Vida CEM swapping

feilsend · Post by **feilsend** » 18 Mar 2026, 20:55

dikidera wrote: 11 Aug 2023, 15:49
rkam wrote: 13 Feb 2023, 11:09 Looks like the Denso has its own way of storing CAN IDs in the signal configuration.

Stored - CAN-ID
401E 020A - 0042 401E
401E 030A - 0062 401E
0021 0808 - 0100 0021
0002 0A08 - 0140 0002
0014 1008 - 0200 0014
0006 1408 - 0280 0006
0012 1708 - 02E0 0012
A little late, but thanks to emulation I have found at least one function that sets the CAN IDs now, with this I have found that each "signal" is described in a 32 byte structure.

ROM:00001B1C off_1B1C: .long 0x7080F00, unk_FFFFDEF0, unk_FFFFDF28, poweron
ROM:00001B1C ! DATA XREF: ROM:00001044↑o
ROM:00001B1C ! ROM:000010A4↑o ...
ROM:00001B2C off_1B2C: .long dword_30000, 0x401E020A, 0xFBFFBFFF, 0x3FFF5FFF
ID Obviously 0x401E020A

0x7080F00L The first byte 0x07 is both a record identifier signifying if this is the last signal or at least a main one, not sure yet. 0x08 is the DLC, as its being put in address E498 of the CAN module. 0x07 identifier can maybe sometimes be 0x04 which does an additional step in the ID setting function.

unk_FFFFDEF0 is still unknown as well the other address and 0xFBFFBFFF, 0x3FFF5FFF and dword_30000 but hey it's start.

Then I have identified the functions I have so named CANSend_Byte, word, dword etc.

They take two arguments, an offset and the value to send.

mov.w #0x1428, r4
jsr @r13 ! SendCANWord_sub_ACD8
0x1428 is a data structure offset, perhaps 24 bytes in length. It contains a few things(mostly unknown for now), one of which is the offset 1b1c, we can *maybe* infer that 1b1c is the CAN signal that will be used to transmit the message from id 0042 401E, in this case it was the Throttle Opening Angle.

Although one little tidbit is still unclear, my 80401E address is kind of missing in action but I will see.

Now, with this what we can do is dump the TCM firmware and see if a similar table exists, for e.g reading. I would expect the TCM to have the same addresses in it's signal configuration.

Have you made any more progress on this? I asked for a CAN dump in another thread but what I did instead was wire everything together temporarily and then did a frame capture. I am going to paste the CSV data from the PCAN software that I prepended each line with "KP2" (frames captured with key in position #2), "ECM" (frames that appeared when I powered up the Denso ECM while attached to the XC90 HS-CAN and "TCM" (frames that appeared when the power was applied to the TF-80SC TCM while the previous two conditions were also true).

