Vida CEM swapping

[T5Luke]

Yes both

[andrewgabler]

I was correct in my hypothesis that MKR Shield for some reason was not able to communicate with the bench cem. Adding 120hm termination to the uno allows it to communicate. In the process of cracking one of my bench cems now that my bosch transceivers came in.

[andrewgabler]

I decided it was time to catchup and make sure I missed nothing in this thread before posing further questions. I spent my night reading all 300 pages to digest the information and boy is there alot. I think I'll have some further questions later, but I am wondering about the PIN decoding still.

With my new hardware setup I cracked my first CEM-L (2006 s60 2.5t) on the bench with no dim hooked up. I then transferred my wiring to a different PN CEM-L also (2006 s60 2.5t) and it failed to crack 4 or 5 times (bad 3rd byte).

After reading this whole post I decided to switch the teensy clock speed to full 600mhz. This allowed the cracker to function and find a pin, but it failed to verify it? This happened twice and produced the same pin both times. I didn't save a log but can get one tomorrow when I run it again.

To ensure there was no hardware issues I transferred my connections back to the previously cracked CEM and re-cracked it with no issue. Both PN are defined in the file, so I'm not sure why it is having this issue. Neither of my CEM-H's cracked at 180mhz, but I only tried once so far.

Any ideas? Thanks for the help.

Edit: 1 CEM-L Cracked 1CEM-H Cracked 2 with found pins that fail verification.

[kailash9999]

I have a little present for you all if it is helpful, It can be used with Dice for individual module programming as long as you have 3 items.
1) pin code
2) SBL (secondary boot loader)
3) the file you wish to flash.

This is the latest version used from P80 Chassis types all the way to the new SPA/CMA platform.
The software comes with an example for programming your own application along with SDK and information in PDF format.

If posting this is in violation of any terms please let me know.

Nice! Is it written by you?

This software is written by Volvo, when volvo technicians (not dealer technicians) need to sort cars on the side of the road (warranty vehicles) they can take the SBL/Firmware with them along with pin codes and programme the vehicle without using Vida.

This is why normal technicians can get hold of the software but not the files. This is because regional techs are supposed to delete all files when finished.

Wish I knew more about coding but I'm a part timer and only code things when needed, this unfortunately means I have to refresh my C knowledge everytime.

If we can make our own SBL's we may be in with a chance using this software.

I also have other software packages that may be helpful such as car config editor. Again though some files are missing but I do have sample files.



Pictures from the car config editor:
Main folder:

Open File image:

Vehicle details image:

Changing car configuration image:


This is all OEM software, used along with Vida by Volvo regional technicians to diagnose/test/repair vehicles with the minimum of fuss.

This thread has helped me a lot so far in regards to pins. So I would like to give something back to contributors only at the moment. The reason for this is I believe we can maybe make our own software. interface with teensy or something alike. To crack pin, read vehicle config. Read all vehicle module firmwares for backup in case of future failure. Also changing configs would not require the use of other software such as Vida/ Vdash. Saving a lot of people a lot of time and money.

Hi require Volvo SDA Tool, Car config and VBF Editor, could you please share the download link as PM please ? Thanks !

[jamezcab]

my apologies this is a lab rat i ordered. obviously incorrect

Be a man and make it a CEM!

is immo pin in the same dump?

[DJGlock]

Sorry was 50 downloads only, here are both again...

Also Windows 10 doesn't notice me about anything, maybe it is location based on 3 computers i get nothing. Maybe defender in US sees something problematic in this code...

Dear T5Luke
I tried to use UDSTool Crack to get PIN for my XC70, but got the following issue.
Car: XC70 2007, YV1SZ595771286825
Dice: Chinese clone, but works good (as per my experience).
Repro steps:
The car stayed for a day, I just opened it, connected DICE and run your tool. Did not touch ignition lock at all (so it was in position 0).
It tried to start the process, but failed (log below).

Repeated several times - no luck. Had a small conversation with vtl, he advised to ask for help here.
Does the response from CEM tells you anything useful? Vtl told me that it looks like one of modules did not enter sleeping mode and hence the response was bad. Any ideas how to fix it? May be you have any other build with extended logging?

I had a small conversation with T2Luke regarding this. Small update:
I was able to start PIN cracking procedure. Not sure what was wrong last time (in Autumn). But this time I did the following:
- Disconnected battery for 10-20 s.
- Switched on - off the ignition.
- Waited for 5-6 minutes.
- Started crack util.

And did this a couple of times. I have not got any PIN yet (I will have to repeat this procedure several times, because don't have a charger nearby). But anyway it works. May be it will help anybody.




