Vida CEM swapping

Post by **RickHaleParker** » 27 Mar 2021, 18:18

T5Luke wrote: ↑27 Mar 2021, 18:13

T5Luke · Post by **T5Luke** » 27 Mar 2021, 18:25

If you take a simple multimeter you can mesure through the CEM from D33 to D31, C21, D32, and the same for the other can line. So bus is diretly connected. In the older CEMs before 2005 is a relais which seperates the lines from obd and only closes after the right bytes on k line. But on this CEM is a direct connection, cracker works for most cems from 2005 and newer at the moment.

Post by **RickHaleParker** » 27 Mar 2021, 18:33

T5Luke · Post by **T5Luke** » 27 Mar 2021, 18:52

How you like, don't know who is the troll here. Many parts of this project are supported by me. Do you know what this means and why the cracker works?

FFCAC6 F2E1F2 MOV.B:Q #1H,-EH[FB]
FFCAC9 96B6F900E0FF CMP.B:G -7H[FB],FFE000H
FFCACF 9A29 JNE FFCAF9H
FFCAD1 96B6F701E0FF CMP.B:G -9H[FB],FFE001H
FFCAD7 9A21 JNE FFCAF9H
FFCAD9 96B6FB02E0FF CMP.B:G -5H[FB],FFE002H
FFCADF 9A19 JNE FFCAF9H
FFCAE1 96B6F603E0FF CMP.B:G -AH[FB],FFE003H
FFCAE7 9A11 JNE FFCAF9H
FFCAE9 96B6F804E0FF CMP.B:G -8H[FB],FFE004H
FFCAEF 9A09 JNE FFCAF9H
FFCAF1 96B6FA05E0FF CMP.B:G -6H[FB],FFE005H
FFCAF7 DA03 JEQ FFCAFBH

I'm the one hardly thinking about putting this loader also on open source or start selling like the others here (people here pay 100ds of dollars to czech just for changeing 2 bytes in their CEMs). Best greetings from western germany

Post by **vtl** » 27 Mar 2021, 19:41

I didn't test with a multimeter whether Renesas has a standalone CAN controller for OBD-II, but when in https://github.com/vtl/volvo-ddd I set a wrong baud rate on any bus, or swap the H and L wires or do anything else wrong - the car certainly misbehaves and reads a lot of communication errors from many modules afterwards.

MaxDenisov · Post by **MaxDenisov** » 28 Mar 2021, 03:26

vadimskok wrote: ↑27 Mar 2021, 14:54
MaxDenisov wrote: ↑26 Mar 2021, 14:47
MaxDenisov wrote: ↑10 Mar 2021, 05:20 Pin for my XC90 added to Vdash:
Today i tried to make changes to configuration of my car using Vdash and PIN( Thanks to Vtl)

Thanks to Vdash team for great support!

PIN is working well for configuration change:

Freedom!
what did you do, i know 2011 Volvo have bluetooth hand free, why did you activate it?

In my car it was not installed. Now I can install extra equipment and activate in sw

repair · Post by **repair** » 28 Mar 2021, 04:14

vtl wrote: ↑25 Mar 2021, 21:55 ...............(for ~90% of CEMs)..............

Yes.
It is too early to celebrate success.
On CEM P2 with "H" versions, cracker it is possible to find only 2 pin digits correctly, or even all the wrong ones ...
This has already been tested on different flashes from these blocks ... .

T5Luke · Post by **T5Luke** » 28 Mar 2021, 05:14

CEM H is the CEM of the XC90, it should not make a big difference. Can you look up which version you have, there exist 3 types. 512kb with old bootloader (pin has different order), 512kb with new bootloader, pin should be found but latency is short above 60 us and not above 80 us and the latest 320kb CEM with new bootloader and same order.

repair · Post by **repair** » 28 Mar 2021, 05:36

Well, we are talking about CEM on P2 since 2005.
They all have a flash size of 320 kb.
It does not depend on the version - L or H.
The versions differ only in the general equipment of the car and the installation of additional drivers in CEM.
But the dump structure for flashes from different versions is different.
But finding a pin in a flash in the same place.

T5Luke · Post by **T5Luke** » 28 Mar 2021, 05:43

No, from MY 2005 the cem type changed and the first cpus have a flash with 512kb, look closely to the cpu. The early serials all have 512kb, all cems with a serial starting with 5 or above have 320kb flash, the swap was done shortly before 5

M30835F Flash starts at F80000 to FFFFFF 512kb total
M30855F Flash starts at FB0000 to FFFFFF 320kb total

Vida CEM swapping

Re: Vida CEM swapping