[KP2], CAN-ID=00224024h, Length=8, Data=3F F8 00 00 13 FF C0 00, CycleTime=14.0, Count=10283
[KP2], CAN-ID=0042406Ch, Length=8, Data=40 A8 00 00 60 00 C0 03, CycleTime=10.0, Count=15254
[ECM], CAN-ID=0062401Eh, Length=8, Data=01 14 60 00 A2 22 04 00, CycleTime=12.0, Count=3
[ECM], CAN-ID=0080401Eh, Length=8, Data=BE 00 80 00 00 0B 12 16, CycleTime=12.0, Count=3
[ECM], CAN-ID=00A20016h, Length=8, Data=07 E9 04 00 00 14 00 00, CycleTime=19.4, Count=2
[TCM], CAN-ID=00C0402Ah, Length=8, Data=5F E4 10 0A 06 F2 C7 FF, CycleTime=9.9, Count=4265
[TCM], CAN-ID=00D00022h, Length=8, Data=00 00 02 A3 00 00 E7 FF, CycleTime=9.9, Count=4265
[KP2], CAN-ID=00E24026h, Length=8, Data=00 01 E0 EC 9F 00 00 00, CycleTime=14.0, Count=10283
[ECM], CAN-ID=00F00006h, Length=8, Data=00 00 33 7F 00 00 A7 82, CycleTime=12.0, Count=3
[KP2], CAN-ID=01000020h, Length=8, Data=00 00 00 00 00 00 00 00, CycleTime=10.0, Count=14416
[ECM], CAN-ID=01400006h, Length=8, Data=00 00 00 00 C9 F7 D9 14, CycleTime=12.9, Count=3
[ECM], CAN-ID=01600012h, Length=8, Data=80 00 00 00 00 00 00 00, CycleTime=18.9, Count=2
[KP2], CAN-ID=01A2402Ah, Length=8, Data=00 AD 52 06 80 00 80 00, CycleTime=10.0, Count=14405
[KP2], CAN-ID=10004002h, Length=8, Data=80 00 00 00 C0 00 C0 00, CycleTime=14.0, Count=10283
[KP2], CAN-ID=10400020h, Length=8, Data=C1 1D 47 00 00 00 00 00, CycleTime=29.8, Count=4808
[KP2], CAN-ID=10600020h, Length=8, Data=02 FE FE 00 37 04 1D D7, CycleTime=255.4, Count=347
[KP2], CAN-ID=10800006h, Length=8, Data=00 80 00 6F 00 00 00 00, CycleTime=48.2, Count=2936
[KP2], CAN-ID=10A2407Ch, Length=8, Data=11 21 06 17 01 01 02 05, CycleTime=280.0, Count=489
[ECM], CAN-ID=10C00002h, Length=8, Data=00 00 00 00 00 00 00 00, Count=1
[KP2], CAN-ID=10E24000h, Length=8, Data=08 00 58 00 07 FA 6E 00, CycleTime=55.9, Count=2570
[TCM], CAN-ID=11000022h, Length=8, Data=03 FB DC 00 00 4B 02 F2, CycleTime=69.9, Count=609
[KP2], CAN-ID=11100024h, Length=8, Data=00 00 00 14 7E 00 80 00, CycleTime=50.0, Count=2889
[KP2], CAN-ID=11220028h, Length=8, Data=21 63 03 3C 00 00 1D 1C, CycleTime=59.9, Count=2407
[KP2], CAN-ID=11420006h, Length=8, Data=00 00 00 1F 00 00 DE 00, CycleTime=118.5, Count=1211
[KP2], CAN-ID=11600002h, Length=8, Data=F5 14 20 00 00 00 00 00, CycleTime=98.0, Count=1470
[KP2], CAN-ID=11800002h, Length=8, Data=00 00 03 01 00 00 00 00, CycleTime=98.9, Count=1470
[KP2], CAN-ID=11A00020h, Length=8, Data=00 00 00 00 C0 00 00 00, CycleTime=149.8, Count=964
[ECM], CAN-ID=11C00002h, Length=8, Data=00 00 60 00 00 00 00 0C, CycleTime=13.9, Count=2

---

Unfortunately, I cannot start and drive the vehicle in this configuration as I have all of the IO on the engine still wired to my aftermarket ECM.

Will you please help me make sense of this information? I tried to DM you but I think you must have that feature disabled.

Thank you in advance.

lookforjoe · Post by **lookforjoe** » 20 Mar 2026, 19:33

So looking at the resistors, I have 10Kohm on the CANH & 100ohm on the CANL -

The other 3 I have are the same

Should I remove the 100ohm & put 10K in their place?

The Waveshare boards (only version I can see with a brand name) have the same resistor setup

Post by **vtl** » 20 Mar 2026, 19:49

lookforjoe wrote: 20 Mar 2026, 19:33 Should I remove the 100ohm & put 10K in their place?

The Waveshare boards (only version I can see with a brand name) have the same resistor setup

No. This resistor is not used in fact, not until you put a jumper. In-car cracking does not need this terminating resistor.

Post by **vtl** » 20 Mar 2026, 19:55

Example of your part number pin cracked: viewtopic.php?p=643475&hilit=31327215#p643475 See how CEM responds? -> is request from Teensy, <- is response from CEM.

mikkeltom · Post by **mikkeltom** » 24 Mar 2026, 11:08

Hi guys, i have read my CEM on my volvo s80 2001, 2.4t. chassis 185244.
My CEM is type 8645541, HW-PN 9452553, Serial nr 000000854641.
Im not sure where to find the pin code, i used some arduino code that has a interace like this.
Arduino CEM Reader, press:

e: enter BDM Mode
l: leave BDM (experimental)
r: read complete memory
b: read Boot 0-3FFF
s: read security block 4000-7FFF
d: read car data 8000-1FFFF
f: read firmware 20000-7FFFF
c: BD32 Command Mode
Enter BDM
1
Read FLASH
i choose e, then r then saved and removed the above text.
Going to offset 6000 i see some kind of data but i am unsure what the pin should look like, my goal is to add it to my VDASH so i can swap headunit to HU801 from HU601. My complete dump is attached if anyone can help and for people who might need a clean file for their ECM.

Post by **vtl** » 24 Mar 2026, 11:19

mikkeltom wrote: 24 Mar 2026, 11:08 Hi guys, i have read my CEM on my volvo s80 2001, 2.4t. chassis 185244.
My CEM is type 8645541, HW-PN 9452553, Serial nr 000000854641.
Im not sure where to find the pin code, i used some arduino code that has a interace like this.
Arduino CEM Reader, press:

e: enter BDM Mode
l: leave BDM (experimental)
r: read complete memory
b: read Boot 0-3FFF
s: read security block 4000-7FFF
d: read car data 8000-1FFFF
f: read firmware 20000-7FFFF
c: BD32 Command Mode
Enter BDM
1
Read FLASH
i choose e, then r then saved and removed the above text.
Going to offset 6000 i see some kind of data but i am unsure what the pin should look like, my goal is to add it to my VDASH so i can swap headunit to HU801 from HU601. My complete dump is attached if anyone can help and for people who might need a clean file for their ECM.

