FORD technical service bulletin : ICC touch screen display

[block58]

I've always wondered if there was a way to access the filesystem do some customization like changing the splash screen or creating new themes (Classic, Kinetic and Borderless are getting a bit dated) - seems like you're getting us closer to the answer. Appreciate your work and sharing it with us.

[JasonACT]

I'm yet to add a "Service Port" to the one in my car (two extra wires sticking out, one has "Tx" taped to it, so I know it's the output from the device - important to remember these are 3.3v signals too!).. The 4 other wires are the power (red/brown) and CAN BUS (yellow is +, orange is -) but that's just temporary for bench testing:



The spash screen would be easy to change, rename the Ford one and copy yours over. Themes though, well there's 930 graphic files in each theme directory - some are for non-NAV versions, some for NAV versions:



Space for one more button in the middle:



I spent most of this morning playing with the broken unit, but I think it's a lost cause now - without having access to an external mass storage device, there's just not a lot you can do with it. Kind of left me feeling deflated. There's also no MMC/SD drivers on the unit to get the SD card slot working either.

I have also been looking for SAT NAV solutions. I've found the application executable (it's a huge 20MB file) and text that's inside the file have things like "can't open maps with your current license file" or something like that. I can see 3 license files (one I showed earlier, but there's a couple more in the persist directory). This also didn't help me feel like I was getting anywhere.

Then I found this link about Jeeps, the QNX iGO Nav system they run and a guy who used the hack to get into the file system to update his maps.

https://forum.xda-developers.com/gen...t3194106/page5

Page 5 (post 41 & 44) is where it got serious. There's vague information about hacking the binary file to skip the test that the maps are for your specific unit (you still need a license file for the maps, but he can now run maps from other devices he owns). Apparently the iGO Android app uses the maps we need (but you need to jailbreak the phone to copy the files out).

I've downloaded his hacked exe file, and a newer version someone else posted, I'll see if I can find the change he made - I may be able to make the same change to the 20MB executable on the ICC. I can certainly find the text the guy used to find where to make the hack - so I'm pretty sure I've got that part covered.

I don't have a way to get the maps though, apparently they are only $30 or something, he wrote. My android phone is 8 years old and I don't have data on it anymore - and I've got no reason to upgrade (other than for this exercise).

If worst comes to worst, I'll take a copy of the V20 maps in my car and put them on the spare ICC on the bench which has V19. That will be a good test.

Merry Xmas!

[bb_zetec]

Lot of Effort there Jason to get into the nitty gritty of these things...you might be the only guy around in the country that understands how they work!!

Got me thinking though....will these ICC's spell the end of our FG's being on the road long term?

I can see that as they age more and more faults will appear and getting a good one might be hard to find...perhaps is it worth stocking a working one on the shelf a good idea now while they are at Wreckers etc.

Humidity might also play a downfall to a shelf spare too...working in electronics if spares are stored incorrectly its an almost guaranteed death sentence from corrosion and things like that.

I can see Ford being unable to re-program these things too in the future...they probably wont be able to do anything with a Falcon after 2026 or even earlier.

What is the general thought around here on these things?

[Citroënbender]

My honest opinion is that built-in touch screens are going to be increasingly problematic across the board. It’s a fast-changing tech and the lack of standardised interfaces or connectivity blight it badly.

The hope for me, is for the basic systems to be broken down and cracked so they are fully operational with a smartphone or tablet.

[JasonACT]

It's Christmas, and all mine may have come today...

Top-Left: That guy's hacked file.
Top-Mid: The other guy's unhacked file.
Top-Right: Sumitomo's 20MB file, string tracked down, code to change identified.

Bottom-Left: file compare details (what to search for and replace) - Theirs vs mine.

The screen in my car (well, it clearly wasn't today!!) has a newer firmware (and lots of FPV stuff the other SAT NAV unit doesn't have) but you can still search for the 8 bytes (you find it once only in the file) and replace what's on the left with what's on the right.

