MicroHacker Forum

interesting find - i long suspected he hadn't done this himself, just like the dpf indicator.

so does the UK/EU convers+ have the same 4MB flash and so be able to flash the chinese software; or did they add larger flash?

Do not upload this firmware to EU IPC. You will overwrite the data in EPROM.
I think there is another memory map in the Chinese IPC. EPROM must be on. Extended Flash coincides with the EU EPROM address.

I think it would be enough to replace the flash and change PBL to Chinese.

"Normal" Extended Flash is from 0x30 00 00 00 to 0x30 20 00 00.
Chinese Extended Flash is from 0x30 00 00 00 to 0x30 40 00 00.

EEPROM in both cases is from 0x80 00 00 00 to 0x80 00 80 00.

RAM, the same: from 0x40 00 00 00 to 0x40 00 C0 00

There is no overlapping.
I did wrote the Chinese FW to an European Convers+ and no harm done, just it didn't boot right. For External Flash I wrote only first 2Mb.

I will change the 2MB flash chip with a 4MB one to see if it will boot, but I think there are also some HW differences.

EPROM in EU C+ starting from 0x60000000
But you're right. It doesn't overlap EPROM.

bigi wrote: ↑25 Dec 2019, 23:41 interesting find - i long suspected he hadn't done this himself, just like the dpf indicator.

That was my thought from the beginning... or that he somehow managed to get the sourcecode. But maybe we do him wrong and he is just genius!?

bigi wrote: ↑25 Dec 2019, 23:41 so does the UK/EU convers+ have the same 4MB flash and so be able to flash the chinese software; or did they add larger flash?

No the EU version has a smaller chip and so could not hold the data. But maybe it's worth to get one of those chinese ones. Did some of you ever seen them on Aliexpress or so?

DGAlexandru wrote: ↑26 Dec 2019, 11:15 I will change the 2MB flash chip with a 4MB one to see if it will boot, but I think there are also some HW differences.

Again i would totally agree with you. Maybe the use completly different screen to have chinese chars.

dgalexandru, tasicky, where you have the info about the IO addresses of the external components (here EEPROM)?
I found and checked some with my IDA disassemblings and started making a table here https://mk4-wiki.denkdose.de/en/artikel ... memory_map
It would be also very interesting to know which IO ports of the MAC7116 are connected to what periphals.

languadge english and?

CN IPC is different only flash (CN flash = 4MB, EU flash = 2MB ).
BUT...
If you use CN firmware on EU car (change flash 2MB to 4MB - S29GL16 to S29GL32 TSOP 48pin) parking mode not working. CN car have different PAM module. Maybe firmware on PAM module ,HW IS the same i dont know...
If you need Origo Ford parking mode must have CN IPC and PAM...

Sorry for my english...

but the pdc mod is extractet from the chinese cluster
so i think its only importand to have can signal on pam
and this is done with updating the pam