FORD technical service bulletin : ICC touch screen display

[JasonACT]

So.. Moving on..

I decided to run a brute force over the FG (I) EEPROM to check out if it's the same algorithm to protect the data areas (I don't have the firmware, it [the filename] is not divulged like it is with the FG2 unit)... Yep, same algorithm.

Plain dump:

0x000 00 00 75 00 00 00 d6 dc ad b9 5b 73 b6 e6 6d cd ..u...ÖÜ*.[s¶æmÍ
0x010 db 9a b7 35 6e 6b dc d7 b9 af 73 5f e6 be cd 7d Ûš·5nkÜ×.¯s_æ.Í}
0x020 9a fb 35 f7 6b ee 1e c4 36 46 50 41 41 41 4a 47 šû5÷kî.Ä6FPAAAJG
0x030 53 57 38 41 35 31 31 30 38 ff 1e c4 36 46 50 41 SW8A51108ÿ.Ä6FPA
0x040 41 41 4a 47 53 57 38 41 35 31 31 30 38 ff d3 73 AAJGSW8A51108ÿÓs
0x050 cf 66 93 33 ff ff 10 10 10 10 10 10 10 20 20 20 Ïf“3ÿÿ.......___
0x060 10 00 10 10 10 10 10 10 10 10 00 10 10 10 10 20 ..............._
0x070 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00 ____._____..€.ÿ.
0x080 0f 5a ff 0f 1f 02 06 06 0a 00 56 97 19 01 08 c0 .Zÿ.......V—...À
0x090 50 36 ff ff 80 22 10 3c 06 00 38 52 32 39 ca 72 P6ÿÿ€".<..8R29Êr
0x0A0 1f 32 74 61 85 03 26 03 eb 02 a8 02 39 02 f9 01 .2ta..&.ë.¨.9.ù.
0x0B0 16 01 b6 00 7e 00 62 00 00 00 a0 0f 5e 1a 1c 25 ..¶.~.b...*.^..%
0x0C0 98 3a 50 46 c0 5d 78 69 30 75 f4 7e 11 00 94 70 ˜:PFÀ]xi0uô~..”p
0x0D0 00 00 a0 0f 40 1f e0 2e 80 3e 20 4e c0 5d 60 6d ..*.@.à.€>_NÀ]`m
0x0E0 00 00 65 02 0b 05 6b 07 cf 09 34 0c 98 0e fd 10 ..e...k.Ï.4.˜.ý.
0x0F0 02 00 84 71 00 00 00 14 00 1e 00 28 00 32 00 37 ...q.......(.2.7
0x100 00 46 00 82 00 00 00 15 00 1f 00 29 00 33 00 38 .F.........).3.8
0x110 00 47 00 83 00 00 59 03 06 05 b2 06 5f 08 35 09 .G.ƒ..Y....._.5.
0x120 b8 0b be 10 6b 13 04 00 28 4f 20 03 ab 03 c1 04 ¸...k...(O_.«.Á.
0x130 14 05 c8 05 ed 05 36 06 5e 06 00 00 0c 01 24 03 ..È.í.6.^.....$.
0x140 c4 03 2f 04 3b 05 53 07 5f 08 1e 00 47 c3 00 00 Ä./.;.S._...GÃ..
0x150 1e 01 e2 01 a7 02 2f 04 06 05 b2 06 89 07 5f 08 ..â.§./......._.
0x160 b8 08 c4 09 10 27 c4 09 f4 01 70 17 94 11 27 08 ¸.Ä..'Ä.ô.p.”.'.
0x170 0c 00 05 00 cf 03 0b 0b 0b 0b e4 cc 32 00 64 00 ....Ï.....äÌ2.d.
0x180 0a 00 00 00 2f 04 5f 08 00 00 70 00 e0 00 a0 05 ..../._...p.à.*.
0x190 c0 08 e0 0b 00 00 20 03 40 06 e8 cc 14 36 5e 80 À.à..._.@.èÌ.6^€
0x1A0 26 6e ba ff 80 a8 d6 ff 03 08 12 1a 80 a8 d6 ff &nºÿ€¨Öÿ....€¨Öÿ
0x1B0 00 08 12 1a 66 96 cf ff 66 96 cf ff 5e 01 7f 00 ....f–Ïÿf–Ïÿ^...
0x1C0 39 00 90 a7 c0 c7 c7 c7 c2 c2 c2 c2 f5 d1 00 00 9..§ÀÇÇÇÂÂÂÂõÑ..
0x1D0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1E0 00 00 21 12 00 01 95 2c ff 14 06 07 00 14 46 64 ..!....,ÿ.....Fd
0x1F0 ff 12 00 02 80 41 46 32 30 cf 20 46 00 00 00 00 ÿ...€AF20Ï_F....


