MicroHacker Forum

Online community for electronics and microcontroller reverse engineering
https://microhacker.denkdose.de/

Analyze flash dump of NX

https://microhacker.denkdose.de/viewtopic.php?t=7

Page 1 of 1

Analyze flash dump of NX

Posted: 14 Feb 2019, 06:22
by Go4IT
Hey guys, after reading out and browsing through the contents of the mainboard Flash, i found lot's of interesting readable strings there. Maybe it tells uns more about the architecture of the system.

The flash is only partially used. An image representation of the contents i made with https://binvis.io gives an good overview:
NX_7S7T-18K931-BL_NX_7612300534_MBFLASH.png
The white areas are unused (0xFF, which means "blank" in the terms of a Flash memory).

You can also find compile dump sessions of the source code over and over, very informative. Also many references to debug messages. I wonder if we can get them somewhere on the UART ports. Shure, only with some magic telling the system to,put them out (switch into debug mode). But it could also that these are only library messages, not being triggered or used in the production code. Here is an example:

Code: Select all

tcc --debug -c --remove_unneeded_entities -od:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/build/reliance/reliance/nucleus/arion/reliance_d/debug/reliance/common/tools/objects/rlmunge.o --diag_style=ide --cpu=ARM926EJ-S --fpmode=ieee_full -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/build/reliance/reliance/nucleus/arion/reliance_d/debug/versionheader/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/FLASHFX/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/FlashFX/dcl/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/FlashFX/dcl/os/nucleus/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/Reliance/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/Reliance/oil/nucleus/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/interfaces/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/reliance/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/reliance/oil/nucleus/newproj/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/ansi/arm/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/interfaces/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/nucleus_core/core/nucleus/include/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/stl/Blaupunkt/ -Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/system/ -DDEBUG -DNO_DLL_USE -DOSAL_CONF=OSAL_NUCLEUS -DOSAL_CONF=VARIANT_FTR_TFFS -DOSAL_DEBUG -DOSAL_PLATFORM=OSAL_TUAREG -DSYSTEM_S_USE_BPSTL -DTUAREG_DEBUG -DVARIANT_FTR_FFS2TFFS -DVARIANT_FTR_FFS_3_4 -DVARIANT_S_FTR_DISABLE_HEAPCLEAR -DVARIANT_S_FTR_ENABLE_FFS2TFFS -DVARIANT_S_FTR_ENABLE_FFS_3_4 -DVARIANT_S_FTR_ENABLE_LOGICAL_STACK -DVARIANT_S_FTR_ENABLE_TFFS -DVARIANT_S_FTR_ENABLE_TRACE_EXT_PROTOCOL -DVASCO_OS_NUCLEUS -D_DEBUG -D__arm -O0 --apcs=/inter --brief_diagnostics --force_new_nothrow --no_wrap_diagnostics d:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/components/reliance/common/tools/rlmunge.c
fseek.o

ARM/Thumb C/C++ Compiler, RVCT2.1 [Build 328]
armcc --thumb -c --split_ldm -ofseek.o --depend=fseek.d --schedule_cpu="ARM9E-S,ARM10200E,ARM1136JF-S" --cpu=4TxM --fpu=none -I../../ -I../../angel -I../../public -J../../stdh -Dfseek_c -Otime --apcs=/no8byte/interwork/noswst/norwpi/ropi --memaccess=rw:-S22 ../../stdio.c
raise.o

ARM/Thumb C/C++ Compiler, RVCT2.1 [Build 328]
armcc --thumb -c --split_ldm -oraise.o --depend=raise.d --schedule_cpu="ARM9E-S,ARM10200E,ARM1136JF-S" --cpu=4TxM --fpu=none -I../../ -I../../angel -I../../public -J../../stdh -Draise_c -Otime --apcs=/no8byte/interwork/noswst/norwpi/ropi --memaccess=rw:-S22 ../../signal.c
arm_endcatch_noexceptions.o
So they are used "tcc" to compile, er? ;-) Now it's clear the software is written in C/C++ on the base of an Nucleus RTOS. Also there is no doubt about the processor architecture "--cpu=ARM926EJ-S". Oh, i really want to get my hands on this "d:" drive ;-))

I also hope to find a filesystem or other datastructures somewhere. I've added a "strings only" version here,to download so you can look into it, even if you are not able to dump a flash yourself. Also added two extracted versions only containing the Windows- and Linux-Style paths. Those are "uniqed", so remove duplicate lines.