Try 43 92 25 95 17 15 or 92 43 95 25 15 17 if bswap16 was not done while reading flash.

mikkeltom · Post by **mikkeltom** » 24 Mar 2026, 11:59

Thank you, i thought it might have been a bad read since i saw so many 46's, my other reads had a lot of those also but that was because the arduino IDE cannot copy more than X amount of bytes so i used CoolTerm to save the output.
I'll see tommorow if i can get some pin only commands through, anyway, many thanks, have a great evening!

Post by **vtl** » 24 Mar 2026, 12:02

mikkeltom wrote: 24 Mar 2026, 11:59 Thank you, i thought it might have been a bad read since i saw so many 46's, my other reads had a lot of those also but that was because the arduino IDE cannot copy more than X amount of bytes so i used CoolTerm to save the output.
I'll see tommorow if i can get some pin only commands through, anyway, many thanks, have a great evening!

If you have DiCE, you can read the pin directly with http://www.openmoose.net/ now. CEM cracker also supports it (via separate branch), but that means you need to have a cracker hardware.

dikidera · Post by **dikidera** » 24 Mar 2026, 12:25

feilsend wrote: 18 Mar 2026, 20:55
dikidera wrote: 11 Aug 2023, 15:49
rkam wrote: 13 Feb 2023, 11:09 Looks like the Denso has its own way of storing CAN IDs in the signal configuration.

Stored - CAN-ID
401E 020A - 0042 401E
401E 030A - 0062 401E
0021 0808 - 0100 0021
0002 0A08 - 0140 0002
0014 1008 - 0200 0014
0006 1408 - 0280 0006
0012 1708 - 02E0 0012
A little late, but thanks to emulation I have found at least one function that sets the CAN IDs now, with this I have found that each "signal" is described in a 32 byte structure.

ROM:00001B1C off_1B1C: .long 0x7080F00, unk_FFFFDEF0, unk_FFFFDF28, poweron
ROM:00001B1C ! DATA XREF: ROM:00001044↑o
ROM:00001B1C ! ROM:000010A4↑o ...
ROM:00001B2C off_1B2C: .long dword_30000, 0x401E020A, 0xFBFFBFFF, 0x3FFF5FFF
ID Obviously 0x401E020A

0x7080F00L The first byte 0x07 is both a record identifier signifying if this is the last signal or at least a main one, not sure yet. 0x08 is the DLC, as its being put in address E498 of the CAN module. 0x07 identifier can maybe sometimes be 0x04 which does an additional step in the ID setting function.

unk_FFFFDEF0 is still unknown as well the other address and 0xFBFFBFFF, 0x3FFF5FFF and dword_30000 but hey it's start.

Then I have identified the functions I have so named CANSend_Byte, word, dword etc.

They take two arguments, an offset and the value to send.

mov.w #0x1428, r4
jsr @r13 ! SendCANWord_sub_ACD8
0x1428 is a data structure offset, perhaps 24 bytes in length. It contains a few things(mostly unknown for now), one of which is the offset 1b1c, we can *maybe* infer that 1b1c is the CAN signal that will be used to transmit the message from id 0042 401E, in this case it was the Throttle Opening Angle.

Although one little tidbit is still unclear, my 80401E address is kind of missing in action but I will see.

Now, with this what we can do is dump the TCM firmware and see if a similar table exists, for e.g reading. I would expect the TCM to have the same addresses in it's signal configuration.
Have you made any more progress on this? I asked for a CAN dump in another thread but what I did instead was wire everything together temporarily and then did a frame capture. I am going to paste the CSV data from the PCAN software that I prepended each line with "KP2" (frames captured with key in position #2), "ECM" (frames that appeared when I powered up the Denso ECM while attached to the XC90 HS-CAN and "TCM" (frames that appeared when the power was applied to the TF-80SC TCM while the previous two conditions were also true).

