P3Tool - Volvo Hacking Takes Its Next Big Step

Introduction

Before we begin I want to talk briefly about the P3 chassis modding scene and its brief history. Hopefully this forward will provide some insight and context as to the importance of P3Tool.

Anyone that has been in the Volvo scene long enough with a “modern” era chassis has probably at least heard of VDASH. It was developed in eastern Europe and allows users to “crack” their cars CEM and access parameters usually only accessible by Volvo. When the tool first hit the scene around 2017, it was a revelation to all those with newer cars, allowing them to add remote start, headlight configurations, key controls and more. The prices were pay-per-mod and they were…reasonable. Some categories being more expensive than others based on what I can only describe as desirability. However in 2022, my opinion on this tool has been swayed.

Having been out of the P3 scene for some years (having sold my S60, buying an Alfa Romeo, and then selling the Alfa Romeo for the V70) I did not notice the changes that had been made to VDASH. When I went and unlocked my V70, I found that many of the options and features I had been able to access on my S60 were gone. What I learned was that many of VDASHs actually useful features had been locked behind a paywall, allowing only those with a “Pro” account to enable and disable certain parameters.

Now its important that you understand that I am aware that my pre-sensus V70 is lacking the hardware for many of the mods that my S60 was capable of, however the biggest issue I had was with the ITP security system parameters. This is needed for when a user installs any OEM audio part on the MOST network. To make a long story short, the car needs to see identical keys across all the audio system components or it will refuse to work. This can be bypassed if the part is installed by a dealer and “properly” coded to the car, but is not possible for many upgrade cases like installing a premium sound amp in a high performance sound car. This feature is locked behind a yearly payment with VDASH which can cost over $400.

Now, lets get into the real substance of the article; P3tool.

Prerequisites

P3Tool is a windows program created by Johnny Persson, who you can find on Swedespeed under the username jp_swe. It was originally developed by Johnny to bypass the payment system in place with the old VDASH tools so he could add a power tailgate to his V70. He is a much smarter man than I so you can read more about its development here on Swedespeed.

The first step to setting it up was acquiring the software. You can sign up on Johnny’s site here:

Once the file is downloaded, we will extract the files to our PC and use the login information provided by Johnny.

This is the homescreen (USERINFO tab) once you are logged into the tool. There are a few areas to note to start off:

  1. Select interface: this is where your DICE unit will show up. I used my original chinese DICE unit from the VDASH article.

  2. VIN / Voltage: this is pretty self explanatory. The voltage is helpful in seeing if your battery tender is working properly. A battery tender / charger is needed when decoding your CEM PIN! More on that later in the article.

  3. Vehicle Data / Cars in userprofile: This is where you will be able to select a car loaded into the program. The DEMO profile allows you to use a demo vehicle and see all the options available before even connecting a car. I love this feature, not only does the demo shows everything, but I am able to load my own cars profile while not connected at at least see what changes I have made.

  4. Credits: Credits are added when a car is added to the program, this allows you to access the parameters to make modifications to the car. Unlike VDASH, the cost in P3Tool is $50 flat fee paid only once. This gives you lifetime access to that car.

Hardware you will need:

  1. Battery Tender / Charger

  2. Windows Laptop

  3. Volvo DiCE Connector

    • These can be found from China via AliExpress, genuine unit is not needed.

Getting Started

Start by connecting your battery tender to your battery, and connecting your DiCE unit to your PC. If everything is recognized, you should see the DiCE show up in the interface tab on the tool.

At this point the car should be in key position 1 or 2. Now, click the blue CONNECT button. Once you have verified connection, go over to the P3 CarConfig tab.

Go to PIN Search and select the start/stop, Once this happens, the car will be completely off. This is normal. Do not attempt to start the car during this process. Essentially, the car is in a hibernation state with the computer talking exclusively with the CEM.

You can now watch the tool “crack” the CEM PIN code. I use the quotations since this is not really a crack, in encryption terms a a brute-force attack. The tool is rapidly firing off PIN codes, going one by one trying to find one that the CEM accepts. The maximum throughput of this process is limited by the speed of the cars network to about 250 keys per second. Johnny has a great description of this process in his thread on Swedespeed. It is also worth mentioning that since this is not a crack, the CEM is not open to any program that does not know the PIN! This means that even if you have previously done work to the car with VDASH and found the CEM PIN with that tool, P3Tool has no idea what the PIN is.

