FORD technical service bulletin : ICC touch screen display - Page 21

JasonACT · 20-01-2022, 08:41 PM

Oh, I guess we will talk again in a few hours! (ha ha)

Superb · 20-01-2022, 08:44 PM

Quote:

Originally Posted by JasonACT

Oh, I guess we will talk again in a few hours! (ha ha)

LOL what

, that should be in the disclaimer

jakka351 · 20-01-2022, 08:50 PM

Quote:

Originally Posted by Whiteford

Did someone say J2534 support?

I think it.will work.already without modification.

JasonACT · 20-01-2022, 08:48 PM

Yeah, I know, it's slow, sorry...

For the cool things my software attempts, it doesn't need a great deal of speed... And for the limited use stuff (like getting 'that' part of the firmware) once it's done, we never have to do it again. I know though, it's a bit annoying.

Superb · 20-01-2022, 08:52 PM

Quote:

Originally Posted by JasonACT

Yeah, I know, it's slow, sorry...

For the cool things my software attempts, it doesn't need a great deal of speed... And for the limited use stuff (like getting 'that' part of the firmware) once it's done, we never have to do it again. I know though, it's a bit annoying.

Honestly its fine, though if its going to take awhile I may as well just start again with the GT-F dash.

This first run, was just going to be a test

JasonACT · 20-01-2022, 08:53 PM

Ha ha, Jakka... I get it as 406! That's what you get when you're using Window Calculator with a mouse! And the Mk1 firmware is using all of the 256KB of flash it has available, so there's no "adding" to it - only small patches are realistic.

jakka351 · 20-01-2022, 08:59 PM

Quote:

Originally Posted by JasonACT

Ha ha, Jakka... I get it as 406! That's what you get when you're using Window Calculator with a mouse! And the Mk1 firmware is using all of the 256KB of flash it has available, so there's no "adding" to it - only small patches are realistic.

Well there is 0x403, 0x406, 0x409.....according to.my.CAN butt sniffing. All BEM related.

JasonACT · 20-01-2022, 09:05 PM

The biggest problem with the Mk1 (other than the ELM not being up to the task, due to the high speed of the data extraction's routine) is that it's not designed to be "updated" while it's in the car. You need to get into the programming mode by powering up the unit (from OFF, totally OFF) while sending in a "denial of service" type attack on it! Your car will not like it, unlike the EEPROM (and RAM) stuff I got working on it.

jakka351 · 20-01-2022, 09:24 PM

Quote:

Originally Posted by JasonACT

The biggest problem with the Mk1 (other than the ELM not being up to the task, due to the high speed of the data extraction's routine) is that it's not designed to be "updated" while it's in the car. You need to get into the programming mode by powering up the unit (from OFF, totally OFF) while sending in a "denial of service" type attack on it! Your car will not like it, unlike the EEPROM (and RAM) stuff I got working on it.

I am (slowly) piecing together a python script to do it, via socketcan so the ELM won't be a problem. Currently it is not very dynamic, so it will generate the key from an error message if that's what it receives instead of a seed. But have successfully gotten seed and generated key within the script..

After I get a handle on reading the EEPROM with socketcan I will try for the deeper stuff.

Superb · 20-01-2022, 10:07 PM

Laptop went to sleep, starting the dump again.
Sorry

JasonACT · 20-01-2022, 10:15 PM

Lol!

Superb · 20-01-2022, 10:34 PM

Quote:

Originally Posted by JasonACT

Lol!

Silly me.

Now got an error, will start again :(

Quote:

ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
065001003201F400
065002001901F400
056701ED43AA0000
0267020000000000
OK
Uploading SBL
04742000CA000000
0276010000000000
0377550200000000
04742000CA000000
0276010000000000
03779BAC00000000
04742000CA000000
0276010000000000
037732AE00000000
04742000CA000000
0276010000000000
0276020000000000
0276030000000000
0276040000000000
0276050000000000
0276060000000000
0276070000000000
0276080000000000
0276090000000000
02760A0000000000
02760B0000000000
02760C0000000000
02760D0000000000
02760E0000000000
02760F0000000000
0276100000000000
0276110000000000
0276120000000000
0276130000000000
0276140000000000
0276150000000000
0276160000000000
0276170000000000
0276180000000000
0276190000000000
02761A0000000000
02761B0000000000
02761C0000000000
02761D0000000000
02761E0000000000
02761F0000000000
0276200000000000
0276210000000000
0276220000000000
0276230000000000
0276240000000000
0276250000000000
0276260000000000
0276270000000000
0276280000000000
0276290000000000
02762A0000000000
02762B0000000000
02762C0000000000
037F377800000000
037791DF00000000
04742000CA000000
0276010000000000
0377D6F700000000
OK
Running SBL
0571010301100000
OK
Reading FLASH: 00000000, 00005000
OK
Reading FLASH: 00005000, 00010000
OK
Reading FLASH: 00015000, 0006A000
Failed to initiate read mode / complete the read

JasonACT · 20-01-2022, 10:36 PM

Hmmm, maybe it's best not to do all 5 at once... You did get the one part we need (5000-10000)...

