Volvo V70/XC70/S60 2005->> CEM Thread

[soxten]

Thread for Volvo V70/XC70/S60 2005-2010 CEM ("L" CEM)

This CEM have all info stored in MCH Renesas M32C M30855FWUGP and is coded.

I have read CEM info with Maxidas 708 and find that it show 3 diffrent S/W? (se picture)
194965194966
__________________________________________________ ________________________________________________
Copy from a Swedish forum translate to eng.
link Visa tr?d - Renesas m30855fwugp Hj?lp ? Svenska ElektronikForumet (http://www.elektronikforumet.com/forum/viewtopic.php?f=7&t=58173&view=previous)
It is their M32C/85 and there is protection against readout, both for serial and parallel readout. There is a "password" consisting of 7 bytes that you should know in order that could change this protection through serial programming, once it is done, one can access the circuit that you want.
I deem it quite difficult ...
With serial booting (some pins in certain situations with reset button, standing in the data sheet), one can access to communicate with ***956;C'n (so I programmed them) and then they talk at 9600 baud (8n1). The sequence to enter the password is at ~ 12 bytes incl. password, then you should check if it is opened and it requires a shorter stopping and young. 5 bytes more before knowing that around the time of 30 bytes would probably suffice.
Then you can try 32 codes / second - if it was not so that you have to make a total power-down between each unsuccessful code ... Say that you can do it, too, quickly and efficiently, then there will be at most ~ 4 codes / second can be tested. With ~ 72,057,594,037,900,000 possible combinations and an estimated hit by half the number it will take ~ 9,007,199,254,740,000 seconds or ~ 285,616,414 years to crack.
__________________________________________________ ________________________________________________

So do someone now how to beat this chip?
And tools to read it?


(Chip image is borrowed from Dane-Elec here on DK)

[soxten]

There is a company that manages to read the information on Renesas m30855fwugp
So the question is whether Renesas m30855fwugp is encrypted?
see Central Electronic Module (CEM) Transfer Service - Xemodex Inc. | Xemodex Inc. (http://xemodex.com/technologyimproved/cars/central-electronic-module-cem-transfer-service)


Looks like I can read the chip if I buy this
http://www.renesas.eu/products/tools/introductory_evaluation_tools/renesas_starter_kits/rsk_m32c87/index.jsp#order


__________________________________________________ __________________________________________________ _________________________________________________

Product Overview:

The M32C/85 m30855fwugp is based on the M32C/80 CPU Core and has 16MB of address space.Maximum operating frequency is 32MHz. Mask ROM and Flash Memory Versions areavailable. Internal Flash Memory is programmable on a single power source.
Key Features:



16-bit Multifunction Timer (Timer A and B, incl. 3-phase inverter motorcontrol function): 11 channels
Clock Synchronous / Asynchronous Serial Interface: 5 channels
10-bit A/D Converter: 34 channels*
8-bit D/A Converter: 2
DMAC: 4 channels
DMAC II: Can be activated by all peripheral function interrupt factors
Intelligent I/O

Time Measurement (Input Capture) or Waveform Generating (Output Compare)Function: 16-bit x 8 channels
Communication Function
2-phase Pulse Signal Processing (2-phase encoder input)


CAN: 2 channels (2.0B)
CRC Calculation Circuit
X/Y Converter
Watchdog Timer
Clock Generation Circuits: Main Clock Generation Circuit, Sub ClockGeneration Circuit, On-chip Oscillator, PLL Synthesizer
Oscillation Stop Detection Function
Power Supply Voltage Detection (Except for T Version)
ROM Correction Function
I/O Ports: 123*
External Interrupt Pins: 11
Data Flash: 4KB (Flash Memory Version only)

*: Spec of 144-pin version.



Key Applications:

Audio, Cameras, Office Equipment, Communication/Portable Devices,Automotive

[soxten]

I have now order Renesas Starter Kit for M32C/87 | Renesas Electronics Singapore (http://sg.renesas.com/products/tools/introductory_evaluation_tools/renesas_starter_kits/rsk_m32c87/index.jsp)
to se if I can read m30855fwugp :)

[sipelgas]

Let us know how it works out. I need to get that CEM opened also. But i haven't bought the programmer fro trying because of the cost versus need.

