FORD technical service bulletin : ICC touch screen display - Page 24

jakka351 · 20-03-2022, 12:38 AM

I think there's an engineer around who might be able to test this out.

gkhn · 20-03-2022, 12:47 AM

Wish mine was Mk2.
I would try this till I break my working ICC

jakka351 · 20-03-2022, 12:50 AM

MONOCHROME FDIM FTW

JasonACT · 20-03-2022, 01:02 AM

Quote:

Originally Posted by jakka351

I think there's an engineer around who might be able to test this out.

Quote:

This unit does not have navigation.

Got to be careful, when running a Ford recore. Save the navi license file, otherwise it won't re-install.

He would have to use a customer's unit - or alter the EEPROM's serial number and copy over someone else's license - to get his working again.

Hence, I'm posting this without any third party testing. I've done the best testing I can though and have now recovered my unit from earlier attempts, using this. Happy days.

jakka351 · 30-03-2022, 10:20 PM

Speaking of engineers. Maybe this will peak the curiosity of someone.

Quote:

Timestamp: 1648628178.733230 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628178.743027 ID: 0728 S DLC: 8 03 fa 03 00 00 00 00 00 Channel: can0
Timestamp: 1648628182.945849 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628186.239956 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628186.243035 ID: 0728 S DLC: 8 03 fa 03 00 00 00 00 00 Channel: can0
Timestamp: 1648628194.455588 ID: 0720 S DLC: 8 05 ba 03 02 00 01 00 00 Channel: can0
Timestamp: 1648628196.860470 ID: 0720 S DLC: 8 05 ba 03 01 00 01 00 00 Channel: can0
Timestamp: 1648628198.446991 ID: 0720 S DLC: 8 05 ba 03 02 00 01 00 00 Channel: can0
Timestamp: 1648628210.883744 ID: 0720 S DLC: 8 05 ba 03 01 00 02 00 00 Channel: can0
Timestamp: 1648628216.339628 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628223.288610 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628224.712198 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628225.636848 ID: 0720 S DLC: 8 05 ba 03 01 00 03 00 00 Channel: can0
Timestamp: 1648628225.646077 ID: 0728 S DLC: 8 05 fa 03 00 c0 05 00 00 Channel: can0
Timestamp: 1648628230.291607 ID: 0720 S DLC: 8 05 ba 03 01 00 04 00 00 Channel: can0
Timestamp: 1648628230.294599 ID: 0728 S DLC: 8 06 fa 03 00 c0 00 14 00 Channel: can0
Timestamp: 1648628234.102727 ID: 0720 S DLC: 8 05 ba 03 01 00 05 00 00 Channel: can0
Timestamp: 1648628234.109261l ID: 0728 S DLC: 8 07 fa 03 00 c0 00 14 c1 Channel: can0
Timestamp: 1648628273.209271 ID: 0720 S DLC: 8 05 ba 03 03 00 05 00 00 Channel: can0
Timestamp: 1648628273.215067 ID: 0728 S DLC: 8 07 fa 03 20 20 20 20 20 Channel: can0

Exploring around in the Supplier Diagnostic Session, gUyZ i FoUnD sOmeThInG

5 Locations of something, called with Service 0xBA routine 0x0301, the 0x01 signifies to read one byte the location 0x0001, you get a positive response changing this byte(Byte 3 of the can frame, from zero) setting this to 0x01-0x04, as the response in a single frame can fit a maximum of 4 bytes of data when you remove the length carrier, service, subservice.

location 0x0001-0x0005 return a positive response when called with BA0301.

Ie can message 720#05BA0301000100 recieves positive response 728#05FA0301xxxxxxxx

**aussiblue** · 20-03-2022, 09:04 PM

Quote:

I've deleted up a bunch of old messages now, from a guy who never got back to me after pestering me to help extract firmwares from clusters. Saw he was over in the forscan forum asking about PATS too. Meh.

Forscan's Russian software isn't it? I should probably stop mentioning it now.

Yes; Russian not Ukrainian and per this thread: https://fordforums.com.au/showthread.php?t=11493645 and the advice on their website it means

Quote:

What's new in FORScan

March 04, 2022 - Suspending Extended License sales

Due to sanctions against Russian banks and unability [SIC] to transfer funds, we have to suspend selling Extended Licenses.

I guess if tensions don't ease they may even close the site to Westerners or worse, if they are offside with the west, seeding malicious code in it. Still better to be here without Forscan than in the Ukraine.

