Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
User avatar
prometey1982
Posts: 46
Joined: 5 June 2021
Year and Model: 2010 XC90
Location: Novosibirsk
Has thanked: 4 times
Been thanked: 5 times
Contact:

Re: Vida CEM swapping

Post by prometey1982 »

rkam wrote: 09 Feb 2023, 01:04 De som forventer å komme til himmelen når de dør blir nok skuffet.
Thanks for explanation.

Да это не важно, просто игра слов для некоторых с украинским флагом. Хотя сам он жил в соседнем со мной городе. Точнее так, я жил в деревне в 40 км от города. И ездил в город учиться, а потом работать. И вот так по разному судьба сложилась. Я хоть и не прям патриот своей страны, но благодарен тому, что она мне дала. Наше бесплатное образование, и наши люди, которые преподают. Короче, минусов хватает, как и везде. Но никогда не понимал людей, которые начинают прям ненавидеть свою родину. Это же как родственники, какие бы они не были, они все равно твои родственники. Да, порой лучше прекратить с ними общение, но чтобы начать их ненавидеть и желать им смерти? Я такого не понимаю и понять не смогу.
Они просто сдохнут, а мы попадем в рай.

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

rkam wrote: 09 Feb 2023, 00:00 This thread used to be about CEM, so there is quite a bit of information earlier.

L-shaped CEM has an M32C CPU with a PBL, and require a pin code to allow sending an SBL to it.
EEPROM is encrypted with a key stored in Flash.

B2 and AF are D2 commands, and I'm still pretty sure you need the length byte while running normal communication mode (D2)
D2 commands cannot be used in programming mode.
Then more work is to come.

I have been thinking how to speedup vtl's bruteforcer.

VTL, what if instead of waiting for a reply immediately after sending pin request, we spam the bus with the pin combination. We create a thread to monitor for CEM replies and log the one that say sucess. We extrapolate the data and narrow down on the pin possibly used.
Or does the bottleneck come from the reply speed of the CEM and cannot be further optimized?

I would imagine if it was full 2^48 bits it would have been impossible over CAN. But since I am not a math person due to reasons, what is expected with the histogram?
If the ECU replied back slower it means that more instructions got executed and thus more branches taken and thus this is a side-channel attack?

rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

The 6-byte pin code cracker is using timing side-channel attack so it can crack some of the numbers before the rest.
The UDS cracker is 24-bit. The resulting pin is one out of 65536 that will work with UDS protocol. One of them would be the above.

vtl  
Posts: 4724
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 604 times

Post by vtl »

P1/P2 can be sped up, in exchange of loss of "run anywhere". The current P2 algo is compatible with all the CEMs. P1 CEMs, at least some of them, can be sped up drastically, as shown by sirlion. But that does not work with any of P2 CEMs. I probably can improve the code here and there to make it run slightly faster and smoother, but I have no spare time for hobbies recently.

P3 is a completely different beast, it is just a dumb brute force that relies solely on CEM processing speed. Since it is a constant time hash algo, timing attack does not apply.

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

Thank you for this information.

I wish to mention some of my observations.

When I sent CAN commands to the car while running such as CB 7A A6 10 1D, which means get Engine RPM, I get a reply back that says CC 7F A6 12, according to DHA it means "Sub-function not supported or wrong message format". Since I know it is correct and exists, it means my message format is wrong and the protocol rejects it.

vtl  
Posts: 4724
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 604 times

Post by vtl »

dikidera wrote: 09 Feb 2023, 09:42 When I sent CAN commands to the car while running such as CB 7A A6 10 1D, which means get Engine RPM, I get a reply back that says CC 7F A6 12, according to DHA it means "Sub-function not supported or wrong message format". Since I know it is correct and exists, it means my message format is wrong and the protocol rejects it.
C8 + request size
module id
the rest is the request itself

Actually, A6 needs a repetition byte: https://github.com/vtl/volvo-ddd/blob/m ... 5_us.h#L60

So your msg would need to look like CC 7A A6 10 1D 01, I think.

