Vida CEM swapping

[RickHaleParker]

Hello

i've gone ahead and built myself a teensy setup but having issues when trying it... all I get in return are 0s. I've measured continuity across the board connections and am pretty sure it is wired up OK.

You have a 2007 P2 S60. If you have a DiCE or any J2534 or ISO 22900 interface you might be better off using T5Luke's UDS software software to get a 5 byte UDS Pin number instead of the 6 byte legacy PIN.

Somebody here reported that editing the device name in the executable with enable it to work with other with other devices.

[Mozambique11]

Hello

i've gone ahead and built myself a teensy setup but having issues when trying it... all I get in return are 0s. I've measured continuity across the board connections and am pretty sure it is wired up OK.

You have a 2007 P2 S60. If you have a DiCE or any J2534 or ISO 22900 interface you might be better off using T5Luke's UDS software software to get a 5 byte UDS Pin number instead of the 6 byte legacy PIN.

Somebody here reported that editing the device name in the executable with enable it to work with other with other devices.

Thanks Rick!
do these two different(?) pins serve the same purpose?

[RickHaleParker]

Thanks Rick!
do these two different(?) pins serve the same purpose?

It is two different ways to access the control modules. UDS = Unified Diagnostic Services.

Europe has already adopted UDS and Volvo is a European car. We are not 100% sure but it looks like Volvo made the change to UDS in late 2005. We think all 2006+ Volvos are UDS. The earlier ones being both UDS and OBD2. Or more likely 2006+ P1 - P3 are both P5 & P6 are UDS only. This has not yet be confirmed.

North America is in the process of adopted UDS and will initiate a transition phase starting in 2023, where ECUs are allowed to support either OBD2 or OBDonUDS.

[T5Luke]

You can crack the UDS pin by dice.
Then take the UDSreader and read your firmware by dice.

In this firmware you find the 6 byte code of your cem at this position:

offset _ B3 B1 B5 B0 │ B2 B4 XX XX
04E000 53 38 03 21 │ 18 02 FF FF

PIN = B0 B1 B2 B3 B4 B5
PIN is 21 38 18 53 02 03

So you have both pins...

[vtl]

Relays clicking is the direct sign of a miswired CAN. Either wrong CAN bus speed is set (like low speed connected to high speed) or H/L wires are swapped.

[prometey1982]

I can also write upload : 0xD5,0xEF,0x12,0x0E,0x00,0x03,0xBC,0x00,0x00,0xFB,0x12,0x33,0x02,0x10,0xF7,0x01,0x86,0xCB,0xF8,0x01,0x8C,0x86,0xCB,0xF9,0x01,0x8C,0x86,0xCB,0xFA,0x01,0x8C,0x86,0xCB,0xFB,0x01,0x8C,0x86,0xCB,0xFC,0x01,0x8C,0x86,0xCB,0xFD,0x01,0x8C,0xD6,0xF7,0x33,0x02,0xD6,0xF0,0x33,0x02,0xD6,0xFF,0x33,0x02,0x0A,0x33,0x02,0xDA,0xFC,0x12,0x0E,0x00,0xD6,0xF1,0xE9,0x03,0xD6,0xF9,0xE9,0x03,0xD6,0xF9,0xE9,0x03,0xD6,0xF1,0xE9,0x03,0xA9,0x8E,0x47,0x56,0xD5,0x8A,0xB2,0x12,0x0E,0x00,0xBB,0xFC to your cems ram, set program counter to start and you are done. If you have questions look into the p2 protocol documentation...

Hi!
Where can I find p2 protocol documentation? Which upload address should I use for this bootloader?

[T5Luke]

This was thought more as a joke to some members here.I don't know if there really exist some documentation about p2 protocol. Everything i know about P2 protocol is by logging and analyzing. I provide a working example here which i think is more useful to most members here as writing around some stuff only a small percentage can use. Yes you can upload this data to 0xC000 and set the program counter there. Everything should run this way in my provided exe files, you can setup some can logger and should have very useful logs...

[PontusLSE]

Hi! I am about to order the necessary hardware to build my device to crack the pin to my Volvo V70 2007 (P2?).


Edit 2: I understand that this is the newest version requirements:
Teensy 4.1 (https://www.electrokit.com/produkt/teen ... iftlister/)
OBD-II cable (https://www.electrokit.com/produkt/obd2 ... -kapsling/)
Resistors 2x 10kOhm
CAN Tranciever: sn65hvd230dr - Seems to be out of stock everywhere, is there any alternative products that might works too?



Can anyone help me out here?

Edit:
I just noticed the last few posts in this thread. I do have a china version VIDA DICE 2014D, how can i find out if it is an DICE-206751?

[prometey1982]

This was thought more as a joke to some members here.I don't know if there really exist some documentation about p2 protocol. Everything i know about P2 protocol is by logging and analyzing. I provide a working example here which i think is more useful to most members here as writing around some stuff only a small percentage can use. Yes you can upload this data to 0xC000 and set the program counter there. Everything should run this way in my provided exe files, you can setup some can logger and should have very useful logs...

Thanks! I analyzed your SBL code and it looks like dumping CEM ROM data into the CAN.
https://onlinedisassembler.com/odaweb/Mhyy9dS7/0
Am I wrong?

[prometey1982]

I just noticed the last few posts in this thread. I do have a china version VIDA DICE 2014D, how can i find out if it is an DICE-206751?

Hi. You can run DiCE diagnosic tool and look DiCE number. Also you can open regedit and try to find 206751 value.