Also added an output of "binwalk". Just a trial to identify what's inside the Flash. It did not find any filesystem at all, but this ELF:
"0x140020 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)"
The results of "readelf" is added too.

Re: Analyze flash dump of NX

Posted: 14 Feb 2019, 08:16
by Go4IT
Let's do some "buzzword bingo" and analyze the meaning of some lines and terms found in the hexdump:

Code: Select all

--cpu=ARM926EJ-S
This is what we are dealing with. Helpfull and needed for disassembling the code. As you can read here https://en.wikipedia.org/wiki/ARM9 The ARM926EJ-S processor family was first introduced 2001. As you can find here https://en.wikipedia.org/wiki/List_of_A ... hitectures, the "ARM926EJ-S" core belongs to the "ARM9E" family and uses the "ARMv5TEJ" architecture (instruction set). The only thing we should worry about is this: "ARM926EJ-S with ARM Jazelle technology, which enables the direct execution of 8-bit Java bytecode in hardware, and an MMU". Hopefully, the engineers void using Java :|
The http://infocenter.arm.com/help/topic/co ... p5_trm.pdf

Code: Select all

ARM/Thumb C/C++ Compiler, RVCT2.1"[/b]
They use "tcc", which is the C-compiler of the "RealView Development Suite". Looking at [url]http://infocenter.arm.com/[/url] a real good site for all ARM related infos, if found "RVCT" stands for "RealView Compilation Tools". It generates code for the 32-bit ARM and 16-bit Thumb and Thumb-2 instruction sets and support full ISO standard C and C++.
Some usefull documents i found for later use:
[url=http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204h/Babbfdih.html]ARM926EJ-S Technical Reference Manual[/url]
[url=http://infocenter.arm.com/help/topic/com.arm.doc.qrc0006e/QRC0006_UAL16.pdf]Thumb Instruction Set[/url] and a real nice [url=http://re-eject.gbadev.org/files/ThumbRefV2-beta.pdf]Thumb Opcodes Cheat-Sheet[/url] (no clue if they use "Thumb" mode or not...)
Some quick notes about "Thumb" instruction set: "Processors since the ARM7TDMI have featured the Thumb instruction set. When in this state, the processor executes the Thumb instruction set, a compact 16-bit encoding for a subset of the ARM instruction set." - I don't expect to find any Thumb code in the NX, because space is no matter here.

[code]OSAL
Is a "Operating system abstraction layer" and also a task sheduling engine.

Code: Select all

-Id:/ccstg/mrh_DI_ARION_PSW_6.5V51.vws/di_arion_psw/products/nucleus_core/core/nucleus/include/
Copyright MGC 2003 - Nucleus PLUS v. 1.14.5 - ARM926T TI OMAP5912 RVCT 2.0.1
TI OMAP5912 OSK
TI OMAP5946 OSK
TI_OMAP5912_OSK
Includes the Nucleus core, which is an realtime operating system (RTOS) https://en.wikipedia.org/wiki/Nucleus_RTOS
It is a Linux-Like operating system for embedded devices. So there is a good chance to find a filesystem inside...
The second line denote the RTOS version used and also proof that i was right that OMAP5948 is based on OMAP5912 :-)

Code: Select all

ARION
This seams to be the project name of the HMI-Processor (OMAP5948) code.

Code: Select all

DI_ARION_PSW_6.5V51
The bootloader part of the code.

Code: Select all

/dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT/VERSIONS
/dev/registry/LOCAL_MACHINE
/dev/registry/LOCAL_MACHINE/SOFTWARE
/dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT
Hmm.. they are using some Windows-style registry-system to store configurationdata..?

