Mib STD2 PQ + NAV - need help

[ollync]

Hi to everyone.
Short story :
I have a dead (water damaged) Mib Std2 PQ + Nav, part number 5C0035680D SW0363 HW H31 11/17, originally from my Car VW Sharan 2017.
I bought another Mib Std2 PQ + Nav , part number 5C0035680G SW0468 HW H41 39/17 , new bought from dealer.
I think the only difference between those units is that the new one supports DAB.
Now comes the problem, after installing the new unit in car, of course Component Protection active, i went to dealer service and asked them to remove Component Protection and restore my VIN related functions.

Dealer tehnician succesfully removed CP , but never succeded to restore any of the functions. But charged me 116 Euros for trying.
Tryed another VW workshop and same thing, they took money but din't get it working.

So now i want to activate my original functions somehow.

So far i managed to read Eeprom and Emmc from old (damaged unit) and i have read Eeprom and Emmc from new unit, and did several experiments .

1: i wrote only eeprom data from old to new unit - powered it up - Component protection active , not working.

2: i wrote only CP data from new unit eeprom to old unit eeprom - powered it up - no component protection active , no Navigation, Radio has only FM (before it had AM too), and when i press Menu one new option appeared - CarNet , ok something changed

3: i wrote whole Emmc and eeprom from old unit to new one, powered it up, no component protection active, i can see the old saved radio stations but no button works , and after 30 second the display turns off - also not working.


For now i am stuck, maybe someone has a hint or maybe somebody can help to restore those functions.

I attach connection for Emmc reading - if someone want to dump his emmc - without to desolder it from board, you can use a SD card adapter to do that.
Note you can use only Dat0 , Cmd, Clk, Vcc and Gnd but the reading/writing will be very slow, about 24-27 minutes.
With all 4 Data lines connected to SD card adapter the reading / writing speed increases, about 7-8 min.

I will post more detailed info how to dump the card soon, now i am in a lack of time.

[trn]

post the photo
label
of the two units

[ollync]

Dead one :
IMG_5648.jpg
IMG_5649.jpg

New one :
IMG_5647.jpg
IMG_5650.jpg

[A3fDevil666]

Try Remote odis her @selling Board

[ollync]

Quick update.
I installed Navigation in car and OPS is working and Wlan is working , eeprom data is from old unit - only CP data in eeprom is from new unit.

[Samoerai]

Hi to everyone.
Short story :
I have a dead (water damaged) Mib Std2 PQ + Nav, part number 5C0035680D SW0363 HW H31 11/17, originally from my Car VW Sharan 2017.
I bought another Mib Std2 PQ + Nav , part number 5C0035680G SW0468 HW H41 39/17 , new bought from dealer.
I think the only difference between those units is that the new one supports DAB.
Now comes the problem, after installing the new unit in car, of course Component Protection active, i went to dealer service and asked them to remove Component Protection and restore my VIN related functions.

Dealer tehnician succesfully removed CP , but never succeded to restore any of the functions. But charged me 116 Euros for trying.
Tryed another VW workshop and same thing, they took money but din't get it working.

So now i want to activate my original functions somehow.

So far i managed to read Eeprom and Emmc from old (damaged unit) and i have read Eeprom and Emmc from new unit, and did several experiments .

1: i wrote only eeprom data from old to new unit - powered it up - Component protection active , not working.

2: i wrote only CP data from new unit eeprom to old unit eeprom - powered it up - no component protection active , no Navigation, Radio has only FM (before it had AM too), and when i press Menu one new option appeared - CarNet , ok something changed

3: i wrote whole Emmc and eeprom from old unit to new one, powered it up, no component protection active, i can see the old saved radio stations but no button works , and after 30 second the display turns off - also not working.


For now i am stuck, maybe someone has a hint or maybe somebody can help to restore those functions.

I attach connection for Emmc reading - if someone want to dump his emmc - without to desolder it from board, you can use a SD card adapter to do that.
Note you can use only Dat0 , Cmd, Clk, Vcc and Gnd but the reading/writing will be very slow, about 24-27 minutes.
With all 4 Data lines connected to SD card adapter the reading / writing speed increases, about 7-8 min.

I will post more detailed info how to dump the card soon, now i am in a lack of time.

that emmc have hidden partition RPMB

https://www.slideshare.net/linaroorg/intro-to-emmc

[ollync]

Tried with someone to do online Odis function restore but it ends with error:

The VCRN from the data set does not match the VCRN from the control module information

VCRN control module : BE32733560
VCRN data set : F6854668DC

I don’t know what it means . Any Odis specialist that can give a hint?



Sent from my iPhone using Tapatalk Pro

[majonez]

Do you have screens of FEC, SwAP codes to compare between units? I guess all of the codes are invalid now. Recently i did something silmilar - copied VW eeprom and eMMC (without rpmb) to Skoda unit. All codes became invalid and even bluetooth menu is not reachable now. As Samoerai wrote, there is RPMB partition in the eMMC chip. You can read it (eg. with a Raspberry PI, but not with cheap SD card reader), but you can't write it unless you know 32 bytes long Key/MAC. RPMB partition is visible as /dev/hd1 from the radio's console but don't know any tool to read/write it from the inside.

