volvo CEM

[vanos batam]

hello friends DK
i want to know where immo store on this CEM?
regard




s o l v e d

[vanos batam]

any body ?
pls

[bram380]

volvo type?

[gtmech]

is that a 9s12 on the top? What car is this from? thanks

[vanos batam]

volvo xc,60 2006 think.
yes 9s12 on the top

[vanos batam]

volvo xc,60 2006 think.
yes 9s12 on the top


today i get the CEM
i seems on the board NO 9s12 or no more motorola MCU.
anyone know where immo STORE ?

[alexics]

today i get the CEM
i seems on the board NO 9s12 or no more motorola MCU.
anyone know where immo STORE ?

The M32C is a renesas flash processor. The data may be in there.

[puu]

The M32C is a renesas flash processor. The data may be in there.


Hi..
How to read The M32C is a renesas flash processor?
Which programmer can do it ?
Regard

[igorr]

is there 28f400 in cem

[vanos batam]

is there 28f400 in cem

this is differen CEM. see the fhoto..
this isn't XC90.70.60 2001-2003

[adam12112]

Read 93c86 (nearby M32C)and try change but i think it is encrypted. I'm not sure there is immo.

[vanos batam]

Read 93c86 (nearby M32C)and try change but i think it is encrypted. I'm not sure there is immo.

AR706 AR043 mean???

[Holtek]

Immo is in M30855FWUGP Renesas processor. It is in Flash. Immo is encrypted.

Datasheet: http://documentation.renesas.com/eng/products/mpumcu/rej03b0046_32c85ds.pdf

[vanos batam]

Immo is in M30855FWUGP Renesas processor. It is in Flash. Immo is encrypted.

Datasheet: http://documentation.renesas.com/eng/products/mpumcu/rej03b0046_32c85ds.pdf

ahahh

BIG thanks for you ...

[vanos batam]

Immo is in M30855FWUGP Renesas processor. It is in Flash. Immo is encrypted.

Datasheet: http://documentation.renesas.com/eng/products/mpumcu/rej03b0046_32c85ds.pdf

if posible read and writing renesas flash with X prog.?

[vanos batam]

Read 93c86 (nearby M32C)and try change but i think it is encrypted. I'm not sure there is immo.


here the dump 93c86 (nearby M32C)

[twardy12345]

but first think what you want doit ?? you want change it cem ?? or ??

[vanos batam]

but first think what you want doit ?? you want change it cem ?? or ??

I need change the Cem

[adam12112]

If you want change CEM you have to change flash renesans processor (there are stored vin and specifications car). Did you found where is immo?

[vanos batam]

If you want change CEM you have to change flash renesans processor (there are stored vin and specifications car). Did you found where is immo?

immo in flash renesas..

[adam12112]

Did you know where exactly immo is stored ?(what address or offset,lengh)

[Holtek]

Did you know where exactly immo is stored ?(what address or offset,lengh)

Do you read Flash of Renesas processor?

[neriuks007]

hello i have volvo xc90 2005year,cem broken how to swap used cem? thanks

[adam12112]

Needed CEM 28f400 flash HW PN 9494594 and Hw PN 8688436

[soxten]

It stored in MCH Renesas M32C M30855FWUGP

But it looks like it password to access MCU

Copy from a Swedish forum translate to eng.
link Visa tr?d - Renesas m30855fwugp Hj?lp ? Svenska ElektronikForumet (http://www.digital-kaos.co.uk/forums/redirect-to/?redirect=http%3A%2F%2Fwww.elektronikforumet.com%2 Fforum%2Fviewtopic.php%3Ff%3D7%26t%3D58173%26view% 3Dprevious)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------
It is their M32C/85 and there is protection against readout, both for serial and parallel readout. There is a "password" consisting of 7 bytes that you should know in order that could change this protection through serial programming, once it is done, one can access the circuit that you want.


I deem it quite difficult ...


With serial booting (some pins in certain situations with reset button, standing in the data sheet), one can access to communicate with ***956;C'n (so I programmed them) and then they talk at 9600 baud (8n1). The sequence to enter the password is at ~ 12 bytes incl. password, then you should check if it is opened and it requires a shorter stopping and young. 5 bytes more before knowing that around the time of 30 bytes would probably suffice.


Then you can try 32 codes / second - if it was not so that you have to make a total power-down between each unsuccessful code ... Say that you can do it, too, quickly and efficiently, then there will be at most ~ 4 codes / second can be tested. With ~ 72,057,594,037,900,000 possible combinations and an estimated hit by half the number it will take ~ 9,007,199,254,740,000 seconds or ~ 285,616,414 years to crack.


Even if you can trick it to run 19k2 is hardly any more helpful, I would think that the car has rusted away then ...


EDIT: some typos and such.

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

So... do some one now how to pass this f*cking password to access MCU?