(Sorry about the large image, I've got a 40" 4K computer screen)


I used these lines to copy (and keep the old) maps over.. I cd /fs/usb0 and run the commands from there - where I've copied the bits and pieces needed:

#Delete any really old maps (never happens the first time)

rm -fr /packages/factory/navi_maps/root_dir/usr/navngo/MobileNavigator_o

#Update the NAV files keeping a copy

mv /packages/factory/navi_maps/root_dir/usr/navngo/MobileNavigator /packages/factory/navi_maps/root_dir/usr/navngo/MobileNavigator_o
cp -LR MobileNavigator /packages/factory/navi_maps/root_dir/usr/navngo

#Copy over any extra licenses (here I pick SWSA* just so I don't copy anything else and clobber any other of my good files)

cp /packages/factory/navi_maps/root_dir/usr/navngo/MobileNavigator/license/SWSA* /packages/persist/root_dir/usr/navngo/MobileNavigator/license

#Keep a copy of the original exe file, put in the hacked one

mv /packages/factory/navi/root/usr/navngo/MobileNavigator/sumitomo_sw-qnxarm-release /packages/factory/navi/root/usr/navngo/MobileNavigator/sumitomo_sw-qnxarm-release_o
cp sumitomo_sw-qnxarm-release2 /packages/factory/navi/root/usr/navngo/MobileNavigator/sumitomo_sw-qnxarm-release

Went to start up with the maps copied but before I copied the hacked exe over.
I got the following log output over and over and over, then copied the hacked exe and restarted and it all worked..

Ham: Entity "igo_starter" with pid: 917560 died
Ham: Restarted: /etfsRoot/usr/navngo/MobileNavigator/igo_starter

Lots more licenses now:



Updated maps running fine:



I've extended the two wires down to the tissue holder in my car, so I can get to them by just pulling that out next time.
I should mention you need to use the cigar lighter socket for a ground to the laptop!

Now that I've got complete backups of my 3 working units, I'm far more confident that I could recover from the blank screen problem now.
It would only be rare cases when critical files became corrupt - and it's probably just what certain companies are doing to recondition them.

Maybe I should now wrap up my two working spare units in sealed bags

Thanks guys, for your support. (And Merry Christmas again!)

[JasonACT]

I spent the time to disassemble the "media-player" file (about 6MB so not too large). I found 28 instances of "1000" and could tell 8 of them were for the mp3 file limiter, the rest were various things like book playback speed (I think that's an Apple thing) and file reading lengths.

I changed the 8 numbers to be closer to 10000 (ARM CPUs have an optimised 12bit number format in instructions so 9984 was what I came up with). When I put the stick in with 8000 files, it crashed. I put in one with 1000 files, it worked. Looking at the log, it said where in the media-player exe the problem was... When I looked it was calloc (allocate and clear memory). So it runs out of memory somewhere between 1000 and 2000 mp3 files. So sad.

Here's some files to cheer me up...

[PHATAL]

If you could provide a service for putting that GForce thingo on to standard ICC units you could make a quid.

Sent from my SM-G965F using Tapatalk

[JasonACT]

Ha ha! Yeah, that would be cool. I'm pretty sure the CAN BUS has a few extra measurement devices plugged into it throughout the car on FPVs. I've heard people getting these things to show up on standard sat-nav ICCs - but you don't get any readings.

Still, there are ways to emulate all that's required.

I'm just not sure how much space is left on the non-sat-nav ICCs (there's plenty on the sat-nav ones which have a 1GB chip ~450MB free). 128MB on the non version, and almost totally full.

[XD 351 Ute]

Originally Posted by JasonACT

Here's some files to cheer me up...

image

image

Regarding my earlier post with the memory minder while changing the vehicle battery. These are the images/ICC I don't want to die!

Ed

[JasonACT]

I should say, having used the hidden tissue box wires today, which is the first time I've tried to send in Unix commands while it's in the car... The bloody screen goes to sleep all the time even though it's showing a picture. If I wait long enough, my commands are processed, but I found it easier to switch from accessories to off to accessories to wake the screen when I've queued the commands. I only ever need to run a few commands so it's not so bad. On the bench, my Arduino microcontroller is always sending recorded commands in which wakes it - it's a bit sluggish, but fairly reliable.

I've ordered iGo Android files on a SD card from China. Apparently it's got the app and latest maps. Their instructions for updating the maps give me confidence that it's got the files I need, but they don't mention copying over a license file in the details about the files I want. Hmm, they seem to be so reputable! We shall see, I paid almost double to get it in 4-7 days. US$25 + US$20 postage. AU$67 total.

They say it's iGo 8 Primo... Sounds right to me. I may be hacking the exe again if there's no license file though. I'll post a link to their site if I can get it all working.

