Vida CEM swapping

5ft24 · Post by **5ft24** » 05 Sep 2022, 16:43

T5Luke wrote: 05 Sep 2022, 14:02 This reads flash by 6 byte code:

Sweet. Thank you

5ft24 · Post by **5ft24** » 05 Sep 2022, 20:57

Perfect!
Now have a 320K bin to play with LOL
I guess the other question is writing changes back...

5ft24 · Post by **5ft24** » 05 Sep 2022, 21:57

using the online disassembler, what do I use for the entry code. I know the MCU is M32C also, do I just select default for Endian?
Thanks

konielian · Post by **konielian** » 07 Sep 2022, 05:34

Hello,

I can help you modifying that flash, i have all neccesary data to change and information.

But i have no idea how to write it back to CEM and this is an issue!

If you want you can send me the flash.

Thanks!

Post by **vtl** » 07 Sep 2022, 06:27

5ft24 wrote: 05 Sep 2022, 21:57 using the online disassembler, what do I use for the entry code. I know the MCU is M32C also, do I just select default for Endian?
Thanks

BaseAdr=FB0000

Default endianness.

5ft24 · Post by **5ft24** » 07 Sep 2022, 20:39

ODA as M32C, BaseAddr 0xFB0000 and default Endian... Wants to know where to start disassembling... If I tell it to start at the beginning, it comes up with a bunch of "unknown"...

flyovr · Post by **flyovr** » 07 Sep 2022, 20:57

T5Luke wrote: 21 Aug 2022, 15:07 If just change config is enough, here a simple extract from my flasher.
Open CEM 320kb bin from CEM MY 2006- and change config. Not so nice but free...
parameter.txt needs to be next to exe and you need to find parameters on your own...

I think it has bugs but it will work...
Sorry, link was wrong, now with parameter file
https://filetransfer.io/data-package/348Y8KBl#link

Hey all, been lurking for some time. Cracked my P2 MY07 XC70 last night using Teensy and managed to get a solid CEM bin file. I can read it with a hex editor and am finding my VIN included.

@T5Luke, Super interested in this config tool. Also noticed you mention its from your flasher. I have been trying to read up through all of the pages of this forum but have gotten lost.

Seems like the 50 user download limit has been hit and was wondering if you could re-up? Looking to change my headlight config to ABL and adjust tire size for speed correction.

Thanks everyone for your work on this. I've always been super interested in the topic but haven't had the time to deep dive into the topic.

Cheers!

flyovr · Post by **flyovr** » 07 Sep 2022, 21:00

5ft24 wrote: 07 Sep 2022, 20:39 ODA as M32C, BaseAddr 0xFB0000 and default Endian... Wants to know where to start disassembling... If I tell it to start at the beginning, it comes up with a bunch of "unknown"...

Seems like we are in the same boat! Tried the same but wasn't able to disassemble exactly like you.

Did you happen to figure out how to flash back to the CEM afterwards? Can't wrap my head around everything at the moment.

konielian · Post by **konielian** » 08 Sep 2022, 04:04

I can help you change the config you want just send me the 320kb flash and i change it for you!

Post by **vtl** » 08 Sep 2022, 07:04

5ft24 wrote: 07 Sep 2022, 20:39 ODA as M32C, BaseAddr 0xFB0000 and default Endian... Wants to know where to start disassembling... If I tell it to start at the beginning, it comes up with a bunch of "unknown"...

That's ok, as the dump contains both code and data sections. Disassemble the whole file, save to disk. Register at Renesas site, download M32C datasheet, look at the address space map, vectors, start sequence.