Apply custom images to Ford Convers+

[Ursadon]

Great job!
I working on Qt utility. After some refactoring i push it to gihub

Still having issues getting the right color map.
Assuming the maps starts with "00 FF 00 FF" (where the ink really is "FF 00 FF", RGB, first byte only for padding into 32 bit), i identified maps at these positions in the ROM file:
0x0006DE50
0x0006E250
0x0006E650
0x0006EA50
0x0006EE50
0x000B5DD0

With some help of IDA, we have many LUT:

LUT.png

[Ursadon]

I rewrite my Qt utility, and i confirm, that LUT table is found! GJ

image.png

[Ursadon]

Okay, we have two LUT's - each for its own theme:

at 6E250 - blue theme (Theme 1)

filtered_xout.134672.png

at 6EE50 - brown theme (Theme 2)

filtered_xout.134672_t1.png

[Go4IT]

What you call "blue" is "dark" for me. There should also be a "blue" one, for the preFL.

So you seem to have great programming skills. I only used to program backends with PHP and Java, but a Windows app is needed here... Would good to have it on Git, would you share it?

How about the 500 images not refereced by the LUT? Any ideas?
Maybe it is a good idea to make an graphical map of all the regions we have identified, so it could be more clear what is "missing"?!

The animations seem be present as single images. Most of them. The sliding menus seem to be done using image offsets.

What we also miss is the coordinate where the images are shown. I bet it is fixed, because most of them appear on a fixed position. If we find this, we could build a virtual Convers view. Uh, by the way, would it be possible to run the Firmware in a QEMU?

Now that we identified the relevant parts, it's time to change it to our needs and write back onto the Convers. I bet there is at least a checksum which makes the Convers void mangled Firmwares to be loaded. If we are lucky is is calced by some easy algo like CRC-32.

[Ursadon]

What you call "blue" is "dark" for me. There should also be a "blue" one, for the preFL.

So you seem to have great programming skills. I only used to program backends with PHP and Java, but a Windows app is needed here... Would good to have it on Git, would you share it?

How about the 500 images not refereced by the LUT? Any ideas?
Maybe it is a good idea to make an graphical map of all the regions we have identified, so it could be more clear what is "missing"?!

The animations seem be present as single images. Most of them. The sliding menus seem to be done using image offsets.

Now that we identified the relevant parts, it's time to change it to our needs and write back onto the Convers. I bet there is at least a checksum which makes the Convers void mangled Firmwares to be loaded. If we are lucky is is calced by some easy algo like CRC-32.

My programming skill is very low
Grab my soft at https://github.com/Ursadon/ConversHacker

How about the 500 images not refereced by the LUT? Any ideas?
Maybe it is a good idea to make an graphical map of all the regions we have identified, so it could be more clear what is "missing"?!

I think, we need to go deeper with IDA

Now that we identified the relevant parts, it's time to change it to our needs and write back onto the Convers. I bet there is at least a checksum which makes the Convers void mangled Firmwares to be loaded. If we are lucky is is calced by some easy algo like CRC-32.

Roadmap looks like:
1) Encode source image with LUT.
2) RLE compression
3) Embed image into free space on Flash
4) Change Start-of-frame and Start-of-data values in Flash for logo (link to new addresses)
5) Calculate CRC32 of .bin
6) Make .vbf and calculate CRC32 for it

[Go4IT]

I totally aggree, and there is plenty of unused space in the flash for it

To use an own image i guess we you make a method to find the nearest colormap ink of an RGB pixel to tranform it. Do you know a implementation pattern for it?

[Ursadon]

I totally aggree, and there is plenty of unused space in the flash for it

To use an own image i guess we you make a method to find the nearest colormap ink of an RGB pixel to tranform it. Do you know a implementation pattern for it?

We can use Euclidean distance
https://en.wikipedia.org/wiki/Euclidean_distance
https://www.cyotek.com/blog/finding-nea ... n-distance

But in any case, we need to prefer images with blue colors, due to lack of green/red colors in LUT

img.png

[Ursadon]

I just managed to create my own image with headers and etc (also i attached it to the post)

Roadmap now looks like:
1) Encode source image with LUT. OK
2) RLE compression OK
3) Embed image into free space on Flash
4) Change Start-of-frame and Start-of-data values in Flash for logo (link to new addresses)
5) Calculate CRC32 of .bin
6) Make .vbf and calculate CRC32 for it

img2.png

Embedding is not too hard. But I, unfortunately, have no UCDS cable. Therefore, I have yet to develop a procedure for updating the firmware
P.S.> I think that it is not necessary to calculate CRC32 for FLASH

[Stevebe]

This is awesome guys, wish I had your skills, I would love to add to the subject but it’s way above my head, although I do understand in principle,, it would be great to have our own theme and logo for our convers,

[Go4IT]

Great @Ursadon! You a way ahead of me. I still have no Framework or GUI and fear my C++ skills are way to basic to keep up with you! For this i could only provide algos and research on this, or a concurrent tool written with Java Swing.

I have a UCDS and also had captured the CAN comms of updating an IPC with new firmware. I will provide that log here, maybe it‘s of some use for you... but there are parts regarding random seed which are useless to replay, i guess, but give it a try.

If you are familar with CAN you find what you are looking for. For thise who not, i will look forward to post an article about programming in the CAN section of the forum.

Unfortunately i lend my Convers to somebody and expect to get it back in a week or so. As soon as i get it i try to place a custom image insde and test to programm it!