startup logo

[Daku]

@skodapilot, what about color clusters graphics ?

[skodapilot]

Unfortunately, we do not know encrypt and compress algo for VDO dashboard. Main difference of color dashboard is own MCU for LCD. Firmware file for color dashboard contains one more flashblock. I don't know ways to get flash image for this MCU other than unpack from firmware file, but it is impossible now.

[Daku]

I've found some text in color cluster memory but i think that color graphics have another shorage ;/

Hidden Content

This board requires you to be registered and logged-in to view hidden content.

[dnoermann]

nice

[dnoermann]

So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

[ecarruda]

So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

You are right about this big update secrion and I am going to tell you that is not associates to the V850 NEC, this section is inside of the display unit, display unit for 3d clusters has a tsop56 flash, i bricked my cluster one time, the VCP was returning timeout waiting this section erase time. This information maybe help your reverse engineering.

Best Regards,
Evandr

[Daku]

Hi,

If you brick yours LCD then ask me a PM, i'll help

Good to know about address and that someone can "Pack and crypt" created data.

I reviewed some bin's from LCD

Hidden Content

This board requires you to be registered and logged-in to view hidden content.

[dnoermann]

Thanks Daku.
Content from your bin does have similar format.

Does anyone know the size in Pixxel from the 3D display ?
I would guess 200x800 or so.

After looking deeper into the Data i guess 256x330

[dnoermann]

Since there is no Datasheet for this customized Display available,
I did take a highres picture of the Test-Picture and manual counted the Dots.
It is 240 Pixel wide and 320 Pixel high

[Daku]

Yeah, because it's display dimmension for 01xx - 05xx, i don't have 100% correct information for higher SW but i think it's same.

For car dimmension 05xx it's something about 78px x 36px or 88px width