[sipelgas]

BTW C30/S40/V50 CEM is PIN protected for operations with OE tester. But working with MCU itself is not protected.

So it's possible that this CEM has chip that has no protection enabled or default code is used. It has PIN protection enabled in Volvo SW. So just need to test.

[soxten]

For this thread CEM read my post at How to read M30855FWUGP? - M32C - Forum - M32C - RenesasRulz (http://renesasrulz.com/renesas_products/m32c/f/24/t/3922.aspx)
I have tryed to clone 96x86 Eeprom on L-cem but don't work.
in this week i will try to desolder Mcu and move to used L-cem and se if vin and immo is stored inside MCU


(For v50/c30 connect direkt to MCU with Xprog, but do we have to copy both mcu? Or only one of them?
i think I started a special thread for v50/30 Cem?)

i have plenty of used parts and even cars to test on but my time is short....
But i trying to fix this L-cem and others

[soxten]

I have now resolder the MCU 100pin to a used CEM "L"
but it don`t work... if the problem is in the soldering... I have to check tonight.
resolder and solder a 144pin MCU IS a hell...

(I don`t have pinout to connect my Renesas Starter Kit to check IF the MCU is protected, IF someone can help me to connect the MCU to the kit so PLEASE PM me!)
Datasheet for MCU http://documentation.renesas.com/doc/products/mpumcu/rej09b0271_32c80hm.pdf

[soxten]

I have ask this comopany if they can read this MCU, but they can`t..... :(

MCU Beijing Shouxi Zhixin Technology Co. LTD (http://www.mcureverse.com/MCU/)

[Meat-Head]

Cool, but volvo why?

[soxten]

Meat-head: why? Don't understand you'r post?

[PremierD]

Mate ... Meaty don't understand his post either .. he just hits random keys .. and sometimes they make words .. :)

[Meat-Head]

Something to do with an iShit phone, if turn pc on, hours gone.

on topic

intresting topic on repair of control unit, but is is for a Volvo which are only driven by old people who moan or younger weirdos

[soxten]

Ok Mest-Head :)
In Sweden Volvo has 30-40% of the car market.
To change a CEM to a brand new OEM cost 800-1500 dollar so it's a market to use used CEM

But, we all have to look att Renesas mcu and find solutions to hack or code extract this basterds.
I see that many cars have Renesas today and we "electronic helping company" can't do anything at the moment...

[Meat-Head]

ok that INFERIOR link states milage - have you checked the mlage IN-correction section, see if anything flags up.

[soxten]

I have now succeeded to mount a USED CEM-L in a car! :)
(I write how to fix this CEM-L to night!)

Broken CEM-L is Diesel and Automat gear and used CEM-L is petrol and 5gear, and it`s no problem!.


But milage is stored in some Eeprom, do some one know were?

[MV auto]

I have now succeeded to mount a USED CEM-L in a car! :)
(I write how to fix this CEM-L to night!)

Broken CEM-L is Diesel and Automat gear and used CEM-L is petrol and 5gear, and it`s no problem!.


But milage is stored in some Eeprom, do some one know were?

you never shared how you made it...
could you just cloned flash in M32C and eeprom from 93c86?

[soxten]

Used codecard program

[johnnype]

So now I have started to look into this 2005+ CEM, I know (just about) all there is to know about the old 1999-2004 CEM's and have been happy with that. It enabled me to change CarConfig and lots of upgrades to my cars without paying to much money to Volvo :)

And now I'd like to share some developments I've made and ask for help :)


What I've read so far:
The 2005+ CEM MCU is encrypted and reading the Renesas M32C is impossible.
Contents of 93LC86C EEPROM is also encrypted and you need codeguard program to swap CEM's and sync against ECM.

