Vida CEM swapping

[vtl]

I'm struggling with my early style P2 CEM. It is very slow, and it always gives the best latency to byte 00, in all PIN positions.

[vtl]

Old code was branched out to "old" in case anyone will need it, rework was merged back into master.

[h3b]

What can i do for example if i have the pin code?
Is there anything except cem swapping?
I've a 05 XC90 D5 so should be one of the later P2 if i understand that correctly.

[vtl]

With the pin code in hands you can invest your money into the Czech Republic economy: https://d5t5.com/article/volvo-change-configuration. Having a sw backup of your CEM also comes handy at times.

[RickHaleParker]

Here's the case when the code decides std is glaring more than the latency (which normally has the priority):

The new master went with Standard Deviation on Frankenstein. Frankenstein is still uncrackable.

CPU Maximum Frequency: 600000000
CPU Frequency: 600000000
Execution Rate: 600 cycles/us
PIN bytes to measure: 3
Number of samples: 30
CAN low-speed init done.
Reading part number from ECU 0x40 on CAN_LS
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
CAN_LS ---> ID=000ffffe data=cb 40 b9 f0 00 00 00 00
Part Number: 31394157
Searching P/N 31394157 in 49 known CEMs
CAN HS baud rate: 500000
PIN shuffle order: 3 1 5 0 2 4
CAN high-speed init done.
Putting all ECUs into programming mode.
CAN_HS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff 86 00 00 00 00 00 00
Reading part number from ECU 0x50 on CAN_HS
CAN_HS ---> ID=000ffffe data=50 88 00 00 00 00 00 00
CAN_HS <--- ID=00000003 data=50 8e 00 00 31 39 41 57
Part Number: 31394157
Initialization done.

Calculating bytes 0-2
1000 pins in 640 ms, 1562 pins/s, average response: 87 us, histogram 43 to 130 us

lat_k 0.01%, std_k 1.37% pin[0] choose candidate: 20 based on std
lat_k 0.01%, std_k 0.44% pin[1] choose candidate: 01 based on std
lat_k 0.01%, std_k 0.39% pin[2] choose candidate: 46 based on std

Candidate PIN 20 01 46 -- -- -- : brute forcing bytes 3 to 5 (3 bytes), will take up to 640 seconds
Progress: 0%..5%..10%..15%..20%..25%..30%..35%..40%..45%..50%..55%..60%..65%..70%..75%..80%..85%..90%..95%..
PIN is NOT cracked in 1225.39 seconds
done
Resetting all ECUs.
CAN_HS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00
CAN_LS ---> ID=000ffffe data=ff c8 00 00 00 00 00 00

Full Log is attached.

[vtl]

Do you have a dump?

[RickHaleParker]

I'm struggling with my early style P2 CEM. It is very slow, and it always gives the best latency to byte 00, in all PIN positions.

What happens if you exclude 00 as a candidate? say measure 01 - 99 rather then 00 - 99.

[h3b]

With the pin code in hands you can invest your money into the Czech Republic economy: https://d5t5.com/article/volvo-change-configuration. Having a sw backup of your CEM also comes handy at times.

ah okay, thanks. then i will try it. do i just need a teensy 4.0? or do i have to make a circuit like you did on your github page? or is a external board like this (https://amzn.to/3ehKCfO) fine?

[vtl]

ah okay, thanks. then i will try it. do i just need a teensy 4.0? or do i have to make a circuit like you did on your github page? or is a external board like this (https://amzn.to/3ehKCfO) fine?

You need a Teensy and two of these transceivers. And DC-DC in case USB power is weak.

[h3b]

ah okay, thanks. then i will try it. do i just need a teensy 4.0? or do i have to make a circuit like you did on your github page? or is a external board like this (https://amzn.to/3ehKCfO) fine?

You need a Teensy and two of these transceivers. And DC-DC in case USB power is weak.

Okay, i have the teensy 4.0 already then i will try it the next days. my car doesn't move far anyway right know, because the power steering oil cooler decided to leak heavy.
Thanks! I'll give feedback if it works