[nc_fairlane]

Originally Posted by JasonACT

I should say, having used the hidden tissue box wires today, which is the first time I've tried to send in Unix commands while it's in the car... The bloody screen goes to sleep all the time even though it's showing a picture. If I wait long enough, my commands are processed, but I found it easier to switch from accessories to off to accessories to wake the screen when I've queued the commands. I only ever need to run a few commands so it's not so bad. On the bench, my Arduino microcontroller is always sending recorded commands in which wakes it - it's a bit sluggish, but fairly reliable.

I've ordered iGo Android files on a SD card from China. Apparently it's got the app and latest maps. Their instructions for updating the maps give me confidence that it's got the files I need, but they don't mention copying over a license file in the details about the files I want. Hmm, they seem to be so reputable! We shall see, I paid almost double to get it in 4-7 days. US$25 + US$20 postage. AU$67 total.

They say it's iGo 8 Primo... Sounds right to me. I may be hacking the exe again if there's no license file though. I'll post a link to their site if I can get it all working.

What maps are they providing you ? Latest is 2019 Q2. I might still have a android cracked file and maps floating around if your interested mate ?

[JasonACT]

Thanks buddy! Those are the same maps they are now sending me. If they don't come with a license file, I may well contact you for just that small file... I'd prefer to not completely crack the software - they need to stay in business for me to get future updates.

US$25 (with free postage, once I'm not desperate to get them soon, to know if it'll all work) isn't really a bad price to update the FGII factory maps. They (the Chinese) also offer 3 and 5 year updates for a small extra fee - but I wanted to check out the compatibility first - no point wasting tomorrow's lunch money if it isn't going to work.

Makes you understand really, how Ford added in their service fee making them unpopular and the vendor deciding it wasn't worth their time and effort.

[happy1]

On a different note, I saw that Mr. FPV is offering SYNC2 to SYNC3 conversions on Ebay now for approx $1400 on an exchange basis for the FGX. That only works if you have SYNC2 dash wiring already in your car.

[XRPete]

Hi All,


just writing an update, since i put the second hand icc in October.

Yesterday, it hit 45c in Adelaide and had my car out in the heat for a couple hours (had no choice ).
I get in and start the car, only to see my icc screen did not turn on, once again A/C and Radio working. After about 5-10 mins of driving and the A/C on, the screen came back to life and was flickering the image rapidly for about 30 seconds, then displayed normally.

Checked again this morning (cars out in the heat - 30c today) and screen is working however, did start flickering at startup for about 10-15 seconds.

I'm just assuming at the point but heat might be a playing factor in these ICC's dying to?,

[JasonACT]

Hard to say, but heat can be a real killer. The NASA pdf on NAND flash memory specifically tested them at the extreme rating. Most of the chips in these units are rated for 80c (the exception is the USB chip which is ~20c higher). Why bother?

In terms of memory errors I'm seeing, the QLD sourced ICC has a lot of ECC errors. The VIC sourced ICC had some, but less (and they are disappearing - I assume the driver has decided to remap sectors - but that's the newer firmware). My ACT one (1/8 the flash memory size though) has heaps - and not disappearing - old firmware again.

I've been learning about QNX and how to tell what's going on under the hood, it seems the non-nav version (mine) uses about 60% of available RAM. The media-player still crashes. The output is less than the newer firmware - i.e no details. Killing the process and running it as root does give an extra message though - Memory fault (core dumped). It's not running out of memory - one of the dynamically allocated buffers is being overrun. I know this because I've extended the static buffers out to 10MB (and it still all loads - so plenty of memory available - about 110MB) so static buffers are not being exceeded.

Some of the checks I've seen in the code about reading music files say 4,999,999 is the absolute limit. But I think the programmers have added their own crap logic to the shuffle function using fixed buffers - then limited it to 1000 files. Morons. But like the hardware side, I have not given up.

There's two things I want from the ICC screen - a decent music player and good navigation.

[JasonACT]

Today I trained myself in the QNX "dumper" program which has been kindly left on the ICC unit for me to use. With it, you can dump the memory of running programs and set it up to produce a core dump for failing programs. I got to compare the working media-player executable against my hacked one, which showed me how close I was to getting it working the other day

There are 7 large static buffers (all a multiple of 1000) of which I could directly see 4 of them being used when reading the music files. I had already enlarged them to be 10 times the size (making them support 10000 files instead of 1000). I had forgotten to make one extra change though - which I could see in the dumps, nice.

One of the buffers I changed is 1025000 bytes (about 1MB) and I had to relocate it (so there's 1MB wasted) and the exe takes up about 10MB extra RAM now.