Also are you sure ECM has that 7A id? And the A6 command offset/address is the right one?

rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

CD actually.
CD 7A A6 10 1D 01
This is one of the things I do wrong most often while trying something in a hurry.

And while you're at it: ;-)
CB 7A B9 F0

I typically also fill the rest of the CAN message with 00.
CB 7A B9 F0 00 00 00 00

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

@vtl I will try that combination, but you can see I am no stranger to bruteforce approach.
diki@raspberrypi:~ $ history 350 | grep 7AA6
1435 cansend can1 000FFFFE#CD7AA61042010000
1707 cansend can1 000FFFFE#CB7AA6100d
1708 cansend can1 000FFFFE#CB7AA6100D
1709 cansend can1 000FFFFE#CC7AA6100D
1710 cansend can1 000FFFFE#CB7AA6100D
1711 cansend can1 000FFFFE#7AA6100D
1712 cansend can1 00000726#7AA6100D
1713 cansend can1 00000726#CB7AA6100D
1714 cansend can1 000FFFFE#7AA6100D
1715 cansend can1 000FFFFE#CB7AA6100D
1716 cansend can1 000FFFFE#CB7AA6100D00
1717 cansend can1 000FFFFE#CB7AA6100D000000
1718 cansend can1 000FFFFE#CB7AA6100D00
1719 cansend can1 000FFFFE#CB7AA6100D000000
1720 cansend can1 000FFFFE#CB7AA61000
1721 cansend can1 000FFFFE#CB7AA61001
1722 cansend can1 000FFFFE#CB7AA61002
1723 cansend can1 000FFFFE#CB7AA61003
1724 cansend can1 000FFFFE#CB7AA6100D000000
1730 cansend can1 000FFFFE#CB7AA61001D00000
1731 cansend can1 000FFFFE#CB7AA6101D000000
1732 cansend can1 000FFFFE#CB7AA6101D0000
1733 cansend can1 000FFFFE#CB7AA6101D
1734 cansend can1 000FFFFE#7AA6101D
1735 cansend can1 000FFFFE#CB7AA6101D
1736 cansend can1 000FFFFE#CB7AA61023
1737 cansend can1 000FFFFE#CB7AA61024
1738 cansend can1 000FFFFE#CB7AA61024000000
1739 cansend can1 000FFFFE#CB7AA6101D
1740 cansend can1 000FFFFE#CB7AA6101D000000
1741 cansend can1 000FFFFE#CB7AA61024000000
1742 cansend can1 000FFFFE#7AA61024
1743 cansend can1 000FFFFE#7AA6102400000000
1744 cansend can1 000FFFFE#CC7AA61024000000
1745 cansend can1 000FFFFE#CC7AA61024010000
1746 cansend can1 000FFFFE#CB7AA61024010000
1748 cansend can1 000FFFFE#CB7AA61024010000
1749 cansend can1 000FFFFE#CB7AA61024000000
1750 cansend can1 000FFFFE#CB7AA6101D020000
1751 cansend can1 000FFFFE#CB7AA6101D02
1752 cansend can1 000FFFFE#CB7AA61000000000
1753 cansend can1 000FFFFE#CC7AA61000000000
1754 cansend can1 000FFFFE#CD7AA61000000000
1755 cansend can1 000FFFFE#CA7AA61000000000
1756 cansend can1 000FFFFE#C7AA61000000000
1757 cansend can1 000FFFFE#CB7AA61000000000
1758 cansend can1 000FFFFE#CB7AA6100001
1759 cansend can1 000FFFFE#CB7AA61000010000
1760 cansend can1 000FFFFE#CB7AA610000100
1761 cansend can1 000FFFFE#CB7AA61001000000
1762 cansend can1 000FFFFE#CB7AA610010000
1763 cansend can1 000FFFFE#CB7AA61001
1764 cansend can1 000FFFFE#CC7AA61001
1765 cansend can1 000FFFFE#CB7AA61001
1784 history 350 | grep 7AA6
diki@raspberrypi:~ $