This process can take a few hours and entirely depends on where your PINs hex code is based on the list the tool is trying. Running overnight is the recommended procedure. During this process you can stop the search and the tool will pick up where it left off. Progress can be seen on the side bar under the voltage readout.

Once it is completed its search, the PIN field will populate with the cars CEM PIN.

CarConfig

The first step after cracking the PIN is to backup your cars stock CarConfig. This can be done by going down to the Config Backup section and selecting save. This will save your cars factory state and serve as a backup in case anything is changed that affects the cars functions.

Make sure this file is backed up properly. I make sure to make a backup before doing any changes. Now for the config changes.

I recommend that everyone take the time to scroll through each parameter to see what is available as it is an extensive range of vehicle options, many of which you wont need to change or have any use changing (such as the amount of doors on the vehicle).

For this example lets say we want added a Sirius XM radio module to the car.

In parameter 125 the cars factory state is set as 0x03 “HD Radio”, so we will select 0x04 for the Sirius XM Radio.

Now we will hit Save Change. This saves our selection, but it has not yet been applied to the car! We need to hit Write, up in the Read/Write area. This will then flash the changed parameter to the car.

This process is the same for any change to any parameter. Multiple changes can be made at once and saved before writing to the CEM.

Advanced Options + ITP/MOST Security

While most modifications to a P3 do not require any extra steps, the audio system is a bit of a difference beast. Do not be discouraged though, there are a few more steps which we need to take to be able to add things like premium sound amps, dedicated subwoofers, etc.

The first thing we will do is go over to the P3 Security tab. Here we will be finding the security PIN via the Find Security PIN button. This is similar to the CEM PIN however this process only takes a few minutes.

Once this PIN found you are able to set the status of the ITP security. If you are adding a subwoofer or amplifier from a junkyard vehicle, you will want to set the security OFF. It can stay permanently off, if it re-engages it will stop your sound system from working.

Conclusion

There is still much to discover with P3Tool. It has tools for many onboard modules of the car as well as for the TFT display (which my car is not equipped with). I will be following this project closely and I think i speak for everyone in the community when I say thank you Johnny for your work. Stay tuned for any updates!

Project Nashville Pt. 3 - MOST Excelent!

How to upgrade your P3 V70/XC70/S80 to the Premium (DynAudio) Sound System

Introduction:

As the P3 cars continue to age, it is no suprise that they have become more common in junkyards across the country. This is excellent news for us who have been fans of the chassis for a while as it means that well optioned cars can now be picked over to upgrade those still on the road. From personal experience it seems that people really love taking the grille and headlights, an odd choice considering how common they are and how they went unchanged for close to 8 years, but I digress. This weekend I had the benefit of going to 3 P3 cars in South Carolina. Both yards were mere minutes from my parents house in Charleston so a weekend trip was well worth it. The marked vehicles were two S80s and 2009 V70, the V70 being a rarity to show up in LKQ yards due to their low sales in the US. While all 3 cars were tan interior vehicles, they all had great items to pick.

This V8 was fully loaded. DynAudio, heated and cooled seats, ABL headlights, and more.

Parts:

From each vehicle I was able to get some plug and play items useful for anyone with a P3 that share parts between the 70/80 chassis. My first stop was Blue and Gold Auto Salvage in Goose Creek, SC.

From the white V8 S80 I got:

  • DynAudio Tweeters

  • Sirius XM Module

The tweeters are easily removed from the A pillar by prying them back gently. They have a small connector that is easily removed the XM module is bolted in with a few hard to access bolts, but comes out easily once unbolted.