It takes about 5 minutes to "load music files from USB".. No crashing, but sheesh, I didn't think it was working. Takes about the same time to get into the folder with lots of files too. The one with 1000 files wasn't so bad. I have two folders on my stick so I can move them around when I notice it replay the first song. I'm pretty sure that's a thing of the past now because the shuffle is now playing everything.

I hacked both the old firmware file (media-player) and the new one (I'm not sure I want to start hacking parts of the new firmware into the older units just at the moment). It also means I can post the difference and which ever file someone has, they can check the left bytes and if they match, change them to the right bytes

Old Firmware

000000A8: 2C B0
000000A9: A1 FB
000000AA: 10 B2
0001C284: FA 27
0001C285: 0F 0C
0001C2A8: FA 27
0001C2A9: 4F 4C
000275F8: FA 27
000275F9: 0F 0C
000277F8: FA 27
000277F9: CF CC
00027814: FA 27
00027815: 8F 8C
0002C62C: D8 00
0002C62D: 19 E8
0002C62E: 2A CB
0002C638: 98 80
0002C639: FA AF
0002C63A: 29 CA
000321E8: 98 80
000321E9: FA AF
000321EA: 29 CA
000321EC: AC 70
000321ED: 56 48
000321EE: 1A 2E
000321F0: E8 90
000321F1: A3 9F
000321F2: 0F 9D
0003221C: D8 00
0003221D: 19 E8
0003221E: 2A CB
00034A60: 40 C0
00034A61: AB 29
00034A62: 19 2A
00036F8C: 98 80
00036F8D: FA AF
00036F8E: 29 CA
00036F90: D8 00
00036F91: 19 E8
00036F92: 2A CB
0003B050: F4 04
0003B051: BA C6
0003B052: 19 2A
0003B124: F0 00
0003B125: BA C6
0003B126: 19 2A
0003B54C: FA 27
0003B54D: 0F 0C
0003C358: FA 27
0003C359: 4F 4C
0003C810: F4 04
0003C811: BA C6
0003C812: 19 2A
0003CB9C: FA 27
0003CB9D: 0F 0C
00054774: A0 00
00054775: 2C 37
00054776: 1A 2D
00069530: 70 20
00069531: 3E 85
00069532: 1A 2D
00081FBD: 31 39
00081FBE: 30 39
00081FBF: 30 38
00081FC0: 30 34
000995C4: A4 28
000995C5: 8C E7
000995C6: 10 B2

New Firmware

000000A8: 3C C0
000000A9: A1 FB
000000AA: 10 B2
0001C7CC: FA 27
0001C7CD: 0F 0C
0001C7E8: FA 27
0001C7E9: 4F 4C
00027F54: FA 27
00027F55: 0F 0C
00028154: FA 27
00028155: CF CC
00028170: FA 27
00028171: 8F 8C
0002CF88: 80 A8
0002CF89: 5B 29
0002CF8A: 2A CC
0002CF94: 40 28
0002CF95: 3C F1
0002CF96: 2A CA
00032B60: 40 28
00032B61: 3C F1
00032B62: 2A CA
00032B64: 54 18
00032B65: 98 8A
00032B66: 1A 2E
00032B68: E8 90
00032B69: A3 9F
00032B6A: 0F 9D
00032B94: 80 A8
00032B95: 5B 29
00032B96: 2A CC
000353DC: E8 68
000353DD: EC 6B
000353DE: 19 2A
000378FC: 40 28
000378FD: 3C F1
000378FE: 2A CA
00037900: 80 A8
00037901: 5B 29
00037902: 2A CC
0003B9C0: 9C AC
0003B9C1: FC 07
0003B9C2: 19 2B
0003BA94: 98 A8
0003BA95: FC 07
0003BA96: 19 2B
0003BEBC: FA 27
0003BEBD: 0F 0C
0003CCC8: FA 27
0003CCC9: 4F 4C
0003D180: 9C AC
0003D181: FC 07
0003D182: 19 2B
0003D50C: FA 27
0003D50D: 0F 0C
000558E8: 48 A8
000558E9: 6E 78
000558EA: 1A 2D
0006BEBC: 18 C8
0006BEBD: 80 C6
0006BEBE: 1A 2D
00084CDD: 31 39
00084CDE: 30 39
00084CDF: 30 38
00084CE0: 30 34
0009D76C: A4 28
0009D76D: 8C E7
0009D76E: 10 B2







You've never seen so many files in that middle picture!!

