FORD technical service bulletin : ICC touch screen display

[jakka351]

Originally Posted by JasonACT

The i.MX31 can boot from USB, Serial, SD and Flash but the circuit board is hardwired for Flash boot. Also, due to the hardware bug in the USB peripheral and the way the software driver on the unit is written, where it turns off USB when sleeping, I don't think it would work without a lot of re-engineering.

SD boot is a possibility, but it would require a lot of work also, you'd need to rebuild the initial file system (the read-only one) so it included the SD driver. I don't have the boot sector either, that would load the IFS, so there is a lot missing and not much chance of getting support for a chip more than 15 years old now.

So....into the bin with it. and replace with raspberry pi. I wonder if the fascia of Mk2 will take the foundation screen as well as the mk1 fascia.

[JasonACT]

Originally Posted by jakka351

So....into the bin with it

Not exactly, the Terry unit I have (my test unit) has a Flash memory chip that "doesn't last long" when refreshed with the full package... But there's enough good space to load the SD driver into - and then put softlinks pointing to SD on it.

I almost never see it have issues now that the main partition is so empty.

[JasonACT]

I'm going to post Q&A stuff that I get asked (not in the thread) if it's relevant...

Quick question, I'm about to change battery in 2012 fg xr6 non nav and ****ting about black screen. Would your icc recore on usb be used before I go ahead to save/fix a copy, or used after if I had problems? screen works perfectly at the moment.

Doesn't matter at this point - either before or after. Point being, either way, you will only get the files as they are currently (perfect or corrupt) and if the system is somehow worse off than my software can repair, then you will need to seek help from elsewhere (dealers etc. can attempt to re-install everything, then run the repair with what's in my repo - for example).

It's a slightly different story though, had my software been around for years... You could have had a perfect backup (back when) and once a year run the test... Any small corruptions would have been fixed, and a reboot would correct any other detected issues.

Edit: thinking about it, doing it before disconnecting the battery will tell you if there are corruptions - by reviewing the repair.log on USB in Notepad++. If there are, might be worth going out and buying a battery saver device to change the battery? Just a thought.

[jakka351]

A prophecy in plastic....

[JasonACT]

Seems I've better documented stuff here than in my own FG2 area on my C:\

I came back here today to get the hex signatures needed to remove the navigation license check, thinking there's maybe one more "repair" recore program to fix "broken by bad Ford vs Sumitomo relationship stuff" while backing up existing programs & maps and copying/replacing existing ones with any new ones that somehow get put on a USB stick in root.

New ones (2022/Q2) are due in 3 months... Kelly watch the stars.

[JasonACT]

*** Warning *** This is Alpha level software and may not work. Has not been tested on anything earlier than 2013 firmware.

Instructions:

Extract the archive to an empty FAT32 USB stick.. (Preferably one with a blinky LED)
Insert the USB stick into the FG2 and wait a bit..
Running "Recore" via FG2ICCComms.exe will make a backup of navi [old]content folders, but do nothing else.

Putting a new file in the USB stick's root directory (.fbl/.fda/.poi/.spc) and runnign Recore will...

1. Check the navi executable to see if it's compatible, or if it's already been "fixed"
2. Stop the navigation software
3. Fix the executable if it's compatible, and alter the manifest file(s) to match (or remove the map checks)
4. Backup existing files to the USB "oldcontent" directory
5. Delete any matching map content for the file prefix/suffix it sees in the USB's root
6. Install new map content that was detected in the USB root
7. Reset the unit if needed

File prefixes that are detected are:

Australia..
Basemap..
New_Zealand..
NewZealand..

File suffixes that are detected are: .fbl/.fda/.poi/.spc

E.G. Putting a file called "Australia_Map2022Q2.fbl" in the USB root and pressing Recore will..

1. Fix the navi executable
2. Backup all existing files
3. Remove all Australia*.fbl & ..fda files
4. Install the new Aussie .fbl / .fda in the correct place
5. Reboot.

Basemap & New Zealand files will not be touched, in this example.

The last Basemap I've seen is from 2017, which is at least 2 years newer than the last maps on an FG2.

Seems older map files had fbl & fda, but newer ones now only have fbl files.

Do not rename your map files, the filename is part of its checksum. Oh, and filenames with spaces in them are ignored.

The USB root is used as a work-area (more reliable than the FLASH on these units) and will have old/new versions
of any files that were processed during this exercise. Keep them! This is Alpha software after all!

Attached is a .zip file renamed to .txt so it can be attached...

Last reminder... Beware alpha software! Post your log file if you have any issues.

[jakka351]

I think there's an engineer around who might be able to test this out.

[gkhn]

Wish mine was Mk2.
I would try this till I break my working ICC

[jakka351]

MONOCHROME FDIM FTW

[JasonACT]

Originally Posted by jakka351

I think there's an engineer around who might be able to test this out.

This unit does not have navigation.

Got to be careful, when running a Ford recore. Save the navi license file, otherwise it won't re-install.

He would have to use a customer's unit - or alter the EEPROM's serial number and copy over someone else's license - to get his working again.

Hence, I'm posting this without any third party testing. I've done the best testing I can though and have now recovered my unit from earlier attempts, using this. Happy days.

[aussiblue]

I've deleted up a bunch of old messages now, from a guy who never got back to me after pestering me to help extract firmwares from clusters. Saw he was over in the forscan forum asking about PATS too. Meh.

Forscan's Russian software isn't it? I should probably stop mentioning it now.

Yes; Russian not Ukrainian and per this thread: https://fordforums.com.au/showthread.php?t=11493645 and the advice on their website it means

What's new in FORScan

March 04, 2022 - Suspending Extended License sales

Due to sanctions against Russian banks and unability [SIC] to transfer funds, we have to suspend selling Extended Licenses.

I guess if tensions don't ease they may even close the site to Westerners or worse, if they are offside with the west, seeding malicious code in it. Still better to be here without Forscan than in the Ukraine.

The man Alex Savin is an Android developer that has been active since 2015 and has one app (FORScan Lite) in Google Play. FORScan Lite is listed in the category "Tools". It is highly ranked in several countries, and is also one of the more popular apps in Google Play with more than 100 thousand installs. He resides at 26-36 Kartashova str, Tomsk, Russia, 634041 At least some of his townsfolk were protesting against the war https://www.youtube.com/watch?v=zZHlOsvJcKw

[jakka351]

Speaking of engineers. Maybe this will peak the curiosity of someone.

Timestamp: 1648628178.733230 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628178.743027 ID: 0728 S DLC: 8 03 fa 03 00 00 00 00 00 Channel: can0
Timestamp: 1648628182.945849 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628186.239956 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628186.243035 ID: 0728 S DLC: 8 03 fa 03 00 00 00 00 00 Channel: can0
Timestamp: 1648628194.455588 ID: 0720 S DLC: 8 05 ba 03 02 00 01 00 00 Channel: can0
Timestamp: 1648628196.860470 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628198.446991 ID: 0720 S DLC: 8 05 ba 03 02 00 01 00 00 Channel: can0
Timestamp: 1648628210.883744 ID: 0720 S DLC: 8 05 ba 03 01 00 02 00 00 Channel: can0
Timestamp: 1648628216.339628 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628223.288610 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628224.712198 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628225.636848 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628225.646077 ID: 0728 S DLC: 8 05 fa 03 00 c0 05 00 00 Channel: can0
Timestamp: 1648628230.291607 ID: 0720 S DLC: 8 05 ba 03 01 00 04 00 00 Channel: can0
Timestamp: 1648628230.294599 ID: 0728 S DLC: 8 06 fa 03 00 c0 00 14 00 Channel: can0
Timestamp: 1648628234.102727 ID: 0720 S DLC: 8 05 ba 03 01 00 05 00 00 Channel: can0
Timestamp: 1648628234.109261l ID: 0728 S DLC: 8 07 fa 03 00 c0 00 14 c1 Channel: can0
Timestamp: 1648628273.209271 ID: 0720 S DLC: 8 05 ba 03 03 00 05 00 00 Channel: can0
Timestamp: 1648628273.215067 ID: 0728 S DLC: 8 07 fa 03 20 20 20 20 20 Channel: can0