What I've done:
Written a Arduino sketch for reading 93LC86C (no, I'm not buying any tools yet!)
(comments in Swedish, sorry about that)


// ------------------------------------------
// Microwire interface f?r 93LC86C EEPROM
// ------------------------------------------
// * L?s, Skriv och Radera funktioner
// * OBS! Endast x8 l?ge (8bitars)
//
// koppla f?ljande tr?dar till kresten

int DATA_IN = 2; // EEPROM PIN#4
int DATA_OUT =3; // EEPROM PIN#3
int CLOCK =4; // EEPROM PIN#2
int CHIP_SEL =5; // EEPROM PIN#1

byte READ = 0b110; // read 2bit kommando (r?kna med 0!)
byte WRITE = 0b101; // write
byte EWEN = 0b10011; // erase write enable 4bit kommando
byte EWDS = 0b10000; // erase write disable
byte ERAL = 0b10010; // erase all

void setup(){
pinMode(CLOCK ,OUTPUT);
pinMode(DATA_OUT ,OUTPUT);
pinMode(DATA_IN ,INPUT);
pinMode(CHIP_SEL ,OUTPUT);
digitalWrite(CHIP_SEL ,LOW);
Serial.begin(9600);
}

// modifierad Arduino instruktion fr?n wiring_shift.c
void shiftOut_Xbit(uint8_t dataPin, uint8_t clockPin, uint8_t bitOrder, uint16_t val, uint8_t bitlen)
{
uint8_t i;
for (i = 0; i < (bitlen+1); i++)
{
if (bitOrder == LSBFIRST)
digitalWrite(dataPin, !!(val & (1 << i)));
else
digitalWrite(dataPin, !!(val & (1 << ( bitlen - i))));
digitalWrite(clockPin, HIGH);
delayMicroseconds(1);
digitalWrite(clockPin, LOW);
delayMicroseconds(1);
}
}

void EWEN93x86()
{
digitalWrite(CHIP_SEL ,HIGH);
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,EWEN,4); // EW Enable
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9); // skicka 9 'X' i x8 l?get enligt ett datablad!
digitalWrite(CHIP_SEL ,LOW);
}

void EWDS93x86()
{
digitalWrite(CHIP_SEL ,HIGH);
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,EWDS,4); // EW Disable
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9); // skicka 9 'X' i x8 l?get enligt ett datablad!
digitalWrite(CHIP_SEL ,LOW);
}


void Read93x86()
{
char buf[8];
int high = 0,low =0; // address, starta p? 0x000

// l?s 2048bytes f?r 93LC86C EEPROM
// denna krets autoincrementerar sin l?spekare!
// s? vi kan h?mta hem hela minnet p? en instruktion.
digitalWrite(CHIP_SEL ,HIGH);
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,READ,2); // skicka 3-bitars READ instruktion
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,low,10); //skicka 10-bit adress
for (int i=0; i<=2047; i++) // 2047 f?r x8 l?ge
{
//byte a = shiftIn(DATA_IN,CLOCK,MSBFIRST); //sendin data
// x16Bit Org
// byte b = shiftIn(DATA_IN,CLOCK,MSBFIRST); //sendin data
//low+=2; // x16
//low++; // x8
//sprintf(buf, "%02X%02X", a,b); // x16
//sprintf(buf, "%02X", a); // x8
//Serial.print(buf);
Serial.write(shiftIn(DATA_IN,CLOCK,MSBFIRST)); // skicka data bin?rt!
}
digitalWrite(CHIP_SEL ,LOW);
}

void Write93x86(int adr, byte data)
{
EWEN93x86();
digitalWrite(CHIP_SEL ,HIGH);
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,WRITE,2); // skicka instruktion
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,adr,10); //skicka 10-bit adress
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,data,7); //send
digitalWrite(CHIP_SEL ,LOW);
delay(10);
EWDS93x86();
}

void Erase93x86()
{
Serial.print("ERAL...");
EWEN93x86();
digitalWrite(CHIP_SEL ,HIGH);
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,ERAL,4); // ERAL instruktion
shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9); // skicka 9 'X' i x8 l?get enligt ett datablad!
digitalWrite(CHIP_SEL ,LOW);
Serial.println("DONE!");
EWDS93x86();
}



void loop()
{
int adr=0;
char serialdata,buf[8];

