MicroHacker Forum

Hello forum,
I have for very first time a Ford HSRNS unit 7612300532, 7S7T-18K931-BK, Firmware: 0843_090128 with Omap 5948 and S29GL512 flash. The unit reacts little bit strange - it accepts code, works some time, and then the display goes off but radio still works and there is sound, and after few seconds the sound stops and unit reboots - display goes on, sound comes and so on. After 2-3-4 cycles it goes in sleep mode and it has to be turned on manually and all begins over. Measured voltages - all seems to be ok, just in case I changed the RAM chips ( I had similar units with fault RAMs, but mostly Nissan LCNs). Nothing changes. There is nothing burned, nothing overheating... So decided to look at content of the flash.
I have some experience with Nissan LCN units, they are little bit different but the basis is the same - Omap+gl512.. Time ago I made my own project for LCN, and I am able to read and write the flash content, including the protected sector 0 with bootloader ( wich secret I see you already found ).
But I had not the right dump from exact same unit... So I used a friend's dump from 7612300533 / 7S7T-18K931-BJ, Firmware: 0218_070817. And it worked! The unit is working now on my desk over 3 hours, no reboots, everything seems fine, BUT when I tested it in the car - Ford Galaxy 2008 - there is problem with CAN communication - it does not see the ACC signal ( says it will work an hour ) and the clima does not work at all. I can see the clima menu on the display but can not switch it on, neither to control anything....
I thinked , may be this is because I did not write back the original sector 507, from original dump. At that moment I had not enough time to disassembly the unit again and to program it, but later I swapped the content of sector 507 - same story...
So, I'm hopping some of you has a dump from S29GL512 from exactly same unit 7612300532, 7S7T-18K931-BK to try with.
Or if you have some suggestions about, I will be glad to hear them!
With best regards!

writing sector 507 should have fixed the problem.

Write it again and also delete contents of that external EEPROM chip before first boot.

*BJ is one revision lower than *BK
Search for the FW update image, write it to a DVD and let the unit update its FirmWare... 0218 is very old!

You can find latest 4.1 FW here: viewtopic.php?f=3&t=122 .. it also has DVD patch and Black Theme.

Thanks for the advice!
I rewrote sector 507 and erased the external eeprom ( 95640 ) but without success ...
And with the older firmware - 0218 I hadn't access to the hidden menu ( MENU+NAV ) to eject navigation dvd and to load a disk with new FW.
So, I decided to walk my way
As I said earlier I had some experience with Nissan's LCN units... There is a trick when the unit is totally locked after about 30 attempts and gives you straight direction to the diller - to erase sectors 265 and 266. This is the way to "broke" the file system and to force unit to recover it itself. Of course there is also a way less destructive method for this, but in this case destroying the FS of this HSRNS was the main idea
SO, I erased sectors 265 and 266, it took about 5 minutes to reboot and start - there were no reboots in work, the menu looks like it was, there was an access to the hidden menu BUT now radio does not work! All preset stations on Zero, no manual search neither automatic, volume control also disappear...
And then it spark, in the 95640 I can see the preset stations! May be there is also some data related to the tuner settings... Wrote back the content of eeprom and tuner start working.
And the main question - will it work in the car? I called the owner to bring the car from nearest city to test all - Yes! It works!
Everything works, the unit see the CAN, took date and time from car, and clima also works! Succeeded !
Case is closed!

so it sems 95640 EEPROM is rewritten only if sectors 265 and 266 are good.
If those 2 sectors are gone then maybe OMAP uses also info from that EEPROM to rebuild contents of 265 and 266.

It works with original 0218 FW (that was broken) or with the copied FW from the other FX?

DGAlexandru wrote: ↑14 Jul 2021, 12:32 so it sems 95640 EEPROM is rewritten only if sectors 265 and 266 are good.
If those 2 sectors are gone then maybe OMAP uses also info from that EEPROM to rebuild contents of 265 and 266.

It works with original 0218 FW (that was broken) or with the copied FW from the other FX?

Now, when I read my previous message I see I forgot to mention that I wrote the original dump back before to manipulate with it...

I used the original dump from the unit with FW 0843 and used Omap to rebuild it erasing sectors 265&266, at that moment content of the external eeprom was empty, so it doesn't have any difference for Omap, it restores the file system regardless of the 95640.
WBR

Yes, it restores them, but radio doesn't work.

If everything is OK, erasing external EEPROM only deletes stored radio stations, volume presets... At first boot if EEPROM is empty, it is restored with default values.

I guess you are right.
I can make conclusions only depending on what I have done and seen, and it seems that when Omap rebuild the FS if the content of the external eeprom is corrupt or missing this results on the tuner work. There must be some kind of backup data related to tuner settings in the eeprom for a case if they are needed, and if the eeprom content is corrupted or erased AND FS is OK the Backup data is written again at the next boot.
In my case I had both FS and eeprom bricked (the first from destiny and the second by me ) but now I know how it works...
And if someone is interested I will upload both flash dumps - the original one, although it was not fully working and the second one - rebuilded from Omap.