Read Volvo CEM Flash 28F400 via BDM or Desoldering?

Question:

Customer asks to add a new key to a Volvo v70 2001 with MC68376 + 28F400 inside. He bought the car very cheap but there where a lot of parts missing and there is no key/s.
A locksmith made the key blade from the door barrel, but there is no chip on it. Can you help me out on key programming procedure and tools?

I have these programmers:
Upa V1.3
EZP2010
K-Tag
Mini Zed Bull
FVDI 2020 (for volvo operations i only have Eeprom reading options on the software, but don’t know what they can do)

have other tools, but for ECU reading (Kess v2, MPPS) and i’m pretty sure they wont work with this…

If I’m able to read the chip, is it easier to just do the IMMO OFF or program new key?

Solution:

Quite a big job on model from 2001-2007.

Remove CEM module. Desolder 28F400 microchip inside the CEM.
Put it in a programmer who can read these.
And then you need a key maker who can do these.
And sometimes you can get sync error as well. (But probably not). Needs to be solved with another software.

And also solder the 28F400 microchip back, to the CEM.
But CEM can not be read and written using Galletto, K-TAG, because they do not contain the necessary scripts.

How to read Flash 28F400 or remove the metal frame from CEM?

Tools to read CEM flash 28F400:

BDM method:

1). Jtag SMOK

Best to buy jtag, and the Volvo option. It’s the easiest and clean way..

Jtag Smok BDM programmer can read these without chip desoldering.

Worked well. No need to remove it.

The programmer, plus licence for CEM Volvo (MC68376+28F400) read/write, 160Euro.
The programmer itself, does have some free eeprom function, and all payable option like micronas, renesas, etc work really well.

2) USB BDM NT

Cheap for sure. great stuff for 50usd

The programmer programs all VOLVO CEMs from 1998 to 2004. To read the Flash, just solder five wires: CLK, Frezze, DSI, DSO, RST. And connect the 12V power supply. To write the flash, a 47R resistor must be soldered.

Connect Wpp to +12V

Desoldering method:

Or desolder flash and read with more programmer Beeprog, Orange and etc.

3. Beeprog

Beeprog is the best.

i use a beeprog with a adapter

4. willem

Willem or wellon, both ok!

I read this chip with Willem and use only one option for all of these chips and never had any problem. Doesn’t matter if its TB or not.

i have s60,80 with all keys lost i use willem lpt programmer read 28f400 flash suceeful and use tm100 original, make key ok write flash back to cem

5. TL866

Hot air station, TL886 + Adapters for PSOP44, quickly and job done.

6. VVDI Prog

Just cut frame, if you want desolder
28F400 very sensitive hot air.

Cut the metal frame and could remove flash from CEM and read it with VVDI Prog.

Working experience:

Read it with VVDI-Prog by cutting the metal frame.

Open file with Tango. There was 3 keys programmed, so I program transponder on key 3 position and generate new file.
Then I open that file and program another transponder on 4 key position. New file saved.
Then I write last file to flash.
All ok. Transponder key 3 start car.