Exploring around in the Supplier Diagnostic Session, gUyZ i FoUnD sOmeThInG

5 Locations of something, called with Service 0xBA routine 0x0301, the 0x01 signifies to read one byte the location 0x0001, you get a positive response changing this byte(Byte 3 of the can frame, from zero) setting this to 0x01-0x04, as the response in a single frame can fit a maximum of 4 bytes of data when you remove the length carrier, service, subservice.

location 0x0001-0x0005 return a positive response when called with BA0301.

Ie can message 720#05BA0301000100 recieves positive response 728#05FA0301xxxxxxxx

[JasonACT]

Nah, not me, sorry jakka351 - I'm off to bed...


FG Mk1 - Elevated Security Access Functions

BA0101AAAA Read EEPROM@AAAA 1 byte
BA0102AAAA Read EEPROM@AAAA 2 bytes (bytes are swapped)
BA0201AAAAVV Write EEPROM@AAAA 1 byte VV
BA0202AAAAVVVV Write EEPROM@AAAA 2 bytes VVVV (bytes are swapped)
BA03AAAALL Read RAM@AAAA LL bytes (0-5) [don't use 0!]
BA0401AAAAVV Write RAM@AAAA 1 byte VV
BA0402AAAAVVVV Write RAM@AAAA 2 bytes VVVV (bytes are swapped)
BA05 Read FLASH@3A85 5 bytes (4B01060002 - Boot Loader Version???)
BA06 Read RAM@122A,1228,1229,122C,122B 5 bytes
BA07XXXXXXXXXX Write RAM@1222 5 bytes (order: 2,0,1,4,5,3) & set a flag?
BA08 Run 2 functions? (they appear to be non-trivial!)
BA0901 Read RAM@0136 (4 bytes)
BA0902 Read RAM@013A (4 bytes)
BA0903 Read RAM@013E (4 bytes)
BA0904 Read RAM@0142 (4 bytes)
BA0905 Read RAM@0146 (4 bytes)
BA0906 Read RAM@014A (2 bytes) and incl. 0001 (RAM@1981&0x07) or 0000 (secure mode?)
BA0A01 \_ Seems to muck around with
BA0A02 / the GPIO pin states - only 2 options though!
BA0B01 \_ Seems to return bit status
BA0B02 / for many of the GPIO pins
BA0CXXXXXX Returns a byte, depending on which bit is set in XXXXXX (mask FFFF80)
BA0D Returns 0 or 1 depending on RAM@0234,0230
BA0E Reads RAM@1A52 1 byte
BA0F01 Reads 2 bytes by calling 2 functions
BA0F02 Reads 2 bytes by calling only the first of those 2 functions
BA1001 Calls a function with 1 \_ Returns 2 bytes
BA1002 Calls a function with 0 / No idea what they're doing though
BA1101 \_ If bits in RAM@1981 are 0 (in secure mode?) else return condition not correct
BA1102 / 1 runs 7 functions, 2 runs only the first.

[jakka351]