//Serial.print(":");
while(1)
{
if (Serial.available() > 0)
{
switch(Serial.read())
{
case 'r': Read93x86(); // dumpa hela minnet!
break;

case 'V': Serial.println("MWT10008");
break;

case 'd': Write93x86(0x15,0xDD); // test!
break;

case 'Q': pinMode(CLOCK ,INPUT);
pinMode(DATA_OUT ,INPUT);
pinMode(DATA_IN ,INPUT);
pinMode(CHIP_SEL ,INPUT);
Serial.println("ALL INPUT MODE!");
while( serialdata != 'A' ) //
{
if (Serial.available() > 0)
{
serialdata = Serial.read();
}
}
pinMode(CLOCK ,OUTPUT);
pinMode(DATA_OUT ,OUTPUT);
pinMode(DATA_IN ,INPUT);
pinMode(CHIP_SEL ,OUTPUT);
Serial.println("Normal mode!");
break;

case 'e': Erase93x86(); // t?mmer hela kretsen
break;

case 'w': adr=0; // skriv
while( adr < 2048) // h?mta in 2K data
{
if (Serial.available() > 0)
{
serialdata = Serial.read();
Write93x86(adr,serialdata);
//sprintf(buf, "%02X", serialdata); //(AsciiToHex(serialdata[0]) * 16) + (AsciiToHex(serialdata[1])) );
//Serial.print(buf);
adr++;
}
}
break;

default: break;
}
//Serial.println(); Serial.print(":");
}
}
}


And a Windows program to read/write/erase/save and load BIN-files. (errr... also Swedish)
349288

A few questions:

I've Read my EEPROM a few times. Erased it and started the CEM up againg... even filling it with 0x11! And everytime the bytes at 0x018-0x019 are the same. Is this some kind of ID from CEM?

349291

And can I find the CEM PIN in here to get me into the CarConfig "hacking" again?

Also, is the 4byte PIN here? (I think its 4byte in this one, I know it is 3bytes in old CEM) that gives me security access, to immo,keys etc. via HSCAN-bus: 50 A3 02 E0 xx xx xx xx IF its the correct command?

Any pointers you can give me to get around the encryption would be very helpful! This is about 10year old cars so the commercial value of keeping secrets cant be to much these days. :02.47-tranquillity:

[adam12112]

If you want change carconfig i think that 93LC86 is wrong way, without this 93LC86 you can read out vin and car config. I had virigin this CEM and copy 93C86 after dealer reload i can not make it again virgin. Immo pin code have 3 bytes old and new CEM, master ECU code old and this have 6 bytes . Have you used codecard for cloning ? it did not fit that I noticed when i try to restore virgin. I could be wrong, i tried to fix a couple of years ago but i gave up.

[MV auto]

Hey Guys! I have no solution for cloning those type of CEM (or also the one from XC90 2008+). you guys have a solution?? I tried once to read and copy memory on a 2008 xc90 (from 25320 and from M32C M30882FJ) but without success. I know codecard have no solution yet for those xc90 with 25320, but they have solution for the V70 with 93c86... problem is, I had a call today to clone a 2006 V70 CEM and as per code card: Currently only CEM modules with serial number starting with 00005XXXXXX or higher can be decrypted. Please check your serial number before using our software. my customer state that CEM have 000035xxxxx, so not cover by codecard... any solution for those?? thanks for all input!!

[soxten]

Desolder mcu and Eeprom and move to used!

[adam12112]

I never saw CEM with 25320 have you got pictures ? This is only 2008 ? I have from XC90 2012 and have 93C86

[MV auto]

I never saw CEM with 25320 have you got pictures ? This is only 2008 ? I have from XC90 2012 and have 93C86
here are a few info I gathered on those CEM (xc70, made a mistake, not xc90). 362498 362499 362500
tried to read eeprom and flash (verify with success) and write them in second hand unit... unit seems dead when I installed in car. put back original unit, working. I never had a chance to work again on that vehicle since the customer explains me his problem, and found out there was a TSB concerning radio, not CEM. so I have this second hand unit still in my truck, I could make experiment on it, but no car, and the original unit has been re-install.

[adam12112]

XC70 2008+ it is different CEM. I can not help i do not have expirens with this CEM.

