IPD sale XeMODeX - Experts in Volvo Electronics
Did you know? 🤔
Logged in users can get email notification of topic replies Log in or register (free).
Amazon Link Buy anything with this and it helps MVS!

Vida CEM swapping

Help, Advice, Owners' Discussion and DIY Tutorials on Volvo XC90s. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America).
Rvolvos
Posts: 110
Joined: Sun Apr 01, 2018 6:32 pm
Year and Model: 2006 xc70
Location: California
Has thanked: 37 times
Been thanked: 4 times
United States of America
Rvolvos

Re: Vida CEM swapping

Post by Rvolvos » Mon Mar 04, 2019 11:08 am

yagger wrote: ↑
Fri Jun 22, 2018 5:54 pm
Alas, my English is not the best and I, unfortunately, could not quite correctly read the rules of the forum, if I did not follow them, I ask the moderators not to treat me strictly, but simply delete my message. Thank you for understanding.

I'm not sure that the "light rays came together" only on one company (I mean Canadian specialists). There are much cheaper and faster options for solving problems with Volvo electronics. For example, you can try to use Total Auto Tech from CA. There is very strong experience for repair volvo electronics, can program and clone modules, diagnosis and check any systems... There is a own bench test equipment and own soft for test and programming any modules. You can ask me about it if interesting. ))
Can you please share the address of Total auto tech? The link doesn’t work for me.
Thanks!
2006 XC70 2.5T 190k
2006 V70 2.5T 152k
2011 C30 T5 AW55-50SN 99k
2011 C30 T5 M66 66k

User avatar
abscate
MVS Moderator
Posts: 21525
Joined: Sun Feb 17, 2013 5:54 pm
Year and Model: 99T5 ,99S70,2005V70
Location: NYC, ALBANY NY
Has thanked: 336 times
Been thanked: 1035 times
Trinidad & Tobago
abscate

Re: Vida CEM swapping

Post by abscate » Tue Mar 05, 2019 11:56 am

OP - we have had several people come on with substantial experience in tuning and programming who insist they have cloned a VIN specific module on Volvo then disappear into oblivion after they fail. The equipment to do it will make it an un-economical path for someone not doing this as a service.

Maybe it is just fair to say the info isnt here, perhaps one of the other Fora has it.



Yagger and Doublebug are exceptions - if they can do it they will tell you.
Empty Nester
A Captain in a Sea of Estrogen
1999-V70-T5M56 2005-V70-M56 1999-S70 VW T4 BMW
Link to Maintenance record thread
Link To Volvo Glossary

User avatar
yagger
Posts: 305
Joined: Thu Mar 24, 2016 4:29 pm
Year and Model: S60 2005 2,5T
Location: DreamLand
Has thanked: 5 times
Been thanked: 22 times
Belarus
yagger

Re: Vida CEM swapping

Post by yagger » Tue Mar 05, 2019 5:11 pm

Rvolvos wrote: ↑
Mon Mar 04, 2019 11:08 am
Can you please share the address of Total auto tech? The link doesn’t work for me.
Thanks!
TotalAutoTech
225 San Jose Ave
San Jose, CA 95125

Be sure, they can do everything for Volvo.
Any electronics issues, any programming stuff...
Keys, Remotes, cloning any modules...
I guarantee.
Volvo electronics and programming.Yagger&Doublebug - our experience invaluable.
Aftermarket Online Data Transferring Service for Volvo Pass: total

precopster
Posts: 7482
Joined: Sat Aug 21, 2010 12:20 am
Year and Model: Lots
Location: Melbourne Australia
Has thanked: 4 times
Been thanked: 109 times
Australia
precopster

Re: Vida CEM swapping

Post by precopster » Wed Mar 06, 2019 2:25 am

This is my understanding of the current situation. Vida can reload a module ONLY if you have a licensed subscription to Vida and you buy the software for each reload individually. As far as I know the Volvo corporate site can now pick a real Dice from a clone so even if you buy a subscription you need a genuine Dice costing over $1,000.

