Vida CEM swapping

[brobert]

I've been wanting a cheap CEM to experiment on the bench.
My 2006 V70 has a 30728542 CEM-L but they are rare at my local boneyard.
Today, I have pulled (and oh what fun) a 30786890 CEM-H (L-shaped) from an 2007 XC70.
I will hook it up on the bench with 120 ohms terminations and get its PIN with the Teensy cracker.

I read on this site that CEM-H units can replace CEM-L units (but not the other way around):
https://www.datatransferring.com/cem-p2-2005
Can a kind soul confirm this?

While at it, I'd love to know more about the differences between CEM-L and CEM-H units.
I used to think that it was dictated by the CEM case shape but that's clearly not the complete story.
Maybe a CEM-H is a more powerful unit?

Thanks for the wisdom.

[Edit to add that another CEM lost a PIN poker game]:
found PIN: 34 28 59 56 36 52
PIN is cracked in 1667.82 seconds
Validating PIN
PIN verified.

[duzi]

'L' - lack of components on the internal board side.

[oscilloscope]

I have a p3 here , which I've been trying the cracker on and it doesn't recognise the module.

I was creating a beginning of the wiki , I can potentially still retrieve it via bdm

Pic for reference

20230129_134443.jpg (320.07 KiB) Viewed 3061 times

[brobert]

Thanks & Wow, I never looked on the flip side of a CEM PCB...
What CEM part number is that and do you have a picture of the component side?

I understand making a CEM with less components to save money but stocking all these CEM models should come at a cost too.
Presumably they have done the math but in my opinion so far, I haven't seen real savings in components.
There could be some hard-to-spot differences in the chips however (amount of memory, speed grade, etc.).

Here's my contribution about extra components (compared to a CEM-L).
This is not my picture - I just annotated it.

'L' - lack of components on the internal board side.

[hydziowy]

just an update, worked perfectly, got 909/s speed, took about 4:30hrs to crack a p3 cem from a 2014 v40, trying a 2016 v40 tomorrow, im thinking of doing a little wiki write up about this info etc does anyone mind? just some bench info and how to find and use the p3 branch as the info is spread about these 250 odd pages

Hi there! Did you try 2016 MY? How device works with it?

[duzi]

v40 (2013-2016) cpu SPC560B60

[oscilloscope]

I'm messing around with the code , and attempting a read on the p3 cem I have here , currently with little success, I added a completely new line under p2 , with the part number which didn't work , now and I to understand it won't be able to find the part number as it doesn't know where it is stored in its hex location? , I scrolled down and found at line 463 - 470 looks like it's searching for data at locations, 0x88 , 0x00 , respectively, am I to assume if I can find the part number within a dump file , then populate the location it should be able to find it ?

[rkam]

0x88 is the command sent on CAN bus to request the part number from a controller while it is running its Primary Boot Loader.
Your P3 CEM doesn't use this type of programming mode.

[oscilloscope]

0x88 is the command sent on CAN bus to request the part number from a controller while it is running its Primary Boot Loader.
Your P3 CEM doesn't use this type of programming mode.

I see , so a p3 bootloader would need to be made , I had read on some dodgy site that the delphi module has some weird programming mode which is not very easy to access.

[prometey1982]

Something was written here. Sorry.