skodapilot Forum

@skodapilot, what about color clusters graphics ?

Unfortunately, we do not know encrypt and compress algo for VDO dashboard. Main difference of color dashboard is own MCU for LCD. Firmware file for color dashboard contains one more flashblock. I don't know ways to get flash image for this MCU other than unpack from firmware file, but it is impossible now.

I've found some text in color cluster memory but i think that color graphics have another shorage ;/

nice

So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

dnoermann wrote: 17 Jan 2021 14:03 So very good news i can Dump the 3D Data now.

I was reversing the Bootloader to get the algorithms for compression and "crypto", to be able to make own Update-Files.
While understanding the public available Files
- FL_1K8920875H__1018_S.frf
- FL_1K8920885H__1018_S.frf

I converted them to odx with setup_frf_decoder.exe
After that the update procedere is seen, with Crypted/Compressed Data, but with plain Addresses and Sizes of Data.
As already said from skodapilot, the 3D does have an additional Flash Section.
And this is a big one, it's 16 MByte.
By the way, that is the source for the massive Update-Time of 7 Houres ....

Here is the Address, that is Memory-Mapped I/O for the V850
0xBF000000 - 0xBFFDFFFF Size: 0xFE0000
This can be dumped as Plaintext by UDS_ReadMemoryByAddress when the cluster is in Engeneering mode.
Here is a peek into the first plain 64kbyte of it, from FW 1109.
http://noernet.de/PQx5_3D/SW1109_17.01. ... DFlash.bin
The compleete dump is still running.

You are right about this big update secrion and I am going to tell you that is not associates to the V850 NEC, this section is inside of the display unit, display unit for 3d clusters has a tsop56 flash, i bricked my cluster one time, the VCP was returning timeout waiting this section erase time. This information maybe help your reverse engineering.

Best Regards,
Evandr

Hi,

If you brick yours LCD then ask me a PM, i'll help

Good to know about address and that someone can "Pack and crypt" created data.

I reviewed some bin's from LCD Picture from VDO Editor Generated Picture from attached BIN "The BIN"
https://battlearena.eu/vdo/autka05053.bin

I don't finish this project, and i want to make it " 2 way "
You can view binary data as image, and make binary data from imported image in specified dimmensions.
At 3d i think there's only more bytes for image.

Wellcome screen are stored some diffrent way i think but i think i got "Alltrack" from 0505

At beginning.
VW have simple pixel code storage.

-------------------------------------------------------------------------------------
ff ff ff 0d 01 00 00 00 02 00 00 00 05 00 00 00
FFFFFF - New line
0D - Sometimes it exist after new line sign, it contain pixels to skip.
01 00 00 00 - ( AA RR GG BB ) Pixel with Alpha

-------------------------------------------------------------------------------------
Pixel Repeat
2d 00 00 00 83 2c 00 00 00 01 2b 00 00 00 83

2D 00 00 00 83 - ( AA RR GG BB RPT ), look table of repeat

-------------------------------------------------------------------------------------
Sometimes it have 00 byte before next line sign
01 00 00 00 85 00 ff ff ff 0c 01 00 00 00 03




int[] alpha =
{
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x16, 0x17, 0x19, 0X1a, 0x1c, 0x1d, 0x1e, 0x1f,
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
0x42, 0x44, 0x45, 0x46, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
0x60, 0x61, 0x62, 0x66, 0x69, 0x6c, 0x6d, 0x6e, 0x6f,
0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
0x80, 0x81, 0x82, 0x83, 0x84, 0x86, 0x87, /*0x88,*/ 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
0x92, 0x96, 0x97, 0x9c, 0x9d, 0x9e, 0x9f, 0x99, 0x95, 0x91, 0x9b, 0x9a,
0xaa, 0xa4, 0xa8, 0xaa, 0xab, 0xa0, 0xa1, 0xa5, 0xa7, 0xa6, 0xa9, 0xa3, 0xa2, 0xaf,
0xb2, 0xb4, 0xb7, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xb3, 0xb0,
0xc0, 0xc1, 0xc2, 0xc3, 0xc4
};

int[] repeating =
{
0x01, 0x06, 0x0d, 0x09, 0x07, 0x04, 0x0a, 0x05, /*0x0f,*/ 0x0b,
0x10, 0x12, 0x14, 0x16, 0x13, 0x1c, 0x11, 0x17, 0x1e, 0x1d,
0x20, //0x22,
0x31,
0x51,
0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x89//, 0x8d
};

int[] spacers =
{
0x1b, 0x17, 0x0d, 0x0c, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x02, 0x82, 0x1a
};
// can be spacer or rpt or alpha ...
int[] exception =
{
0x01, 0x02, 0x03, 0x08, 0x10, 0x12, 0x0e, 0x0d, 0x82, 0x86, 0x89, 0x1a, 0x85, 0x8d
};

Thanks Daku.
Content from your bin does have similar format.

Does anyone know the size in Pixxel from the 3D display ?
I would guess 200x800 or so.

After looking deeper into the Data i guess 256x330

Since there is no Datasheet for this customized Display available,
I did take a highres picture of the Test-Picture and manual counted the Dots.
It is 240 Pixel wide and 320 Pixel high

Yeah, because it's display dimmension for 01xx - 05xx, i don't have 100% correct information for higher SW but i think it's same.

For car dimmension 05xx it's something about 78px x 36px or 88px width