FORD technical service bulletin : ICC touch screen display

[Superb]

New ELM arrived today, but still having the same issues..

Though I've got it working though by flipping the high and mid wires around and running full speed.

Doing a dump on my FGX dash currently, when its done i'll go pull the GT-F dash out of the car

[JasonACT]

Whatever works, I say!

[Superb]

Originally Posted by JasonACT

Whatever works, I say!

100%

I'm guessing it takes a while? I'd pressed read all 5

[JasonACT]

Oh, I guess we will talk again in a few hours! (ha ha)

[Superb]

Originally Posted by JasonACT

Oh, I guess we will talk again in a few hours! (ha ha)

LOL what , that should be in the disclaimer

[jakka351]

Originally Posted by JasonACT

While we wait for someone with a GTF Instrument Cluster who's willing to extract the special firmware... @Jakka - these are the "decoded" IDs that a Mk1 Cluster handles (reading the V850 document, the hardware register that deals with these is shifted 2 bits, and to be efficient, the programmers left the data that way - so you need to divide by 4 to work out the values):

image

1D7 does not appear there - I reckon it's a bogus signal when the chip is first configured, especially because it's only 7 bytes, and these things are configured to always generate 8 byte messages. Sorry mate.

Interesting, CAN id 408 are.you sure that's.correct, I get it as 409 in what I've done. Also interesting that ID 313 (cabin temp sensor byte 0) from.the fdim - this can id also contains all the "switches" you can change in the various radio, rds, program types filter options in the FDIM. All the radio, cd, MP3 stuff is in there too, as that can be displayed on the MFD.

How tall a step it is from here to adding stuff here and there, eg display a small engine diagnostics menu like many newer cars have, and successfully flashing that modified firmware back into it successfully?
Steering Wheel Controls could be implemented to control the menu as well.....the list goes on.

[JasonACT]

Yeah, I know, it's slow, sorry...

For the cool things my software attempts, it doesn't need a great deal of speed... And for the limited use stuff (like getting 'that' part of the firmware) once it's done, we never have to do it again. I know though, it's a bit annoying.

[jakka351]

Originally Posted by Whiteford

Did someone say J2534 support?

I think it.will work.already without modification.

[Superb]

Originally Posted by JasonACT

Yeah, I know, it's slow, sorry...

For the cool things my software attempts, it doesn't need a great deal of speed... And for the limited use stuff (like getting 'that' part of the firmware) once it's done, we never have to do it again. I know though, it's a bit annoying.

Honestly its fine, though if its going to take awhile I may as well just start again with the GT-F dash.

This first run, was just going to be a test

[JasonACT]

Ha ha, Jakka... I get it as 406! That's what you get when you're using Window Calculator with a mouse! And the Mk1 firmware is using all of the 256KB of flash it has available, so there's no "adding" to it - only small patches are realistic.

[jakka351]

Originally Posted by JasonACT

Ha ha, Jakka... I get it as 406! That's what you get when you're using Window Calculator with a mouse! And the Mk1 firmware is using all of the 256KB of flash it has available, so there's no "adding" to it - only small patches are realistic.

Well there is 0x403, 0x406, 0x409.....according to.my.CAN butt sniffing. All BEM related.

[JasonACT]

The biggest problem with the Mk1 (other than the ELM not being up to the task, due to the high speed of the data extraction's routine) is that it's not designed to be "updated" while it's in the car. You need to get into the programming mode by powering up the unit (from OFF, totally OFF) while sending in a "denial of service" type attack on it! Your car will not like it, unlike the EEPROM (and RAM) stuff I got working on it.

[jakka351]

Originally Posted by JasonACT

The biggest problem with the Mk1 (other than the ELM not being up to the task, due to the high speed of the data extraction's routine) is that it's not designed to be "updated" while it's in the car. You need to get into the programming mode by powering up the unit (from OFF, totally OFF) while sending in a "denial of service" type attack on it! Your car will not like it, unlike the EEPROM (and RAM) stuff I got working on it.

I am (slowly) piecing together a python script to do it, via socketcan so the ELM won't be a problem. Currently it is not very dynamic, so it will generate the key from an error message if that's what it receives instead of a seed. But have successfully gotten seed and generated key within the script..

After I get a handle on reading the EEPROM with socketcan I will try for the deeper stuff.

[Superb]

Laptop went to sleep, starting the dump again.
Sorry

[JasonACT]

Lol!

[Superb]

Originally Posted by JasonACT

Lol!

Silly me.