Code: Select all

********************************************
**       Start FORD HSRNS System          **
SPM_SHUTDOWN
X:\di_projects\products\boot\base\sources\boot_base.cpp
mbx_255
Start FC SPM.
Start application FC download.
*********** THIS IS THE END ********
Wow! This looks interesting, because this is a debug message which should be seen in a Terminal...
Hopefully this is "THE BEGINNING" not the end of disassembling ;-)

Code: Select all

vor pc_memory_init
vor nucleus_vSysIni_Persdata_Reset
vor OSAL_s32SysCntrl_StateMachine
vor DMB_init(DMB_perTask)
vor DMB_startCreateTasks
vor DMB_create(DMB_perTask)
vor welcomeString
vor DMB_waitOnCreateTasks
vor Report + OSAL_s32Boot()
vor LLD_DEVICECONFIG_vHwinit
vor DMB_hwInit
vor new NppBASE
vor DMB_create(DMB_bootPhase)
vor NU_Create_Task(Process0)
Some German language debug messages ("vor" means "before") and should tell the debugger where the code is currently executed.

Code: Select all

Welcome to Paramount Version
"Paramount" is another internal codeword for some portion of the system.

Code: Select all

{LFM_FlashInit} result=%d  numunits=%d
{LFM_FlashInit} result=0x%lx
{LFM_FlashRead} ID=%s malloc failed
{LFM_FlashCompare} ID=%s malloc failed
{LFM_FlashWrite}  ID=%s malloc failed
{LFM_FlashWrite}  ID=%s write to address =0x%lx failed
LFX Extended NOR-Flash Info
Accessing the NOR-Flash (S29GL512N is used on the NX mainboard) for writing the first sector needs a password (protected).

Code: Select all

BOARD_ID
BOARD_ID_NAME
PRODUCT_ID
PRODUCT_ID_NAME
PARAMOUNT_VERSION
PARAMOUNT_BUILD_DATE
The "Board-ID" is something i already discovered. Each board has a number and a set of resistors, forming a binary code, the Board-ID. The software is all the same, for every kind to satnav-unit, but it behaves differently, based on reading this ID on system bootup. Maybe it is used to determine the entry point of the software also...

Code: Select all

USB_FAKRA_REQ
I know that there is some kind of "USB-Boot" or "USB-Download" for the OMAP and the pins for this are routed to the big radio connector on the rear. This plug is called "Quadlock" and was made from "FAKRA". The USB-Pins are there, but cut-off, so the can't be connected to the a plug, but reached by needles.
"/dev/usb_dnl" belongs somehow to this.

Code: Select all

/dev/ffs3
/dev/ffs2
/dev/ffs
The "FFS" are the memory access pins/modes of the OMAP. They are used to access external memory like Flash, SDRAM. The Nucleus OS seems to provide access to them by means of Unix device nodes in the filesystem.

Code: Select all

EDAR_Application
EDAR is an abbrevation for "Enhanced Digital Audio Routing" and means the processing of the diverse audio sources which will be handled by the DSP as digital signals.

Code: Select all

SDS
Abbrevation for the speech recognition portion of the unit.

Code: Select all

Welcome to FGS-SW-Version: %x.%x
This is the "Front Graphics System", which is in fact the separate board mounted on the backside of the display. It is driven by a Cypress Cyclone III FPGA.

Code: Select all

Odometer: unable to open /dev/kds - using odometer via CAN
Ok, the device node "kds" is used to access CAN data somehow.

Code: Select all

BP SGM 710
BP SGM 710 D02 EMB1
BP VW LL NF D02
BP Ford HSRNS D02
BP SGM 710 D02 EMB2
BP Ford HSRNS D03
BP SGM 710 D03 EMB3
BP SGM 710 D04 EMB4
BP Ford HSRNS D06
BP GE 09
BP APEB
BP Ford LSRNS D01 EMB
BP Ford HSRNS D007 WMB
BP Ford HSRNS B HW BVC
BP Ford HSRNS C HW RVC
BP VW LL NF
BP SGM 710 D04 NULLS
BP Ford HSRNS
BP Ford LSRNS
BP GE 09 A0 sample
Look for those various systems used with this firmware.

