Vida CEM swapping

[rp9]

The way the cracker works - it sends a sequence of 3 meaningful bytes in 6 bytes pin and collects the the reply latency. Originally it was 2 bytes, but in most of cases more samples are needed to collect a statistically meaningful distribution. It is possible to send these 2 bytes over and over, but why not sending the third byte?

Now, going over all 100 values in all 3 bytes (BCD bytes, 0-99, not 0-255) is 100*100*100 pins, which takes quite a time even at 500 Kbps. So there's that SAMPLES value that limits the range for the last byte. SAMPLES thus serves two goals: collecting more samples and scanning through the third byte as well.

The problem with the SAMPLES less than 100 is that it may or may not hit the correct byte. When it does, the pin comparison routing in CEM goes to the next byte check and that increases the latency, quite significant on some CEM software versions. When it does not hit the correct byte, the latency anomaly detection may fail. All depends on the CEM software.

So in cases when quick pin scan with the default SAMPLES=30 does not do anything - set it to 100 and have a couple of beers while it is scanning through the whole range.

I understand that, and I tried SAMPLES=100. It does not go even close to correct value of byte 2. Bytes 0 and 1 are flawless - always correct. I also did another trick: I was putting for bytes 0 and 1 the values that are giving the less average response time thinking that they might have some bias on the response times. No luck with this approach as well. Any other ideas? I will really appreciate if you can spend the time, reflash my pin and try to crack it.

[scaro]

Have put together a mockup. Not the pretties but anyway. Tested first with a V50 CEM number 8690720 (My around 06-07) alot of times didnt work. Ign on, off, no key in or just key inserted (dont know if that should do any difference ?) with different samples mostly 100. Thought it was something with mockup to begin with but had more CEMs laying. Tested another one with number 31254903 (MY 04ish). That one works flawless, even with sample 1.Tried a couple of times same result.
I noticed that 31254903 have low response avg39 all are in middle of area. 8690720 have higher avg151 and are more to the left in area. Will make a readout from 8690720 (have X-prog) to see the what the pin should be.

[vtl]

Any other ideas? I will really appreciate if you can spend the time, reflash my pin and try to crack it.

Email me your dump (email is in git commits). I need to look at the pin routine.

[RickHaleParker]

Will make a readout from 8690720 (have X-prog) to see the what the pin should be.

Measure the resistance across the CAN-HS then CAN-LS wires. Should be 60Ω. If not. you will need to load the CAN buses with 120Ω to get the 60Ω. The 120Ω should be at each physical end of a Can Bus. The terminating resistors are there to absorb reflected signals.

1 / (1/120Ω + 1/120Ω ) = 60Ω .

[scaro]

Will make a readout from 8690720 (have X-prog) to see the what the pin should be.

Measure the resistance across the CAN-HS then CAN-LS wires. Should be 60Ω. If not. you will need to load the CAN buses with 120Ω to get the 60Ω. The 120Ω should be at each physical end of a Can Bus. The terminating resistors are there to absorb reflected signals.

1 / (1/120Ω + 1/120Ω ) = 60Ω .

Yes i know. Have done many repairs of cars over the years, but thanks anyway. Havnt measured this time, but without termination Vida/Dice would not find CEM on bench with my harness. I can measure anyway if it helps someone. As i said will read mcus on the uncracked Cem and see what the pincode should be. If its close to find it or what it could be that makes it hard to crack. Maybee if theres time over tonight. The cracked one i already read long time ago when fixing with ECU/ABS/CEM sync problems (No start)

[RickHaleParker]

I can measure anyway if it helps someone.

Just giving you a heads up.

I removed the termination resistors from my CAN transceivers when I was doing in car cracking because the resistance was 40Ω with them installed, 60Ω without. When I removed one of the CEMs and put in on the bench the resistance jumped to 5MΩ without termination resistors. That is way way high and has the potential of polluting the signal with a lot of reflection. Two 120Ω termination resistors brought it back to where it should be.

[scaro]

I can measure anyway if it helps someone.

Just giving you a heads up.

Yes i understand and thanks for try helping Can measure anyway it could be wrong and work for one CEM and not the other. Will check for more CEMs at home too. Know that i should have some different ones P1, P2 and P2"old".

[RickHaleParker]

could be wrong and work for one CEM and not the other.

Exactly!

Eliminate the potential trouble source by balancing the CAN bus termination. That way you have fewer variables to worry about.

I had noise problems caused by the small and flimsy jumper wires not making good contact in the breadboard. I eliminated them variables by fabricating jumpers out of paper clips.

Went to a estate sale the last week. The basement was full of electronics stuff. Found some good quality Elenco prototyping supplies in the collection, grabbed them along with about $1000.00 worth ( at eBay prices ) of hp test equipment for a price that makes me look like a thief.

[5ft24]

Added jumper pads and RX to 15 pin:
Gerber attached.
@vtl I can assemble and send spare pcb to if needed

Max,
Does your board use the same Teensy code as VTL's?
If not do you have a link to the code you run I could check out? I'm building your circuit to see how it runs.
Thanks

[RickHaleParker]

Trying to prep the CEM-H so I can extract the bin file.
What did you use to clean off the conformal coating on the CEM PCB?
What is the inside diameter of the test pads?