Need to clone some CEM from Volvo V70/XC90 2005->>

[soxten]

You need to desolder Renesas MCU and move to used.
I think you can use any CEM-L and only change MCU.

Renesas i coded from volvo...

[912secured]

You can buy flash on volvo's site and put new key in. Flash via 2534 you do not need security code for buying flash. install volvo vida on diffrent pc and see.

[soxten]

I don't understand?
You can't change ti a used CEM-L and reprogram key:s.
Iif you can do this you need to buy brand new oem key:s and program.
And how do you sync immo from ECU/ECM?

[ivanrpm]

Hi bro, its posible if you have a clone of the car ecu-cem then make new keys and it Works, by codecard sw, just diesel models support or the other way buying new CEM and by j2534 I think you can sincron with ecu. Regards

[soxten]

Codecard don`t have program for CEM-L 2005-2008 only old 99-04 gray/black CEM and Volvo S40/V50/C30 CEM.
In this thread all about CEM-L = Volvo V70/XC70/S60/S80 2005-2008 (2009) and it has the shape of a "L" =CEM-L
The immo is in Renesas MCU and is coded by Volvo (2 diffrent codes, Volvo general code + Code for VIN number)
To use a used CEM-L you need to move MCU from broken to used, You can`t clone Flash+Eeprom from MCU.

You can`t change it on any other way:s
You can`t program used keys.
If you can read immo code/key:s in ECU(ECM) then you can`t program to CEM-L
You can`t change VIN in CEM-L
If you try to program on Vida it`s not possible to married this used CEM-L in to the car, Vida check VIN and if not correct it don`t update CEM-L.

If some one has a working way exept moving MCU please write it here!

[adam12112]

soxten do you know what happened when swap 93c86(car start or not?, any fault code? , are there key codes?) and what you mean " ...volvo general code..." ?

[soxten]

93c86 has not immo.
This is changing time to time if I read it.
I have move mcu 144pin and car start.
Do you know if mile/km i stored in 93c86?

[adam12112]

I do not know where milage stored. When swap 93c86 milage are changed?

[soxten]

Milage is stored in both dim and cem.
I have not controll this yet

[adam12112]

Do you know how make virgin CEM "L"?

[soxten]

Not possible!
Renesas mcu i coded by volvo.
If you try to read mcu all info get deleted.
Some chines guy can hack this typ of mcu, but he don't answer my mail...

[pawliukazz]

Codecard released Synchro with ECU and Cloning Utilities for this kind of CEM

[adam12112]

Any changes in thred volvo CEM L? I found few solutions

Central Electronic Module for Volvo | xemodex United States (http://www.xemodex.com/technologyimproved/central-electronic-module-for-volvo/)
CEM-L & CEM-H Cloning utility (http://codecard.lt/small-soft/cem-l-cem-h-cloning-utility/prod_1022.html)
30786890 31282455 30728539 12243769 Volvo CEM H CEM L Clone - Virgin Reset - Key Service : ECU Decode - ECU Repairs, Unlocks, Cloning, Immobiliser Bypass Tel 01373 302412 (http://ecudecode.go-ecommerce.com/shopping/site/Product/30786890-31282455-30728539-12243769-volvo-cem-h-cem-l-clone-virgin-reset-key-service-cem-l-h-1365575)

Now we know that the possible, anyone know more details?

No offers see decrypted data

[pawliukazz]

Any changes in thred volvo CEM L? I found few solutions

Central Electronic Module for Volvo | xemodex United States (http://www.xemodex.com/technologyimproved/central-electronic-module-for-volvo/)
CEM-L & CEM-H Cloning utility (http://codecard.lt/small-soft/cem-l-cem-h-cloning-utility/prod_1022.html)
30786890 31282455 30728539 12243769 Volvo CEM H CEM L Clone - Virgin Reset - Key Service : ECU Decode - ECU Repairs, Unlocks, Cloning, Immobiliser Bypass Tel 01373 302412 (http://ecudecode.go-ecommerce.com/shopping/site/Product/30786890-31282455-30728539-12243769-volvo-cem-h-cem-l-clone-virgin-reset-key-service-cem-l-h-1365575)

Now we know that the possible, anyone know more details?

No offers see decrypted data

Only codecard, tango and me can decrypt eprom and i can reasure, that noone will offer you decrypted dump :D
Others just offer "cloning" services but they just swap processor and eeprom to new board, they dont care...
As for key programming they use tango, but codecard will release key programming on carprog soon too.

[zoranmadzar]

ok friend...

[pawliukazz]

friend

for you

pass.mhhauto

Different CEM, Different ECU, and we all already have this soft
Wrong thread!

[maxximum]

Please Help,

What is the type of this IC, CEM L Module doesnt work, no communication and can't diagnose, someone before scratched this SOIC-08 IC type number.

CEM Type:

CEM L
12216069
Volvo
30728356
04W442
Germany

BR: maxXimum

271925

[soxten]

I dont know about this chip.
I read 33661 xaknm on mine cem.