Code: Select all

COPY PROTECTION KEY EXCHANGE FAILURE -KEY NOT ESTABLISHED
COPY PROTECTION KEY EXCHANGE FAILURE -AUTHENTICATION FAILURE
COPY PROTECTION KEY EXCHANGE FAILURE -KEY NOT PRESENT
bIsCopyProtectionDisabled
bCopyProtectionCheck
Talking about copy protection :-) Would'nt it be nice to find the sub accessing this property "bIsCopyProtectionDisabled" ;-)

Code: Select all

NAND Flash
NOR Flash
Toshiba
Samsung
Micron
ST Micro
Am30LV0064D
NAND512R3A
NAND256R3A
NAND128R3A
NAND01GR3A
NAND512W3A
NAND256W3A
NAND128W3A
NAND01GW3A
NAND512R4A
NAND256R4A
NAND128R4A
NAND01GR4A
NAND512W4A
NAND256W4A
NAND128W4A
NAND01GW4A
NAND512R3B
NAND01GR3B
NAND02GR3B
NAND04GR3B
NAND08GR3B
NAND512W3B
NAND01GW3B
NAND02GW3B
NAND04GW3B
NAND08GW3B
NAND512R4B
NAND01GR4B
NAND02GR4B
NAND04GR4B
NAND08GR4B
NAND512W4B
NAND01GW4B
NAND02GW4B
NAND04GW4B
NAND08GW4B
MT29F1G16ABA
MT29F1G08ABA
MT29F2G16AAB
MT29F2G08AAB
MT29F4G16BAB
MT29F4G08BAB
TC58128FT/TC58128/2AXB/AFT/TC58D(A,V)M72(A,F)1FT00
TC58512FT/TC58DVM92A1FT00
TC58256/FT/DC/2AXB/AFT/TC58D(A,V)M82(A,F)1FT00/TC58DVM82A1XBJ1
TC58NVG0S3AFT00/5
TH58NVG1S3AFT00/5
TC58V32AFT/ADC/DC
TC58DVG02A1FT00/TH58100FT
TC58V64AFT/BFT
HY27SS16121M
HY27US16121M
HY27SS08121M
HY27US08121M
HY27SS16561M
HY27US16561M
HY27SS08561M
HY27US08561M
HY27SG162G2M
HY27UG162G2M
HY27SG082G2M
HY27UG082G2M
K9K1G16Q0A
K9K1G08Q0A
K9K1G16U0A
K9F1216Q0A/B/K9K1216Q0A/C
K9F1216D0A/B/U0A/B/K9K1216D0C/U0A/C
K9F5608D0C/U0A/B/C
K9F5616Q0B/C
K9F1208Q0A/B/K9K1208Q0B/C
K9F5608Q0B/C
K9F2808Q0B/C
K9F5616D0C/U0B/C
K9F6408U0B/C
K9F2816Q0C
K9F6408Q0C
K9F1208D0A/B/U0A/B/M/K9K1208D0C/U0C
K9F2816U0C
K9F1G08D0M/U0A/M
K9T1G08UOM/K9K1G08U0A/M
K9F2G08U0M/K9K2G08U0A/M
K9F1G16Q0M
K9F2G16Q0M/K9K2G16Q0M
K9K4G16Q0M
K9F1G08Q0M
K9F2G08Q0M/K9K2G08Q0M
K9K4G08Q0M
K9F1G16D0M/U0M
K9F2G16U0M/K9K2G16U0M
K9K4G16U0M
K9K4G08U0M
K9F2808U0B/C/KM29U128T/IT
List of supported Flash/RAM devices?

Re: Analyze flash dump of NX

Posted: 03 Mar 2019, 08:03
by Go4IT
I made a new discovery. It seems the Flash contents gets modified by the system itself, without doing any updates. Maybe from the view of the operating system (RTOS) the Flash is like a filesystem, where it can read and write to some parts of it (e.g. a /var or /tmp location).

After flashing an image to an faulty NX and immediatly after flash, read it back, i found differences, which i did not expect to be. AS an example, the original Flash at address 0x3de96a0 looks like this:

Code: Select all

03DE96A0  31 37 38 2C 20 66 69 6C 65 6E 75 6D 20 31 30 00  178, filenum 10.
03DE96B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
03DE96C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
03DE96D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
03DE96E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
...
where after flashing it looks like this:

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

03DE96A0  31 37 38 2C 20 66 69 6C 65 6E 75 6D 20 31 30 00  178, filenum 10.
03DE96B0  69 19 6B 00 FF FF 0E 00 01 00 00 01 01 64 70 11  i.k.ÿÿ.......dp.
03DE96C0  24 43 72 69 74 69 63 61 6C 20 64 6F 77 6E 6C 6F  $Critical downlo
03DE96D0  61 64 20 65 72 72 6F 72 3A 20 66 69 6C 65 20 44  ad error: file D
03DE96E0  4C 5F 43 4F 4E 46 49 47 2C 20 6C 69 6E 65 20 37  L_CONFIG, line 7
...
As you can see the last equal part is the textline "178, filenum 10.", which is correctly terminated by an 0x00 (c-string representation).
After the flash the system places more information after this one, and for me, it looks like a logfile somehow...