Now got an error, will start again :(

ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
065001003201F400
065002001901F400
056701ED43AA0000
0267020000000000
OK
Uploading SBL
04742000CA000000
0276010000000000
0377550200000000
04742000CA000000
0276010000000000
03779BAC00000000
04742000CA000000
0276010000000000
037732AE00000000
04742000CA000000
0276010000000000
0276020000000000
0276030000000000
0276040000000000
0276050000000000
0276060000000000
0276070000000000
0276080000000000
0276090000000000
02760A0000000000
02760B0000000000
02760C0000000000
02760D0000000000
02760E0000000000
02760F0000000000
0276100000000000
0276110000000000
0276120000000000
0276130000000000
0276140000000000
0276150000000000
0276160000000000
0276170000000000
0276180000000000
0276190000000000
02761A0000000000
02761B0000000000
02761C0000000000
02761D0000000000
02761E0000000000
02761F0000000000
0276200000000000
0276210000000000
0276220000000000
0276230000000000
0276240000000000
0276250000000000
0276260000000000
0276270000000000
0276280000000000
0276290000000000
02762A0000000000
02762B0000000000
02762C0000000000
037F377800000000
037791DF00000000
04742000CA000000
0276010000000000
0377D6F700000000
OK
Running SBL
0571010301100000
OK
Reading FLASH: 00000000, 00005000
OK
Reading FLASH: 00005000, 00010000
OK
Reading FLASH: 00015000, 0006A000
Failed to initiate read mode / complete the read

[JasonACT]

Hmmm, maybe it's best not to do all 5 at once... You did get the one part we need (5000-10000)...

[Superb]

Originally Posted by JasonACT

Hmmm, maybe it's best not to do all 5 at once... You did get the one part we need (5000-10000)...

I pressed reset unfortunately.
So part 5000-10000 is that the exe?

[JasonACT]

From what I understand (latest) EXE is the same in the GTF as it is in the normal FG2.

It's the SIGCFG that's different (5000-10000).

[Superb]

Ahh I understand the naming of your buttons now.
I'll just dump the signal config then for you now, that one doesn't take long.
Just so you know, last time I had it connected to forscan
AR79-14C025-AB was the 2nd boot loader
AR79-14C026-AH was the strategy
BR29-14C318-AA was the signal config

[JasonACT]

Ha ha! I know, right - that BR one is new... 2011, where everything else is Terry SZ numbers 2010.

[JasonACT]

Thank you Superb! That's awesome!

https://github.com/Jasoroony/Ford-Fa...n/extracted_fw

The firmware converted over perfectly - and I can see the magic number (at the end) is correct - so I've uploaded it to github. I'll be checking out the differences soon!

[JasonACT]

The question is... Does it work? Well, after fighting Forscan for a few hours (seems it doesn't necessarily like programming firmwares in devices that didn't come out of your car - I had to revert some saved config files to get firmware programming back!)... Yes, it does work:



I stuck a slightly better [glare wise] picture in there. And yeah, that Cluster is made up from spare parts from a Terry SZ, a Mk1 G6E and a Mk1 5.0 FPV... All the really good stuff ended up in my car, but I had enough nice stuff left over to make a spare MKII Cluster

[jakka351]

You might wanna slow down, that's a pretty high speed to be travelling in your lounge room.

[jakka351]

Originally Posted by JasonACT

While we wait for someone with a GTF Instrument Cluster who's willing to extract the special firmware... @Jakka - these are the "decoded" IDs that a Mk1 Cluster handles (reading the V850 document, the hardware register that deals with these is shifted 2 bits, and to be efficient, the programmers left the data that way - so you need to divide by 4 to work out the values):

image

1D7 does not appear there - I reckon it's a bogus signal when the chip is first configured, especially because it's only 7 bytes, and these things are configured to always generate 8 byte messages. Sorry mate.

Ahh, might I point out that all of these CAN ids are received by the cluster, none of these are transmitted by the cluster - the 0x128, 0x330, 0x728 IDs are TX cluster IDs, but not in this list. Another list there must be!

[JasonACT]

Yeah, I thought of that about 2 minutes after I had posted... And I checked. And I couldn't find any in the extracted firmware with either the real number, or the number multiplied by 4. And I'm not even sure your description of that is true, the cluster is a gateway, so it can transmit (some of) those in that function.

[JasonACT]

White LEDs

[JasonACT]

What may also make your head hurt (it does mine) is the FGII signal configuration doesn't contain the CAN IDs that control the dials - unless it's the GTF specific file, which transfers data through the CAN bridge. They are well hidden.

[JasonACT]

Oh, and 0x720 is there - and it "just" knows to add 8 for replies - so you won't find that one.

[gkhn]

Looks pretty cool but you don't want to get a speeding ticket so be careful..
Pew. pewpew.

Originally Posted by JasonACT

The question is... Does it work? Well, after fighting Forscan for a few hours (seems it doesn't necessarily like programming firmwares in devices that didn't come out of your car - I had to revert some saved config files to get firmware programming back!)... Yes, it does work:

image

I stuck a slightly better [glare wise] picture in there. And yeah, that Cluster is made up from spare parts from a Terry SZ, a Mk1 G6E and a Mk1 5.0 FPV... All the really good stuff ended up in my car, but I had enough nice stuff left over to make a spare MKII Cluster