From the blue 3.2 S80 I got:

  • DynAudio Tweeters (with BLIS)

  • Full BLIS power mirrors

  • DynAudio Amplifier

The tweeters in this vehicle are identical to the V8, however the housing has an extra connector that goes to the mirrors for the BLIS notifier light. They are also easy to remove, and the mirrors come off the chassis with 2 easily accesible T25 bolts. The amp is located under the drivers seat, and was not too hard to access even with no power to the seats. I removed the front seat bolts and bent the seat rails back to access the 3 10mm bolts holding the amp in place.

My second stop was at LKQ Charleston to see the V70. This car was much more rough than the pictures showed, but there were a few small items I took as backups.

From the tan 3.2 V70 I got:

  • Standard BLIS Tweeters

  • Sirius XM module

While I should have probably taken the load cover and maybe the tail lights, I was quickly running out of time before the yard closed. These parts I grabbed as backups and spare parts for my BLIS swap. This car also had BLIS mirrors however the passenger side was destroyed.

The full haul once back home and cleaned up. Every part was gone over with a small brush, and cleaning agent.

Green DynAudio tweeters, standard in blue. Note the white plastic housing in the BLIS equipped sets.

Installation:

  • Sound System

This is where I begin to enter some unknown territory. I have a pretty good idea of what needs to happen for the mirrors, however the audio system uses MOST security which will need to be disabled to add the amplifier. Additionally I plan on possibly adding the premium sound speakers and drivers to the doors to add even more audio fidelity.

The first step was replacing the amplifier, which sounds easy and should have been if it was not for one little bolt holding it in. The amp has 3 10mm bolts that secure it to the floor, and while the first two are super easy to access, the third is located directly under the seat, very close to the seat rail. Getting a socket on the bolt was no easy task, and I ended up breaking the small magnet that is attached to the seat rail to gain access.

What that magnet does, I have no idea.

The rest of the install is very straight forward, just unclip the stock amp, and plug the upgraded one in. Once in we need to take 3 steps in P3tool. (This can also be done in VDASH with a Pro account).

Step 1 is to find the cars security PIN. (P3 Security tab) This is different than the CEM PIN which is needed first to access anything. Running the Find PIN takes about 10 minutes, with the car is the same “deep sleep” state as when you try to find the CEM PIN. Once it is found, it will populate the field (where I have blurred).

Step 2 is to set the ITP Security to Off. This will allow a “foreign” device to be on the MOST network. Without getting too deep into the details, the original amp is coded to the car so when the system sees a new component with a different ID, it throws a flag and will not allow the audio system to turn on. By disabling the ITP security we are telling the system to allow any device. (That being said, if the car is brought to a dealer or updated with VIDA there is a risk of the ITP locking again, in which case you may need to re-install the original amp or disable the ITP security through P3Tool again. This is unchartered territory so do these mods at your own risk!)

Step 1.

Step 2.

Step 3 is to change the audio settings of the car. This means going back to the P3 CarConfig tab and going to parameter #119. Here I will be changing the car from hex 0x03 High Performance Sound to hex 0x04 Premium Sound. Making this change gives you many more options in the audio settings of the car, and allows the premium sound amp to play nicely with the rest of the system.

Step 3.

Save the changes and the car will reboot. You will now see the car show the Premium Sound image instead of the High Performance sound image. The sound difference is night and day. What used to be 80-85 percent up the volume bar is now closer to 40%. I will not be driving the system past about 60-75 percent as the volume factor has increased significantly.

Please Note: With the much powerful amplifier you do run the risk of driving the stock sound components too hard. Playing the sound system at higher than usual volumes can result in damage!
Overall through, this was a pretty easy and very noticable mod to make to the car. With the later addition of premium sound door speakers, the soundscape in the car will have changed drastically.

  • Sirius XM Radio

This is the biggest question mark for me as information online for adding this is sparse. Obviously there are not a whole lot of people adding satelite radio to a 12 year old car. Off to Swedespeed I went, and in my searching found that all P3 cars from 2010 onwards were pre-wired for Sirius XM satellite radios. This meant that the power (MOST) cables, antenna, and fiber optic cables should be all run to the back under the load tray.

I dug into my car, the MOST cables were easy to find, a bright orange two wire connector with a loop on the end. I didnt see any other cables initally, so I went back to Swedespeed and posed a question to anyone that could help. Afterall, who is really taking the time out of their day to install satellite radio in a 12 year old car these days. One user responded, linking the VIDA instruction manual on how to install the module and this made me question my inital search in the car.

