Meat-Head (5th January, 2018)
Hi Folks. I have Audi A6 C6 with MMI 2G system. I would like to make recovery images from memory Head Control ecu, before I will make update. I read some tutorials for MMI 3G how to get data from memory using PuTTY or another I/O terminal. I havent pcb terminal in 2G the same as 3G, so have to find. could somebody help me to initiate loading IPL, ifs root OS, and other flash data to PC using RS232 protocol? Please help.
My Control head label is 4E0 035 739.
Meat-Head (5th January, 2018)
I found some new info, that BGA ic, Spartan-II FPGA from xilinx could have data areay, which maybe is possible to read using J-TAG. I especially want to know bootloader and system data.
ok, it looks easier as I thought. In 2G mmi software are placed in two flashes 29lv651ue (tsop48) but is it enought to make buckup, if such update will failed?
No one can help... I hope i will help someone when I discover the way of proper work. So this two 64M-bit flash memories could be read via Mini-Prog TL866 with special combined adapters, which I already ordered. Wish me luck, but please, if somebody know how it read via JTAG from Spartan or RENESAS 6417709A mcu, please let me know.
Best Regards
Hello mates. I see, that thread I started here is in wrong section, because nobody active... Anyway, flash dumps contains such data. I think this data is similar to. sgo files, but i can't find any .sgo file to my control head unit 4E0 035 729 to see it, before I read my. But i opened another flash dumps and see in hex editor. I saw that structure is that both flash files have to be joined together in one 16-bit file, but bytes are shifted very strange, so string "Copyright " is shown as "oyCpihrg t". In flash 1 there are "oCir t", in flash 2 there are "yphg" and proper join this two files take us proper resoult . I think, if this is sgo format, to could see any usefull information, for future flash modification, like not supported language or functions, should be algorithm to make easy to read file format.
Last edited by WinWoj; 24th November, 2017 at 10:51 AM.
Yes,those are MirrorBit flashes.
Becker used that technology 15 years ago.
Meat-Head (5th January, 2018)
Hello mates!
I've already made in excel mirror-byte swap function on splitted two 8-bit files, converted temporary to ascii and it is very short data block.... each read 29lv651 dums has 8MB, but both has 'FF' empty values from addres 0x1F0 to 0x7FF. So here it is't user interface and languages data... graphics and another Tornado's OS... I attach already decoded data of these splitted files, but it seems to be more complicated to get buckup of MMI system before CD upgrage...
20.jpg
edit: this splitted 29lv651's dump is from Audi Q7 as I got from another thread before...
Last edited by WinWoj; 24th December, 2017 at 11:27 AM.
Hi
Forget about JTAG its to slow on this unit
read the datasheet from the SH4 then you get the info from serial port
WinWoj (24th December, 2017)
You think only the 2 flash chips are not enough to make a backup??
WinWoj (24th December, 2017)
SH4 is renesas or spartan mcu??
What are you trying to achieve?
SH-4 requires Hitachi specific tool which is not available anymore.
FPGA(Spartan) is programmed in Slave Serial mode on each startup,so it is empty when power is removed anyway.
FPGA configuration is stored in flashes.
It is very simple device...
Meat-Head (5th January, 2018)
hi Sima. I'd like to reverse engineering mmi system. but first I want to save all data before I will make cd upgrade to compare after and before. fpga i dont know is easy, because i didn't do this before. Hitachi tool - how it named, i will lokking for. what data is stored in Hitachi and what in FPGA?
best regards
Bookmarks