BA08 Run 2 functions? (they appear to be non-trivial!)
BA0901 Read RAM@0136 (4 bytes)
BA0902 Read RAM@013A (4 bytes)
BA0903 Read RAM@013E (4 bytes)
BA0904 Read RAM@0142 (4 bytes)
BA0905 Read RAM@0146 (4 bytes)
BA0906 Read RAM@014A (2 bytes) and incl. 0001 (RAM@1981&0x07) or 0000 (secure mode?)
BA0A01 \_ Seems to muck around with
BA0A02 / the GPIO pin states - only 2 options though!
BA0B01 \_ Seems to return bit status
BA0B02 / for many of the GPIO pins
BA0CXXXXXX Returns a byte, depending on which bit is set in XXXXXX (mask FFFF80)
BA0D Returns 0 or 1 depending on RAM@0234,0230
BA0E Reads RAM@1A52 1 byte
BA0F01 Reads 2 bytes by calling 2 functions
BA0F02 Reads 2 bytes by calling only the first of those 2 functions
BA1001 Calls a function with 1 \_ Returns 2 bytes
BA1002 Calls a function with 0 / No idea what they're doing though
BA1101 \_ If bits in RAM@1981 are 0 (in secure mode?) else return condition not correct
BA1102 / 1 runs 7 functions, 2 runs only the first.

VDO EOL Holy Trucking Moly

[IAmTedd]

Thanks for your amazing ICC research, Jason.
My FK Mk II had a failed screen after letting the car sit for three months with the battery disconnected. I came across this thread back then, but decided to get an exchange from ASL, which also gave me a nav upgrade.
Now I want to back up the FDIM, but I'm having trouble with the recore function. I have a FAT32 USB stick with the recore.zip extracted to it, and a USB OBDLink. Running your ICCComs program gives the error that NVM settings are incorrect, and to run Forscan first. So I do, but nothing changes.
What exactly do I do with Forscan to get this working?

[JasonACT]

My software only works with an ELM327 or clone, sorry.

[jakka351]

Originally Posted by IAmTedd

Thanks for your amazing ICC research, Jason.
My FK Mk II had a failed screen after letting the car sit for three months with the battery disconnected. I came across this thread back then, but decided to get an exchange from ASL, which also gave me a nav upgrade.
Now I want to back up the FDIM, but I'm having trouble with the recore function. I have a FAT32 USB stick with the recore.zip extracted to it, and a USB OBDLink. Running your ICCComs program gives the error that NVM settings are incorrect, and to run Forscan first. So I do, but nothing changes.
What exactly do I do with Forscan to get this working?

The trick is that forscan isnt actually going to fix your fdim. You should perhaps try connectin to your car with forscan though, and access the midspeed can. This will conjumblebumblebeetuna your OBD dongle to hopefully the right bumblebeetuna for using the program. You will find that google is a great resource for figuring out what conjumblebumblebeetuna is.

[jakka351]

Enabling Logfile 'candump-2022-04-25_223504.log'

Warning: console output active while logging! can0 RX - - 728 [8] 02 50 87 00 00 00 00 00 '.P......'
can0 RX - - 728 [8] 02 51 01 00 00 00 00 00 '.Q......'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'




Heh Heh Heh

[JasonACT]

Back to work tomorrow (and I've had too many myself tonight). But since I was on holidays for the past 11 days... Sync2 unit, be my biatch...

[jakka351]

Originally Posted by Whiteford

There are some very cool applications available for the Sync2 units globally

Aren't you an engineer? I heard you were an engineer. At Holden of all places.

[JasonACT]

Originally Posted by Whiteford

There are some very cool applications available for the Sync2 units globally

Yes, but trust me, they are all pretty underwhelming...



Viewing existing videos..



Playing a video..



Try and play anything recent and you will see jerky playback and app crashes. You might find you need to reboot your unit - I did.

If I were to compare Sync2 to the FG2/SZ 8" colour touch screen, I'd say it's a slight improvement in speed and has WiFi which is nice. But it doesn't really have enough power to do much else with it. The best thing to do I reckon (and I've done it on the FG2) is VNC to a quad-core Raspberry Pi (3 or 4, but a '4 needs far more amps so that gets tricky).

[JasonACT]

iGO...

[nc_fairlane]

Originally Posted by JasonACT

iGO...

image

Well done with this project for Sync2.

Hopefully someone will release this in the future. I take it the maps are stored on a USB in the media hub ?

