Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America).
Post Reply
ZRimaZ
Posts: 66
Joined: 08 Mar 2009, 12:26
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 19 times
Been thanked: 12 times

Re: Vida CEM swapping

Post by ZRimaZ »

RickHaleParker wrote: 12 Dec 2021, 15:25

23 15 92 67 72 Shuffle {3,1,0,2,4} = 92 15 67 23 72 .
00 01 02 03 04 ....... Placement ...... 00 01 02 03 04


00 01 02 03 04 */ Placement /*
23 15 92 67 72 */ PIN in .bin /*
03 01 00 02 04 */ Shuffle /*
92 15 67 23 72 */ PIN /*
Rick, is your shuffle order ok? I'm not really sure. Result is OK. You have counting of bytes 00...04 in top-row, so it has to be written as

00 01 02 03 04 <--- Byte order
23 15 92 67 72 <--- BIN PIN
02 01 03 00 04 <--- Shuffle order
92 15 67 23 72 <--- PIN

Or I'm wrong again? ;)


EDIT: I see, you corrected shuffle order in latest messages.

to matthew1 - sorry, I was little bit off, but I see Rick helped you.

EDIT2: Sorry, you are right. I did it again ( (C) Britney Spears ;) ) - I used wrong direction shuffle direction again. Sorry...
Have a nice day,

ZRimaZ

User avatar
RickHaleParker
Posts: 7000
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 902 times

Post by RickHaleParker »

ZRimaZ wrote: 13 Dec 2021, 08:59 EDIT2: Sorry, you are right. I did it again ( (C) Britney Spears ;) ) - I used wrong direction shuffle direction again. Sorry...
I hope that's not contagious. :wink:
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

ZRimaZ
Posts: 66
Joined: 08 Mar 2009, 12:26
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 19 times
Been thanked: 12 times

Post by ZRimaZ »

RickHaleParker wrote: 13 Dec 2021, 10:15

I hope that's not contagious. :wink:
I also hope. But just in case, stay away from me! :)
Have a nice day,

ZRimaZ

User avatar
RickHaleParker
Posts: 7000
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 902 times

Post by RickHaleParker »

mariom598 wrote: 13 Dec 2021, 01:09 First of all, thank you, I forgot to say, that this is an CEM module mounted on an XC 60/2015
Have you built a Teensy CEM cracker? If so, load it with VTL's P3 branch and see if it cracks the PIN.

Warning the P3 branch can take up to 32 hours and the key needs to be on. You need to use a charger to to keep the battery up. At least 12 amps is the word on the street. Currently the P3 branch does not have a resume function. So if the process is interrupted you got to start all over again.

Bench cracking would be a good idea if you have some P3 CEMs laying around. Somebody needs to work out how to wire a P3 on the bench and post the wiring schematic.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

mariom598
Posts: 4
Joined: 07 Jun 2020, 06:17
Year and Model: 2015 XC60
Location: Ancona
Has thanked: 3 times

Post by mariom598 »

RickHaleParker wrote: 13 Dec 2021, 11:44
mariom598 wrote: 13 Dec 2021, 01:09 First of all, thank you, I forgot to say, that this is an CEM module mounted on an XC 60/2015
Have you built a Teensy CEM cracker? If so, load it with VTL's P3 branch and see if it cracks the PIN.

Warning the P3 branch can take up to 32 hours and the key needs to be on. You need to use a charger to to keep the battery up. At least 12 amps is the word on the street. Currently the P3 branch does not have a resume function. So if the process is interrupted you got to start all over again.

Bench cracking would be a good idea if you have some P3 CEMs laying around. Somebody needs to work out how to wire a P3 on the bench and post the wiring schematic.
No, I used XProg for reading Code Flash and Data Flash from CEM

ZRimaZ
Posts: 66
Joined: 08 Mar 2009, 12:26
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 19 times
Been thanked: 12 times

Post by ZRimaZ »

Tried today to crack PIN from P2 Cem-L 30765149 - no luck :( What could be the reason not to crack it?
PIN NOT CRACKED.txt
(121.52 KiB) Downloaded 69 times
Have a nice day,

ZRimaZ

User avatar
RickHaleParker
Posts: 7000
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 902 times

Post by RickHaleParker »

ZRimaZ wrote: 15 Dec 2021, 03:31 Tried today to crack PIN from P2 Cem-L 30765149 - no luck :( What could be the reason not to crack it?
Could be a lot of things.
Do you have the PIN and/or .bin for that one? Knowing what the PIN is can help see what is going wrong.

If you go back and read through this whole thread you will find a lot of times the hardware quality is an issue.

What cracker hardware version did you use? Hardware construction method? ... Dupont ribbon cables, Solderless breadboard, Soldered breadboard, Wire Wrap breadboard or PCB?

3.3V or 5V CAN transceivers?

A schematic and some pictures of your hardware might help.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

vtl
Posts: 3173
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 34 times
Been thanked: 252 times

Post by vtl »

ZRimaZ wrote: 15 Dec 2021, 03:31 Tried today to crack PIN from P2 Cem-L 30765149 - no luck :( What could be the reason not to crack it?

PIN NOT CRACKED.txt
First two bytes are 87 35 for real. The third is 95 most likely, however your CEM is one of those with the third byte hard to crack. I have a theory/speculation why some CEMs are harder than others, explained with more details in this comment: viewtopic.php?f=10&t=85611&p=577956&hil ... nt#p577956
05 XC70, 19 Tundra, 22 Sequoia, 16 XC60 (sold), 05 XC70 (crashed), 02 V70 (sold)
P1+P2+P3 CEM PIN-code retrieval DIY thread

User avatar
RickHaleParker
Posts: 7000
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 902 times

Post by RickHaleParker »

Anybody know which CEMs are D2 protocol-based and which ones are GGD protocol-based ?
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

matija0610
Posts: 34
Joined: 25 Oct 2021, 14:43
Year and Model: 2003 S60 D5
Location: Croatia
Has thanked: 9 times
Been thanked: 8 times

Post by matija0610 »

RickHaleParker wrote: 16 Dec 2021, 05:04 Anybody know which CEMs are D2 protocol-based and which ones are GGD protocol-based ?
Vida
cem DIAG number.txt
(8.59 KiB) Downloaded 87 times

Post Reply
  • Similar Topics
    Replies
    Views
    Last post