If i put this into text-only i get:

Code: Select all

i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 761, data 1074929440, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 652, data 1074929576, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929644, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929712, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929780, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929780, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929848, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929916, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929984, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929984, errnum 45, filenum 20
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.m.ÿÿ.......dp.$Critical download error: file UNKOWN_FILE, line 323, data 1074930460, errnum 45, filenum 24
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.)..........dSPM: Reset COPRO performed
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`÷...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–...÷.°.ø.°ïþ.°é].°%d.°.].°¥$..»x................M...(..@ïê..¤ø.`.ù...............HL@M.......(..@¤ø.`....W”.......
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`£...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–..iø.°ïþ.°é].°%d.°.].°¥$..»x............Ih......M...(..@ïê..üø.`.ù..........8...°IL@M.......(..@üø.`....W”......$
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AE_264.`²...X:\di_middleware_server\components\fc_tmctuner\Source\tun_Flash_File_Access.cpp................................
.i.Ž.ÿÿ.......dp.......c—..¯–..‘3.°›^.°é].°%d.°µU.°¥$..»x............Ih......M...(..@ïê..dúŽ`.ù..........á...YKL@M.......(..@dúŽ`....W”...àÏ@.
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i...ÿÿ.......dp.....AB_1.þ.Pi.Z.ÿÿ.......dp...|..P.#..ñÿÿÿˆú.PŒ..P.....û.P‹..P.........ü.P(ÿ.Pë7..¨ú.P¹L..Õf..0.. ¤#.
.i.Ž.ÿÿ.......dp.......Õf..y...O....R. uÍ. µˆ' iŠ' Iý. Å÷. .h. .X. ×.. ' . «š. %—. .3. ñ€. ¥$..»x..........ªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªi.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 761, data 1074929440, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 652, data 1074929576, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929644, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929712, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929780, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929780, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929848, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929916, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929984, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929984, errnum 45, filenum 20
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.m.ÿÿ.......dp.$Critical download error: file UNKOWN_FILE, line 323, data 1074930460, errnum 45, filenum 24
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`÷...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–...÷.°.ø.°ïþ.°é].°%d.°.].°¥$..»x................M...(..@ïê..¤ø.`.ù...............HL@M.......(..@¤ø.`....W”..m-/..
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`£...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–..iø.°ïþ.°é].°%d.°.].°¥$..»x............Ih......M...(..@ïê..üø.`.ù..........8...°IL@M.......(..@üø.`....W”......$
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AE_264.`²...X:\di_middleware_server\components\fc_tmctuner\Source\tun_Flash_File_Access.cpp................................
.i.Ž.ÿÿ.......dp.......c—..¯–..‘3.°›^.°é].°%d.°µU.°¥$..»x............Ih......M...(..@ïê..dúŽ`.ù..........á...YKL@M.......(..@dúŽ`....W”...°Ï@.
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i...ÿÿ.......dp.....AB_1.þ.Pi.Z.ÿÿ.......dp...|..P.#..ñÿÿÿˆú.PŒ..P.....û.P‹..P.........ü.P(ÿ.Pë7..¨ú.P¹L..Õf..0.. ¤#.
.i.Ž.ÿÿ.......dp.......Õf..y...O....R. uÍ. µˆ' iŠ' Iý. Å÷. .h. .X. ×.. ' . «š. %—. .3. ñ€. ¥$..»x..........ªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªi.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 761, data 1074929440, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 652, data 1074929576, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929644, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929712, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929780, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929780, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929848, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929916, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929984, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929984, errnum 45, filenum 20
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.m.ÿÿ.......dp.$Critical download error: file UNKOWN_FILE, line 323, data 1074930460, errnum 45, filenum 24
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.)..........dSPM: Reset COPRO performed
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`÷...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–...÷.°.ø.°ïþ.°é].°%d.°.].°¥$..»x................M...(..@ïê..¤ø.`.ù...............HL@M.......(..@¤ø.`....W”.......