[maxximum]

Thanks, possibly it is a

Freescale MC33661 Local
Interconnect Network (LIN) Enhanced Physical Interface with Selectable Slew-Rate

:)

[tatyanka]

2005 Volvo XC90.
I had original water damage CEM #30682982 04w227 with M30835 ,93LC86 and another smal micro(Has "I" logo and crystal,didn't recorded what it was) and replacement CEM #30728539 05w155 with only Renesas and 93LC86.So someone before me changed 93LC86 and Nothing .Car was cranking before,but won't start,,,but after 93LC86 replacement Quit completely. So,I changed M30835 to new board along with 93LC86---Dead instrument cluster(Wrong Flash DTC code) and internal malfunction in CEM.Moved another micro with "I" logo few accompanied resistors and capacitors,and car started right away.
Thanks God. It was PROJECT
Alex
P.S.And datasheet for M30835 didn't mention anything about security or passwords

[soxten]

Number of broken cem and number on used cem?


Christian Johansson via Iphone 5s

[tatyanka]

Edited original post
Alex
P.S.How to add dumps to post(I read both 93LC86)

[NogaroB5S4]

Used the CodeCard software to clone (did Full, not just Immo) CEM on 2005 XC90. The car starts and most ok, but there is a fault in the gearbox (does not shift), CEM is looking for Xenon lights (the original XC90 has halogen) and VIN is still of the old car. So this must all be data contained in the Renesas Flash? Any chance of correcting this coding with VIDA at this point? Or is this pretty much "burned in". If burned in, will need to transfer processor as well so there was really no point of the CodeCard software in this case.

[Tomanio]

You must read M32c flash and write to second CEM :) 10 min of work

[adam12112]

You must read M32c flash and write to second CEM :) 10 min of work

How you read/write by OBD this flash?

[Tomanio]

I get PIN and then I can read it thru OBD

[NogaroB5S4]

You must read M32c flash and write to second CEM :) 10 min of work

I ended up changing the plug from donor unit. The only problem in this case were few broken pins (water damage) on the connector only. No PCB damage.

Best programmer to clone M32c for the future? SMOK?

[Tomanio]

smok is ok :)

[adam12112]

I get PIN and then I can read it thru OBD

How you get PIN so fast if it takes 10 min (is calculator for PIN from VIN)?
Can you erase PIN thru OBD?

[alclot]

Hi everybody! I try to read micro m30855 with smok but I cant. I used wiring on the photo. Can anybody help with tested pinout?
Thanks in advance ;)

[ecumix]

yes i olso have cem m32c M30835FJV from s60 any advice to clone

http://www.digital-kaos.co.uk/forums/showthread.php/579146-volvo-s60-how-to-clone-cem-L

[soxten]

Dont try to read that one ecumix!!!
Desolder is only option!!!


Skickat fr?n min iPhone med Tapatalk

[ecumix]

thank Soxten for good trick

[rachas]

Hi, Can someone help me with Volvo CEM PIN code stored address - offset. I have copied from my 2012 Volvo CEM micro-controller MC9S12XDT384 FLASH memory. In this binary file data are storied between those addresses:

1. 0x8000 - 0xbfff
2. 0x18000 - 0x1bfff
3. 0x28000 - 0x2bfff
4. 0x38000 - 0x3bfff
5. 0x48000 - 0x4bfff
6. 0x58000 - 0x5bfff
7. 0x68000 - 0x6bfff
8. 0x78000 - 0x7bfff
9. 0x88000 - 0x8bfff
10. 0x98000 - 0x9bfff
11. 0xa8000 - 0xabfff
12. 0xb8000 - 0xbbfff
13. 0x138000 - 0x13bfff
14. 0x148000 - 0x14bfff
15. 0x158000 - 0x15bfff
16. 0x168000 - 0x16bfff
17. 0x178000 - 0x17bfff

Does anyone know where PIN code is stored there, please?

[rachas]

Thanks in advance :)

[radugcr]

M30855FWUGP Renesas processor could be read and transfer data.

[sarunasgr]

Hello,
maybe some know how find volvo xc90 2006 CEM -H pin code , or said where is stored by adress 0x8000 ? please!

[sarunasgr]

can some help me with volvo CEM xc90 please?

[vaucher]

Can you share the software to read thru OBD?

[UnQ]

Hi Alcot! Did you succeed in reading your MC? I just tried these days to read M30835 (in circuit) with Smok, it did go unsecured and then received memory error. I know that my MC is bad because I swapped it together with the external eeprom into another CEM-L and the car's behavior is the same. Now, I don't know if my Smok isn't good or the MC is broke or this MC can't be read in my circuit and I need to make another circuit just to be read/write. Any advice?

[UnQ]

M30855FWUGP Renesas processor could be read and transfer data.

What did you used to read the flash and how (in circuit/ on adapter/ other ways)?