Vida CEM swapping

[WhizzMan]

The problem is that Io-terminal and others cannot load SBL with a pin other than FF.

So even if you know the PIN, you cannot modify the SBL to work with a different PIN?
Would below scenario work? Is it even useful or would just using other method be just as fast/complex?

1. Read the PIN via other method
2. "store" the original PIN
3. write just the pin to FF (let all other data remain)
4. Load SBL, read entire 512 kB.
5. write original PIN back.

[Treur]

Так бесполезно читать в диагностической сессии, ну прочитали, а записать всё равно в ней не можем. Вот если мы можем переписать кусок с пином/пропатчить основную программу и PBL, то был бы смысл. Я не особо даже рассматриваю уже этот металлолом ибо тачки на них уже в стадии вымирания.
По части терминала - они далеко не всё вывесили на сайте. Я уже поимел их SBL, но CEM его принимает только при пин FF, и я честно то говоря не очень понимаю мышление шведов - мы пишем только новый блок. Тут рождается логичный вопрос - приехал к дилеру клиент на скажем дооснащение ииии????

It is easier if we stick to English, now I have to copy/paste to Google translate to read.

The logic of the Swedes is not too difficult to understand

1. New car on production line: put config in CEM, put pin codes in for security, how you write bits and bytes is irrelevant.
2. Broken car: replace CEM with virgin, download full config from Volvo headquarters, write full config and pin in new hardware, see "New Car" on how.
3. Changed config in car: Update config in Database at Volvo headquarters, generate new config file on Volvo Headquarters database, see "broken car" for the rest.

All of these scenarios work by assuming that VIDA is used and all car configuration changes are initiated using the central configuration database at Volvo headquarters. All scenarios work by replacing the CEM if it is not working, no repairs done to the CEM themselves.
All scenarios work by assuming that a replacement CEM is a virgin. No other scenarios are possible for Volvo Dealers, because they don't put in 2nd hand parts.

From a manufacturer and dealer perspective, this makes perfect sense. "Monkeys can program a new CEM in car", "Monkeys can replace a CEM in the field", "Monkeys can reprogram a CEM in the field". For people wanting to work on their own car, it is not so easy, but even before the year 2000, manufacturers stopped caring about that.

Okay, the dealer made a config. How will he load it there via Vida/sledgehammer??? CEM will not load SBL, loading is impossible without it. The dealer cannot use BDM. At the same time, I can freely rewrite CEM L via SBL including the PBL area.

So I go to the dealer and want them to activate the cruise control, and they change the CEM. Right?

[Dudde]

Так бесполезно читать в диагностической сессии, ну прочитали, а записать всё равно в ней не можем. Вот если мы можем переписать кусок с пином/пропатчить основную программу и PBL, то был бы смысл. Я не особо даже рассматриваю уже этот металлолом ибо тачки на них уже в стадии вымирания.
По части терминала - они далеко не всё вывесили на сайте. Я уже поимел их SBL, но CEM его принимает только при пин FF, и я честно то говоря не очень понимаю мышление шведов - мы пишем только новый блок. Тут рождается логичный вопрос - приехал к дилеру клиент на скажем дооснащение ииии????

It is easier if we stick to English, now I have to copy/paste to Google translate to read.

The logic of the Swedes is not too difficult to understand

1. New car on production line: put config in CEM, put pin codes in for security, how you write bits and bytes is irrelevant.
2. Broken car: replace CEM with virgin, download full config from Volvo headquarters, write full config and pin in new hardware, see "New Car" on how.
3. Changed config in car: Update config in Database at Volvo headquarters, generate new config file on Volvo Headquarters database, see "broken car" for the rest.

All of these scenarios work by assuming that VIDA is used and all car configuration changes are initiated using the central configuration database at Volvo headquarters. All scenarios work by replacing the CEM if it is not working, no repairs done to the CEM themselves.
All scenarios work by assuming that a replacement CEM is a virgin. No other scenarios are possible for Volvo Dealers, because they don't put in 2nd hand parts.

From a manufacturer and dealer perspective, this makes perfect sense. "Monkeys can program a new CEM in car", "Monkeys can replace a CEM in the field", "Monkeys can reprogram a CEM in the field". For people wanting to work on their own car, it is not so easy, but even before the year 2000, manufacturers stopped caring about that.

Okay, the dealer made a config. How will he load it there via Vida/sledgehammer??? CEM will not load SBL, loading is impossible without it. The dealer cannot use BDM. At the same time, I can freely rewrite CEM L via SBL including the PBL area.

So I go to the dealer and want them to activate the cruise control, and they change the CEM. Right?

If you want to activate CC you can write the config, dealer gets pin to that car from DB and write config block, problem is how to read the flash... Writing is easy if you have pin. But for diy you want to read the flash first before editing..

[Treur]

It is easier if we stick to English, now I have to copy/paste to Google translate to read.