Lo-and-behold after lifitng up some more sound deadening in the trunk there they were. The antenna and fiber optic cables. Next step, installing the board into the car.

Do not throw away / lose the loop installed on the MOST cable as it is required if the module is taken back out!

From here the install was just connecting the 3 cables into their ports and pushing the bracket the RDAR module sits in into the car. It is a press fit with a single bolt to hold it in. The final step will be done in the car with the aid of P3Tool.

In the tool, option #125 was selected which is the config of the radio options. The car was originally set to hex 0x03 for HD radio, however with the new XM module installed it was changed to hex 0x04. I saved the change and the program changed the value in the CEM.

After its reboot I immediately had access to the satellite radio!

What then happened sort of suprised me. I found that all the user data was stored inside the satellite module! This included their subscription data, as well as all of the presets. I figured this data would be stored in the IAM, but lo-and-behold I had a totally free, working XM subscription!

Now this did not last long, as the subscription had clearly expired during the donor cars time in the junkyard, however this does mean that it is possible to find a module with a working, active subscription. From here I went into the audio settings tab to find the radios ID code, and activated the subscription with my own Sirius XM account.

There will be a follow up to this post, covering both the basic uses of P3tool and the installation of BLIS into the car. I am very excited at the new levels that P3 modding are getting to. The P3tool is very easy to use and I genuinely believe will one day overtake VDASH as the modding tool of choice. If there is anything I missed or any questions on some process I did not cover, please feel free to drop a comment below.

NordCarolina Shop Update!

With summer in full swing I have found some spare time to add some new product lines to the shop as well as streamline operation. Before I was using a single store page for all the items, however I have realized that there are many smaller items that people are interested in that I often get requests for. Itsm like bulb holders and fender badges are among the biggest of these requests. As such I have decided to remake the stores, and split them out into 3 categories, as follows:

NordCarolina Shop

This is the standard shop and will not be changing much. Here you will find all the regular items such as 740 headlamps, 940 headlamps, chrome trim, etc. This will be the area for complete sets of items, new items, and high value items.

Spare & Replacement Parts

As the name suggests, this is where I will post spare parts and pieces mostly for the lamps I sell as well as the metal and plastic fender badges. I am open to requests on this page as I am sure there are many small bits and bobs that people are often looking for that were US market only.

Garage Sale & Clearance

This section will be for damaged, incomplete, or misc. items that do not fit into the previous two sections. Here you will find non Volvo related items as well that will still be automotive related. I also plan on selling smaller items here that are not high dollar enough for the main page like mirror glass, turn signal lights, and random online misorders.

This 16 Valve, B234 head is an example of a Garage Sale item.

These changes are now live, however inventory levels and items are subject to change as I go through my woefully un-updated backlog of spare parts. Thank you!

Project Nashville Pt. 2 - Tech Talk

Alright I admit it, I am shamelessly stealing further blog posts names from M539 Restorations on Youtube. With the sheer amount of cars I go through, I think it at least adds a little personality as I am not one to name cars.This part two is only going to be for a few items as I am not extensively modifying this car outside of a few cosmetics, and I have gotten pretty bad at recording things I am doing.

Section 1 - Emissions

The first thing I wanted to cover was the nagging CEL that seems to be playing hide and seek with me. The code being thrown is a P430 code which signifies that the bank 2 catalytic converter is below efficiency. In simple terms, the filter is letting too much fuel by and the O2 sensor is picking that up. This has no effect on driveability, however will set a Check Engine Light thanks to the EPA…

On the 3.2 motor the converters are a known failure point, however with such low milage the idea of dropping $2,000 on a new converter is not ideal. So before going all out, I decided to do some digging and check all the systems that could cause the code. I also checked the diagnostic readouts in VIDA (which we will get into later). The first items I replaced were the PCV box as well as the sensor for bank 2 sensor 2.