[Citroënbender]

You do have eclectic tastes in music!

Sounds like today was a big fat win with the files.

[JasonACT]

Dyslexics untie! The flies were not too bad today.

In all seriousness though, I do recall these ICC units do not save settings unless you change them with the ignition on. That means, you come to a halt and park the car listening to music with the engine off.. You're done and switch off the radio.. You come back to the car some time later and start it - and the radio turns on! I thought the unit was broken when I bought it, but I did that quite a few times and eventually realised something else was going on.

Now tonight, I went back to the car to see if everything was still good... But I didn't have the ignition on when I was using it earlier... So it forgot that I had selected shuffle (which doesn't matter - those numbers on the front of the filenames are my own randomisation - I don't need shuffle). But it also wanted to "check" before starting to play the last "ignition on" song before I selected shuffle, that the USB device was in fact the same one - it took 2 minutes!!!!!

I'll keep an eye on it, if it starts up straight away tomorrow morning I'm good with what I've done - and I can always cull files if it's bad and I get annoyed.

I envisage a Ford executive sticking their USB stick in the 2011 model and saying to SWSA, what gives?, we can't sell these things if they don't start playing straight away!! SWSA says, Oh yeah, right, we'll fix that right away. Ford guy comes back and tests it - says - good work fellas!

[JasonACT]

Just tried again now (an hour later - car fast asleep)... Didn't need to rescan, started playing right away - same song I left it on.

I'm good, even if it happens ever so often.

[JasonACT]

Had a look at a few things today...

I've been trying to work out how the first partition is set up on these things, there's a QNX utility (etfsctl) which is meant to be able to dump raw and etfs filesystems. I've used it to back-up the 2nd file system on all 3 of my working devices (the filesystem I can write to, with all the Ford packages) but it just won't read the 1st partition - says "Error status on option 'R': Invalid argument".

I disassembled the utility, checked out what it was doing (in case SWSA had bodged it up) but it all seems like it should work. Not much on the Internet either.

I went back to the broken board, researching how I can get files into it somehow, maybe with the bluetooth serial port (now that the chip is gone). I didn't get far, I'll need to work out how to kill the master-control that keeps restarting things when they die. Then work out how to receive a certain number of bytes and close the file - seems like a tall order.

I did start to look at some of the symbols that were corrupt on the unit - turns out the corruption was in the qnx libraries (file: libph.so.3) which is one of the larger ones being 1MB in size. Only the ACM and media-player load it - so my issue with the USB not mounting isn't that (I don't think).

There's quite a lot of USB utilities on this device, and I think I've run them all on both the working unit and the broken one. There doesn't seem to be much difference. The control registers of the chip I replaced are being read back as exactly the same (vendor/model/setup) so I assume it's good. One thing though, it says device disabled (one of the registers I can read) but it all comes good when I pull out the usb stick and plug it back again - everything says the same then - but no mounted filesystem and no hd0 device available to do so.

Ok, getting nowhere, I looked at the stupid nav screen on startup.. Press "Accept" to continue. I found the zip file with a file with the text - I removed it... Still got the dialog but with the message "Error loading file: i18n/drive_carefully.xhtml"! Damn, wouldn't it be nice for it to just say, it's not there, I don't need to show this dialog? I may keep looking into this - but I don't want to break pop-ups before I get the new maps.

On to the FPV dials. There's a small FPV exe that runs, seems to take care of the car-status messages and moving graphics. But, there's a really large package (hmi ~ 80MB) that has all the pointers to the graphics files that need to be accessed. This thing seems to take care of all the themes too, and USB updating, and others. The non-sat-nav units have about 2.5MB free on the flash memory - so I don't think there's any chance to get FPV dials working now. I'm also hesitant to try and move this huge package onto the sat-nav unit with the old firmware. Hmm.

Back to the 1st partition again, really drilling down into things now.. There's a "core-pkg" that has everything to rebuild this, including another app called "nandWrite". I can see the scripts that do it (and comments from the author - "replace the running NAND driver while in the middle of an update -- scary!!!" - thanks for that SWSA).

I ran that program in reverse (there's a couple of commands when programming the flash to unlock partition 1 and relock it at the end - so I wasn't so scared I would do any harm). It only reads in blocks (so it will pad files which are less than a block with a given character if needed - but I was reading from the flash block device - so I didn't need that). I didn't specify the verify option either, I just want to throw away the extra ECC bytes on the flash. And, wow, I got 4 files out of the flash at partition 1 using the 4 commands in reverse from the update script.