The logic of the Swedes is not too difficult to understand

1. New car on production line: put config in CEM, put pin codes in for security, how you write bits and bytes is irrelevant.
2. Broken car: replace CEM with virgin, download full config from Volvo headquarters, write full config and pin in new hardware, see "New Car" on how.
3. Changed config in car: Update config in Database at Volvo headquarters, generate new config file on Volvo Headquarters database, see "broken car" for the rest.

All of these scenarios work by assuming that VIDA is used and all car configuration changes are initiated using the central configuration database at Volvo headquarters. All scenarios work by replacing the CEM if it is not working, no repairs done to the CEM themselves.
All scenarios work by assuming that a replacement CEM is a virgin. No other scenarios are possible for Volvo Dealers, because they don't put in 2nd hand parts.

From a manufacturer and dealer perspective, this makes perfect sense. "Monkeys can program a new CEM in car", "Monkeys can replace a CEM in the field", "Monkeys can reprogram a CEM in the field". For people wanting to work on their own car, it is not so easy, but even before the year 2000, manufacturers stopped caring about that.

Okay, the dealer made a config. How will he load it there via Vida/sledgehammer??? CEM will not load SBL, loading is impossible without it. The dealer cannot use BDM. At the same time, I can freely rewrite CEM L via SBL including the PBL area.

So I go to the dealer and want them to activate the cruise control, and they change the CEM. Right?

If you want to activate CC you can write the config, dealer gets pin to that car from DB and write config block, problem is how to read the flash... Writing is easy if you have pin. But for diy you want to read the flash first before editing..

How do you write if CEM don't accept SBL with normal PIN???

Example -
Send pin
Answer :pin accepted
Set offset
Answer: ok
Send AE ......
Answer:some shit
Send AE.......
Answer:some shit
.........

[Dudde]

Okay, the dealer made a config. How will he load it there via Vida/sledgehammer??? CEM will not load SBL, loading is impossible without it. The dealer cannot use BDM. At the same time, I can freely rewrite CEM L via SBL including the PBL area.

So I go to the dealer and want them to activate the cruise control, and they change the CEM. Right?

If you want to activate CC you can write the config, dealer gets pin to that car from DB and write config block, problem is how to read the flash... Writing is easy if you have pin. But for diy you want to read the flash first before editing..

How do you write if CEM don't accept SBL with normal PIN???

For writing it works with normal pin, but not reading. IO Terminal is crap

[vtl]

Этот цем вообще не интересно читать по Кану. Во первых нужен пин, что бы его получить надо цеплять по бдм, а если мы уже на проводах, то чего церемониться!?))) Вот 835 это интересно (855 я читаю и пишу по Кану).

For my own education, what's the difference between M80835 and M80855?

[Treur]

If you want to activate CC you can write the config, dealer gets pin to that car from DB and write config block, problem is how to read the flash... Writing is easy if you have pin. But for diy you want to read the flash first before editing..

How do you write if CEM don't accept SBL with normal PIN???

For writing it works with normal pin, but not reading. IO Terminal is crap

So, why it not accept SBL transmition???

[Treur]

Этот цем вообще не интересно читать по Кану. Во первых нужен пин, что бы его получить надо цеплять по бдм, а если мы уже на проводах, то чего церемониться!?))) Вот 835 это интересно (855 я читаю и пишу по Кану).

For my own education, what's the difference between M80835 and M80855?

Memory

P. S. Так орали, что даж тебя разбудили?)))

[Treur]

For those who are in the tank. We must pass the SBL block in the form of ordinary binary data, it must accept and run. If the data is incorrect, it simply will not work, BUT... The CEM itself does not accept data, instead it responds to each message, and must be silent during the data loading process. All this happens during authorization via the PIN that is in the block. If you change this pin in the block itself to FF, the block will accept SBL.

[Yariy]

And that's why I'm leaning towards SBL for CEMB, because for example, in diagnostic mode, you can read the entire flash (512Kbytes), but it takes at least 20 minutes, and reading from the address in programm mode takes many times more. My test SBL reads the flash in 1 minute and 20 seconds, but so far without any checksums, etc. Well, it doesn't matter yet.

Так бесполезно читать в диагностической сессии, ну прочитали, а записать всё равно в ней не можем. Вот если мы можем переписать кусок с пином/пропатчить основную программу и PBL, то был бы смысл. Я не особо даже рассматриваю уже этот металлолом ибо тачки на них уже в стадии вымирания.
По части терминала - они далеко не всё вывесили на сайте. Я уже поимел их SBL, но CEM его принимает только при пин FF, и я честно то говоря не очень понимаю мышление шведов - мы пишем только новый блок. Тут рождается логичный вопрос - приехал к дилеру клиент на скажем дооснащение ииии????

Honestly, I haven't figured out what the SBL download function is used for in CEMB. Maybe a dump of a brand new CEMB will clarify things. The configuration lies in an unprotected area and you can change it knowing the current Pin code and not necessarily FF. The protected area contains the pin code, keys, synchronization, etc.