Additionally, ever since I managed to make all modules sleep a few weeks ago, I got a persistent SRS DTC set(it's on the DIM in text variant so it could be something else), I looked at DHA and it said to clear DTC of SRS Module, I need to use 58 AF 11
1546 cansend can1 000FFFFE#CB58AF1100000000
1547 cansend can0 000FFFFE#CB58AF1100000000
1548 cansend can1 000FFFFE#CB58AF1100000000
1549 cansend can1 000FFFFE#CB58AF11
1550 cansend can1 000FFFFE#CB58AF1100
1551 cansend can0 000FFFFE#CB58AF1100
1552 cansend can0 000FFFFE#CB58AF11
1553 cansend can0 000FFFFE#C58AF11
1554 cansend can0 000FFFFE#CB58AF11
1555 cansend can1 000FFFFE#CB58AF11
1556 cansend can1 000FFFFE#CB58AF1100
1557 cansend can1 000FFFFE#CB58AF110000
1558 cansend can1 000FFFFE#CB58AF11000000
1559 cansend can1 000FFFFE#CB58AF1100000000
1562 cansend can1 000FFFFE#CB58AF1100000000
1563 cansend can1 000FFFFE#CC58AF1100000000
1564 cansend can1 000FFFFE#CC58AF11000000
1565 cansend can1 000FFFFE#CC58AF110000
1566 cansend can1 000FFFFE#CC58AF1100
1567 cansend can1 000FFFFE#CC58AF11
1568 cansend can1 000FFFFE#CB58AF1100000000
1569 cansend can1 000FFFFE#CB58AF11000000
1570 cansend can1 000FFFFE#CB58AF110000
1571 cansend can1 000FFFFE#CB58AF1100
1572 cansend can1 000FFFFE#CB58AF11
1573 cansend can1 00000726#CB58AF11
1574 cansend can1 00000726#CB58AF1100000000
1575 cansend can1 00000726#58AF1100000000
1576 cansend can1 00000726#58AF110000000000
1577 cansend can1 000FFFFE#58AF11
1578 cansend can1 000FFFFE#58AF1100
1579 cansend can1 000FFFFE#58AF110000
1580 cansend can1 000FFFFE#58AF11000000
1581 cansend can1 000FFFFE#58AF1100000000
1582 cansend can1 000FFFFE#58AF110000000000
1583 cansend can1 000FFFFE#58AF1100000000
1584 cansend can1 000FFFFE#58AF11000000
1585 cansend can1 000FFFFE#58AF1100
1586 cansend can1 000FFFFE#58AF11
1587 cansend can1 000FFFFE#CB58AF11
1588 cansend can1 000FFFFE#CB58AF1100
1589 cansend can1 000FFFFE#CB58AF110000
1590 cansend can1 000FFFFE#CB58AF11000000
1591 cansend can1 000FFFFE#CB58AF1100000000
1592 cansend can1 00000726#CB58AF1100000000
1593 cansend can1 00000726#CB58AF11000000
1594 cansend can1 00000726#CB58AF11000
1595 cansend can1 00000726#CB58AF1100
1596 cansend can1 00000726#CB58AF11
1599 cansend can1 000FFFFE#CB58AF1100000000
1600 cansend can1 000FFFFE#CC58AF1100000000