Jan 01 00:01:00    2    19   1800   part uda, config 00, slba 0, nlba 15204352, elba 15204351
Jan 01 00:01:00    2    19   1800   part rpmb, config 03, slba 0, nlba 256, elba 255
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 3)
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fec]    start reading FECs from store
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 0)
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 3)
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 0)
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    read block 0 from RPMB
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 3)
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    read block 1 from RPMB
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 0)
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    using index block 2
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 3)
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    read block 2 from RPMB
Jun 23 02:34:13    2    20   1800 mmc_set_partition(12e120, 0)
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    first half block is 4
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    second half block is 5
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    end of FEC reached with second half block
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    read FEC: [type: 0x7, status: 0, reason: 2, diagnosis: 0xbf, pos: 1, prim fsid: 0xffffffff, other fsids: 0x00040100, 0x08400008, 0x00050000, 0x00030000, condval on creation: 0]
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    added 2 half blocks for fec
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    half block 4 is used
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    half block 5 is used
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fecstore]    1018 free half blocks available
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fec]    finished reading FECs from store
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    setting the RPMB key was successfull
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    got SPRK_RESPONSE
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    reading key from file /tsd/etc/swap_keys/FEC_key_public_signed.bin
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    signature of key file is valid
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    key successfully read from file
Jun 23 02:34:13    7 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap.fec]    notifying observers that FEC manager is ready to do signature check
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    processing exception list /tsd/etc/slist/signed_exception_list.txt
Jun 23 02:34:13    2 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    parsing exception list failed: syntax error (line 1)
Jun 23 02:34:13    5 10000     1 swap: 02:34:13.732    [Error]    [iMX6.Swap.tsd.mibstd2.system.swap]    parsing exception list failed: syntax error (line 1)
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    got KM_VALUE_CHANGE
Jun 23 02:34:13    6 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    setting mileage to 0km
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    got OPERATING_HOURS_VALUE_CHANGE
Jun 23 02:34:13    6 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    setting operating hours to 1137h
Jun 23 02:34:13    6 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap.theftpr.proxy]    received event 0x7050001
Jun 23 02:34:13    6 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap.theftpr.proxy]    its a response
Jun 23 02:34:13    6 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap.theftpr.proxy]    HMAC of event is valid
Jun 23 02:34:13    7 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap.theftpr.proxy]    removed token used for HMAC check
Jun 23 02:34:13    6 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap.theftpr.proxy]    forwarding event to receiver
Jun 23 02:34:13    7 10014     9 [403d0004] [iMX6.Swap.tsd.mibstd2.system.swap]    enqueued message 0x7050001
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    got VCRN_RESPONSE
Jun 23 02:34:13    5 10014     9 [403d0013] [iMX6.Swap.tsd.mibstd2.system.swap]    VCRN: 0xa5d336db61

[ollync]

The brand new Navigation had no installed codes, in system menu under installed codes the list was empty. Dealer only succedeed to remove component protection.
On old damaged Navigation , the installed codes are 00030000 , 00040100 , 00050000 , 09400008 .
Now, after trying to restore functions online with Odis, the new Navigation shows under installed codes 00030000 , 00040100 , 00050000 , 09400008 but all "temporary rejected"

The emmc and eeprom from old unit are untouched, original, so i am wondering if i solder old emmc and eeprom in the new unit , will it work? I really want to get this sucker work.

This shows the navigation after trying to restore functions online with Odis:

IMG_5685.jpg IMG_5686.jpg IMG_5687.jpg IMG_5688.jpg IMG_5689.jpg

[majonez]

Well, i think it's worth to try to switch eMMC if you can do BGA. EEPROM is 1:1 copyable, so i guess it's not necessary to switch them.
There may be another copy of that damn keys in other chips - who knows. But if you really want to get this sucker to work then try with that eMMC.
Example of RMPB record below:
Attachment 597468

[ollync]

What is this VCRN ? I see in your dump a record VCRN
And for what is used the MX29GL128 on the other side of the board?

[ollync]

Little update - also navigation unit was installed to car with eeprom data from old navigation and component protection data from new unit . In this case , OPS worked, Wifi menu active and CarNet menu active.
With this combination - restoring functions online with odis failed with this vcrn error. Installed codes appeared like temporary rejected.

Now i have put original eeprom from new unit back, and surprise , the installed codes are no more rejected , Telefone works, bluetooth works, navigation works .
But disappeared OPS , wifi and carnet.
IMG_5748.jpg

When i make diagnostic with Odis i get this:

IMG_5747.jpg

Tried to do SVM adaptation online but i also fails with this error : ERP0617E : software configuration not computed




Sent from my iPhone using Tapatalk Pro

[Samoerai]

Well, i think it's worth to try to switch eMMC if you can do BGA. EEPROM is 1:1 copyable, so i guess it's not necessary to switch them.
There may be another copy of that damn keys in other chips - who knows. But if you really want to get this sucker to work then try with that eMMC.
Example of RMPB record below:
Attachment 597468

in the mcu IMX6 are OTP keys

[ollync]

Ok, so eventually i must change the IMX and Jacinto too. No time for that.

I give up , it is now working , the functions what the car had from factory are all active. Thats all i wanted .

At least i didn‘t pay 1116 euros to dealer only to have a working radio.


Sent from my iPhone using Tapatalk Pro

[majonez]

in the mcu IMX6 are OTP keys

The i.mx6 MCU has no internal storage for it. You probably mean MX29GL parallel flash, right?