The oil trap on this car was original from when it left the factory and was still stamped with its 2009 build date. Usually at this age they begin to deteriorate and really recommended to be replaced at the 100,000 mile mark which this car is very much passed. A faully failed unit will make a distinct whistling noise due to the rubber diaphragm inside going. A decently old one such as this can be clogged and will effect fuel trims leading to the code I was seeing. Thankfully replacing these are decently easy, while not being a walk in the park either, located on the top of the motor they are much easier to access compared to the old whiteblocks. A few extensions and swivel sockets were needed to reach the back bolts, and much care was taken to not drop any down into the abyss.

Following this was the installation of a new O2 sensor. While I wish i had photos of this process I unfortunately had to pay a shop to replace it as my sockets and wrenches just could not break free the 10 year old+ threads. I went with an OEM Bosch sensor, one as a precaution and secondly due to some off readings I was getting from the original. Before replacing the sensor was flatlining at 0v randomly, I believed that this reading was causing the code to be thrown as it was not a reoccurring code, oly showing up every ~800 miles. Below are the readings are post sensor install. Not great as you can see the readings are still fluctuating indicating that the cat may still be bad.

The black is Bank 2 Sensor 2 Voltage (the bad cat), purple is Bank 1 Sensor 2, and the two others are the front O2 sensors.

Since these two items were installed (and the ECM parameters reset), I have driven about ~700 miles without issues. We shall see if the code returns. if it does, the next steps will an O2 sensor with built in mini-cat. If this does occur, i will make sure to have a seperate write up on fighting these stupid 3.2 emissions systems.

Section 2 - Cosmetics

If you have followed this blog, you’ll know I am a big proponent of LEDs, especially on these eastly P3s as they make the car look much more modern. Most of the kits I receive I buy off Amazon or AliExpress, links will be provided for each item.

License Plate Lights

Ease of install: 10

Two bolts and about 5 minutes is all you’ll need for these. Slots directly into where the originals were, gives a much cleaner look!

Before and after, LED vs standard filament bulbs.

Looks very clean with the upper LED tail lamp modification done by the PO.

Interior Lighting

Ease of install: 9

This kit came with lighting for all the interior bits and bobs. Some I have not installed yet like the visor mirror lamps or the glovebox, but they all fit without issue all around the car and make it much easier to see at night when digging through the car.

Puddle Lamps

Ease of install: 6

Not a fan of installing these, only due to the fact that getting the stock lamps out is a huge pain. The plastic become brittle and stiff over time so of course it broke trying to get it out. Luckily its no big issues as the replacement goes in easily, however I like to save the original equipment in case something happens to the aftermarket units.

Once installed they cast a nice white LED light, and illuminate much better than stock. Gives the car a clean look all around when on.

Well thats all for this installation. I was hoping to have also gotten some convex mirror glass, but the ones I ordered from China were not the right size. Sad. Hope everyone enjoys, I have a cool box of stuff from VPARTS coming soon as well, so stay tuned for that!

And I Would Drive 500 Miles - Project Nashville Pt. 1

Alexa….play Im Gonna Be by the Proclaimers

This is how I felt last weekend, perpetually on the road. To announce my new addition to the growing list of Volvos I have owned, let me set the stage.

Saturday. Wake up at 5am. Try to find a Lyft to the airport. Live in the middle of nowhere so none are available. Drive 960 to the daily parking deck. Sit in CLT terminal E for 2 hours. Fly to Nashville. Land, test drive car. Purchase car. Drive 7 hours back to Statesville. (I40W was closed for some god forsaken reason). Get home. Realize gear for the NASCAR race the next day is still in my 960 which is at the airport. Take Lyft to the airport. Pickup 960, drive back to Statesville (AGAIN). Go to sleep around 1130.

Got all that? Great.

Now I can finally show you all the car I picked up.

Thanks David for the photo.

(Doug Demuro Voice) THIS…. is a 2010 Volvo V70 R-Design, one of the rarest cars Volvo has sold in North America. Only sold for the 2010 model year, the running number is about 380 of these cars exist in the entire country. Or at least that was the number the time of production, current numbers will be lower due to some being wrecked or scrapped.

