Volvo V70/XC70/S60 2005->> CEM Thread

[MV auto]

I have now succeeded to mount a USED CEM-L in a car!
(I write how to fix this CEM-L to night!)

Broken CEM-L is Diesel and Automat gear and used CEM-L is petrol and 5gear, and it`s no problem!.


But milage is stored in some Eeprom, do some one know were?

you never shared how you made it...
could you just cloned flash in M32C and eeprom from 93c86?

[soxten]

Used codecard program

[johnnype]

So now I have started to look into this 2005+ CEM, I know (just about) all there is to know about the old 1999-2004 CEM's and have been happy with that. It enabled me to change CarConfig and lots of upgrades to my cars without paying to much money to Volvo

And now I'd like to share some developments I've made and ask for help


What I've read so far:
The 2005+ CEM MCU is encrypted and reading the Renesas M32C is impossible.
Contents of 93LC86C EEPROM is also encrypted and you need codeguard program to swap CEM's and sync against ECM.

What I've done:
Written a Arduino sketch for reading 93LC86C (no, I'm not buying any tools yet!)
(comments in Swedish, sorry about that)

// ------------------------------------------
//   Microwire interface f?r 93LC86C EEPROM
// ------------------------------------------
// * L?s, Skriv och Radera funktioner
// * OBS! Endast x8 l?ge (8bitars)
// 
// koppla f?ljande tr?dar till kresten

int DATA_IN = 2;    // EEPROM PIN#4
int DATA_OUT =3;    // EEPROM PIN#3
int CLOCK =4;       // EEPROM PIN#2
int CHIP_SEL =5;    // EEPROM PIN#1

byte READ  = 0b110;          // read     2bit kommando (r?kna med 0!)
byte WRITE = 0b101;          // write 
byte EWEN  = 0b10011;        // erase write enable   4bit kommando
byte EWDS  = 0b10000;        // erase write disable
byte ERAL  = 0b10010;        // erase all

void setup(){
  pinMode(CLOCK ,OUTPUT);
  pinMode(DATA_OUT ,OUTPUT);
  pinMode(DATA_IN ,INPUT);
  pinMode(CHIP_SEL ,OUTPUT);
  digitalWrite(CHIP_SEL ,LOW);
  Serial.begin(9600);
}

// modifierad Arduino instruktion fr?n wiring_shift.c
void shiftOut_Xbit(uint8_t dataPin, uint8_t clockPin, uint8_t bitOrder, uint16_t val, uint8_t bitlen)
{
    uint8_t i;
    for (i = 0; i < (bitlen+1); i++)  
    {
        if (bitOrder == LSBFIRST)
            digitalWrite(dataPin, !!(val & (1 << i)));
        else    
            digitalWrite(dataPin, !!(val & (1 << ( bitlen - i))));
        digitalWrite(clockPin, HIGH);
        delayMicroseconds(1);
        digitalWrite(clockPin, LOW);
        delayMicroseconds(1);       
    }
}

void EWEN93x86()
{
  digitalWrite(CHIP_SEL ,HIGH); 
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,EWEN,4);     // EW Enable
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9);     // skicka 9 'X' i x8 l?get enligt ett datablad! 
  digitalWrite(CHIP_SEL ,LOW);
}

void EWDS93x86()
{
  digitalWrite(CHIP_SEL ,HIGH); 
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,EWDS,4);     // EW Disable
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9);     // skicka 9 'X' i x8 l?get enligt ett datablad!
  digitalWrite(CHIP_SEL ,LOW);
}


void Read93x86()
{
  char buf[8];
  int high = 0,low =0;     // address, starta p? 0x000
  
