openinverter forum

It can't be to hard to figure out what a CEM needs to send out the all good message to the car and unlock or what it needs as input from MCU to send that message out.

If you know the output of the CEM you can know if you even need the CEM.

Now if you have a MCU yes you need a CEM..else it won't allow to start etc.

Now is the question is apart from a display message what is locked?

EV_Builder wrote: ↑Mon Feb 20, 2023 4:00 pm It can't be to hard to figure out what a CEM needs to send out the all good message to the car and unlock or what it needs as input from MCU to send that message out.

If you know the output of the CEM you can know if you even need the CEM.

Now if you have a MCU yes you need a CEM..else it won't allow to start etc.

Now is the question is apart from a display message what is locked?

Well, the immobilizer is two staged: The steering wheel unlocks when the key is recognized and the car should perform all the normal functions.

The second step decides about whether or not the car is allowed to start. This process involves three modules: the CEM, the BCM (brake control module) and the ECM.

0) The BCM seems to spam it's serial number to the bus every 14ms on the HS-CAN bus. This serial number is stored in the ECM as well (but not in the CEM).
1) The CEM sends out a message on the HS-CAN to the ECM, which is based on the so called SYNC value, which is stored in the CEMs EEPROM.
This is probably a cryptographic challenge of some sort.

2) The ECM receives this value and checks if the serial number of the BCM that's sent out on the bus matches the one stored in it's EEPROM and if the message from the CEM corresponds to the SYNC value that's stored in the ECMs EEPROM.

3) If both of those challenges pass, the ECM sends out some sort of success message and the CEM activates the fuel pump and starter. If this check fails, the message in the DIM will be displayed when turning the key to the off-position again.

4) Probably the CEM will tell the ECM if it liked the answer or not and possibly communicate the status of the fuel pump relay and if the start is allowed or not.


What the people from cartools probably did was reverse engineer the cryptographic procedure from the ECM in order to replicate it. As I said previously, the serial number from the BCM is just sent out on the bus and the current SYNC value has to be programmed into their device as well.

I have decided to sell this car.
If anyone is interested, https://www.blocket.se/annons/goteborg/ ... /107226311

Why?

EV_Builder wrote: ↑Mon Feb 27, 2023 11:55 pmWhy?

The Clio works so well with the MGR that I have no need replacing it and the C30 is large and heavy compared to it so I will never get the same efficiency out of it as with the Clio. So plan is to stick with the Clio.

Glad to hear that the mgr is finally a success! I knew it was running better with the new software but wasn’t sure if it met your expectations,

Car is now sold.

I wonder what is the reason you decided to sell the Volvo C30 in the end. I like this car and was thinking about choosing this for my EV conversion. Is there any gotchas that made you sell this one?

I realized I don't want a "modern" car with all its bells and whistles. I prefer an older more analog car.
On top of that there is the hassle with the immobilizer, that can be worked around but not in a way I liked.
If you like the car, go ahead. I think it will work well as an EV.

Ev8 wrote: ↑Tue Feb 28, 2023 6:19 am Glad to hear that the mgr is finally a success! I knew it was running better with the new software but wasn’t sure if it met your expectations,

Is there any info on the MGR project? It's still something I think about doing from time to time. Tried the forum search with no luck.

barracuda816 wrote: ↑Sun Mar 17, 2024 5:01 pm Is there any info on the MGR project? It's still something I think about doing from time to time. Tried the forum search with no luck.

viewtopic.php?t=912&hilit=clio