[KP2], CAN-ID=00224024h, Length=8, Data=3F F8 00 00 13 FF C0 00, CycleTime=14.0, Count=10283
[KP2], CAN-ID=0042406Ch, Length=8, Data=40 A8 00 00 60 00 C0 03, CycleTime=10.0, Count=15254
[ECM], CAN-ID=0062401Eh, Length=8, Data=01 14 60 00 A2 22 04 00, CycleTime=12.0, Count=3
[ECM], CAN-ID=0080401Eh, Length=8, Data=BE 00 80 00 00 0B 12 16, CycleTime=12.0, Count=3
[ECM], CAN-ID=00A20016h, Length=8, Data=07 E9 04 00 00 14 00 00, CycleTime=19.4, Count=2
[TCM], CAN-ID=00C0402Ah, Length=8, Data=5F E4 10 0A 06 F2 C7 FF, CycleTime=9.9, Count=4265
[TCM], CAN-ID=00D00022h, Length=8, Data=00 00 02 A3 00 00 E7 FF, CycleTime=9.9, Count=4265
[KP2], CAN-ID=00E24026h, Length=8, Data=00 01 E0 EC 9F 00 00 00, CycleTime=14.0, Count=10283
[ECM], CAN-ID=00F00006h, Length=8, Data=00 00 33 7F 00 00 A7 82, CycleTime=12.0, Count=3
[KP2], CAN-ID=01000020h, Length=8, Data=00 00 00 00 00 00 00 00, CycleTime=10.0, Count=14416
[ECM], CAN-ID=01400006h, Length=8, Data=00 00 00 00 C9 F7 D9 14, CycleTime=12.9, Count=3
[ECM], CAN-ID=01600012h, Length=8, Data=80 00 00 00 00 00 00 00, CycleTime=18.9, Count=2
[KP2], CAN-ID=01A2402Ah, Length=8, Data=00 AD 52 06 80 00 80 00, CycleTime=10.0, Count=14405
[KP2], CAN-ID=10004002h, Length=8, Data=80 00 00 00 C0 00 C0 00, CycleTime=14.0, Count=10283
[KP2], CAN-ID=10400020h, Length=8, Data=C1 1D 47 00 00 00 00 00, CycleTime=29.8, Count=4808
[KP2], CAN-ID=10600020h, Length=8, Data=02 FE FE 00 37 04 1D D7, CycleTime=255.4, Count=347
[KP2], CAN-ID=10800006h, Length=8, Data=00 80 00 6F 00 00 00 00, CycleTime=48.2, Count=2936
[KP2], CAN-ID=10A2407Ch, Length=8, Data=11 21 06 17 01 01 02 05, CycleTime=280.0, Count=489
[ECM], CAN-ID=10C00002h, Length=8, Data=00 00 00 00 00 00 00 00, Count=1
[KP2], CAN-ID=10E24000h, Length=8, Data=08 00 58 00 07 FA 6E 00, CycleTime=55.9, Count=2570
[TCM], CAN-ID=11000022h, Length=8, Data=03 FB DC 00 00 4B 02 F2, CycleTime=69.9, Count=609
[KP2], CAN-ID=11100024h, Length=8, Data=00 00 00 14 7E 00 80 00, CycleTime=50.0, Count=2889
[KP2], CAN-ID=11220028h, Length=8, Data=21 63 03 3C 00 00 1D 1C, CycleTime=59.9, Count=2407
[KP2], CAN-ID=11420006h, Length=8, Data=00 00 00 1F 00 00 DE 00, CycleTime=118.5, Count=1211
[KP2], CAN-ID=11600002h, Length=8, Data=F5 14 20 00 00 00 00 00, CycleTime=98.0, Count=1470
[KP2], CAN-ID=11800002h, Length=8, Data=00 00 03 01 00 00 00 00, CycleTime=98.9, Count=1470
[KP2], CAN-ID=11A00020h, Length=8, Data=00 00 00 00 C0 00 00 00, CycleTime=149.8, Count=964
[ECM], CAN-ID=11C00002h, Length=8, Data=00 00 60 00 00 00 00 0C, CycleTime=13.9, Count=2

---

Unfortunately, I cannot start and drive the vehicle in this configuration as I have all of the IO on the engine still wired to my aftermarket ECM.

Will you please help me make sense of this information? I tried to DM you but I think you must have that feature disabled.

Thank you in advance.

Yes, progress was made. I successfully figured out (at least for Denso ECM and TCM) how they IDs was encoded. Its a bit back in the thread. And what data is encoded too(depends on the firmware version).

mikkeltom · Post by **mikkeltom** » 24 Mar 2026, 12:32

vtl wrote: 24 Mar 2026, 12:02 If you have DiCE, you can read the pin directly with http://www.openmoose.net/ now. CEM cracker also supports it (via separate branch), but that means you need to have a cracker hardware.

I do not currently have a DiCE, but i use a Mongoose JLR PRO that works perfectly fine with VIDA2014D, could that work? I dont have the hardware on hand as i decided that it is not a big deal pulling the CEM out, its only a 10 minute job on my car at least (seems like a pain on the p2 models with the battery behind the center console lol)