Vida CEM swapping

dikidera · Post by **dikidera** » 24 Jan 2023, 15:59

Constantinos wrote: ↑24 Jan 2023, 14:58 Should I design my own con or should I just use a breadboard?

https://electronics.stackexchange.com/q ... e-for-a-so

oscilloscope · Post by **oscilloscope** » 25 Jan 2023, 08:56

Constantinos wrote: ↑23 Jan 2023, 10:23 Good evening.
I have been for a cheap but effective way to unlock my cem pin through the obd2 port
I found the teensy 4.0 method but I'm having a hard time finding parts.
I found a pcb file which has all the wiring for the pcb as well.
However, I cannot find the bosch cf160 transceivers needed for the job.
Also, in the schematic on github, I can see that some resistors that need installing, but I'm not sure where to install them on the pcb.
The pcb link:
https://www.pcbway.com/project/sharepro ... 037d5.html

The github link: https://github.com/vtl/volvo-cem-cracker

I have 5 of them pcbs from pcbway. I'm yet to try them out and I have 30 of the recommended transceivers Ric suggested too use.

oscilloscope · Post by **oscilloscope** » 25 Jan 2023, 09:04

dikidera wrote: ↑23 Jan 2023, 13:49
rkam wrote: ↑23 Jan 2023, 09:57 I believe J2534-2 is an extension to allow communication with more modules.
Here are some sections marked with J2524-2
https://github.com/diamondman/J2534-Pas ... 34_v0404.h

DiCE J2534 help file can also be useful.
J2534.zip

Some history and revisions:
https://www.kvaser.com/developer-blog/s ... on-part-1/
The help file seems to be missing the actual articles outlined before. I have vida installed, but couldn't find these help files in C:/Vida.

This kvaser cable , how deep can it go? , for instance, key insertion , and synchronization activities?

rkam · Post by **rkam** » 25 Jan 2023, 10:46

The Kvaser cable itself cannot do anything special.
It all depends on what software you have.
Several professional software applications can use the Kvaser interface, but then again the software might be useless without datafiles.
On Volvo, the DiCE can do mostly the same.
Kvaser is better for datalogging.

dikidera · Post by **dikidera** » 25 Jan 2023, 15:43

I have fantastic news.

It all works...Finally. The CAN stuff at least. I could not get VIDA to work because of my socket code. But I managed to dump my maps in as little as 15-19 seconds.

No need for K-line stuff, no "tester present" frames.

I had to put all modules to sleep with FF86, then I could read/write to the ECU with my code.
Most importantly however, when I was done I had to explicitly wake all modules on both BUSes, otherwise the car would not start.

Below is the dump of the maps for BIFUEL CNG, with name of revision or whatever Z7D.

Post by **vtl** » 25 Jan 2023, 16:08

Great! Share your code at github. Opensource is what makes us morally light years ahead of those shadow forum readers who use our work for their own profit, but never return anything back to the community.

dikidera · Post by **dikidera** » 26 Jan 2023, 17:59

I will.

But first. I have to identify how and where the A6 command is handled. At the beginning of my endeavor I was much more optimistic in my reverse engineering of this thing, but one big unintentional hurdle is the design of the architecture or perhaps the space savings of the compiler or both, which produce code which leaves us with little to no xrefs(not xrefs produced by IDA automatically, but those we can infer by simply glancing at the code)

The very fact that the CAN registers(or every single chip peripheral) are accessed in an indirect way is horrifying from where I stand. Just by doing this, it is difficult to interpret what a piece of code is doing because this applies to the whole ECU firmware.

It would have been nice to use JTAG for this, but the JTAG interface is proprietary and the features are undocumented, otherwise I would've hooked my RPI and traced, single stepped and inspected each register individually .

This may still be possible somewhat, but I will verify soon. I just have to furiously type more code.

oscilloscope · Post by **oscilloscope** » 28 Jan 2023, 11:46

I was curious to know if I am able to add to the wiki section. With picture references for cem connection plans , for the cems I encounter ?
It might help folks

Way I ask is I am not massively formilar with github and I don't know its ins and outs. ,

Post by **vtl** » 28 Jan 2023, 13:53

oscilloscope wrote: ↑28 Jan 2023, 11:46 I was curious to know if I am able to add to the wiki section. With picture references for cem connection plans , for the cems I encounter ?
It might help folks

Way I ask is I am not massively formilar with github and I don't know its ins and outs. ,

What's your github name?

oscilloscope · Post by **oscilloscope** » 28 Jan 2023, 14:50

vtl wrote: ↑28 Jan 2023, 13:53
oscilloscope wrote: ↑28 Jan 2023, 11:46 I was curious to know if I am able to add to the wiki section. With picture references for cem connection plans , for the cems I encounter ?
It might help folks

Way I ask is I am not massively formilar with github and I don't know its ins and outs. ,
What's your github name?

Amcelectronics

Vida CEM swapping

Re: Vida CEM swapping