » 09 Apr 2022, 11:46

gnalan wrote: ↑09 Apr 2022, 11:39 What's the chance of bricking the CEM-B doing it this way?

A rule of thumb is to use a fresh flash chip (and tin-lead allow).

Also for older CEMs I think you still can read/write flash unsoldered with BDM programmer.

Post by **charlie13** » 09 Apr 2022, 11:55

gnalan wrote: ↑09 Apr 2022, 11:39
charlie13 wrote: ↑09 Apr 2022, 11:32 I/0 has it solved the other way around, you need to desolder flash and load the content with changed pin. Patch Button 28F400B5 Flash File.
What's the chance of bricking the CEM-B doing it this way

Read Intel 28F400 memory and send me I can give you the pin you read. You will do path and when the pin input function is added, as in the other modules, you will enter your own pin. This will allow you to embed car conf. I/0 software and using cem changes.
In fact, when you read the desoldered flash, you will also save the changes you want to make

ZRimaZ · Post by **ZRimaZ** » 09 Apr 2022, 12:45

IO terminal has no function to read/enter PIN foe CEM-B. As I wrote before, the flash of 29f400 has to be modified/patched either with io terminal or manually. The "patch" is simple replacing of original pin with FF. The pin is located at address 0x4000 or 0x6000, depending on cem version. To patch 28f400 you have to read&write it either by resoldering it or with bdm programmer without resoldering

Post by **RickHaleParker** » 09 Apr 2022, 17:43

ZRimaZ wrote: ↑09 Apr 2022, 12:45 The "patch" is simple replacing of original pin with FF. The pin is located at address 0x4000 or 0x6000, depending on cem version. To patch 28f400 you have to read&write it either by resoldering it or with bdm programmer without resoldering

Is there a checksum in in the 28f400? If so. where is it located, what type of checksum and for what block of data.

ZRimaZ · Post by **ZRimaZ** » 10 Apr 2022, 01:04

As far I know, there is only checksum for config block, not for whole flash

Post by **charlie13** » 10 Apr 2022, 04:07

EDIT Be careful. See two posts down. Matthew /EDIT

Programs for CEM B and P1 SID803. There may be a problem with the antivirus. There is no virus in the files

Vida CEM swapping

Re: Vida CEM swapping