So, it puts the boot program in at position 0 (and the flash chips are meant to be guaranteed to be good on that sector). It then puts 3 copies of the boot file system in 3 locations further along (I assume the boot loader will do a checksum and move on to the next if it fails to load). So that's good news, with the boot partition, there's lots of redundancy.

And what I got (other than being slightly longer than the 2 files in the package on partition 2) was an exact match on the boot sector file and boot filesystem.

I'd give these units a really good chance of being able to be rebuilt (if you've got the files to do so - and the USB hardware hasn't died on you).

[PHATAL]

Awesome work mate. I find this super interesting.

Sent from my SM-G965F using Tapatalk

[JasonACT]

Some day someone may want to know the commands that I reckon work:

Save partition 1 bits (4 of them) to the USB stick:

mount -uw /dev/hd0
mount -uw /fs/usb0
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/iplspl0.bin obs=2048 skip=0 count=4

#Sizes: 1619 for old firmware (mine - late 2012), 1620 for intermediate firmware (the QLD sat-nav unit which is 3 months younger than mine), 1630 for newest firmware from 2014
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core0.ifs obs=2048 skip=512 count=1620
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core1.ifs obs=2048 skip=3072 count=1620
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core2.ifs obs=2048 skip=5632 count=1620

You need to know the size [number of blocks] - or just pick 1630 to make sure you get all the data. The numbers are calculated by the original source size / 2048 and rounded up.

If I were to want to copy one of the good files into, say, the third position (including unlock and re-lock commands):

/packages/factory/core-pkg/send2 -t /dev/etfs1 9:108 3,4
/packages/factory/core-pkg/nandWrite -n=64 if=/fs/usb0/core0.ifs ibs=2048 of=/dev/etfs1 obs=2112 vbs=2112 pad=0xff seek=5632
/packages/factory/core-pkg/send2 -t /dev/etfs1 9:108 1,4

[Charliewool]

Originally Posted by JasonACT

Some day someone may want to know the commands that I reckon work:

Save partition 1 bits (4 of them) to the USB stick:

mount -uw /dev/hd0
mount -uw /fs/usb0
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/iplspl0.bin obs=2048 skip=0 count=4

#Sizes: 1619 for old firmware (mine - late 2012), 1620 for intermediate firmware (the QLD sat-nav unit which is 3 months younger than mine), 1630 for newest firmware from 2014
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core0.ifs obs=2048 skip=512 count=1620
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core1.ifs obs=2048 skip=3072 count=1620
/packages/factory/core-pkg/nandWrite -n=64 if=/dev/etfs1 ibs=2112 of=/fs/usb0/core2.ifs obs=2048 skip=5632 count=1620

You need to know the size [number of blocks] - or just pick 1630 to make sure you get all the data. The numbers are calculated by the original source size / 2048 and rounded up.

If I were to want to copy one of the good files into, say, the third position (including unlock and re-lock commands):

/packages/factory/core-pkg/send2 -t /dev/etfs1 9:108 3,4
/packages/factory/core-pkg/nandWrite -n=64 if=/fs/usb0/core0.ifs ibs=2048 of=/dev/etfs1 obs=2112 vbs=2112 pad=0xff seek=5632
/packages/factory/core-pkg/send2 -t /dev/etfs1 9:108 1,4

Geesh... I need a BEX and a good lie down!

[Citroënbender]

Originally Posted by Charliewool

Geesh... I need a BEX and a good lie down!

Don’t read the “torque wrench extension thread” then!

[raceteam]

Originally Posted by Citroënbender

Don’t read the “torque wrench extension thread” then!

