Audi MMI 2G RX/TX terminal connection please help
Register
Page 1 of 4 1234 LastLast
Results 1 to 15 of 60
  1. #1
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default Audi MMI 2G RX/TX terminal connection please help

    Hi Folks. I have Audi A6 C6 with MMI 2G system. I would like to make recovery images from memory Head Control ecu, before I will make update. I read some tutorials for MMI 3G how to get data from memory using PuTTY or another I/O terminal. I havent pcb terminal in 2G the same as 3G, so have to find. could somebody help me to initiate loading IPL, ifs root OS, and other flash data to PC using RS232 protocol? Please help.

    My Control head label is 4E0 035 739.

  2. The Following User Says Thank You to WinWoj For This Useful Post:

    Meat-Head (5th January, 2018)

  3. #2
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    I found some new info, that BGA ic, Spartan-II FPGA from xilinx could have data areay, which maybe is possible to read using J-TAG. I especially want to know bootloader and system data.

  4. #3
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    ok, it looks easier as I thought. In 2G mmi software are placed in two flashes 29lv651ue (tsop48) but is it enought to make buckup, if such update will failed?

  5. #4
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    No one can help... I hope i will help someone when I discover the way of proper work. So this two 64M-bit flash memories could be read via Mini-Prog TL866 with special combined adapters, which I already ordered. Wish me luck, but please, if somebody know how it read via JTAG from Spartan or RENESAS 6417709A mcu, please let me know.
    Best Regards

  6. #5
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    Hello mates. I see, that thread I started here is in wrong section, because nobody active... Anyway, flash dumps contains such data. I think this data is similar to. sgo files, but i can't find any .sgo file to my control head unit 4E0 035 729 to see it, before I read my. But i opened another flash dumps and see in hex editor. I saw that structure is that both flash files have to be joined together in one 16-bit file, but bytes are shifted very strange, so string "Copyright " is shown as "oyCpihrg t". In flash 1 there are "oCir t", in flash 2 there are "yphg" and proper join this two files take us proper resoult . I think, if this is sgo format, to could see any usefull information, for future flash modification, like not supported language or functions, should be algorithm to make easy to read file format.
    Last edited by WinWoj; 24th November, 2017 at 10:51 AM.

  7. #6
    DK Veteran
    simaservis1108's Avatar
    Join Date
    Aug 2013
    Location
    Serbia,Belgrade
    Posts
    2,075
    Thanks Thanks Given 
    236
    Thanks Thanks Received 
    1,095
    Thanked in
    756 Posts

    Default

    Yes,those are MirrorBit flashes.
    Becker used that technology 15 years ago.

  8. The Following User Says Thank You to simaservis1108 For This Useful Post:

    Meat-Head (5th January, 2018)

  9. #7
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    Quote Originally Posted by simaservis1108 View Post
    Yes,those are MirrorBit flashes.
    Becker used that technology 15 years ago.
    is there some software to work with? i mean swap byte is enough, or specific MirrorBit programmer software can see properly this data? I will use universal flash programmer elnec i hope read/write is implemented good.

  10. #8
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    Hello mates!

    I've already made in excel mirror-byte swap function on splitted two 8-bit files, converted temporary to ascii and it is very short data block.... each read 29lv651 dums has 8MB, but both has 'FF' empty values from addres 0x1F0 to 0x7FF. So here it is't user interface and languages data... graphics and another Tornado's OS... I attach already decoded data of these splitted files, but it seems to be more complicated to get buckup of MMI system before CD upgrage...

    20.jpg

    edit: this splitted 29lv651's dump is from Audi Q7 as I got from another thread before...
    Attached Files Attached Files
    Last edited by WinWoj; 24th December, 2017 at 11:27 AM.

  11. #9
    Member
    Join Date
    Aug 2013
    Posts
    51
    Thanks Thanks Given 
    11
    Thanks Thanks Received 
    13
    Thanked in
    10 Posts

    Default

    Hi

    Forget about JTAG its to slow on this unit


    read the datasheet from the SH4 then you get the info from serial port

  12. The Following User Says Thank You to Samoerai For This Useful Post:

    WinWoj (24th December, 2017)

  13. #10
    DK Veteran

    Join Date
    Aug 2015
    Posts
    704
    Thanks Thanks Given 
    176
    Thanks Thanks Received 
    142
    Thanked in
    120 Posts

    Default

    You think only the 2 flash chips are not enough to make a backup??

  14. The Following User Says Thank You to offsystem For This Useful Post:

    WinWoj (24th December, 2017)

  15. #11
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    SH4 is renesas or spartan mcu??

  16. #12
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    Quote Originally Posted by offsystem View Post
    You think only the 2 flash chips are not enough to make a backup??
    hi, no i don't, i looking for proper way to read all data from all memories.

  17. #13
    DK Veteran

    Join Date
    Aug 2015
    Posts
    704
    Thanks Thanks Given 
    176
    Thanks Thanks Received 
    142
    Thanked in
    120 Posts

    Default

    Quote Originally Posted by WinWoj View Post
    hi, no i don't, i looking for proper way to read all data from all memories.
    Can you maybe send me the two dumps

    Wich sw does it have?

  18. #14
    DK Veteran
    simaservis1108's Avatar
    Join Date
    Aug 2013
    Location
    Serbia,Belgrade
    Posts
    2,075
    Thanks Thanks Given 
    236
    Thanks Thanks Received 
    1,095
    Thanked in
    756 Posts

    Default

    What are you trying to achieve?

    SH-4 requires Hitachi specific tool which is not available anymore.
    FPGA(Spartan) is programmed in Slave Serial mode on each startup,so it is empty when power is removed anyway.
    FPGA configuration is stored in flashes.

    It is very simple device...

  19. The Following User Says Thank You to simaservis1108 For This Useful Post:

    Meat-Head (5th January, 2018)

  20. #15
    DK Veteran
    WinWoj's Avatar
    Join Date
    Jan 2012
    Location
    ECU City
    Posts
    943
    Thanks Thanks Given 
    390
    Thanks Thanks Received 
    106
    Thanked in
    79 Posts

    Default

    Quote Originally Posted by simaservis1108 View Post
    What are you trying to achieve?

    SH-4 requires Hitachi specific tool which is not available anymore.
    FPGA(Spartan) is programmed in Slave Serial mode on each startup,so it is empty when power is removed anyway.
    FPGA configuration is stored in flashes.

    It is very simple device...
    hi Sima. I'd like to reverse engineering mmi system. but first I want to save all data before I will make cd upgrade to compare after and before. fpga i dont know is easy, because i didn't do this before. Hitachi tool - how it named, i will lokking for. what data is stored in Hitachi and what in FPGA?

    best regards

 

 
Page 1 of 4 1234 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
This website uses cookies
We use cookies to store session information to facilitate remembering your login information, to allow you to save website preferences, to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners.