Vida CEM swapping

[Dudde]

Someone have any updated parameter.txt for the CEMtool software? I lost mine

[Kravi80]

Someone have any updated parameter.txt for the CEMtool software? I lost mine

[Skavac]

Not trying to threadjack, a lot of people here are experts on Volvo modules, and maybe can help me with this.

We know key information is in CEM, and we can program new key by reading 28F400 or 93C86 and adding key ID to dump, and write crypt key to the transponder. However the remote is a bit more challenging.

A remote for P2 Volvos come with 2 codes, the short code and the long code.

In the first remote
Short: 0D7D101F
Long: 0A1C 2366 63D9 816D

In UEM Eeprom, short code goes to address
0x0C to 0x0F
However, the long code is changed from
0A1C 2366 63D9 816D to 2070 68DD 100D 1014
This code goes to address 0x4C to 0x53

Another remote
Short: 0084B4EA
Long: 0980 E5AC 2BDB 57E7

Short code is unchanged
Long code in UEM: CE78 E54B A06B 622E

I would like to know how to translate long code from the key's seed to the UEM code so the remote can work.

Remote 1.png (331.98 KiB) Viewed 1559 times

Compare 1.png (795.17 KiB) Viewed 1559 times

Remote 2.png (1.53 MiB) Viewed 1559 times

Compare 2.png (869.45 KiB) Viewed 1559 times

[Dudde]

A remote for P2 Volvos come with 2 codes, the short code and the long code.

In the first remote
Short: 0D7D101F
Long: 0A1C 2366 63D9 816D

In UEM Eeprom, short code goes to address
0x0C to 0x0F
However, the long code is changed from
0A1C 2366 63D9 816D to 2070 68DD 100D 1014
This code goes to address 0x4C to 0x53

Another remote
Short: 0084B4EA
Long: 0980 E5AC 2BDB 57E7

Short code is unchanged
Long code in UEM: CE78 E54B A06B 622E

I would like to know how to translate long code from the key's seed to the UEM code so the remote can work.

Can you upload dump so i can take a look. I myself have wondered the same.

[Skavac]

A remote for P2 Volvos come with 2 codes, the short code and the long code.

In the first remote
Short: 0D7D101F
Long: 0A1C 2366 63D9 816D

In UEM Eeprom, short code goes to address
0x0C to 0x0F
However, the long code is changed from
0A1C 2366 63D9 816D to 2070 68DD 100D 1014
This code goes to address 0x4C to 0x53

Another remote
Short: 0084B4EA
Long: 0980 E5AC 2BDB 57E7

Short code is unchanged
Long code in UEM: CE78 E54B A06B 622E

I would like to know how to translate long code from the key's seed to the UEM code so the remote can work.

Can you upload dump so i can take a look. I myself have wondered the same.

Attached are 3 files in this zip. One original file, another for the first remote, another for the second remote

[Dudde]

What tool have you used to add remotes?

[Skavac]

Added remote using official Volvo VIDA. Then read dumps from UEM with IOTerminal

[xanthefin]

You need go another way if you want add used remote in UEM.

This way only good if you get UEM + remotes as you already noticed SEED Key is rolling one.



You need program they remote itself if want make it as a new specially when UEM is missing or sniff it all via radio.

[Hectus]

Edit: for some reason its working again now, i got this pin 54 00 49 92 74 13.

Is this the actual pin or does it need to be converted into something?

[Skavac]

You need go another way if you want add used remote in UEM.

This way only good if you get UEM + remotes as you already noticed SEED Key is rolling one.



You need program they remote itself if want make it as a new specially when UEM is missing or sniff it all via radio.

Can you tell me more? You can program the remote if UEM is missing? Can the long UEM code be sniffed from radio?