Page 7 of 16
Re: Update IPC
Posted: 17 Sep 2019, 06:21
by leader
Artist wrote: ↑14 Sep 2019, 08:55
Thank you for your response ...
I tried the following attempt, but so far without writing to IPC.
I put the .bin dump into the hex editor and then exported it to the motorola s-hex file. Then I imported this file in VBF Tool 2.2, added the same header as the original vbf file.
The header contains information about the length of the file, the starting address ...
But I can't change the start address, I only have 00000000.
It should be on IPC main flash since 00005000.
Maybe it's not a problem, but I'm not sure the result ...
well thank you...
Hi,
The readable text field in the header are only for informational purpose.
After the readable (plain text) VBF header there are one or more data segements. Each data segment begins with 32bits CallAddress (memory address where data will be loaded), 32bits DataLength, than comes the Data and 16Bits crc checksum at the end of segment.
Here is one little code snippet from my vbf flasher (posted some years ago
here) about reading first data segment from VBF file:
Code: Select all
uint8_t *seekVBF2Data(uint8_t *buffer) {
char pattern[] = "file_checksum =";
uint8_t flag = 0;
uint8_t *subbuf;
if ((subbuf = (uint8_t *) strstr((char *) buffer, pattern)) != NULL)
if ((subbuf = (uint8_t *) strstr((char *) subbuf, "}")) != NULL)
return subbuf+1;
return NULL;
}
uint8_t *readVBF(char *filename, sDataSegment *fw) {
FILE *f = fopen(filename, "r");
//get filesize
fseek(f, 0L, SEEK_END);
long sz = ftell(f);
fseek(f, 0, SEEK_SET);
//alloc buffer
uint8_t *retbuf, *buffer = malloc(sizeof(uint8_t) * sz);
fread(buffer, 1, sz, f);
fclose(f);
//seek vbf to fw data
if ((retbuf = seekVBF2Data(buffer)) == NULL) exit(-1);
fw->callAddress = getInt32(retbuf);
retbuf += sizeof(uint32_t);
fw->length = getInt32(retbuf);
retbuf += sizeof(uint32_t);
fw->data = malloc(sizeof(uint8_t) * fw->length);
memcpy(fw->data, retbuf, fw->length);
retbuf += fw->length;
fw->crc = getInt16(retbuf);
printf("%08X %08X %04X\n", fw->callAddress, fw->length, fw->crc);
free(buffer);
return retbuf;
}
To rebuild data segment it's simple. Just replace the binary data it self in the vbf file (keeping the 2x32bit call address and data length at the begining) and finally rebuild the crc16 checksum at the end of the file (crc16 ccitt must be calcualted on the data segment).
The data must be exactly the same size as the original one.
The file checksum of the header is a CRC32 checksum calcualted on the entire file excluding the header. I allways recalculate this value after modfying the data, but never found any tool that use this field for validation. So you can simple ignore it in most of cases.
Regards,
leader
Re: Update IPC
Posted: 30 Sep 2019, 17:56
by Artist
Thank you for your comprehensive answer.
Somewhere I made a mistake because the IPC uploader will end up with an error ...
I also found out from your very useful information where the data start and end dates and where crc is the sum. Main flash is fine. But it is worse with External flash. There is a similar checksum at the end calculated from the data area without a header, but there are other characters! Even the dump of the IPC uploader has different characters at the end than the original vbf file ...
Even after recalculating crc, there is a problem somewhere and crc doesn't fit. I make a mistake somewhere.
I'm trying to write a clone of my dashboard with additional features into another dashboard. And mainly I try to add, respectively. change language for another by rewriting characters in correct length and write via IPC uploader ...
Re: Update IPC
Posted: 01 Oct 2019, 07:20
by Artist
OK, I found that IPCupdater doesn't read the whole flash. There was an address missing at the end.
I'll try to fester it later ...
Re: Update IPC
Posted: 01 Oct 2019, 14:02
by Artist
So I managed an absolute clone of my Convers+ after the facelift. I have to solve before the facelift model by 2010. There I have correctly made the main flash, but it makes me still external flash.
Re: Update IPC
Posted: 01 Oct 2019, 15:01
by Go4IT
Congrats, but i'm not shure if i get you. Could you please describe in detail what and how you made it?!
Re: Update IPC
Posted: 01 Oct 2019, 16:11
by Artist
Yes, no problem.
Tested tested and functional but, but, but ...
But I will explain this in detail tomorrow I have a lot of work to do ...
I have been cloning Convers + firmware for about a year, but using a UCDS cable.
This is because of the software purchased where this type of connection is primarily selected. By a small modification I could copy this software for free into multiple convers+.
But it also has its shortcomings, which both bother someone and not someone.
I tested it for a long time and came to concrete things.
The Motral software is protected by the VIN number and serial number of the instrument panel and also by a time trigger.
* To bypass the time run, you need to change the time in pc to the approximate day after you purchase the sw ...