1601 cansend can1 000FFFFE#CD58AF1100000000
1602 cansend can1 000FFFFE#CE58AF1100000000
1603 cansend can1 000FFFFE#CF58AF1100000000
1604 cansend can1 000FFFFE#CA58AF1100000000
1605 cansend can1 000FFFFE#C958AF1100000000
1606 cansend can1 000FFFFE#C858AF1100000000
1607 cansend can0 000FFFFE#C858AF1100000000
1608 cansend can0 000FFFFE#C958AF1100000000
1609 cansend can0 000FFFFE#C58AF1100000000
1610 cansend can0 000FFFFE#CA58AF1100000000
1611 cansend can0 000FFFFE#CB58AF1100000000
1612 cansend can0 000FFFFE#CE58AF1100000000
1613 cansend can0 000FFFFE#CD58AF1100000000
1614 cansend can0 000FFFFE#CF58AF1100000000
1615 cansend can0 000FFFFE#CB58AF11000000
1616 cansend can0 000FFFFE#CB58AF110000
1617 cansend can0 000FFFFE#CB58AF1100
1618 cansend can0 000FFFFE#CB58AF11
1619 cansend can1 000FFFFE#C858AF1100000000
1620 cansend can1 000FFFFE#CB58AF1100000000
1621 cansend can1 000FFFFE#CB58AF11000000
1622 cansend can1 000FFFFE#CB58AF110000
1623 cansend can1 000FFFFE#CB58AF1100
1624 cansend can1 000FFFFE#CB58AF11
1625 cansend can1 000FFFFE#58AF11
1626 cansend can1 000FFFFE#58AF110000000000
1627 cansend can1 000FFFFE#58AF11
1662 cansend can1 000FFFFE#58AF11
1663 cansend can1 000FFFFE#CB58AF11
1664 cansend can1 000FFFFE#CB58AF1100
1665 cansend can1 000FFFFE#CB58AF110000
1666 cansend can1 000FFFFE#CB58AF1100000
1667 cansend can1 000FFFFE#CB58AF11000000
1668 cansend can1 000FFFFE#CB58AF1100000000
1669 cansend can1 000FFFFE#58AF1100000000
1670 cansend can1 000FFFFE#58AF110000000000
1671 cansend can1 000FFFFE#D058AF110000000000
1672 cansend can1 000FFFFE#D058AF11
1673 cansend can1 000FFFFE#CB58AF11
1674 cansend can1 000FFFFE#CD58AF11
1675 cansend can1 000FFFFE#CD58AF1100
1676 cansend can1 000FFFFE#CD58AF1101
1677 cansend can1 000FFFFE#CB58AF1101
1678 cansend can0 000FFFFE#CB58AF1101
1679 cansend can0 000FFFFE#CB58AF1100
1680 cansend can0 000FFFFE#CB58AF11
1725 cansend can1 000FFFFE#CB58AF1100000000
1726 cansend can1 000FFFFE#CA58AF1100000000
1727 cansend can1 000FFFFE#CC58AF1100000000
1728 cansend can1 000FFFFE#CA58AF1100000000
1729 cansend can1 000FFFFE#CD58AF1100000000
1785 history 1000 | grep 58AF11
diki@raspberrypi:~ $
I tried all these combinations and on low speed and high speed bus. Maybe it's set elsewhere, I am not sure.


