DIY CEM (and VGM) PIN Retrieval for Volvo and Polestar

[Power6]

If you want to change configuration on your Volvo, you need to have the "CEM PIN" for your car, and if you have an Android Auto based Polestar or Volvo (aka an "iCup" car) you also need the "VGM PIN" for the car. PINs are something like passwords to access modules. Like all modern cars, the manufacturer doesn't want you to make changes, so there are various security features throughout the car to prevent that. There are dozens of PINs for each car. We are only interested in the specific PINs to make configuration changes to the car for this procedure.

We currently offer the PIN service as an easy way to get the PIN(s) you need. But it is possible to get PINs yourself for your car, or PINs for any Volvo or Polestar. OrBit has tools built in to help. First you must gather some information from the official diagnostic software, VIDA. Essentially what you do is make VIDA use the secret PIN on your car and record it, then use OrBit to 'crack' the PIN from that information.

Here's what you will need to do that:

• Access to Volvo or Polestar VIDA
  
• Access to the local computer running VIDA, will need to be able to install Wireshark on it)
  
• Ability to order "configuration test" software in VIDA
  
• VIDA must be connected to the car with wired connection (no dealer WiFi)
  
• VOE Cable to connect to the car (or equivalent, same as what you would use with OrBit)
  

Thanks to right-to-repair law in a single US state (Go Massachusetts  ), consumers in North America (NA) are able to buy a subscription to VIDA at volvotechinfo.com (or polestartechhub.com for Polestar). If you are set up with a Windows laptop and cable for OrBit, the same setup will work for VIDA. Outside North America, VIDA software is not available to consumers, making access to VIDA much more difficult. There have been many workarounds for this, which is not part of this discussion but creative solutions are out there to get to VIDA outside NA. 

This post is not a VIDA DIY, that's a whole other topic! We'll assume you have a subscription set up, or a friendly mechanic with VIDA, and you are able to navigate connecting the car and purchasing software. It can be tricky the first time through to know how the system works.

STEP 1 - Capture software install from VIDA

• Open VIDA and log in
  
  
• Open Wireshark, go to Capture menu, click "Start"
  
•    
  
• Connect to the car in VIDA
  
• In VIDA order a "configuration test" for your car (this is cheap, just $0.01!)
  
• Once ordered, you can retrieve the order in VIDA, to get it ready for install
  
• Install the software in VIDA, wait until it is complete
  
• In Wireshark, go to Capture menu, click "Stop"
  
• Got to the File menu, click "Save As..."
  
• Save the capture file (as a "pcapng" file type)
  
• If this is not the same computer you will run OrBit on, save the pcapng somewhere you can get to it later (cloud service) or take it with you (USB stick)
  

STEP 2 - Crack the PIN with OrBit

• Open OrBit, and log in
  
• Go to "Expert Toolbox" tab
  
• Click the "PIN Finder" button
  
• Choose the pcapng capture file from Step 1
  
• Wait for OrBit to do the magic! It can take up to a minute, maybe longer for really slow laptop...
  

   

• If the pcapng file contains PIN information (including CEM/VGM PINs), OrBit will output the PINs found in the PIN finder report
  
• You can save the PIN(s) report for safe keeping. If your car is currently connected, OrBit will prompt you to save the PINs in the profile.
  
• If your car is not connected, you can later paste the PIN(s) into the "Add CEM PIN" and "Add VGM PIN" dialogs opened with the buttons on the Shortcuts tab in OrBit, while you are connected to your car. 
  

Enjoy exploring and modifying config with OrBit! I'd like to note here, unlike "other" software, OrBit reflects my belief that *you* own your car, so always the PINs that you get, are given to you, to use however you like! You can take them and use them with any other Volvo software, make your own software or tools, whatever. We don't borrow them from Volvo then lock them up in our own proprietary system. Just wanted to get that off my chest lol ;-) Enjoy!

[bingo619]

Thank you for making this. Quick question, is there any way to retrieve the pin from Vdash? I have been using Vdash, pin cracked by Vdash automatically with vida log. Unfortunately, I did not save the vida log. Just wondering if I can get the pin somewhere without going over this again.

[VOLVO-pan]

谢谢你做这个。快速提问，有什么方法可以从 Vdash 检索 pin 码吗？我一直在用Vdash，用vida log自动被Vdash破解pin。不幸的是，我没有保存 vida 日志。只是想知道我是否可以在不重头再来的情况下找到某个地方。

VDASH will not tell you any information.

[LiveTrash]

So to be clear, if I purchase the w/ pin package, I do not need to purchase a vida license at all? The OrBit license will give the program the ability to get these pins?

[BeachBoy]

So to be clear, if I purchase the w/ pin package, I do not need to purchase a vida license at all? The OrBit license will give the program the ability to get these pins?

Exactly.

Much, much simpler for similar price. Only difference is you do not get to play with VIDA and update software/check wiring diagrams, calibrate stuff etc

[Power6]

Well covered but yeah when deciding: If you got VIDA easily available (US or Canada) and you want to do some other things, like run the "Total Upgrade" updates on your car, get any diagnostic info or procedures while you are in there, then get VIDA. 

If you don't want to wade through the process to subscribe and get set up with VIDA, or you don't have VIDA easily available to you, then the PIN service is great to bypass that need.

It's fine either way, I just want to enable people to get the needed PINs to use OrBit. And you will get your PIN to have either way too, no secrets, you can get mad at OrBit and take your PIN to use with another tool if you like, we don't take hostages here ;-)

[BeachBoy]

you can get mad at OrBit and take your PIN to use with another tool if you like, we don't take hostages here ;-)

Insert "I see what you did here" meme

Sent from my Pixel 6 Pro using Tapatalk

[Partridge]

Yep. I’m going to be doing VIDA at some point but I was just reaaaally impatient to play with things so I did the pin retrieval. Time and money are interchangeable.


Sent from my iPhone using Tapatalk

[marc92]

Yep. I’m going to be doing VIDA at some point but I was just reaaaally impatient to play with things so I did the pin retrieval.  Time and money are interchangeable.

How long did the OrBit pin retrieval take for you? Is it a quick thing or more of a longer brute-force type attack?

I'm weighing the PIN retrieval options and both are manageable, but I don't have a power source so I'm hoping to limit time on battery.

[x119]

Yep. I’m going to be doing VIDA at some point but I was just reaaaally impatient to play with things so I did the pin retrieval.  Time and money are interchangeable.

How long did the OrBit pin retrieval take for you? Is it a quick thing or more of a longer brute-force type attack?

I'm weighing the PIN retrieval options and both are manageable, but I don't have a power source so I'm hoping to limit time on battery.

OrBit does not retrieve it from the car, there is no connectivity required. It's a simple PIN for $$ transaction. No questions asked, no lies told

For information: Brute force isn't feasible on a SPA car because the ECU locks out after failed attempts. You either have to wait for the lock out to pass or reset the ECU to allow new attempts. This required procedure unfortunately causes too much delay in attempts and instead of XX hrs, you're in to the realms of months / years to brute the PIN. It's much more efficient to either use VIDA to extract a Seed / Key and generate a working PIN, pull the ECU and extract the firmware on a bench or to purchase some magic as loosely outline above..