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`£...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–..iø.°ïþ.°é].°%d.°.].°¥$..»x............Ih......M...(..@ïê..üø.`.ù..........8...°IL@M.......(..@üø.`....W”......$
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AE_264.`²...X:\di_middleware_server\components\fc_tmctuner\Source\tun_Flash_File_Access.cpp................................
.i.Ž.ÿÿ.......dp.......c—..¯–..‘3.°›^.°é].°%d.°µU.°¥$..»x............Ih......M...(..@ïê..dúŽ`.ù..........á...YKL@M.......(..@dúŽ`....W”...àÏ@.
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i...ÿÿ.......dp.....AB_1.þ.Pi.Z.ÿÿ.......dp...|..P.#..ñÿÿÿˆú.PŒ..P.....û.P‹..P.........ü.P(ÿ.Pë7..¨ú.P¹L..Õf..0.. ¤#.
.i.Ž.ÿÿ.......dp.......Õf..y...O....R. uÍ. µˆ' iŠ' Iý. Å÷. .h. .X. ×.. ' . «š. %—. .3. ñ€. ¥$..»x..........ªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªi.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 761, data 1074929440, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 652, data 1074929576, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929644, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929712, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929780, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929780, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929848, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929916, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929984, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929984, errnum 45, filenum 20
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.m.ÿÿ.......dp.$Critical download error: file UNKOWN_FILE, line 323, data 1074930460, errnum 45, filenum 24
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`÷...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–...÷.°.ø.°ïþ.°é].°%d.°.].°¥$..»x................M...(..@ïê..¤ø.`.ù...............HL@M.......(..@¤ø.`....W”..zì...
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`£...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–..iø.°ïþ.°é].°%d.°.].°¥$..»x............Ih......M...(..@ïê..üø.`.ù..........8...°IL@M.......(..@üø.`....W”......$
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AE_264.`²...X:\di_middleware_server\components\fc_tmctuner\Source\tun_Flash_File_Access.cpp................................
.i.Ž.ÿÿ.......dp.......c—..¯–..‘3.°›^.°é].°%d.°µU.°¥$..»x............Ih......M...(..@ïê..dúŽ`.ù..........á...YKL@M.......(..@dúŽ`....W”...°Ï@.
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i...ÿÿ.......dp.....AB_1.þ.Pi.Z.ÿÿ.......dp...|..P.#..ñÿÿÿˆú.PŒ..P.....û.P‹..P.........ü.P(ÿ.Pë7..¨ú.P¹L..Õf..0.. ¤#.
.i.Ž.ÿÿ.......dp.......Õf..y...O....R. uÍ. µˆ' iŠ' Iý. Å÷. .h. .X. ×.. ' . «š. %—. .3. ñ€. ¥$..»x..........ªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªªi.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 761, data 1074929440, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 652, data 1074929576, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929644, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929712, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929780, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929780, errnum 45, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 690, data 1074929848, errnum 45, filenum 20
.i.t.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1462, data 1074929916, errnum 45, filenum 10
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 708, data 1074929984, errnum 47, filenum 20
.i.k.ÿÿ.......dp.$Critical download error: file DL_CONFIG, line 710, data 1074929984, errnum 45, filenum 20
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.m.ÿÿ.......dp.$Critical download error: file UNKOWN_FILE, line 323, data 1074930460, errnum 45, filenum 24
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`÷...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–...÷.°.ø.°ïþ.°é].°%d.°.].°¥$..»x................M...(..@ïê..¤ø.`.ù...............HL@M.......(..@¤ø.`....W”..}„...
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AB_36..`£...X:\di_middleware_server\components\vd_dimming\vd_dimming_main.cpp..............................................
.i.Ž.ÿÿ.......dp.......c—..¯–..iø.°ïþ.°é].°%d.°.].°¥$..»x............Ih......M...(..@ïê..üø.`.ù..........8...°IL@M.......(..@üø.`....W”......$
.i.S.ÿÿ.......d.....ALWAYS.........................................................
.i.Ž.ÿÿ.......dp...AE_264.`²...X:\di_middleware_server\components\fc_tmctuner\Source\tun_Flash_File_Access.cpp................................
.i.Ž.ÿÿ.......dp.......c—..¯–..‘3.°›^.°é].°%d.°µU.°¥$..»x............Ih......M...(..@ïê..dúŽ`.ù..........á...YKL@M.......(..@dúŽ`....W”...°Ï@.
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i.l.ÿÿ.......dp.$Critical download error: file DL_HELP_FUNCTIONS, line 1333, data 0, errnum 178, filenum 10
.i...ÿÿ.......dp.....AB_1.þ.Pi.Z.ÿÿ.......dp...|..P.#..ñÿÿÿˆú.PŒ..P.....û.P‹..P.........ü.P(ÿ.Pë7..¨ú.P¹L..Õf..0.. ¤#.
.i.Ž.ÿÿ.......dp.......Õf..y...O....R. uÍ. µˆ' iŠ' Iý. Å÷. .h. .X. ×.. ' . «š. %—. .3. ñ€. ¥$
For me, it really looks like the system is pissed by some errors and try again and again. What do you think?
I've shared you the images on Dropbox.