@rkam, I tried the command, but because I am not sure what CAN ID to expect, I am not sure if I saw the correct response.
923 cansend can0 000FFFFE#CB7AB9F0
924 cansend can0 000FFFFE#7AB9F0
925 cansend can0 000FFFFE#CB7AB9F000000000
926 cansend can0 000FFFFE#CD7AB9F000000000
927 cansend can0 000FFFFE#7AB9F000000000
1172 cansend can1 000FFFFE#7AB9F0
1173 cansend can1 000FFFFE#7AB9F00000000000
1174 cansend can1 000FFFFE#CB7AB9F000000000
1175 cansend can1 000FFFFE#7AB9F00000000000
1176 cansend can1 000FFFFE#CB7AB9F00000000000
1177 cansend can1 000FFFFE#CB7AB9F000000000
1178 cansend can1 000FFFFE#7AB9F00000000000
1179 cansend can1 00000726#CB7AB9F000000000
1180 cansend can1 00000726#7AB9F000000000
1181 cansend can1 00000726#7AB9F00000000000
1183 cansend can1 00000726#7AB9F00000000000
1184 cansend can1 000FFFFE#7AB9F00000000000
1185 cansend can1 000FFFFE#B9F00000000000
1186 cansend can1 000FFFFE#B9F0000000000000
1187 cansend can1 000FFFFE#7AB9F00000000000
1189 cansend can1 000FFFFE#7AB9F00000000000
1190 cansend can1 000FFFFE#B9F0000000000000
1191 cansend can1 00000726#7AB9F00000000000
1192 cansend can1 000FFFFE#B9F0000000000000
1193 cansend can1 000FFFFE#7AB9F00000000000
1194 cansend can1 000FFFFE#CB7AB9F000000000
1195 cansend can1 000FFFFE#7AB9F00000000000
1196 cansend can1 000FFFFE#CB7AB9F000000000
1197 cansend can1 000FFFFE#7AB9F00000000000
1198 cansend can1 000FFFFE#CB7AB9F000000000
1199 cansend can1 00000726#7AB9F00000000000
1201 cansend can1 00000726#7AB9F0000000000A
1202 cansend can1 00000726#7AB9F00000000000
1203 cansend can1 000FFFFE#CB7AB9F000000000
1204 cansend can1 000FFFFE#7AB9F00000000000
1205 cansend can1 000FFFFE#50B9F00000000000
1206 cansend can1 000FFFFE#CB50B9F000000000
1207 cansend can1 000FFFFE#7AB9F00000000000
1208 cansend can1 000FFFFE#CB50B9F000000000
1209 cansend can1 000FFFFE#CB7AB9F000000000
1210 cansend can1 000FFFFE#CB50B9F000000000
1211 cansend can1 000FFFFE#7AB9F00000000000
1213 cansend can1 000FFFFE#7AB9F000000000
1214 cansend can1 000FFFFE#CB7AB9F000000000
1215 cansend can1 000FFFFE#7AB9F000000000
1216 cansend can1 000FFFFE#7AB9F00000000000
1217 cansend can1 000FFFFE#7AB9F0
1218 cansend can1 000FFFFE#CA7AB9F0
1219 cansend can1 000FFFFE#CD7AB9F0
1220 cansend can1 000FFFFE#CE7AB9F0
1221 cansend can1 000FFFFE#FFB9F0
1230 cansend can1 000FFFFE#7AB9F0
1240 cansend can1 000FFFFE#7AB9F00000000000
1247 cansend can1 000FFFFE#7AB9F00000000000
1248 cansend can1 000FFFFE#CB7AB9F000000000
1249 cansend can1 000FFFFE#C7AB9F000000000
1250 cansend can1 000FFFFE#CA7AB9F000000000
1252 cansend can1 000FFFFE#CA7AB9F000000000
1254 cansend can1 000FFFFE#7AB9F00000000000
1255 cansend can1 000FFFFE#CA7AB9F000000000
1256 cansend can1 000FFFFE#CB7AB9F000000000
1257 cansend can1 000FFFFE#7AB9F00000000000
1258 cansend can1 000FFFFE#CB7AB9F00000000000
1259 cansend can1 000FFFFE#CB7AB9F000000000
1260 cansend can1 000FFFFE#7AB9F00000000000
1262 cansend can1 000FFFFE#7AB9F00000000000
1269 cansend can1 000FFFFE#7AB9F00000000000
1270 cansend can1 000FFFFE#CB7AB9F000000000
1271 cansend can1 000FFFFE#7AB9F00000000000
1272 cansend can1 000FFFFE#CB7AB9F000000000
1273 cansend can1 000FFFFE#CB7AB9F00000000000
1274 cansend can1 000FFFFE#CB7AB9F000000000
1275 cansend can1 000FFFFE#CB7AB9F0000000
1276 cansend can1 000FFFFE#CB7AB9F000000000
1277 cansend can1 000FFFFE#7AB9F00000000000
1278 cansend can1 000FFFFE#7AB9F000000000
1279 cansend can1 000FFFFE#7AB9F0000000
1280 cansend can1 000FFFFE#7AB9F00000
1281 cansend can1 000FFFFE#7AB9F000