There’s some questionable mathematics going on there

[JasonACT]

How To: Removing the "Drive Carefully" message from the ICC unit's Sat-Nav:

Download the iGoLua.zip from this guy's website (links are near the bottom)

https://sites.google.com/site/tweakr...s/igo-from-nng

Having made a backup of your files, like someone who looks after their car with pride, you will find a data.zip file in /packages/factory/navi/root/usr/navngo/MobileNavigator

Extract from the data.zip archive data.zip\ui_sumitomo\common\ui\general.lua
Decompile it with the iGoLua tool
Edit the resulting general.luad text file and add "sc_accept_drive_carefully()" as shown (somewhere in the middle of the text file):

sc_drive_carefully_init = function()
sc_drive_carefully_show()
KEY("RETURN")
KEY("REC")
KEY("UP")
KEY("DOWN")
sc_accept_drive_carefully()
end


Use the iGoLua decompiler/compiler to recompile the text version to a .lua file
delete the original general.lua file from where you are working so you can..
rename 2_general.lua to general.lua
copy data.zip to data2.zip (save the old data.zip and mod the data2.zip one)
Open data2.zip in WinRAR 3.30 (research suggests you need an old version not 4! Not WinZip and not 7zip - they all failed)
Navigate to data2.zip\ui_sumitomo\common\ui
Copy the new general.lua over the old one (drag and drop - accept the change)

run these commands on the ICC when the usb stick has the data2.zip file on it:

cd /fs/usb0
mv /packages/factory/navi/root/usr/navngo/MobileNavigator/data.zip /packages/factory/navi/root/usr/navngo/MobileNavigator/data_o.zip
cp data2.zip /packages/factory/navi/root/usr/navngo/MobileNavigator/data.zip
shutdown


I'm bloody happy with that!

[Citroënbender]

Now you’re into territory where there’s potential for real mischief (replacing the Drive Carefully message).

[PHATAL]

Legend

Sent from my SM-G965F using Tapatalk

[JasonACT]

How To: Disassemble the FGII ICC Screen (FDIM):

Thought it would be good to do this properly, including photos.

There are 4 screws to undo from the front (2 each side, top and bottom)



There are 2 large screws on the back



At the point that the screen is separated later, you need to remember to unhook the metal bracket from the plastic screw holes



There are 4 clips (2 on the top, 2 on the bottom) holding the case together



With each unhooked, the case comes apart (and so do the boards)



This is where the metal bracket needs to be taken off (remember the screw holes mentioned above). Stick a very small screwdriver where shown to unclip the metal bracket and use pliers to shift it down as shown. There's also one other clip which isn't hard to undo (this is the hardest one)



The bracket then comes off



Unplug the backlight cable. Using the small screwdriver again, unhook the metal latch for the touchscreen cable



Then the brown latch can be moved out



And the cable removed



There are two more latches holding the screen plastic onto the main board's case, one on the top and one on the bottom



Then you can separate the units. Note, this is the first time a small metal protector has come loose - I'll show how it fits back on the last photo - ready for re-assembly



It is easy to remove the LCD cable from the LCD screen side, but I've never been able to unhook it from the main-board side. You don't really need to unplug that one though. Just flip the main-board over and remove the 4 corner screws



Using a larger screwdriver, unhook the main-board from the case and use another screwdriver to pop the board out



The USB plug does get stuck in the case, but it does pop out with a bit of fiddling



Flip the board over again and it's ready to add "service" wires that can be made to stick out of the unit through the same hole as the master plug



Here's where the piece of metal goes, note that it's different on each end. The end with the extra tab goes on the LCD screen side, not the touchscreen side

[JasonACT]

I looked at the FPV dials executable today, but it's really integrated into the latest firmware. I don't know why, it's a simple enough thing, but that's life.

I did think up some ideas though. I know there's 5 serial ports on the main CPU of which I'm almost certain only 4 are being used (1=master console, 2=bluetooth, 3=smaller board, 5=GPS). If "ser4" can be configured, and I can find the location on the main-board for it (Rx is only needed, for my idea) then a new micro-controller can talk to the screen.

I would need a connection to the high speed CAN-BUS of the car, the micro-controller could read out all the things I'm interested in and pass them to a new program on the main-board. I would model the program after the touch-screen calibration program, it outputs graphics and takes input from the touch-screen. It's only small too (I'd be hacking away all the existing code and adding in mine).

I'm not sure about how to go about getting touch-screen data (I can see the graphics library functions being used, but there doesn't seem to be any details about the touch-screen). So, I'm thinking, the program runs in the background via a start-up script (which I think I can do easily enough). A push button on the micro-controller tells the new program through the serial 4 port to "create a new screen" (this is how the NAV software works). The new screen takes over the display (like the NAV does) and would output graphics to show stuff. Then, press the bushbutton again and it all disapears - like switching off the NAV software.

I know the NAV software can be switched back and forth between the main screen with the bottom touch-buttons - but I don't think I'll be able to get that sort of integration.

Anyway, it's something to aim for.