Vida CEM swapping

[rkam]

You can put one or more of your probes directly on the CPU pins on the other side. Inside the metal box.

With the pin code, you could have dumped the flash in programming mode.

[LukeFlynn]

You can put one or more of your probes directly on the CPU pins on the other side. Inside the metal box.

With the pin code, you could have dumped the flash in programming mode.

via dice?

[rkam]

Yes, DiCE or other CAN bus interface. Most controllers can be read in programming mode although very slowly without special boot loaders.
The brick shaped CEM does not use a secondary boot loader. Sending the pin code is enough.
I don't remember if the available memory address range was limited though.

You should still try to trace the broken pad to another point or all the way back to the CPU pin.
It is always good to have a working ground level backup solution.

[vtl]

The brick shaped CEM does not use a secondary boot loader. Sending the pin code is enough.

Interesting. Given that the brick shaped CEM has unsoldered relays and like ten times easier to remove the plastic cover, it is hands down a better CEM than L-shaped one. If only it was possible to attack pin over CAN...

[vitalik2134]

Hello. Teensy 4.1 works well. I read the code and then read the CEM flash. Maybe someone has a dump of P2 XC90 2006 + B5254T2 you need to deal with it.

[dikidera]

I may not have studied compiler theory, but I for sure can tell that whatever compiler emitted this...is terrible. I've seen similar such code in all SH2 binaries I've studied. So many redundant operations.

sub_30E60:

var_2= -2

add #-4, r15 //redundant?
mov.w #PADR_W, r2
mov.w @r2, r0
mov.w r0, @(2,r15) // redundant
mov.w @(2,r15), r0 //redundant
extu.w r0, r0
mov.l #off_8000, r3
and r3, r0
cmp/eq r3, r0
movt r0
add #4, r15 //why even use the stack in the first place?
rts
nop

[vtl]

I see it very often that an old GCC (before ~4.4 or so) is/was used in vendor's SDKs. GCC didn't have Static Single Assignment that avoids unnecessary copies you've mention, and peephole optimization as well, which utilizes CPU's pipeline better by tossing the instructions slightly so they would produce the same result but cause less pipeline stalls.

Before that GCC version I was hand-writing assembly code better and understanding a disassembly code easily. After - not anymore.

[xiaofei204716]

[3staar]

Part no: 30765624

Trying to replace the CEM in my current car but cant seem to crack the pin, i keep getting the following:


Anyone have any insights as to why?

[vtl]

It is FF FF CB DB 0E