(SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

[Go4IT]

On the component layer (top) of the mainboard PCB you find an Spansion S29GL Flash chip, placed as a BGA64 package at position (2) on this picture:

navi-fx_main-pcb_top_explained.jpg

The Flash is directly connected to the OMAP5948 HMI-processor and contains the Firmware of the userinterface (HMI). In order to download the content from the Flash, e.g. for reverse engineering or to copy it to another device, you need an JTAG-probe.

The only working solution i know until now is to use a "Segger J-Link" interface in combination with the Segger "J-Flash" tool. The "EDU" version of the interface is sufficient for reading. The software tools can be downloaded from Seggers webpage here: https://www.segger.com/downloads/jlink/
Unfortunately, Segger limit the features of the tools in depend of the edition. So with J-Link EDU you can only read flash using J-Flash, but not erase or write. If you search the interface you may find a tool to generate licenses for the EDU edition to use all tools with full features

How to connect the interface to the mainboard and how to setup and read the content is described here: https://mk4-wiki.denkdose.de/artikel/na ... oard_flash

Here are the Segger J-Flash projectfiles needed, ready for download:

• https://mk4-wiki.denkdose.de/_media/art ... 948.jflash
• https://mk4-wiki.denkdose.de/_media/art ... 948.jflash
• https://mk4-wiki.denkdose.de/_media/art ... 948.jflash

To share dumps please use BIN (raw binary) format and the following naming convention:
RADIO_TYPE "_" FORD_PART "_" BOSCH_PART "_" FLASH_SOURCE "_" PIN [ "_" MAIN_SW_VER ] "_" STATUS ".bin"

• RADIO_TYPE could be "NX", "FX" or "MCA"
• FORD_PART is the Ford partnumber like "7S7T-18K931-BL"
• BOSCH_PART is the BOSCH partnumber without blanks, like "7612300534"
• FLASH_SOURCE should be "MBFLASH" for Mainboard Flash or "GBFLASH" for Graphicsboard Flash
• PIN the 4 digit PIN code like this "PIN-xxxx"
• MAIN_SW_VER, if known (optional) the software version of the main Firmware (found in SW/HW Versions of radio menu)
• STATUS can be "Working" or "RebootLoopError" or "InsertDataCarrierForDownload" or something to describe whats on with the image. NOTE: Also faulty images a valueable!

[Stevebe]

Ok let’s try and read this flash

DB524E14-7F84-49CC-B1A4-AB04B6BC6F71.jpeg

Ok were done, after tracing fault to WDT not being disabled, wire in wrong place Doh...
I’m looking for A NX System DVD Drive, ( used for maps and loading update) if you have a good working one
I’m interested, PM.
Wile I am on the cadge a set of knobs would be cool, or just the inner of the AC knobs. Again PM.

[Go4IT]

Oh, this board is prepared for video input, very rare on NX boards. You can see the spare round solder pad on the right side? On NX-Plus (with video-in for rear-view-camera) there will be a Rosenberger HF connector soldered.
Just for interest: Could you please tell me the Board number? It's on the opposite side (component side) of the PCB, under that QR-Code. It has two lines of digits and chars.

[Stevebe]

Will do, that was one of the main reasons I wanted to use this MoBo..
Just need a good video card,, I have a vid card but it is toast.
I’ll grab numbers tomorrow as I just got in,

[Go4IT]

Would you provide a picture of that "toast"? Maybe i am able to reconstruct it, as i have all parts needed. It's shure a hell of a job...

[Stevebe]

290C9C63-D42C-4ED3-84ED-DD05EBFF3553.jpeg

Oh, this board is prepared for video input, very rare on NX boards. You can see the spare round solder pad on the right side? On NX-Plus (with video-in for rear-view-camera) there will be a Rosenberger HF connector soldered.
Just for interest: Could you please tell me the Board number? It's on the opposite side (component side) of the PCB, under that QR-Code. It has two lines of digits and chars.

As requested
I have got a new system dvd drive chassis on its way, DVS 7150v as this one looked like it had been through a crusher lol,,

[oscarboiro]

Hello!! Very good information.
I have 3 units of travelpilot NX:

1 Travelpilot nx DVD withouth rear camera
1 travelpilot nx DVD with rear camera, this unit have a software problem after update with wrong software
1 travelpilot nx SD with rear camera with foul in screen PCB

Now im interested to recover the unit with fault in the software. i have a j-link (clone) but i need the software to use and instructions to connect.
in this post have a complete infromation, and go to try.

I have a ford kuga mk1, some time ago y try to install one unit of mondeo mk4 restayl, but dont work the lights of button, in my kuga, the signal of the light is analog, and in the mondeo the signal are in CAN BUS.
the units is the same, but have a little difference in the software.
This forum have a very high level, i have a very low level, but im interesting to learn and increase my level to contribute.

Actually i use arduino with CAN BUS shield to hack can bus, at the moment i have a Sony simulator to activate V2C withouth radio. i don need this mod, but i work on this to learn.

Best regard!!!

[Go4IT]

Hey Oscar, nice to meet you here!

1 travelpilot nx SD with rear camera with foul in screen PCB

Just to clearify, this is not an NX, it's an MCA-Plus (because of the RVC input).
What exactly do you mean with "foul in screen PCB"? You mean the graphics-board behind the TFT screen, i guess.

I have a ford kuga mk1, some time ago y try to install one unit of mondeo mk4 restayl, but dont work the lights of button, in my kuga, the signal of the light is analog, and in the mondeo the signal are in CAN BUS.

Correct. You can distinguish them by the Ford partnumber on the side label. The Mondeo partnumbers starts with *S7T-... like "7S7T-..." or "8S7T-..." or "BS7T-..." whereas Kuga uses "8V7T-..." and Focus/C-Max "8M5T-...". Kuga uses the same electronic setup like Focus or C-Max, whereas Mondeo and S-Max and Galaxy share the same internals.

Look at my Wiki, there i have comprehensive partnumber database for each devicetype. Here for example the NX: https://mk4-wiki.denkdose.de/artikel/na ... ilenummern

the units is the same, but have a little difference in the software.

No, not really. They are similar but NOT the same. No question that FX, NX and MCA differ, but also inside each type they differ. They have different Board-IDs. This ID is set by resistors in an area near the Flash chip which pulls signals to 0 or 1 on the addressbus. I'll describe their meaning in a separate topic here

So for example flashing the NX firmware of a Mondeo radio onto a chassis of an Kuga would not result into a change of light and ignition handling. But this is unproven yet, go and try it for your own to make us all smarter

[oscarboiro]

Hello, i have news. i follow all steps to dowload software, and connect unit. i made a back up of my 2 dvd units.
but when i try to write have a problem:

ScreenShot segger Fail.jpg

any sugestions to solve?

[Stevebe]

flash started.png

flash gives up.png

Hello, i have news. i follow all steps to dowload software, and connect unit. i made a back up of my 2 dvd units.
but when i try to write have a problem:

ScreenShot segger Fail.jpg

any sugestions to solve?

i was having the same problem, but now it keept stoping at 32% saying MCU was running.(the WD linmk is on) ..
then it started to get to 52%. but fails at the address seen on capture

the unit seems to shut down 0 mA, under programming 130 mA reading 100mA.
and this is the latest error seemss like the WD MMU is not staying halted.
this is the original file from the unit,

flash error 3.png

if i use go4it file i get this error
Connected successfully
Programming target (67108864 bytes, 1 range) ...
- ERROR: Programming failed @ address 0x00000000 (program 1 over 0)
- ERROR: Program failed
- ERROR: Failed to program target
Disconnecting ...
- Disconnected