After dealing with stiff, sporty sedans I finally said enough as enough, I need a new wagon so that my poor old 960 wont have to be a daily driver anymore. I initially started looking for standard V70s, not as hard of a find due to them being sold from 08-10. Immediately I realized that finding one without a gross tan interior was going to require some searching. Due to their age, they seem to be in a mix of buy-here pay-here lots and private sales which also means a lot of them have little to no service history or any redeeming factors to justify their often obscene asking prices. Slowly losing hope that I would be able to find a proper replacement to my almost new Giulia I put out a feeler on Swedespeed, just to see if there were listings in the country I might have missed. After that I waited.

A few messages came in here and there. Mostly links to autotrader for cars I had already seen and inquired about. I was quickly realizing that buying a car from a dealer or scumbag car lot was not going to make any sense financially.

I gave up on my search and quickly hoped to looking at some XC70s. One had caught my eye in NJ and I booked a flight to go see it. To my dismay, it was in appallingly bad condition for its age, and the Audi dealer selling would not budge on price. I walked from the deal, and found myself headed back to my buddies place to book a flight for the next day to fly home. As luck would have it, thats when I received a phone call from David. He had messaged me on Swedespeed about his V70 he was thinking of selling. A white, former CPO V70 R-Design that had lived its whole life in the south. The timing couldn’t have been better, it was fate.

Flew out, did some time test driving up in the Smokies, paid and was on my way. This car has nicely extensive service history with lots of records on scheduled service plus other nice items like newer headlamps that really set the car off.

Driving the car home went without a hitch, even with the long drive the car did great. My only gripe is that I am not a huge fan of the currently installed Pirelli tires, I believe they are inferior in ride quality, noise and handling compared to Michelin Pilot Sports+ which I will most likely install later this year due to the current tires being from early 2018.

So far modification wise I have tried to stay relatively OEM+ with the exception being sequential style turn signals in the mirrors from VPARTS in Sweden. I am not sure if I like the look or not, but they were super easy to install. I may end up going back to the stock corner lamps with an LED installed or switch to black caps as I like to keep the look as OEM as possible.

Stock.

Volvo V70 P3 fas2 blinker mod aftermarket vparts blinker flasher

VPARTS.se Aftermarket

Additionally I did a R-Design dead pedal (did the same mod on my S60 back in the day), along with LED headlights and fog lights. The CEM was cracked with VDASH to add better headlight controls as the stock North American configuration is awful.

The car on the tender overnight while VDASH cracks the CEM, the process was started around 6PM and finished around 1am.

I think my only letdown with these early P3 cars is that they do not offer the same options that the later 2012+ models did like easily added remote start, or global window control with the key. I believe this is due to the early P3s using a 5 button PCC key instead of 6 as they are missing the “data” button used for those options.

The car already has an IPD sway bar and end links, and I plan on ordering the metal skidplate as it makes oil changes much easier and adds a level of protection for a lowered car.

As a side note, for audio I used a TUNAI Firefly LDAC BT to AUX adapter as the car only comes with AUX and USB for audio, Bluetooth for calls only. I am very impressed with this adapter and the sound system of the High Performance Sound in the V70 is exceptional, and as good as the Premium Sound I remember from my S60. The cable fits perfectly out of the way and connects as seamlessly as a built in bluetooth system. (If not faster and better than my Alfa Romeos stock system).

Under the garage lights after its first post trip wash. I also did a full glass regiment as well as decent clean of the interior and leather treatment. Some additional carpet shampooing will be needed for some stubborn sections, and a touchup pen is next on my order list.

The city and corner marker lamps were replaced with Sylvania 194 LEDs. The corner lamps were decently easy to access, with the center city lights being very hard to access requiring the use of a few picks and other long tools.

The full LED conversion give the car a much fresher and modern look, while also aiding in visibility.

With all the LEDs installed, all that is left is to order some Michelin Pilot Sport 4s from my friends up at Hailey Import Service. In part two, I will be installing the optional R design front bumper grille accessory as well as headlight eyelids both from VPARTS. Additionally I will install the more modern shifter like was done in my S60 a few years back, along with LED interior lighting and LED license plate lighting.

Links for all the products I use: