Volvo V70/XC70/S60 2005->> CEM Thread

[soxten]

Thread for Volvo V70/XC70/S60 2005-2010 CEM ("L" CEM)

This CEM have all info stored in MCH Renesas M32C M30855FWUGP and is coded.

I have read CEM info with Maxidas 708 and find that it show 3 diffrent S/W? (se picture)
Renesas_MCU .jpgCem1.JPG
__________________________________________________ ________________________________________________
Copy from a Swedish forum translate to eng.
link Visa tr?d - Renesas m30855fwugp Hj?lp ? Svenska ElektronikForumet
It is their M32C/85 and there is protection against readout, both for serial and parallel readout. There is a "password" consisting of 7 bytes that you should know in order that could change this protection through serial programming, once it is done, one can access the circuit that you want.
I deem it quite difficult ...
With serial booting (some pins in certain situations with reset button, standing in the data sheet), one can access to communicate with ***956;C'n (so I programmed them) and then they talk at 9600 baud (8n1). The sequence to enter the password is at ~ 12 bytes incl. password, then you should check if it is opened and it requires a shorter stopping and young. 5 bytes more before knowing that around the time of 30 bytes would probably suffice.
Then you can try 32 codes / second - if it was not so that you have to make a total power-down between each unsuccessful code ... Say that you can do it, too, quickly and efficiently, then there will be at most ~ 4 codes / second can be tested. With ~ 72,057,594,037,900,000 possible combinations and an estimated hit by half the number it will take ~ 9,007,199,254,740,000 seconds or ~ 285,616,414 years to crack.
__________________________________________________ ________________________________________________

So do someone now how to beat this chip?
And tools to read it?


(Chip image is borrowed from Dane-Elec here on DK)

[soxten]

There is a company that manages to read the information on Renesas m30855fwugp
So the question is whether Renesas m30855fwugp is encrypted?
see Central Electronic Module (CEM) Transfer Service - Xemodex Inc. | Xemodex Inc.


Looks like I can read the chip if I buy this
http://www.renesas.eu/products/tools...ndex.jsp#order


__________________________________________________ __________________________________________________ _________________________________________________

Product Overview:

The M32C/85 m30855fwugp is based on the M32C/80 CPU Core and has 16MB of address space.Maximum operating frequency is 32MHz. Mask ROM and Flash Memory Versions areavailable. Internal Flash Memory is programmable on a single power source.
Key Features:

• 16-bit Multifunction Timer (Timer A and B, incl. 3-phase inverter motorcontrol function): 11 channels
• Clock Synchronous / Asynchronous Serial Interface: 5 channels
• 10-bit A/D Converter: 34 channels*
• 8-bit D/A Converter: 2
• DMAC: 4 channels
• DMAC II: Can be activated by all peripheral function interrupt factors
• Intelligent I/O
  
  • Time Measurement (Input Capture) or Waveform Generating (Output Compare)Function: 16-bit x 8 channels
  • Communication Function
  • 2-phase Pulse Signal Processing (2-phase encoder input)
  
  
• CAN: 2 channels (2.0B)
• CRC Calculation Circuit
• X/Y Converter
• Watchdog Timer
• Clock Generation Circuits: Main Clock Generation Circuit, Sub ClockGeneration Circuit, On-chip Oscillator, PLL Synthesizer
• Oscillation Stop Detection Function
• Power Supply Voltage Detection (Except for T Version)
• ROM Correction Function
• I/O Ports: 123*
• External Interrupt Pins: 11
• Data Flash: 4KB (Flash Memory Version only)

*: Spec of 144-pin version.



Key Applications:

Audio, Cameras, Office Equipment, Communication/Portable Devices,Automotive

[soxten]

I have now order Renesas Starter Kit for M32C/87 | Renesas Electronics Singapore
to se if I can read m30855fwugp

[sipelgas]

Let us know how it works out. I need to get that CEM opened also. But i haven't bought the programmer fro trying because of the cost versus need.

[sipelgas]

BTW C30/S40/V50 CEM is PIN protected for operations with OE tester. But working with MCU itself is not protected.

So it's possible that this CEM has chip that has no protection enabled or default code is used. It has PIN protection enabled in Volvo SW. So just need to test.

[soxten]

For this thread CEM read my post at How to read M30855FWUGP? - M32C - Forum - M32C - RenesasRulz
I have tryed to clone 96x86 Eeprom on L-cem but don't work.
in this week i will try to desolder Mcu and move to used L-cem and se if vin and immo is stored inside MCU


(For v50/c30 connect direkt to MCU with Xprog, but do we have to copy both mcu? Or only one of them?
i think I started a special thread for v50/30 Cem?)

i have plenty of used parts and even cars to test on but my time is short....
But i trying to fix this L-cem and others

[soxten]

I have now resolder the MCU 100pin to a used CEM "L"
but it don`t work... if the problem is in the soldering... I have to check tonight.
resolder and solder a 144pin MCU IS a hell...

(I don`t have pinout to connect my Renesas Starter Kit to check IF the MCU is protected, IF someone can help me to connect the MCU to the kit so PLEASE PM me!)
Datasheet for MCU http://documentation.renesas.com/doc...71_32c80hm.pdf

[soxten]

I have ask this comopany if they can read this MCU, but they can`t.....

MCU Beijing Shouxi Zhixin Technology Co. LTD

[Meat-Head]

Cool, but volvo why?

[soxten]

Meat-head: why? Don't understand you'r post?

[PremierD]

Mate ... Meaty don't understand his post either .. he just hits random keys .. and sometimes they make words ..

[Meat-Head]

Something to do with an iShit phone, if turn pc on, hours gone.

on topic

intresting topic on repair of control unit, but is is for a Volvo which are only driven by old people who moan or younger weirdos

[soxten]

Ok Mest-Head
In Sweden Volvo has 30-40% of the car market.
To change a CEM to a brand new OEM cost 800-1500 dollar so it's a market to use used CEM

But, we all have to look att Renesas mcu and find solutions to hack or code extract this basterds.
I see that many cars have Renesas today and we "electronic helping company" can't do anything at the moment...

[Meat-Head]

ok that INFERIOR link states milage - have you checked the mlage IN-correction section, see if anything flags up.

[soxten]

I have now succeeded to mount a USED CEM-L in a car!
(I write how to fix this CEM-L to night!)

Broken CEM-L is Diesel and Automat gear and used CEM-L is petrol and 5gear, and it`s no problem!.


But milage is stored in some Eeprom, do some one know were?