[simaservis1108]

V70 also has 95320(25320).

[gussen]

two different CEM and two different ways to handle codes.
In P2 (50), the code is 12 characters long, P3 (eg Xc70 2008), the code is 10 characters long. Between 2010 and 2012 there are two types of CEM with different types of processors M32C and R32C. Here is some help. In this processors you can find your magic codes. in terms of the 6 digit code to add keys, it in 93LC86 respective 25320th These are encrypted. The keys are placed in the second block. in EE-PROM.

You can change carconfig i all this cem without code. And is possible to clone both of them.


Good luck.

[MV auto]

do you have screen shot of those bytes you are talking about? not sure if I understand correctly as to where the info are... in eeprom (93c86/25320) or in flash (M32C/R32C)? and at what address
and the code you are talking about (either the 12-10 or 6 bytes long), what can you do with these? use VIDA to program key or those are like ISN between CEM and ECM??? I thought key could only be program by means of online "software update".
and how would you clone these CEM if eeprom are encrypted? (except by manually transfering flash and eeprom chip)
as I mentioned, I tried once to copy flash (with SMOK programmer) and eeprom (with UPA programmer), and CEM seems dead after transfer. :(

[johnnype]

I have copied M32C flash memory from working CEM to another (that was inadvertently erased). No problems, I used a serial interface and a small software i wrote for the purpose with information gathered from a few M16C datasheets..

424820

[soxten]

If you try to read "locked" area from mcu it delete all info in that area!


After that you cant do anything.



Skickat fr?n min iPhone med Tapatalk

[simaservis1108]

Not all CEM's are locked...I have read a couple of them..

[wormland]

Does anyone have virgin files of these CEM? I have for 1999-2004 but World like for newer CEM?s also.

[snyper cyrus]

Desolder mcu and Eeprom and move to used!

I did, but now windows not working,and only engine check light coming on the dash. But the car starts fine. Any help there?

[soxten]

I did, but now windows not working,and only engine check light coming on the dash. But the car starts fine. Any help there?

Resolder MCU, make good cleaning on pads and pins!



Skickat från min iPhone med Tapatalk

[johnnype]

If you try to read "locked" area from mcu it delete all info in that area!


After that you cant do anything.



Skickat fr?n min iPhone med Tapatalk

Nope, works just fine! :) No need to desolder stuff. Made my own program so I cant answer for whatever programsuite other ppl use.

[wormland]

Johnny,
Do you even read eeprom with your program?

[keymax]

Sorry to wake up an old thread. Just ran into the CEM-L with lower serial. Anyway to decrypt the EEprom? Any solution other than vida download to add keys?
Here's the dump from the 93LC86C

Thanks in advance!

[johnnype]

If you copy MCU and EEPROM at the same time it all works nice.

[boxsport]

Hello guys,
I'm new here, and today i had a person asking me if i could program a key (and probably the control).
I'm "still like a virgin" into this key programming stuff, and i was hoping someone could help me out...
Its a 2012 V70 Volvo.
Supposedly there is no key or chip to clone so its needs to be all new...
Can anyone help me out and tell me what will be the procedure and what tools i will need?
I'm in Mexico, but i assume that the system will be the same to other countries...
Also, where could i get a good deal for the key/control & Chip for this model?
Thanks for the support...

[BrotherMatt]

If you copy MCU and EEPROM at the same time it all works nice.

Johnnype, can you please elaborate? I think a lot of us(including me) would benefit.
I need to clone the CEM on my 2005 S60R. It has the 00005XXXXXX serial number. You mentioned that you read the M32 MCU flash and the EEPROM.
-For the EEPROM: Did you read and reprogram the 93CL86C with an Arduino using the code that you posted here (https://www.digital-kaos.co.uk/forums/showthread.php/334452-Volvo-V70-XC70-S60-2005-gt-gt-CEM-Thread?p=2673551&viewfull=1#post2673551)?
-For the MCU flash: How did you reprogram the Renesas M32C flash? Did you solder to headers on the board?

Please do expand on how you accomplished the CEM clone. Thanks.

[redaveliem]

thank you for sharing