  // l?s 2048bytes f?r  93LC86C EEPROM
  // denna krets autoincrementerar sin l?spekare!
  // s? vi kan h?mta hem hela minnet p? en instruktion.
  digitalWrite(CHIP_SEL ,HIGH);
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,READ,2); // skicka 3-bitars READ instruktion
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,low,10);   //skicka 10-bit adress 
  for (int i=0; i<=2047; i++) // 2047 f?r x8 l?ge
  {
    //byte a = shiftIn(DATA_IN,CLOCK,MSBFIRST); //sendin data
    // x16Bit Org
    // byte b = shiftIn(DATA_IN,CLOCK,MSBFIRST); //sendin data
    //low+=2;       // x16
    //low++;   // x8
    //sprintf(buf, "%02X%02X", a,b);    //  x16
    //sprintf(buf, "%02X", a);    //  x8
    //Serial.print(buf);
    Serial.write(shiftIn(DATA_IN,CLOCK,MSBFIRST)); // skicka data bin?rt!
  }
  digitalWrite(CHIP_SEL ,LOW);
}

void Write93x86(int adr, byte data)
{
  EWEN93x86();
  digitalWrite(CHIP_SEL ,HIGH);
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,WRITE,2); // skicka  instruktion
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,adr,10);   //skicka 10-bit adress 
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,data,7); //send
  digitalWrite(CHIP_SEL ,LOW);
  delay(10);
  EWDS93x86();
}

void Erase93x86()
{
  Serial.print("ERAL...");
  EWEN93x86();
  digitalWrite(CHIP_SEL ,HIGH);                 
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,ERAL,4);   // ERAL instruktion 
  shiftOut_Xbit(DATA_OUT,CLOCK,MSBFIRST,0x00,9);   // skicka 9 'X' i x8 l?get enligt ett datablad!  
  digitalWrite(CHIP_SEL ,LOW);
  Serial.println("DONE!");
  EWDS93x86();
}

 

void loop()
{
  int adr=0;
  char serialdata,buf[8];
  
  //Serial.print(":");
  while(1)
  {
      if (Serial.available() > 0) 
      {
        switch(Serial.read())
        {
          case 'r': Read93x86(); // dumpa hela minnet!
                    break;
 
          case 'V': Serial.println("MWT10008");
                    break;

          case 'd': Write93x86(0x15,0xDD); // test!
                    break;
          
          case 'Q':   pinMode(CLOCK ,INPUT);
                      pinMode(DATA_OUT ,INPUT);
                      pinMode(DATA_IN ,INPUT);
                      pinMode(CHIP_SEL ,INPUT);
                    Serial.println("ALL INPUT MODE!");
                    while( serialdata != 'A' ) // 
                    {
                      if (Serial.available() > 0) 
                      {    
                        serialdata = Serial.read();
                      }
                    }
                      pinMode(CLOCK ,OUTPUT);
                      pinMode(DATA_OUT ,OUTPUT);
                      pinMode(DATA_IN ,INPUT);
                      pinMode(CHIP_SEL ,OUTPUT);
                    Serial.println("Normal mode!");
                    break;
                    
          case 'e': Erase93x86(); // t?mmer hela kretsen
                    break; 
                    
          case 'w': adr=0;    // skriv 
                    while( adr < 2048) // h?mta in 2K data
                    {
                      if (Serial.available() > 0) 
                      {    
                        serialdata = Serial.read();
                        Write93x86(adr,serialdata);
                        //sprintf(buf, "%02X", serialdata);  //(AsciiToHex(serialdata[0]) * 16) + (AsciiToHex(serialdata[1])) );
                        //Serial.print(buf);
                        adr++;
                      }
                    }
                    break;
                    
          default:  break;
        }
        //Serial.println(); Serial.print(":"); 
      }
  }
}

And a Windows program to read/write/erase/save and load BIN-files. (errr... also Swedish)
MicroWireEEPROMtool.zip

A few questions:

I've Read my EEPROM a few times. Erased it and started the CEM up againg... even filling it with 0x11! And everytime the bytes at 0x018-0x019 are the same. Is this some kind of ID from CEM?

bild1.JPG

And can I find the CEM PIN in here to get me into the CarConfig "hacking" again?