The man Alex Savin is an Android developer that has been active since 2015 and has one app (FORScan Lite) in Google Play. FORScan Lite is listed in the category "Tools". It is highly ranked in several countries, and is also one of the more popular apps in Google Play with more than 100 thousand installs. He resides at 26-36 Kartashova str, Tomsk, Russia, 634041 At least some of his townsfolk were protesting against the war https://www.youtube.com/watch?v=zZHlOsvJcKw

JasonACT · 30-03-2022, 11:05 PM

Nah, not me, sorry jakka351 - I'm off to bed...

FG Mk1 - Elevated Security Access Functions

BA0101AAAA Read EEPROM@AAAA 1 byte
BA0102AAAA Read EEPROM@AAAA 2 bytes (bytes are swapped)
BA0201AAAAVV Write EEPROM@AAAA 1 byte VV
BA0202AAAAVVVV Write EEPROM@AAAA 2 bytes VVVV (bytes are swapped)
BA03AAAALL Read RAM@AAAA LL bytes (0-5) [don't use 0!]
BA0401AAAAVV Write RAM@AAAA 1 byte VV
BA0402AAAAVVVV Write RAM@AAAA 2 bytes VVVV (bytes are swapped)
BA05 Read FLASH@3A85 5 bytes (4B01060002 - Boot Loader Version???)
BA06 Read RAM@122A,1228,1229,122C,122B 5 bytes
BA07XXXXXXXXXX Write RAM@1222 5 bytes (order: 2,0,1,4,5,3) & set a flag?
BA08 Run 2 functions? (they appear to be non-trivial!)
BA0901 Read RAM@0136 (4 bytes)
BA0902 Read RAM@013A (4 bytes)
BA0903 Read RAM@013E (4 bytes)
BA0904 Read RAM@0142 (4 bytes)
BA0905 Read RAM@0146 (4 bytes)
BA0906 Read RAM@014A (2 bytes) and incl. 0001 (RAM@1981&0x07) or 0000 (secure mode?)
BA0A01 \_ Seems to muck around with
BA0A02 / the GPIO pin states - only 2 options though!
BA0B01 \_ Seems to return bit status
BA0B02 / for many of the GPIO pins
BA0CXXXXXX Returns a byte, depending on which bit is set in XXXXXX (mask FFFF80)
BA0D Returns 0 or 1 depending on RAM@0234,0230
BA0E Reads RAM@1A52 1 byte
BA0F01 Reads 2 bytes by calling 2 functions
BA0F02 Reads 2 bytes by calling only the first of those 2 functions
BA1001 Calls a function with 1 \_ Returns 2 bytes
BA1002 Calls a function with 0 / No idea what they're doing though
BA1101 \_ If bits in RAM@1981 are 0 (in secure mode?) else return condition not correct
BA1102 / 1 runs 7 functions, 2 runs only the first.

jakka351 · 30-03-2022, 11:41 PM

Quote:

BA08 Run 2 functions? (they appear to be non-trivial!)
BA0901 Read RAM@0136 (4 bytes)
BA0902 Read RAM@013A (4 bytes)
BA0903 Read RAM@013E (4 bytes)
BA0904 Read RAM@0142 (4 bytes)
BA0905 Read RAM@0146 (4 bytes)
BA0906 Read RAM@014A (2 bytes) and incl. 0001 (RAM@1981&0x07) or 0000 (secure mode?)
BA0A01 \_ Seems to muck around with
BA0A02 / the GPIO pin states - only 2 options though!
BA0B01 \_ Seems to return bit status
BA0B02 / for many of the GPIO pins
BA0CXXXXXX Returns a byte, depending on which bit is set in XXXXXX (mask FFFF80)
BA0D Returns 0 or 1 depending on RAM@0234,0230
BA0E Reads RAM@1A52 1 byte
BA0F01 Reads 2 bytes by calling 2 functions
BA0F02 Reads 2 bytes by calling only the first of those 2 functions
BA1001 Calls a function with 1 \_ Returns 2 bytes
BA1002 Calls a function with 0 / No idea what they're doing though
BA1101 \_ If bits in RAM@1981 are 0 (in secure mode?) else return condition not correct
BA1102 / 1 runs 7 functions, 2 runs only the first.