Breakdown - where a length is shown [in hex], the next 2 bytes are a checksum:


0x000 ____ 00 00 75 00 00 00 d6 dc ad b9 5b 73 b6 e6 6d cd db 9a b7 35 6e 6b dc d7 b9 af 73 5f e6 be cd 7d 9a fb 35 f7 6b ee
0x026 (14) 1e c4 6FPAAAJGSW8A51108
0x03A (14) 1e c4 6FPAAAJGSW8A51108
0x04E (08) d3 73 cf 66 93 33 ff ff
0x056 ____ 10 10 10 10 10 10 10 20 20 20
0x060 ____ 10 00 10 10 10 10 10 10 10 10 00 10 10 10 10 20
0x070 ____ 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00
0x080 (08) 0f 5a ff 0f 1f 02 06 06
0x088 ____ 0a 00 56 97 19 01 08 c0
0x090 ____ 50 36 ff ff 80 22 10 3c 06 00 38 52 32 39 ca 72
0x0A0 ____ 1f 32 74 61 85 03 26 03 eb 02 a8 02 39 02 f9 01
0x0B0 ____ 16 01 b6 00 7e 00 62 00 00 00 a0 0f 5e 1a 1c 25
0x0C0 ____ 98 3a 50 46 c0 5d 78 69 30 75 f4 7e 11 00
0x0CE (24) 94 70 00 00 a0 0f 40 1f e0 2e 80 3e 20 4e c0 5d 60 6d 00 00 65 02 0b 05 6b 07 cf 09 34 0c 98 0e fd 10 02 00
0x0F2 (36) 84 71 00 00 00 14 00 1e 00 28 00 32 00 37 00 46 00 82 00 00 00 15 00 1f 00 29 00 33 00 38 00 47 00 83 00 00 59 03 06 05 b2 06 5f 08 35 09 b8 0b be 10 6b 13 04 00
0x128 (24) 28 4f 20 03 ab 03 c1 04 14 05 c8 05 ed 05 36 06 5e 06 00 00 0c 01 24 03 c4 03 2f 04 3b 05 53 07 5f 08 1e 00
0x14C (2E) 47 c3 00 00 1e 01 e2 01 a7 02 2f 04 06 05 b2 06 89 07 5f 08 b8 08 c4 09 10 27 c4 09 f4 01 70 17 94 11 27 08 0c 00 05 00 cf 03 0b 0b 0b 0b
0x17A (20) e4 cc 32 00 64 00 0a 00 00 00 2f 04 5f 08 00 00 70 00 e0 00 a0 05 c0 08 e0 0b 00 00 20 03 40 06
0x19A (26) e8 cc 14 36 5e 80 26 6e ba ff 80 a8 d6 ff 03 08 12 1a 80 a8 d6 ff 00 08 12 1a 66 96 cf ff 66 96 cf ff 5e 01 7f 00
0x1C0 (0C) 39 00 90 a7 c0 c7 c7 c7 c2 c2 c2 c2
0x1CC (16) f5 d1 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1E2 (04) 21 12 00 01
0x1E6 (12) 95 2c ff 14 06 07 00 14 46 64 ff 12
0x1F2 ____ 00 02 80 41 46 32 30 cf
0x1FA (06) 20 46 00 00 00 00


I can see the same tacho and speedo maps:


0x0CE
=====
00 00 = 00000 = 0
a0 0f = 04000 = 1000
40 1f = 08000 = 2000
e0 2e = 12000 = 3000
80 3e = 16000 = 4000
20 4e = 20000 = 5000
c0 5d = 24000 = 6000
60 6d = 28000 = 7000

00 00 = 0000
65 02 = 0613
0b 05 = 1291
6b 07 = 1899
cf 09 = 2511
34 0c = 3124
98 0e = 3736
fd 10 = 4349

02 00 ?

0x0F2
=====
00 00 = 000 (000)
00 14 = 020 (040)
00 1e = 030 (060)
00 28 = 040 (080)
00 32 = 050 (100)
00 37 = 055 (110)
00 46 = 070 (140)
00 82 = 130 (260)

00 00 = 000
00 15 = 042
00 1f = 062
00 29 = 082
00 33 = 102
00 38 = 112
00 47 = 142
00 83 = 262

00 00 = 0000
59 03 = 0857
06 05 = 1286
b2 06 = 1714
5f 08 = 2143
35 09 = 2357
b8 0b = 3000
be 10 = 4286

6b 13
04 00


So nothing especially different between the FG2 and FG, except for the CCC.