The way the software works is if key data or configuration is already on the used CEM from a different vehicle other than the one the CEM is fitted to it won't reload it so you can't just bring a used CEM to a dealer and have it reprogrammed. The dealers will ONLY program new CEMs or perform a CEM reload if it is the original CEM belonging to the vehicle.

Which leaves you in the good hands of the guys mentioned above who CAN erase key data without Vida and then erase the ROM and reload data from another CEM.
Current cars:2002 XC70, 2006 Ssangyong Rodius (Stavic), 2006 XC90 2.5T, VW Transporter 2.5TDI

www.precisioncarmodules.com.

User avatar
vtl
Posts: 1901
Joined: Thu Aug 16, 2012 1:35 pm
Year and Model: 2005 XC70
Location: Boston
Has thanked: 3 times
Been thanked: 68 times
United States of America
vtl

Re: Vida CEM swapping

Post by vtl » Wed Jun 24, 2020 3:11 pm

I'm sorry for kicking an old thread...

VIDA Online (for those of us in Northern America) works fine with a Chinese forged DiCE. Every operation in official VIDA is expensive, of course.

2005+ (speaking about P2) has an L-shaped CEM that runs on Renesas M32C. This chip has a built-in flash that is read/write protected by ID. Only Volvo knows this ID for your vehicle. Without ID it is not possible to read the flash or even overwrite it. Dealer can't flash a new software into a used CEM that you've got cheap from ebay or junkyard.

EEPROM in these CEMs is still old good standalone 93C86. However, its content is encrypted. The encryption key is hidden in M32C's flash. You can desolder the EEPROM and read it in a programmer, but the dump will be of a very little use, because it can't be modified.

Renesas states in the datasheet that even with flash locked it is still possible to erase the flash, thus bringing CEM a "clean" state that the dealer can work with. To do so you need a E8 or E8a software emulator from Renesas that costs anywhere from $30 to $250 on ebay. Or make a do-it-yourself solution with MCU board like Arduino that will send the erase code to the M32C. Information is googleable. I think this is how "reconditioned" empty CEMs make their way to ebay.

With a DIY hw tool you can also try to hack the ID code by enumerating every possible combination in 7 bytes sequence. That takes ton of time, but at the end you'll be able to do the clone. Maybe the ID sequence used by Volvo does not span the whole possible dimension, and knowing the ranges you can hack the code much quicker by avoiding sequences that do not exist, for Volvo.

Also, M16 family (M32C is M16 family) has a bug, or, rather, a nuance that allows to shorten the hacking process by light years using timing attack on the BUSY line. It turned out that the chip holds the BUSY line for slightly longer period of time when the software sends the byte that is the right byte for this position in ID code. Hmm... :)

I think it is possible to crack the ID code in those Renesas-equipped CEMs using a cheap, but mighty MCU board, like ESP32. The latency for reading a digital pin seems to be well below microsecond, this is probably enough to see the jitter on BUSY line. ESP32 is real cheap, $10 delivered to your door. Hmm...
05 XC70 265k, 16 XC60 45k, 19 Tundra 5k

User avatar
RickHaleParker
Posts: 4405
Joined: Mon May 25, 2015 2:30 pm
Year and Model: See Signature below.
Location: Kansas
Has thanked: 3 times
Been thanked: 562 times
United States of America
RickHaleParker

Re: Vida CEM swapping

Post by RickHaleParker » Wed Jun 24, 2020 5:32 pm

vtl wrote: ↑
Wed Jun 24, 2020 3:11 pm
I think it is possible to crack the ID code in those Renesas-equipped CEMs using a cheap, but mighty MCU board, like ESP32.
It has been done.

There is a program out that will calculate the CEM pin from the bin file. The link below is a program said to calculate the CEM pin from a 2005 - 2009 Volvo CEM bin file. I have not tried it because I never bought a programmer to to extract the bin file. A good source tells me a Orange 5 programmer works real well for extracting the bin files.

https://mega.nz/file/WoEiTCSS#FdV5x3yhk ... ZCh%20L2YY
--------
Platform: P80 1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
Platform: X40 (Nedcar) 2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
Platform P2 2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Platform P2 2004 S60R, B2524T4, AW50/51 AWD, B8444S TF80 AWD, Bosch Motronic 7.0, BorgWarner K24 turbocharger. V8 conversion in progress.