1282 cansend can1 000FFFFE#7AB9F0
1284 cansend can1 000FFFFE#7AB9F00000000000
1285 cansend can1 00800021#7AB9F00000000000
1286 cansend can1 00000726#7AB9F00000000000
1287 cansend can1 000726#7AB9F00000000000
1288 cansend can1 726#7AB9F00000000000
1289 cansend can1 726#CB7AB9F000000000
1304 cansend can1 000FFFFE#7AB9F00000000000
1305 cansend can1 000FFFFE#CB7AB9F000000000
1308 cansend can1 000FFFFE#7AB9F0
1336 cansend can1 0FE#7AB9F0
1337 cansend can1 726#7AB9F0
1338 cansend can1 FFF#7AB9F0
1339 cansend can1 000000#7AB9F0
1340 cansend can1 0#7AB9F0
1341 cansend can1 000#7AB9F0
1345 cansend can1 021#7AB9F0
1363 cansend can1 000FFFFE#8|7AB9F00000000000
1364 cansend can1 000FFFFE#R8|7AB9F00000000000
1365 cansend can1 "000FFFFE#R8|7AB9F00000000000"
1366 cansend can1 000FFFFE#R8|7AB9F00000000000
1367 cansend can1 "000FFFFE#R8|7AB9F00000000000"
1368 cansend can1 "000FFFFE#R8|7AB9F000000000"
1369 cansend can1 "000FFFFE#R1|7AB9F000000000"
1370 cansend can1 "000FFFFE#R17AB9F000000000"
1371 cansend can1 "000FFFFE#R1#7AB9F000000000"
1372 cansend can1 000FFFFE#R1#7AB9F000000000
1373 cansend can1 000FFFFE#R2#7AB9F000000000
1374 cansend can1 000FFFFE#R2<7AB9F000000000>
1375 cansend can1 000FFFFE#R27AB9F000000000
1681 cansend can0 000FFFFE#CB50B9F0
1682 cansend can0 000FFFFE#50B9F0
1683 cansend can0 000FFFFE#CB50B9F0
1684 cansend can0 000FFFFE#50B9F0
1685 cansend can1 000FFFFE#50B9F0
1686 cansend can1 000FFFFE#CB50B9F0
1687 cansend can1 000FFFFE#50B9F0
1688 cansend can1 000FFFFE#CB50B9F0
1689 cansend can1 000FFFFE#CB50B9F000000000
1690 cansend can1 000FFFFE#CB40B9F000000000
1691 cansend can1 000FFFFE#40B9F000000000
1692 cansend can1 000FFFFE#40B9F00000000000
1693 cansend can1 000FFFFE#50B9F00000000000
1694 cansend can1 000FFFFE#CA50B9F000000000
1696 cansend can1 000FFFFE#CA50B9F000000000
1697 cansend can1 000FFFFE#50B9F00000000000
1698 cansend can1 000FFFFE#CB40B9F000000000
1699 cansend can1 000FFFFE#CB50B9F000000000
1701 cansend can1 000FFFFE#CB50B9F0
1702 cansend can1 000FFFFE#CB7AB9F0
1703 cansend can1 000FFFFE#7AB9F0
1705 cansend can1 000FFFFE#7AB9F0
1706 cansend can1 000FFFFE#CB7AB9F0
1786 history 1000 | grep B9F0
diki@raspberrypi:~ $
Additionally I am starting to think cansend(from can-utils) is inserting additional data and changing the frame slightly. So I will quickly put together my version in Python.

rkam
Posts: 102
Joined: 19 October 2022
Year and Model: 14473_96090_XC7007
Location: Norway
Has thanked: 5 times
Been thanked: 25 times

Post by rkam »

When you got the 7F response you almost had everything right.

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

Success. I managed to reset the TCM oil counter. I had done a drain and flush several times and noticed good shifts for a short while then they became progressively worse. Now after resetting the oil degradation counter, the shifts become smoother, faster and the gearbox doesn't try to upshift immediately after reaching a certain speed but lets me maintain high RPMs for a while longer.

I also managed to talk to the ECM, CEM and so forth. But the SRS module was AWOL, it did not reply back.

SRS Can command was CB 58 AF 11 00 00 00 00 to clear all stored 2 byte DTCs. I sent the same command (CB 50 AF 11 etc) to the CEM, and DIM and ECM(and they work, it clears everything), but the SRS Airbag Urgent error has not disappeared. I wonder if another module is storing the codes or my SRS module is dead.

Post Reply
  • Similar Topics
    Replies
    Views
    Last post