[JasonACT]

Yep, using the Russian's software I cracked, I've installed his skeleton key on USB (lets the USB override his list of installed apps) and I run "/USB Disk/wince/primo.exe" via his app-helper exe (turns off the Sync interface while the app is running, then back on when it finishes).

I've also patched primo to use his special [sound] wave.dll that overrides WinCE's system dll (I assume something more is going on with that - like two sound cards in Sync 2 or something - where you need to use the right one). Both the VideoPlayer and Navitel use that, but MirrorLink doesn't?

Along with having his Navitel GPS simulated COM port driver installed, which I think is being picked up by primo. Trouble is, I'll need to work out the SDLC device to get the GPS to talk to the APIM, so that's not tested yet... And I think I'll need to connect up the ACM too, to get any sound (connecting earphones to the APIM pins directly has produced nothing so far).

But everything else has worked perfectly - maps are on USB... But it could all be on SD card too without any issues, I'm sure. It is cracked software from China though, so totally illegal, and I have put 2020.Q2 maps on it now - and it works without checking for newer licenses... But I'm not sure it'll be me who'll "release" it!

[nc_fairlane]

Pretty impressive on what you have achieved so far with the sync 2 system.

[QIKESP]

@JasonACT Thought I'd run the Recore program you've compiled to create a good working backup of my ICC.

ELM327 seems to be happy on the initial connection (mscan), however I'm getting a fault after running the Recore command.

>31AB01
7F 31 22
Condition not correct

Any idea what could cause this ?

Thanks !

[JasonACT]

It looks good, until that command - the only time I've seen that is when it's already been started without the USB stick in place (so it's now running forever which prevents you redoing it)...

Try resetting the ICC... And get the latest from my github too (that one is a bit old by the look of it)...

https://github.com/Jasoroony/Ford-Fa...G2ICCComms.exe

https://github.com/Jasoroony/Ford-Fa...ain/repair.zip

[QIKESP]

Thanks for the reply and link to updated version !

Issue ended up being that I'd only had the ignition on ACC.
ICC was powered, however USB port was only happy once ignition set to ON.

Start of log
opening /hmi/dp = 4
Copy /packages/factory/speech
Copy /packages/factory/iplspl
Copy /packages/factory/core-pkg
Copy /packages/factory/navi_maps
Copy /packages/factory/qnx_binaries_and_libraries
Copy /packages/factory/navi
Copy /packages/factory/swsa_binaries_and_libraries
Copy /packages/factory/power
Copy /packages/factory/io
Copy /packages/factory/media_player
Copy /packages/factory/hmi
Copy /packages/factory/fast_startup
Copy /packages/factory/graphics
Copy /packages/factory/diagnostics
Copy /packages/factory/applications
Copy /packages/factory/bluetooth
Test /packages/factory/speech
Test /packages/factory/iplspl
Test /packages/factory/core-pkg
Test /packages/factory/navi_maps
Test /packages/factory/qnx_binaries_and_libraries
Test /packages/factory/navi
Found /packages/factory/navi/root/usr/navngo/MobileNavigator/content/lang/Lang_English-aus.zip (3765111250, 3819502961) ERROR
Test /packages/factory/swsa_binaries_and_libraries
Test /packages/factory/power
Test /packages/factory/io
Test /packages/factory/media_player
Test /packages/factory/hmi
Test /packages/factory/fast_startup
Test /packages/factory/graphics
Test /packages/factory/diagnostics
Test /packages/factory/applications
Test /packages/factory/bluetooth
End of log

Just need to run the recore again to fix the noted error in one of the packages.

I'm a big fan of backups and your program works perfectly. Thanks for your efforts !

[JasonACT]

You're welcome.

FYI (though I expect you already know): Lang_English-aus.zip [3765111250] is in the navi download in my github repo... So yep, replace that bad file which is now on the USB stick with the one from github, and re-run it to repair it.

(That particular file is one of the few that is the same across many firmware versions.)

[jakka351]

Bootsplashy

https://github.com/jakka351/FG-Falco.../bootsplashies