And just a random question, a little bit off topic:
A have two DIMs. One is native with English, another one is from Spain. And I want to have a new DIM with English.
How can I download the image from DIM1 and upload it to DIM2 using Dice (another words - how to clone DIM)? I can use VDASH for sure, but I don't want to pay around 60 Euros for what I already have I can see that T5Luke has CEM Image reader, but cannot find similar tool for DIM. Can you point me to the right direction/topic please? I used forum search, but was not so lucky

[NFedor]

Sorry was 50 downloads only, here are both again...

Also Windows 10 doesn't notice me about anything, maybe it is location based on 3 computers i get nothing. Maybe defender in US sees something problematic in this code...

Dear T5Luke
I tried to use UDSTool Crack to get PIN for my XC70, but got the following issue.
Car: XC70 2007, YV1SZ595771286825
Dice: Chinese clone, but works good (as per my experience).
Repro steps:
The car stayed for a day, I just opened it, connected DICE and run your tool. Did not touch ignition lock at all (so it was in position 0).
It tried to start the process, but failed (log below).

Repeated several times - no luck. Had a small conversation with vtl, he advised to ask for help here.
Does the response from CEM tells you anything useful? Vtl told me that it looks like one of modules did not enter sleeping mode and hence the response was bad. Any ideas how to fix it? May be you have any other build with extended logging?

I had a small conversation with T2Luke regarding this. Small update:
I was able to start PIN cracking procedure. Not sure what was wrong last time (in Autumn). But this time I did the following:
- Disconnected battery for 10-20 s.
- Switched on - off the ignition.
- Waited for 5-6 minutes.
- Started crack util.

And did this a couple of times. I have not got any PIN yet (I will have to repeat this procedure several times, because don't have a charger nearby). But anyway it works. May be it will help anybody.




And just a random question, a little bit off topic:
A have two DIMs. One is native with English, another one is from Spain. And I want to have a new DIM with English.
How can I download the image from DIM1 and upload it to DIM2 using Dice (another words - how to clone DIM)? I can use VDASH for sure, but I don't want to pay around 60 Euros for what I already have I can see that T5Luke has CEM Image reader, but cannot find similar tool for DIM. Can you point me to the right direction/topic please? I used forum search, but was not so lucky

X-Prog programmer.

[oscilloscope]

Dear T5Luke
I tried to use UDSTool Crack to get PIN for my XC70, but got the following issue.
Car: XC70 2007, YV1SZ595771286825
Dice: Chinese clone, but works good (as per my experience).
Repro steps:
The car stayed for a day, I just opened it, connected DICE and run your tool. Did not touch ignition lock at all (so it was in position 0).
It tried to start the process, but failed (log below).

Repeated several times - no luck. Had a small conversation with vtl, he advised to ask for help here.
Does the response from CEM tells you anything useful? Vtl told me that it looks like one of modules did not enter sleeping mode and hence the response was bad. Any ideas how to fix it? May be you have any other build with extended logging?

I had a small conversation with T2Luke regarding this. Small update:
I was able to start PIN cracking procedure. Not sure what was wrong last time (in Autumn). But this time I did the following:
- Disconnected battery for 10-20 s.
- Switched on - off the ignition.
- Waited for 5-6 minutes.
- Started crack util.

And did this a couple of times. I have not got any PIN yet (I will have to repeat this procedure several times, because don't have a charger nearby). But anyway it works. May be it will help anybody.




And just a random question, a little bit off topic:
A have two DIMs. One is native with English, another one is from Spain. And I want to have a new DIM with English.
How can I download the image from DIM1 and upload it to DIM2 using Dice (another words - how to clone DIM)? I can use VDASH for sure, but I don't want to pay around 60 Euros for what I already have I can see that T5Luke has CEM Image reader, but cannot find similar tool for DIM. Can you point me to the right direction/topic please? I used forum search, but was not so lucky

X-Prog programmer.

You'll need xprog with the appropriate auth , then IoT , or smok , supposedly smok that can perform certain cems on the bench.

[prometey1982]

There is the flashing documentation for Renesas M16/M32 chips
https://www.renesas.com/us/en/document/ ... -m32c-r32c
Also code for flash/erase functions are available. I'll write tools for flash CEM-L/H over j2534 device. But need some help with getting data from CAN for such MCUs.

[prometey1982]

Disassembled IDA 7.7 database of my CEM
https://cloud.mail.ru/public/DXjh/HcoBA3QWU

CAN registers are not defined. But code looks fine. Will continue analyze of the code later.