Superb · 20-01-2022, 10:42 PM

Quote:

Originally Posted by JasonACT

Hmmm, maybe it's best not to do all 5 at once... You did get the one part we need (5000-10000)...

I pressed reset unfortunately.
So part 5000-10000 is that the exe?

JasonACT · 20-01-2022, 10:44 PM

From what I understand (latest) EXE is the same in the GTF as it is in the normal FG2.

It's the SIGCFG that's different (5000-10000).

Superb · 20-01-2022, 11:00 PM

Ahh I understand the naming of your buttons now.
I'll just dump the signal config then for you now, that one doesn't take long.
Just so you know, last time I had it connected to forscan
AR79-14C025-AB was the 2nd boot loader
AR79-14C026-AH was the strategy
BR29-14C318-AA was the signal config

JasonACT · 20-01-2022, 11:04 PM

Ha ha! I know, right - that BR one is new... 2011, where everything else is Terry SZ numbers 2010.

JasonACT · 20-01-2022, 11:28 PM

Thank you Superb! That's awesome!

https://github.com/Jasoroony/Ford-Fa...n/extracted_fw

The firmware converted over perfectly - and I can see the magic number (at the end) is correct - so I've uploaded it to github. I'll be checking out the differences soon!

JasonACT · 21-01-2022, 09:41 PM

The question is... Does it work? Well, after fighting Forscan for a few hours (seems it doesn't necessarily like programming firmwares in devices that didn't come out of your car - I had to revert some saved config files to get firmware programming back!)... Yes, it does work:

I stuck a slightly better [glare wise] picture in there. And yeah, that Cluster is made up from spare parts from a Terry SZ, a Mk1 G6E and a Mk1 5.0 FPV... All the really good stuff ended up in my car, but I had enough nice stuff left over to make a spare MKII Cluster

jakka351 · 21-01-2022, 09:53 PM

You might wanna slow down, that's a pretty high speed to be travelling in your lounge room.

gkhn · 25-01-2022, 11:06 PM

Looks pretty cool but you don't want to get a speeding ticket so be careful..
Pew. pewpew.

Quote:

Originally Posted by JasonACT

The question is... Does it work? Well, after fighting Forscan for a few hours (seems it doesn't necessarily like programming firmwares in devices that didn't come out of your car - I had to revert some saved config files to get firmware programming back!)... Yes, it does work:

image

I stuck a slightly better [glare wise] picture in there. And yeah, that Cluster is made up from spare parts from a Terry SZ, a Mk1 G6E and a Mk1 5.0 FPV... All the really good stuff ended up in my car, but I had enough nice stuff left over to make a spare MKII Cluster

JasonACT · 25-01-2022, 10:44 PM

Yeah, I thought of that about 2 minutes after I had posted... And I checked. And I couldn't find any in the extracted firmware with either the real number, or the number multiplied by 4. And I'm not even sure your description of that is true, the cluster is a gateway, so it can transmit (some of) those in that function.

JasonACT · 25-01-2022, 10:45 PM

White LEDs

JasonACT · 25-01-2022, 10:50 PM

What may also make your head hurt (it does mine) is the FGII signal configuration doesn't contain the CAN IDs that control the dials - unless it's the GTF specific file, which transfers data through the CAN bridge. They are well hidden.

Superb · 25-01-2022, 11:35 PM

Quote:

Originally Posted by JasonACT

What may also make your head hurt (it does mine) is the FGII signal configuration doesn't contain the CAN IDs that control the dials - unless it's the GTF specific file, which transfers data through the CAN bridge. They are well hidden.

So the firmware file I supplied doesn't make it work?

Also don't suppose anyone knows what IPC DTC u2024:56 (Control Module Cal-Config Data) means?

JasonACT · 25-01-2022, 10:57 PM

Oh, and 0x720 is there - and it "just" knows to add 8 for replies - so you won't find that one.

JasonACT · 25-01-2022, 11:44 PM

Hi Superb, no mate, it works fine

My comment was only to say that it's very complicated in how each part works. Which is why I have not posted (m)any updates. Your contribution was flawless though, thanks again, making that file available was priceless!

Superb · 25-01-2022, 11:53 PM

You've most welcome

jakka351 · 28-01-2022, 12:52 AM

Quote:

Originally Posted by Superb

You've most welcome

Pew.Pew.Pew. Good Job on a successful undercover mission 99.

Superb · 28-01-2022, 10:37 PM

Quote:

Originally Posted by jakka351

Pew.Pew.Pew. Good Job on a successful undercover mission 99.

Ohhh Max