Vida CEM swapping

dikidera · Post by **dikidera** » 05 Feb 2023, 11:40

Haha I was thinking the same thing, ELM327 may be capable of doing so, the only problem is if it cannot do Low Speed Network over pins 3 and 11.

repair · Post by **repair** » 06 Feb 2023, 05:53

oscilloscope wrote: ↑05 Feb 2023, 06:27 Is this pavel the same one who has something to do with orange 5 calculators and scripts?

No. That Pavel has nothing to do with VDASH))

oscilloscope · Post by **oscilloscope** » 06 Feb 2023, 06:47

prometey1982 wrote: ↑05 Feb 2023, 06:17 Buy the way there is IDB project for vdash_u.exe
https://cloud.mail.ru/public/gLyq/9dmwfkoWH

What is it ment to do ?

oscilloscope · Post by **oscilloscope** » 06 Feb 2023, 13:10

prometey1982 wrote: ↑05 Feb 2023, 06:48
oscilloscope wrote: ↑05 Feb 2023, 06:27
prometey1982 wrote: ↑05 Feb 2023, 05:57 Ok. VDASH software has protocols and some SBLs inside their communication layer. This layer downloads during car communication. So it can be dissasembled and reversed for protocols not only Volcano which is known but also for UDS and newer. The code of vdash_u.exe is very alful. For example 8000 lines of code inside the main function is very funny. Also many copy-pasting about sending data to j2534 channel and reading of messages in place instead of HAL layer. So from developers point of view Pavel (vdash developer) is junior developer. But he is very enthusiast of Volvo. Eight year ago I tryed to dissabled vdash code. And there was an message from him about russian hackers that we assholes on something like this. But he is russian too. In current vdash code only message with job offer. So I have a dilemma. I don't want to ruin all the work of all the people who helped me with Volvo flashing (not the fucking vdash and fucking сzechs) and understanding of this process. But also I want to made some benefit to community.
Is this pavel the same one who has something to do with orange 5 calculators and scripts?
I don't know(

I identify Pavel by this comment:
http://hackingvolvo.blogspot.com/2012/1 ... 9280026751

He is unnamed now but Olaf answered to him by Pavel.

Looks like this pavel was on to somthing. It would appear just stopped.

prometey1982 · Post by **prometey1982** » 07 Feb 2023, 07:08

oscilloscope wrote: ↑06 Feb 2023, 06:47 What is it ment to do ?

Sorry I don't understand you. Can you explain your thoughts?

Post by **vtl** » 08 Feb 2023, 09:44

oscilloscope wrote: ↑06 Feb 2023, 06:47 What is it ment to do ?

I think he is trying to extract SBLs for various modules from VDASH files. That one is somehow related.

dikidera · Post by **dikidera** » 08 Feb 2023, 16:36

Now that I have my hands on a 2005 V70 L-shaped CEM, I very interested to know if there are any open source solutions, or in general, anything to get me started on changing the configuration options, specifically enabling features. Like BLISS, Rear park sensors, and the external petrol heater.
Is this configuration stored in internal SH705X flash(difficult to write to), external flash(also difficult to write to) or the more easily available EEPROM(very easy to overwrite)?

And if the CEM has a PBL to send it SBLs. These are my next goals, enable BLISS, install new side mirrors. Install an external petrol heater etc.

Next on the roadmap is a transplantation of an existing P3 DIM or entirely custom digital DIM with screen like 2014+.

In the meantime I went in and tested a few CAN commands from Volvo DHA.

I tried to clear the oil degradation with can command 6E B2 31, then I tested with ECM Clear All DTC 7A AF 11, and also CEM 50 AF 11, but nothing happened.
Perhaps the CEM,TCM and ECM are all expecting D2 protocol messages or anything but RAW can?

rkam · Post by **rkam** » 09 Feb 2023, 00:00

This thread used to be about CEM, so there is quite a bit of information earlier.

L-shaped CEM has an M32C CPU with a PBL, and require a pin code to allow sending an SBL to it.
EEPROM is encrypted with a key stored in Flash.

B2 and AF are D2 commands, and I'm still pretty sure you need the length byte while running normal communication mode (D2)
D2 commands cannot be used in programming mode.

prometey1982 · Post by **prometey1982** » 09 Feb 2023, 00:08

rkam wrote: ↑09 Feb 2023, 00:00 B2 and AF are D2 commands, and I'm still pretty sure you need the length byte while running normal communication mode (D2)
D2 commands cannot be used in programming mode.

Can you explain that is D2? Is it Volvo CAN protocol? Which protocol is used on P3 platform? As far as I know P3 platform uses 11 bit CAN messages. How does scanner request data from CMs? Which CAN id is used?

rkam · Post by **rkam** » 09 Feb 2023, 01:04

D2 is "Diagnose 2" and P3 is typically using GGD.
Both are Volvo protocols, but similar to other standards.
GGD is more like UDS.
See Vida tables T121 and T122.

De som forventer å komme til himmelen når de dør blir nok skuffet.

Vida CEM swapping

Re: Vida CEM swapping