Vida CEM swapping

Post by **vtl** » 28 Mar 2021, 14:36

That's what I call a ghetto build!

T5Luke · Post by **T5Luke** » 29 Mar 2021, 18:37

With the CODE it gets so easy to read out the CEM

Post by **RickHaleParker** » 29 Mar 2021, 20:16

RickHaleParker wrote: 23 Dec 2020, 19:25
vtl wrote: 23 Dec 2020, 17:41 CEM must be powered on within 5 seconds after "sending CEM into programming mode" is printed.
Is this correct?

Process to get CEM into programing mode.
1. Power on cracker.
2. Wait for "sending CEM into programming mode" in the terminal.
3. Within 5 seconds power on CEM.

On the bench:
You need to be able to switch the Cracker and the CEM separately.

In car:
You power the cracker with the +12V on the OBD port, Which is always on.
1. Key in POS 0.
2. Insert Cracker in OBD port.
3. Wait for "sending CEM into programming mode" in the terminal.
4. Within 5 seconds turn key to POS II.

How do you know in advance which com port the Cracker will show up on?

vtl wrote: 23 Dec 2020, 19:37 That's correct for on the bench. I haven't tried it in car yet (burnt valve), just finished a 3.5 months long engine rebuild.

You can just open a serial monitor/console on the correct port with the code running and press reset on the Teensy.

Today I Breadboarded a PIN cracker and got the answer. When cracking the pin in car, don't even bother to put the key in the ignition.

When the car is turned on the CEM will not respond to attempts to unlock the CEM. My Breadboarded PIN cracker got it on the first try with the key off.

This has got me wondering if the cracker need the CAN-LS. Tommorrow I am going to pull the CAN-LS off the breadboard and and see if it will crack without a CAN-LS.

Post by **vtl** » 29 Mar 2021, 21:11

T5Luke wrote: 29 Mar 2021, 18:37 With the CODE it gets so easy to read out the CEM

Congrats! And where's the github link? =)

Post by **vtl** » 29 Mar 2021, 21:17

RickHaleParker wrote: 29 Mar 2021, 20:16 Today I Breadboarded a PIN cracker and got the answer. When cracking the pin in car, don't even bother to put the key in the ignition.

When the car is turned on the CEM will not respond to attempts to unlock the CEM. My Breadboarded PIN cracker got it on the first try with the key off.

This has got me wondering if the cracker need the CAN-LS. Tommorrow I am going to pull the CAN-LS off the breadboard and and see if it will crack without a CAN-LS.

Congrats!

CAN-LS is only for shutting all the modules in car. All the job is done over CAN-HS.

No key cracking, huh? Just in case, don't leave the cracker being powered overnight, or you may find it in the morning with all the Volvos in your neighborhood cracked over the air, because who knows?

Post by **RickHaleParker** » 29 Mar 2021, 21:24

vtl wrote: 29 Mar 2021, 21:17 CAN-LS is only for shutting all the modules in car. All the job is done over CAN-HS.

I'm thinking because the key needs to be on to run diagnostics. The control modules on the CAN-LS might be offline anyway. If that is the case we can reduce the complexity by eliminating the CAN-LS.

It did get the PIN with the KEY in POS 0.

T5Luke · Post by **T5Luke** » 30 Mar 2021, 04:18

vtl wrote: 29 Mar 2021, 21:11
T5Luke wrote: 29 Mar 2021, 18:37 With the CODE it gets so easy to read out the CEM
Congrats! And where's the github link? =)

As i wrote before, at the moment i just share this exe by pm, i will clean up code and organize a open j2534 lib to release soon as open version...

T5Luke · Post by **T5Luke** » 30 Mar 2021, 04:22

RickHaleParker wrote: 29 Mar 2021, 21:24
vtl wrote: 29 Mar 2021, 21:17 CAN-LS is only for shutting all the modules in car. All the job is done over CAN-HS.
I'm thinking because the key needs to be on to run diagnostics. The control modules on the CAN-LS might be offline anyway. If that is the case we can reduce the complexity by eliminating the CAN-LS.

In diagnostic mode you need to power up modules like the ECM, ETM, ABS which are fully sleeping without key in pos II, otherwise they won't return any dtcs.
The CEM goes into sleep mode but is always listeneng and wakes up by the 1st can message it gets.

On previous page i demonstraded a minimal working setup with just 3 wires to the obd socket that works without key in.

repair · Post by **repair** » 30 Mar 2021, 04:58

T5Luke wrote: 29 Mar 2021, 18:37 With the CODE it gets so easy to read out the CEM

That's understandable.
But I do not see that the pin is determined by this program ... .
I/O Terminal already has exactly such options - for example.

T5Luke · Post by **T5Luke** » 30 Mar 2021, 05:16

repair wrote: 30 Mar 2021, 04:58
T5Luke wrote: 29 Mar 2021, 18:37 With the CODE it gets so easy to read out the CEM
That's understandable.
But I do not see that the pin is determined by this program ... .
I/O Terminal already has exactly such options - for example.

What do you mean by determined? I need to paste in my CEM code i have found out before with teensy, and then i'm able to read.
I blurr out my code, cause my code identifies my car...