Login Register

Vida CEM swapping

Post Reply
User avatar
RickHaleParker
Posts: 7195
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 977 times

Post by RickHaleParker »

vtl wrote: 24 Jun 2020, 19:57 Yeah, seen that. I don't really understand what this software does.
It gets the pin number needed to make changes in the CEM. Like software reloads, cloning ... ect.

Yagger can get the PIN through the OBDII port but like all the other services the CEM PIN is not shared with the customer. It is used by him to provide his services. VDASH does the same and it makes sense. If they gave out the CEM PIN. Idiots would messing with things and then try to blame the service provider in order to get their mess fixed for free. Fixing someone else's mess is not cheap.

If i recall correctly Yagger's method for the P2 requires hardware other than DiCE. Or like VDASH you can snail mail the CEM and he will put the CEM pin on file in your account information.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
Top
vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

RickHaleParker wrote: 24 Jun 2020, 20:20 It gets the pin number needed to make changes in the CEM. Like software reloads, cloning ... ect.
It says:
"Read Processor Renesas M32C Flash file.
Browse file and get CEM PIN security CODE.

Enjoy GUSS"

As I said before, you can't do the first line without knowing PIN up front. At least, as per Renesas.

I "browsed" a random file (PNG picture) and it printed me a 00 00 00 00 00 00 code, that was at the offset where the PIN is stored in flash. I'd say, this is not a very useful "tool" ;)
Top
User avatar
RickHaleParker
Posts: 7195
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 977 times

Post by RickHaleParker »

vtl wrote: 24 Jun 2020, 21:27 As I said before, you can't do the first line without knowing PIN up front. At least, as per Renesas.
You need to hard wire the programmer to the PC board. Read this. Your not after a chip pin. You are after a board pin or software key.

Note the third line in the comment section of the programmer software.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
Top
vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

In the video they read unsecured/unlocked flash. To read the locked flash you need to know ID.

That programmer costs arm and a leg. My setup is $0 investment (everything was taken from parts bin) :)

Image
Top
User avatar
yagger
Posts: 373
Joined: 24 Mar 2016, 16:29
Year and Model: V60 2016
Location: DreamLand
Has thanked: 6 times
Been thanked: 39 times

Post by yagger »

RickHaleParker wrote: 24 Jun 2020, 19:37 Have you considered making a better program/service to directly compete with Vdash?
We have service similar like Vdash, but we have other philosophy. We work with people directly. WE WORK WITH CUSTOMER. )))
In case with Vdash, CUSTOMER WORK WITH SERVICE for own risk about result.
We work from 2010. But unfortunately, I think we are not good bisnessman's, we never advertise our service for world market like Vdash, but now, we start show our tech posibilites and they are very cool. Also, we try to work with shops only, because very often situations when regular customer do not has tech experience and we spend a loooot time for explain them what need to do. We lake to work with tech educated guys, they can check any things we ask them without additional spended time. Our service include diagnostic and recomendations except service itself. Sorry about my English, if need some additional explanation, better to text me PM... My be need to creat new topic about our service? ))
Top
User avatar
RickHaleParker
Posts: 7195
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 977 times

Post by RickHaleParker »

vtl wrote: 24 Jun 2020, 21:27 As I said before, you can't do the first line without knowing PIN up front. At least, as per Renesas.
Have you seen this document on programing R8C/M16C/M32C/R32C?

"To unlock the chip, we need to know the flash locking code that was last programmed into it. Most development tools use either all zeros or all ones (0xff) for the default key, so if you don't know the right key you can try those. Each chip reserves seven bytes near the end (high addresses) of the flash,which vary by family:"
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
Top
vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

Yes, and if the key is not all 0s or 1s the chip is locked and you can't make any progress until you know the key.
Top
User avatar
RickHaleParker
Posts: 7195
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 977 times

Post by RickHaleParker »

MwAAAgPki-A-960.jpg
MwAAAgPki-A-960.jpg (353.03 KiB) Viewed 7849 times
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
Top
User avatar
RickHaleParker
Posts: 7195
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 977 times

Post by RickHaleParker »

vtl wrote: 25 Jun 2020, 13:24 Yes, and if the key is not all 0s or 1s the chip is locked and you can't make any progress until you know the key.
Brute force: 16^14 +1 = 17,057,594,037,927,937 possibilities. How long would it take a cracker to try one, check the status then move on to the next one?
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )
Top
vtl
Posts: 4926
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 129 times
Been thanked: 686 times

Post by vtl »

RickHaleParker wrote: 25 Jun 2020, 16:17
vtl wrote: 25 Jun 2020, 13:24 Yes, and if the key is not all 0s or 1s the chip is locked and you can't make any progress until you know the key.
Brute force: 16^14 +1 = 17,057,594,037,927,937 possibilities. How long would it take a cracker to try one, check the status then move on to the next one?
Few seconds. I've mentioned a possibility of a side-channel timing attack on BUSY line in my first comment to the thread.

Scroll down the slides, M16 portion is in the middle: http://q3k.org/slides-recon-2018.pdf
Top
Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “XC90 1st gen 2003-2014”