VDO EOL Holy Trucking Moly

IAmTedd · 18-04-2022, 12:14 PM

Thanks for your amazing ICC research, Jason.
My FK Mk II had a failed screen after letting the car sit for three months with the battery disconnected. I came across this thread back then, but decided to get an exchange from ASL, which also gave me a nav upgrade.
Now I want to back up the FDIM, but I'm having trouble with the recore function. I have a FAT32 USB stick with the recore.zip extracted to it, and a USB OBDLink. Running your ICCComs program gives the error that NVM settings are incorrect, and to run Forscan first. So I do, but nothing changes.
What exactly do I do with Forscan to get this working?

jakka351 · 20-04-2022, 07:47 PM

Quote:

Originally Posted by IAmTedd

Thanks for your amazing ICC research, Jason.
My FK Mk II had a failed screen after letting the car sit for three months with the battery disconnected. I came across this thread back then, but decided to get an exchange from ASL, which also gave me a nav upgrade.
Now I want to back up the FDIM, but I'm having trouble with the recore function. I have a FAT32 USB stick with the recore.zip extracted to it, and a USB OBDLink. Running your ICCComs program gives the error that NVM settings are incorrect, and to run Forscan first. So I do, but nothing changes.
What exactly do I do with Forscan to get this working?

The trick is that forscan isnt actually going to fix your fdim. You should perhaps try connectin to your car with forscan though, and access the midspeed can. This will conjumblebumblebeetuna your OBD dongle to hopefully the right bumblebeetuna for using the program. You will find that google is a great resource for figuring out what conjumblebumblebeetuna is.

jakka351 · 26-04-2022, 12:11 AM

Enabling Logfile 'candump-2022-04-25_223504.log'

Warning: console output active while logging! can0 RX - - 728 [8] 02 50 87 00 00 00 00 00 '.P......'
can0 RX - - 728 [8] 02 51 01 00 00 00 00 00 '.Q......'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'
can0 RX - - 728 [4] 05 50 00 00 '.P..'

Heh Heh Heh

JasonACT · 18-04-2022, 02:18 PM

My software only works with an ELM327 or clone, sorry.

JasonACT · 26-04-2022, 12:19 AM

Back to work tomorrow (and I've had too many myself tonight). But since I was on holidays for the past 11 days... Sync2 unit, be my biatch...

jakka351 · 28-04-2022, 08:16 PM

Quote:

Originally Posted by Whiteford

There are some very cool applications available for the Sync2 units globally

Aren't you an engineer? I heard you were an engineer. At Holden of all places.

JasonACT · 28-04-2022, 09:40 PM

Quote:

Originally Posted by Whiteford

There are some very cool applications available for the Sync2 units globally

Yes, but trust me, they are all pretty underwhelming...

Viewing existing videos..

Playing a video..

Try and play anything recent and you will see jerky playback and app crashes. You might find you need to reboot your unit - I did.

If I were to compare Sync2 to the FG2/SZ 8" colour touch screen, I'd say it's a slight improvement in speed and has WiFi which is nice. But it doesn't really have enough power to do much else with it. The best thing to do I reckon (and I've done it on the FG2) is VNC to a quad-core Raspberry Pi (3 or 4, but a '4 needs far more amps so that gets tricky).

JasonACT · 07-05-2022, 03:54 PM

iGO...

nc_fairlane · 07-05-2022, 10:29 PM

Quote:

Originally Posted by JasonACT

iGO...

image

Well done with this project for Sync2.

Hopefully someone will release this in the future. I take it the maps are stored on a USB in the media hub ?

JasonACT · 07-05-2022, 11:30 PM

Yep, using the Russian's software I cracked, I've installed his skeleton key on USB (lets the USB override his list of installed apps) and I run "/USB Disk/wince/primo.exe" via his app-helper exe (turns off the Sync interface while the app is running, then back on when it finishes).

I've also patched primo to use his special [sound] wave.dll that overrides WinCE's system dll (I assume something more is going on with that - like two sound cards in Sync 2 or something - where you need to use the right one). Both the VideoPlayer and Navitel use that, but MirrorLink doesn't?

Along with having his Navitel GPS simulated COM port driver installed, which I think is being picked up by primo. Trouble is, I'll need to work out the SDLC device to get the GPS to talk to the APIM, so that's not tested yet... And I think I'll need to connect up the ACM too, to get any sound (connecting earphones to the APIM pins directly has produced nothing so far).

But everything else has worked perfectly - maps are on USB... But it could all be on SD card too without any issues, I'm sure. It is cracked software from China though, so totally illegal, and I have put 2020.Q2 maps on it now - and it works without checking for newer licenses... But I'm not sure it'll be me who'll "release" it!

nc_fairlane · 08-05-2022, 12:03 AM

Pretty impressive on what you have achieved so far with the sync 2 system.

JasonACT · 08-05-2022, 03:58 PM

It looks good, until that command - the only time I've seen that is when it's already been started without the USB stick in place (so it's now running forever which prevents you redoing it)...

Try resetting the ICC... And get the latest from my github too (that one is a bit old by the look of it)...

https://github.com/Jasoroony/Ford-Fa...G2ICCComms.exe

https://github.com/Jasoroony/Ford-Fa...ain/repair.zip

QIKESP · 08-05-2022, 08:33 PM

Thanks for the reply and link to updated version !

Issue ended up being that I'd only had the ignition on ACC.
ICC was powered, however USB port was only happy once ignition set to ON.

Start of log
opening /hmi/dp = 4
Copy /packages/factory/speech
Copy /packages/factory/iplspl
Copy /packages/factory/core-pkg
Copy /packages/factory/navi_maps
Copy /packages/factory/qnx_binaries_and_libraries
Copy /packages/factory/navi
Copy /packages/factory/swsa_binaries_and_libraries
Copy /packages/factory/power
Copy /packages/factory/io
Copy /packages/factory/media_player
Copy /packages/factory/hmi
Copy /packages/factory/fast_startup
Copy /packages/factory/graphics
Copy /packages/factory/diagnostics
Copy /packages/factory/applications
Copy /packages/factory/bluetooth
Test /packages/factory/speech
Test /packages/factory/iplspl
Test /packages/factory/core-pkg
Test /packages/factory/navi_maps
Test /packages/factory/qnx_binaries_and_libraries
Test /packages/factory/navi
Found /packages/factory/navi/root/usr/navngo/MobileNavigator/content/lang/Lang_English-aus.zip (3765111250, 3819502961) ERROR
Test /packages/factory/swsa_binaries_and_libraries
Test /packages/factory/power
Test /packages/factory/io
Test /packages/factory/media_player
Test /packages/factory/hmi
Test /packages/factory/fast_startup
Test /packages/factory/graphics
Test /packages/factory/diagnostics
Test /packages/factory/applications
Test /packages/factory/bluetooth
End of log

Just need to run the recore again to fix the noted error in one of the packages.

I'm a big fan of backups and your program works perfectly. Thanks for your efforts !

JasonACT · 08-05-2022, 08:52 PM

You're welcome.

FYI (though I expect you already know): Lang_English-aus.zip [3765111250] is in the navi download in my github repo... So yep, replace that bad file which is now on the USB stick with the one from github, and re-run it to repair it.

(That particular file is one of the few that is the same across many firmware versions.)

jakka351 · 16-05-2022, 10:23 PM

Bootsplashy

https://github.com/jakka351/FG-Falco.../bootsplashies

JasonACT · 16-05-2022, 10:27 PM

VNC Client for Sync 2: (Configure a Raspberry Pi for 800x480 - and you can control it from the Sync 2 unit)...

https://forum.xda-developers.com/t/m.../post-86898515

gkhn · 19-05-2022, 11:33 PM

This is the current state of my mark 1 ICC screen at the moment

It is connected to pi and running Open Auto Pro/Android auto

and this is when I VNC into it.

jakka351 · 20-05-2022, 01:49 PM

Quote:

Originally Posted by gkhn

This is the current state of my mark 1 ICC screen at the moment

image

It is connected to pi and running Open Auto Pro/Android auto

and this is when I VNC into it.
image

How did you get quality so good with analog video out from pi?

jakka351 · 20-05-2022, 01:54 PM

Have you got socketcan up?

gkhn · 20-05-2022, 09:41 PM

Don't have a CAN hat yet.
Will need to tap into the CAN at some point

Quote:

Originally Posted by jakka351

Have you got socketcan up?

gkhn · 20-05-2022, 09:13 PM

Didn't do anything special.
Just used the video kit from mentioned company (ASL ahem ahem).
The reason is good quality is because it converts native composite signal from pi to RGB component and sync (5 different wires (R+G+B+SYNC+GROUND) as opposed to 2 wires Signal(which has all the colours and sync in 1 single wire!) and Ground).
I have also opened the video kit box and the PCB is designed by ASL!
So it isn't an off the shelf item where they just slapped ASL logo on it...

Quote:

Originally Posted by jakka351

How did you get quality so good with analog video out from pi?

jakka351 · 20-05-2022, 06:56 PM

Quote:

Originally Posted by Whiteford

Can you do this on a monochrome?

Yes, ASL offer this service, give them a call for this proprietary in house, custom, not pinched from a forum solution.