Re: Analyze flash dump of NX

Posted: 04 Mar 2019, 14:06
by Go4IT
Here is the folderstructure of an Firmware update CD (here for the FX, but NX and MCA are similar):

Code: Select all

\---dnl
    |   content.txt
    |   
    +---bin
    |   +---nav
    |   |   +---common
    |   |   |       navfx001.uli
    |   |   |       
    |   |   \---ford_hsm
    |   |           navarreg.uli
    |   |           
    |   \---system
    |       \---arion
    |           \---ford_hsm
    |               |   backup.bat
    |               |   basereg.uli
    |               |   boot.bin
    |               |   bootload.bin
    |               |   ffsbat.ena
    |               |   ffsnand.bat
    |               |   fgs.dnl
    |               |   main_ver.bin
    |               |   main_vsn.bin
    |               |   navcrc.bat
    |               |   plattapp.uli
    |               |   plattreg.uli
    |               |   radio.dnl
    |               |   replace.btl
    |               |   sdsapp.uli
    |               |   sdsreg.uli
    |               |   system.elf
    |               |   unbackup.bat
    |               |   
    |               +---ffsbatch
    |               |       scrpt_01.bat
    |               |       scrpt_02.bat
    |               |       scrpt_06.bat
    |               |       scrpt_07.bat
    |               |       scrpt_20.bat
    |               |       
    |               \---ffsbatdata
    |                       scrpt_01.bat
    |                       scrpt_02.bat
    |                       scrpt_06.bat
    |                       scrpt_07.bat
    |                       scrpt_20.bat
    |                       
    \---ford_hsm
        \---ffs
            \---dia
From the various files i read that the following parts gets updates
backup.bat

- boot.bin, bootload.bin (same content) = This is the bootloader, found in the first sector of the mainboard flash
- fgs.dnl = The flash content for the graphics board
- radio.dnl = This part is for the internal flash of the radio processor (V850)
- replace.btl = Some rule/tool to replace the existing bootloader of the unit with the boot.bin
- sdsapp.uli = Part for the speech recognition system (SDS) of the radio
- system.elf = Maybe a part of the base RTOS (because of the ELF format)

Re: Analyze flash dump of NX

Posted: 12 May 2019, 18:41
by Go4IT
I'm always thinking of where the Nucleus RTOS is storing it's files? There must be some kind of filesystem inside the Flash and i bet, the Nucleus Core is using it, beneath the RAM to store also logfiles and other things. If you look on the end portion of the flash you find many entries with readable text which looks similar to logmessages.
On an non-working system if found this at 0x27028A0 "No bootable partitions!.Invalid partition table.Error loading ROM-DOS.Missing ROM-DOS" and things like "Critical download error: file DL_DOWNLOADSERVICE, line 2874, data 34, errnum 35, filenum 5" or "new <NAVI > sw: version from 7.8.2008, 17:00, CRC 37b988ea" and many of them. This can't be random.
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited