startup logo

[Daku]

@skodapilot, what about color clusters graphics ?

[skodapilot]

Unfortunately, we do not know encrypt and compress algo for VDO dashboard. Main difference of color dashboard is own MCU for LCD. Firmware file for color dashboard contains one more flashblock. I don't know ways to get flash image for this MCU other than unpack from firmware file, but it is impossible now.

[Daku]

I've found some text in color cluster memory but i think that color graphics have another shorage ;/

127670257_2806393192937527_7368589932797103248_n.jpg

127662756_203811521248829_3471880239307157852_n.jpg

127515864_205411691096794_546723592102598255_n.jpg

127280262_309850466741174_3983927378506745347_n.jpg

rtav2.png

36be6b6s-960.jpg

bat all.png

[dnoermann]

nice

[dnoermann]

So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

[ecarruda]

So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

You are right about this big update secrion and I am going to tell you that is not associates to the V850 NEC, this section is inside of the display unit, display unit for 3d clusters has a tsop56 flash, i bricked my cluster one time, the VCP was returning timeout waiting this section erase time. This information maybe help your reverse engineering.

Best Regards,
Evandr

[Daku]

Hi,

If you brick yours LCD then ask me a PM, i'll help

Good to know about address and that someone can "Pack and crypt" created data.

I reviewed some bin's from LCD Picture from VDO Editor

passat 05.png

Generated Picture from attached BIN

car.png

"The BIN"
https://battlearena.eu/vdo/autka05053.bin

I don't finish this project, and i want to make it " 2 way "
You can view binary data as image, and make binary data from imported image in specified dimmensions.
At 3d i think there's only more bytes for image.

Wellcome screen are stored some diffrent way i think but i think i got "Alltrack" from 0505

At beginning.
VW have simple pixel code storage.

-------------------------------------------------------------------------------------
ff ff ff 0d 01 00 00 00 02 00 00 00 05 00 00 00
FFFFFF - New line
0D - Sometimes it exist after new line sign, it contain pixels to skip.
01 00 00 00 - ( AA RR GG BB ) Pixel with Alpha

-------------------------------------------------------------------------------------
Pixel Repeat
2d 00 00 00 83 2c 00 00 00 01 2b 00 00 00 83

2D 00 00 00 83 - ( AA RR GG BB RPT ), look table of repeat

-------------------------------------------------------------------------------------
Sometimes it have 00 byte before next line sign
01 00 00 00 85 00 ff ff ff 0c 01 00 00 00 03




int[] alpha =
{
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x16, 0x17, 0x19, 0X1a, 0x1c, 0x1d, 0x1e, 0x1f,
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
0x42, 0x44, 0x45, 0x46, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
0x60, 0x61, 0x62, 0x66, 0x69, 0x6c, 0x6d, 0x6e, 0x6f,
0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
0x80, 0x81, 0x82, 0x83, 0x84, 0x86, 0x87, /*0x88,*/ 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
0x92, 0x96, 0x97, 0x9c, 0x9d, 0x9e, 0x9f, 0x99, 0x95, 0x91, 0x9b, 0x9a,
0xaa, 0xa4, 0xa8, 0xaa, 0xab, 0xa0, 0xa1, 0xa5, 0xa7, 0xa6, 0xa9, 0xa3, 0xa2, 0xaf,
0xb2, 0xb4, 0xb7, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xb3, 0xb0,
0xc0, 0xc1, 0xc2, 0xc3, 0xc4
};

int[] repeating =
{
0x01, 0x06, 0x0d, 0x09, 0x07, 0x04, 0x0a, 0x05, /*0x0f,*/ 0x0b,
0x10, 0x12, 0x14, 0x16, 0x13, 0x1c, 0x11, 0x17, 0x1e, 0x1d,
0x20, //0x22,
0x31,
0x51,
0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x89//, 0x8d
};

int[] spacers =
{
0x1b, 0x17, 0x0d, 0x0c, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x02, 0x82, 0x1a
};
// can be spacer or rpt or alpha ...
int[] exception =
{
0x01, 0x02, 0x03, 0x08, 0x10, 0x12, 0x0e, 0x0d, 0x82, 0x86, 0x89, 0x1a, 0x85, 0x8d
};

[dnoermann]

Thanks Daku.
Content from your bin does have similar format.

Does anyone know the size in Pixxel from the 3D display ?
I would guess 200x800 or so.

After looking deeper into the Data i guess 256x330

[dnoermann]

Since there is no Datasheet for this customized Display available,
I did take a highres picture of the Test-Picture and manual counted the Dots.
It is 240 Pixel wide and 320 Pixel high

[Daku]

Yeah, because it's display dimmension for 01xx - 05xx, i don't have 100% correct information for higher SW but i think it's same.

For car dimmension 05xx it's something about 78px x 36px or 88px width