User avatar
yagger
Posts: 305
Joined: Thu Mar 24, 2016 4:29 pm
Year and Model: S60 2005 2,5T
Location: DreamLand
Has thanked: 5 times
Been thanked: 22 times
Belarus
yagger

Re: Vida CEM swapping

Post by yagger » Wed Jun 24, 2020 5:58 pm

What are you talking about, guys?
Everything cracked at least 8 years ago. We work through OBD with L-shaped CEMs around 8 years.
And Data transfer service is not so expensive. There is sens to buy equipment and start to learn how to transfer software if you are going to work with this constantly I think. In other way it is not so effective.
Volvo electronics and programming.Yagger&Doublebug - our experience invaluable.
Aftermarket Online Data Transferring Service for Volvo Pass: total

User avatar
RickHaleParker
Posts: 4405
Joined: Mon May 25, 2015 2:30 pm
Year and Model: See Signature below.
Location: Kansas
Has thanked: 3 times
Been thanked: 562 times
United States of America
RickHaleParker

Re: Vida CEM swapping

Post by RickHaleParker » Wed Jun 24, 2020 7:37 pm

yagger wrote: ↑
Wed Jun 24, 2020 5:58 pm
There is sense to buy equipment and start to learn how to transfer software if you are going to work with this constantly I think. In other way it is not so effective.
That is why I never bought the Orange 5 programmer.

Vdash cannot do the P2 CEM crack through DiCE or the OBDII port. Have you considered making a better program/service to directly compete with Vdash?
--------
Platform: P80 1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
Platform: X40 (Nedcar) 2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
Platform P2 2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.
Platform P2 2004 S60R, B2524T4, AW50/51 AWD, B8444S TF80 AWD, Bosch Motronic 7.0, BorgWarner K24 turbocharger. V8 conversion in progress.

User avatar
vtl
Posts: 1901
Joined: Thu Aug 16, 2012 1:35 pm
Year and Model: 2005 XC70
Location: Boston
Has thanked: 3 times
Been thanked: 68 times
United States of America
vtl

Re: Vida CEM swapping

Post by vtl » Wed Jun 24, 2020 7:57 pm

RickHaleParker wrote: ↑
Wed Jun 24, 2020 5:32 pm
It has been done.

There is a program out that will calculate the CEM pin from the bin file. The link below is a program said to calculate the CEM pin from a 2005 - 2009 Volvo CEM bin file. I have not tried it because I never bought a programmer to to extract the bin file. A good source tells me a Orange 5 programmer works real well for extracting the bin files.

https://mega.nz/file/WoEiTCSS#FdV5x3yhk ... ZCh%20L2YY
Yeah, seen that. I don't really understand what this software does. The problem is to read the flash from the chip. Once you read it, the ID is in last bytes of the image (bin file), as per datasheet. But to read the flash you need to unlock it first with the ID.
05 XC70 265k, 16 XC60 45k, 19 Tundra 5k

User avatar
vtl
Posts: 1901
Joined: Thu Aug 16, 2012 1:35 pm
Year and Model: 2005 XC70
Location: Boston
Has thanked: 3 times
Been thanked: 68 times
United States of America
vtl

Re: Vida CEM swapping

Post by vtl » Wed Jun 24, 2020 7:59 pm

yagger wrote: ↑
Wed Jun 24, 2020 5:58 pm
What are you talking about, guys?
Everything cracked at least 8 years ago. We work through OBD with L-shaped CEMs around 8 years.
And Data transfer service is not so expensive. There is sens to buy equipment and start to learn how to transfer software if you are going to work with this constantly I think. In other way it is not so effective.
Are you saying you can crack the ID code remotely via OBD? Maybe it's some dumb barely randomized sequence, so brute force enumeration is quick? Wonder why VDASH cracks the ID for P3, but not for P2...

Actually, if you are able to convince CEM to run your custom bootloader the things are much simpler.
05 XC70 265k, 16 XC60 45k, 19 Tundra 5k

Post Reply
  • Similar Topics
    Replies
    Views
    Last post