Mondeo MK5 IPC

IPC - Instrument cluster panels (like Convers+)
leader
Active member
Posts: 50
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader »

paxtonix wrote: 25 Feb 2020, 06:58 I wrote about the fact that the entire QNX reminds me of a system from mobile phones on which you could install .js applications.
You are not far from the reality.

Basicaly QNX was the operating systems of Blackberry phones and mainly used in many embadded systems. For example this days is the most powerfull and mostly used operating systems in car navigations and instrument clusters (just some examples: VAG - RMC, MMI3G, MIB1/2/2p, BMW, Mercedes, uConnect (Fiat, Crylser, LR), Ford Sync3 and so on).

QNX is an UNIX based operating system with microkernel (there are very few microkernel based OS). Some of its components are adopted from NetBSD (for example the network stack) for this reason QNX is mostly compared against NetBSD.
It's a very power full OS, supports to work in multuple nodes where clusters communicates on QNET.

Just an example how pwoerfull is the QNX:
In case of VAG MIB1/2 navigations there are 2 subsystems (2 nodes) in the nvaigation unit: RCC and MMX. RMC executes the the low level functions including security checks of the navigations (like feature codes, component protection) and MMX runs the user enviroment (like the GUI). For example the sdcard are available only from MMX (user environment) and not from the low level RCC node. The 2 nodes are communicating on QNET. So the user accessable area and the low level functions are separated on 2 nodes....

I thinks this days the QNX is the most powerfull embaded operating systems...
paxtonix
Active member
Posts: 99
Joined: 16 Oct 2019, 14:25

Re: Mondeo MK5 IPC

Post by paxtonix »

After digging it out from IPC the structure of script and graphic contant is located in .ddb file .
mchacker.jpg
As far I know for UNIX operating system there is a decompiler called Desctop Data Menager.
I'll try to play with it through the weekend to find out is there any thing to pull out from that file extension

One other thing is - If you see this screen on IPC
mchacker22.jpg
DO NOT PANIC - it is happening when you flash corrupted file in to IPC. - the unit can be reflashed like Convers+ ipc - Just to inform you guys.
You do not have the required permissions to view the files attached to this post.
Tourist
leader
Active member
Posts: 50
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader »

Those DDB files are bitmap images in special format. (DDB extension means Device Dependent Bitmap).

The first 16 bits (bytes 0-1) stores the widt,h the second 16 bits (bytes 2-3) stores the height of the image.
The next 4 bytes (4-7) stores the colorformat, line order and compression method of the image.
leader
Active member
Posts: 50
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader »

I created a tool 1,5 years ago to the convert the DDP images to PNG or standard BMP format.
It's handles almsot all (but not all) DDP formats...
Just for examples here are the background images from GS7T-14C088-BJE:
GS7T-backgrounds.zip
So if someone have the urge to customize the gui than everythign is given. I can make the custom VBF from the modified images....
Maybe we can create some custom background with Microhacker label/log (do we have logo?) for the ipc...
(I'm not so good in graphics)
You do not have the required permissions to view the files attached to this post.
paxtonix
Active member
Posts: 99
Joined: 16 Oct 2019, 14:25

Re: Mondeo MK5 IPC

Post by paxtonix »

leader wrote: 03 Mar 2020, 21:47 Those DDB files are bitmap images in special format. (DDB extension means Device Dependent Bitmap).
Didnt know that - from QNX forum I found it some kind of Desktop Data ... something.

After extracting all of those files from soft - looks like it is only bitmap's - there is also 4 or 5 fonts and that is all. So customizing to look is not a big deal , but im more concern about adding new features in in, like it is possible on mk4.
mk5mk5.jpg

IF it work like bitmaps - so it can be customized as we want is it ?
You do not have the required permissions to view the files attached to this post.
Tourist
paxtonix
Active member
Posts: 99
Joined: 16 Oct 2019, 14:25

Re: Mondeo MK5 IPC

Post by paxtonix »

That is also Helpfull information

heigh

Code: Select all

30 00
width

Code: Select all

26 00

color format

Code: Select all

02 80 05 00 
mk5mk5.jpg
If this 4bits also includes the color depth like
1- monochrme
4 - 16colors
8- 256colors
24 - Full/true color? :oops:
You do not have the required permissions to view the files attached to this post.
Tourist
leader
Active member
Posts: 50
Joined: 24 Jun 2019, 10:35
Contact:

Re: Mondeo MK5 IPC

Post by leader »

paxtonix wrote: 04 Mar 2020, 11:52

Code: Select all

02 80 05 00 
{0x02, 0x80, 0x05, 0x00} means RGBA5551 color format with RLE (Running Length Encoding) compression and with reverse line order.
User avatar
Stevebe
Pro
Posts: 258
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe »

managed to read SPC5606S mask 2m25v from a early mk5 IPC can’t find external eeprom like on the all digital mk5 ipc so assume it’s being emulated in the MCU
fs7t-10849-ahg unit.jpg
fs7t-10849-ahg unit-front.jpg
hooking up the JTAG port
88331238_1364466970403436_3968303572503756800_n.jpg
wiring JTAG header1-fs7t-10849-ahg .jpg
5.jpg
reading
reading unuit.jpg
various readings
1.jpg
2.jpg
3.jpg
4.jpg
have read both the 512k flash section the 64k and the 3 16k once i get them all sorted out will post
next up the full digital
You do not have the required permissions to view the files attached to this post.
Digimod
User avatar
Stevebe
Pro
Posts: 258
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe »

can anyone help?
im looking for data on the following (found thansk any way)
Spansion
GL256S11DHV02 could be o2
ipc 2.jpg
You do not have the required permissions to view the files attached to this post.
Digimod
User avatar
Stevebe
Pro
Posts: 258
Joined: 08 Feb 2019, 12:28

Re: Mondeo MK5 IPC

Post by Stevebe »

ust a update ..
We have managed to dump the spc5606s MCU on the digital ipc 144 pin and on the needle version 176 pin
There are 2 flash files of 512k 1x 64k and 4 x16k , after spending time looking at the dumps and all the original vbf files found that most of the flash 0 and 1 data
Comes from the 14c26-ajb. The 88bjb larger vbf must be is loading into external mem,
Which I can’t seem to access from the JTAG .. at the moment , although both IPC s use same MCU they are very different in structure and setup
Here is hoping others have found more information or want to collaborate... ( or PM ME)
we need a genius to make a mk5 ipc dumper. Lol...
Hope all are keeping safe,
Digimod
Post Reply