Apply custom images to Ford Convers+

[DGAlexandru]

we can join forces and develop together. Github?

Yes, if I figure it out on how to integrate QT Creator with GitHib.. and my find my username/password
Let's continue this discussion by PM for now

[Gwe89]

Ursadon, I hope you're OK with all of this.
If you want I can give you the sources for all of this.

I am glad that my achievements did not go unnoticed
Since you could figure out my ugly code, we can join forces and develop together. Github?

Hey welcome back, I see you managed to dump a pam module, there is a topic on here for it but I can't tag you in it, could you explain how you dumped the pam module, I have autopam and want to pull the firmware from it to share and we can all work out how it's works

[Ursadon]

Ursadon, I hope you're OK with all of this.
If you want I can give you the sources for all of this.

I am glad that my achievements did not go unnoticed
Since you could figure out my ugly code, we can join forces and develop together. Github?

Hey welcome back, I see you managed to dump a pam module, there is a topic on here for it but I can't tag you in it, could you explain how you dumped the pam module, I have autopam and want to pull the firmware from it to share and we can all work out how it's works

PAM firmwares (and others too) can be downloaded from Ford DSFM site. Later we will add the firmware dump functionality of other modules to IPCupdate
PAM hacking explained by Dr. Charlie Miller & Chris Valasek - http://illmatics.com/carhacking.html

P.S. I am also glad to be back after succesful hacking Lada Vesta dashboard

[Gwe89]

I am glad that my achievements did not go unnoticed
Since you could figure out my ugly code, we can join forces and develop together. Github?

Hey welcome back, I see you managed to dump a pam module, there is a topic on here for it but I can't tag you in it, could you explain how you dumped the pam module, I have autopam and want to pull the firmware from it to share and we can all work out how it's works

PAM firmwares (and others too) can be downloaded from Ford DSFM site. Later we will add the firmware dump functionality of other modules to IPCupdate
PAM hacking explained by Dr. Charlie Miller & Chris Valasek - http://illmatics.com/carhacking.html

P.S. I am also glad to be back after succesful hacking Lada Vesta dashboard

I have autopam from conversmod and a gateway box that turns my parking module on under 9mph when I added this feature I got a loader to program my pam module so there is a fw change in the module that need to pull out

[Stevebe]

PAM hacking explained by Dr. Charlie Miller & Chris Valasek - http://illmatics.com/carhacking.html

P.S. I am also glad to be back after succesful hacking Lada Vesta dashboard

Ursadon
It’s great to see you back. These papers by Charlie Miller & Chris Valasek - http://illmatics.com/carhacking.html
Are a brilliant read they helped me set up a ECU on the bench with PAM and a few other bits still work in progress

[Ursadon]

Okay, now we have successfully set the background image.
Now the question is how to correctly add images to flash memory:
1) Replace old wallpaper by new. But size is different, so someday we'll run into an overflow problem. Also need to pre-calulate offset of image header.
2) Change wallpaper offset in MainFW, poining to new wallpaper, placed at the end of Flash
3) Changing old wallpaper's StartOfImage and StartOfData values in Flash on to point to new wallpaper. The best choise IMHO, no need to reflash MainFW

screenshot.png

[peter]

2) Change wallpaper offset in MainFW, poining to new wallpaper, placed at the end of Flash

page 13 from this topic was already info how to:
download/file.php?id=703

[DGAlexandru]

From my point of view the harder thing to do is to write the external flash as this one is much slower and for now it can't be done over JTAG without some code development that needs to be sent to MAC to its RAM and executed from there.
With this in mind, the solution would be to use free space from External Flash and erase only those sectors, then reprogram MainFlash to read the image from new address. Because images can have different size, their "ending frame" will be at different address, so a good idea would be to have at 0x30 12 00 00 address the needed "ending frame" for that image, then the personalized LUT (BGR) for that image and then the image itself. This way in main FW you only need to point the boot image to 0x30 12 00 00 one time.

Another optimization I see is to have only one version of External Flash for both PreFL and FL versions, where we will also have the parking images and others (like they are in Chinese C+ version) that now are in Main Flash. This will make more space in Main Flash for new functions and have it back how the official engineers designed it.

If we want to develop software for modifying C+ we should first agree on how we want C+ main and external FW to be used

[Go4IT]

What we are currently doing is just playing with pointers and trying understand functions by disassembling (i get really deep and can publish some things soon).
To get own software running (patcher, loader, additional subs, and so on) we need a development environment to compile C-Code for the MAC7100 series of processors. As it is ARM7 it should be doable.

[Ursadon]

New release

## [1.2.0] - 05-01-2020
### Fixed
- Minor UI updates
- Fix show Image at offset - now jumps to image regardless of file.
### Added
- Screenshot via JTAG (JLink) feature

In next release: adding custom wallpaper & generating VBF (both: MainFW & Flash), so you can easy set wallpaper! Stay tuned

1.2.0.png

ConversHacker-v1.2.0.zip