Also, is the 4byte PIN here? (I think its 4byte in this one, I know it is 3bytes in old CEM) that gives me security access, to immo,keys etc. via HSCAN-bus: 50 A3 02 E0 xx xx xx xx IF its the correct command?

Any pointers you can give me to get around the encryption would be very helpful! This is about 10year old cars so the commercial value of keeping secrets cant be to much these days.

[adam12112]

If you want change carconfig i think that 93LC86 is wrong way, without this 93LC86 you can read out vin and car config. I had virigin this CEM and copy 93C86 after dealer reload i can not make it again virgin. Immo pin code have 3 bytes old and new CEM, master ECU code old and this have 6 bytes . Have you used codecard for cloning ? it did not fit that I noticed when i try to restore virgin. I could be wrong, i tried to fix a couple of years ago but i gave up.

[MV auto]

Hey Guys! I have no solution for cloning those type of CEM (or also the one from XC90 2008+). you guys have a solution?? I tried once to read and copy memory on a 2008 xc90 (from 25320 and from M32C M30882FJ) but without success. I know codecard have no solution yet for those xc90 with 25320, but they have solution for the V70 with 93c86... problem is, I had a call today to clone a 2006 V70 CEM and as per code card: Currently only CEM modules with serial number starting with 00005XXXXXX or higher can be decrypted. Please check your serial number before using our software. my customer state that CEM have 000035xxxxx, so not cover by codecard... any solution for those?? thanks for all input!!

[soxten]

Desolder mcu and Eeprom and move to used!

[adam12112]

I never saw CEM with 25320 have you got pictures ? This is only 2008 ? I have from XC90 2012 and have 93C86

[MV auto]

I never saw CEM with 25320 have you got pictures ? This is only 2008 ? I have from XC90 2012 and have 93C86

here are a few info I gathered on those CEM (xc70, made a mistake, not xc90). 08 XC70 pictures1.rar 08 XC70 pictures2.rar 08_XC70_CEM_eeprom+flash.rar
tried to read eeprom and flash (verify with success) and write them in second hand unit... unit seems dead when I installed in car. put back original unit, working. I never had a chance to work again on that vehicle since the customer explains me his problem, and found out there was a TSB concerning radio, not CEM. so I have this second hand unit still in my truck, I could make experiment on it, but no car, and the original unit has been re-install.

[adam12112]

XC70 2008+ it is different CEM. I can not help i do not have expirens with this CEM.

[simaservis1108]

V70 also has 95320(25320).

[gussen]

two different CEM and two different ways to handle codes.
In P2 (50), the code is 12 characters long, P3 (eg Xc70 2008), the code is 10 characters long. Between 2010 and 2012 there are two types of CEM with different types of processors M32C and R32C. Here is some help. In this processors you can find your magic codes. in terms of the 6 digit code to add keys, it in 93LC86 respective 25320th These are encrypted. The keys are placed in the second block. in EE-PROM.

You can change carconfig i all this cem without code. And is possible to clone both of them.


Good luck.

[MV auto]

do you have screen shot of those bytes you are talking about? not sure if I understand correctly as to where the info are... in eeprom (93c86/25320) or in flash (M32C/R32C)? and at what address
and the code you are talking about (either the 12-10 or 6 bytes long), what can you do with these? use VIDA to program key or those are like ISN between CEM and ECM??? I thought key could only be program by means of online "software update".
and how would you clone these CEM if eeprom are encrypted? (except by manually transfering flash and eeprom chip)
as I mentioned, I tried once to copy flash (with SMOK programmer) and eeprom (with UPA programmer), and CEM seems dead after transfer.

[johnnype]

I have copied M32C flash memory from working CEM to another (that was inadvertently erased). No problems, I used a serial interface and a small software i wrote for the purpose with information gathered from a few M16C datasheets..

DSC_0666.JPG

[soxten]

If you try to read "locked" area from mcu it delete all info in that area!


After that you cant do anything.



Skickat fr?n min iPhone med Tapatalk

[simaservis1108]

Not all CEM's are locked...I have read a couple of them..