** To change the serial number, it is necessary to change the serial number of the unit in eeprom. It goes well ...
*** And to change the VIN number:
- if I update the IPC in my car, ie the car to which the VIN is tied, there is no need to change anything.
- if I update the IPC in another car, it is necessary to change the Vin number in Bcm in order for the purchased software to load at all and continue.
What is achieved by changing Vin numbers?
So there it is:
With a permanent Vin change, there are several errors in the diagnosis, written as DTCs.
These are just "U" errors that don't matter.
However, the user has full support of all functions as in the purchased software.
If Vin changes back to the original, the following will not work:
- Display of battery voltage and coolant temperature.
- Visual display of parking sensors on Convers +.
All other things in the modified software will work and these are:
- Translation of a language mutation (East of Paradise)
- Display digital speed
- Show black theme (before facelift)
- Display PTC heating, duplicate even Webasto, if it was purchased.
- Turn off the door opening message
- Full view of the light package (resolution of lights on, beam including fog lights and turn signals)
So far, I have done all this through UCDS, but to make it easier and to access other software I didn't have, I needed an IPC uploader ...
For me it's software that has the title of software of the year !!!
Everything is now possible.
However, the author is probably afraid and does not continue. I wrote him a pity!
But it does not matter, thanks to this great forum, things have moved forward ...
If I could program, I would also remove the protection, unfortunately it is not possible and so it is at least partially functional.
P.S:
I use Convers, which is after the facelift in the car before the facelift, so in the year 2007. And so the clone works reliably and does not illuminate the airbag.
So the modified software is functional also on another bus HS can ...
Tomorrow I give if I pursue a specific procedure ...
Re: Update IPC
Posted: 02 Oct 2019, 22:33
by Artist
Manual how to make an IPC backup for re-writing via software IPC upload.
It is a lay explanation and procedure.
Warning! instructions apply to IPC after facelift!
For use on other and older IPC panels it is necessary to have other calibration files and bootloader.
The current version 1.4 does not yet support write backup dump files, they need to be converted and modified as
original vbf file ...
Use IPC upload software (latest ver.1.4)
Download IPC content (eeprom, main flash and extended flash) (1)
Open the original calibration files "VBF" format (attached in the post).
Cut the contents of the backup and paste it into the original vbf file as shown
Start and end address. (2),(3)
The length must correspond to the original file, be careful about the exact beginning and end.
After pasting the data content, cut or re-cut the data. recalculate the CRC checksum as shown.
Override the recalculated CRC sum at the end of the file. (4)
Save in vbf format. (just change the ending)
Load in IPC uploader and check CRC. (6)
Repeat the procedure for the second flash file (approx. 2mb). Beware of different start and end address and file size. (5)
Even with a good CRC sum if the file length is wrong, the software may throw a write error!
In the case of writing directly to the IPC, it is important to have the correct files selected for a particular dashboard type!
There are 3 types of Convers + dashboards.
The first and second models are the same, they differ only visually. Normally they can be distinguished by software, rom version,
where applicable, by the serial number.
One version is before facelift and the other is interfacial.
Before the facelift version, the rom had ranging from 0805 to 1007.
Interfacial to ver. 1122
Replacing software via IPC upload will cause a defect ...
The IPC may flash or have broken indicators!
However, there is no problem to return the original correct version back to the IPC.
This is a good IPC upload and especially a backup of the original Convers + content in case of various experiments ...
The version after the facelift is also visually different and has other hw part than the software part.
However, if the IPC is switched to an older car, it has a airbag problem and the airbag is permanently on.
However, it works great with customized software ... (I use it myself)
So much in a nutshell.
You test everything at your own risk.
But I tried different versions and even after killing, it was always possible to revive again.
It is important not to change the bootloader and to keep the data size and crc.
If someone does this for the first time, there is no need to worry. After loading the boot loader, the IPC will delete the data and then delete it
starts writing. As you type, the directional arrows blink to the end.
Do not switch on the appliance in the car or turn the key to another position. The battery should be fine ...
Re: Update IPC
Posted: 03 Oct 2019, 11:10
by Go4IT
REALLY GOOD JOB! I'm looking forward to repeat all steps you told on one of my Convers+ devices. Unfortunately i only have preFL ones. Just looking for a cheap FL to buy and test.
Re: Update IPC
Posted: 03 Oct 2019, 12:21
by Artist
You can also try on older convers +
The same steps apply to main FW!
Use the correct bootloader and customize the main FW.
If everything goes well and the dashboard turns on you know it works ...
I have some problems with Flash (Extended flash), I can't find the end of the data block. Meanwhile, the enrollment ends with the flashing IPC.
But then there was no problem to write only Flash FW which I have correct and IPC came to life. So main Fls also works 100% this way.
Re: Update IPC
Posted: 11 Oct 2019, 08:39
by Gwe89
Great tool, your work is great, I had a play around with it and editing the eeprom, sometimes I messed the eeprom up so I have to re write it back to the eeprom chip with another tool, are you open to suggestions to your new ipc tool?