When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
Progressing slowly, I was able to get root access and dump all flash chips.
Not much other than that since the main board is not communicating with the nvidia visual computing module. I suspect the application file system was corrupted so I have to reimage it from my backup. The splash screen displayed on the lcd is from the vcm so it isn’t dead, but if the reimage does not solve it, there will probably be more delays
I do have the PCM running on the bench, so I can access and reconfigure it before installing it in my car.
Attached are the pinouts for PCM3.1 and PCM4, anybody who is attempting this should be able to repin the adapter cable with this. Pins E1, E2, E7 and E8 should be removed from the PCM3.1 side of your adapter harness, re-terminated with the appropriate multilock pins, then routed to the PCM4 LCD connector. You'll also need to splice into +12V and ground to power the LCD panel.
If you use the pre-made adapter harness from aliexpress, the PCM3.1 side of it will only have up to pin A14, while pin A15 (VBATT) is required, so either remove it and install the wire into the PCM4 end of your new harness (position D16), or try to source the correct quadlock receptacle. The MOST waveguide on your factory harness is in the adapter's position of 12v/GND, so you will need to remove the 2 pins and drill them out to accommodate the optical connectors.
Some signals have been renamed on the PCM4 side of things, for example the rear camera is now FBAS vs CVBS. Also, the MOST optical cables are only required for Bose / Burmeister cars, if you have the standard sound system, there's no optical cables to connect so you can leave those off of your BOM. If you have a MOST network in your car, you can purchase a housing that accepts the optical cables from your old quadlock connector so it can be directly installed into your new PCM4 (TE Part # 1-1355426-1)
I need help from any rl'er who has a 991.2 and access to a coding tool (VCDS or the like). Please dump your long coding for module 5F (Infotainment / PCM) and post here along with your options (carplay, porsche connect, sound package, etc...). I've figured out how to code some features to the radio but a lot of it is still not working, for example I need the correct value of byte 03 in order to tell the PCM that my car is a 911.
So far, here's what I have
Byte 0-2 = Car ID for car menu, 074406 = Macan 074405 = Boxster, 074404 = Cayman
Byte 3 and 11 = sound system (02 and 02 = Bose)
Byte 17 = Car ID for startup animation (see list below and convert the listed ID to hex before updating coding)
Car IDs for startup animation byte 18
Code:
ID (DEC) - Model Name
0 - Macan
1 - 911
2 - 911 Carrera Coupe
3 - 911 Carrera 2S Coupe
4 - 911 Carrera 4 Coupe
5 - 911 Carrera 4S Coupe
6 - 911 Carrera Cabrio
7 - 911 Carrera 2S Cabrio
8 - 911 Carrera 4 Cabrio
9 - 911 Carrera 4S Cabrio
10 - 911 Targa 4
11 - 911 Targa 4S
12 - 911 Turbo Coupe
13 - 911 Turbo Cabrio
14 - 911 Turbo S Coupe
15 - 911 Turbo S Cabrio
16 - 911 GT3
17 - 911 GT2
18 - 911 GT3 RS
19 - 911 GT2 RS
20 - 911 Carrera Coupe
21 - Carrera Cabrio
22 - 911 Carrera gts Coupe
23 - 911 Carrera 4 gts Coupe
24 - 911 Carrera gts Cabrio
25 - 911 Carrera 4 gts Cabrio
26 - 911 Targa 4 GTS
27 - 911 Targa 4
28 - 911 Targa 4S
52 - Boxster
53 - Boxster s
54 - Boxster rs
55 - Boxster gts
56 - Boxster spyder
60 - Cayman
61 - Cayman s
62 - Cayman rs
63 - Cayman gts
64 - Cayman gt4
82 - Panamera
112 - Cayenne
113 - Cayenne s
114 - Cayenne turbo
115 - Cayenne turbo s
116 - Cayenne gts
117 - Cayenne s hybrid
118 - Cayenne diesel
120 - Cayenne diesel s
121 - Cayenne s hybrid
122 - Cayenne s e-hybrid
141 - Macan
142 - Macan s
143 - Macan hybrid
144 - Macan s ehybrid
145 - Macan turbo
146 - Macan turbo s
147 - Macan gts
148 - Macan diesel
149 - Macan diesel s
What happens if you just plug 07 44 03 into the first three bytes? Or for that matter 07 44 07? You might inadvertently 'discover' an unreleased model.
What happens if you just plug 07 44 03 into the first three bytes? Or for that matter 07 44 07? You might inadvertently 'discover' an unreleased model.
It doesn't go in order unfortunately. I can see all of the available vehicle types in my firmware dump, but I'm not sure what values they correspond to. As far is unreleased models, there is a cayman RS and a 718 GT4 image in there but they just look like placeholders (especially since the GT4 image doesn't look like the recently announced car).
As far as the rest of the retrofit. I've made some progress regarding feature codes (FECs) which are required to get certain features working. Bluetooth audio, carplay, sport chrono, android auto (yes it appears to be supported natively in PCM4), navigation, etc... all require these codes and porsche will not sell them to you since (in some cases) part numbers do not exist for the 991.1. Therefore, we need to work around this.
FECs are stored on the PCM4 system in persistent memory (efs-persist), along with public keys. When a FEC is added, Porsche authenticates and signs it, then the signature and option code (hex) get uploaded to the PCM4 and stored in a file named FecContainer.fec. Unfortunately you can not simply alter this file to add an option, since it will alter the checksum; and you can not update the checksum because only Porsche has the private key used for signing. So, you need to do two things: generate a FEC file and generate your own RSA key pair. I spent some time reviewing the FEC file format, and found it uses an RSA signed RMD160 checksum. The checksum is based off of the software options, and your car's vin and VCRN.
I've written a script to generate a new FEC container and RSA key pair, which should solve this problem. You can review the code here, and generate your own FEC container to get an idea of the mechanism that they use. https://github.com/ibreakifix/Porsch...C_Generator.sh
Replacing the keys and FEC file on the PCM4 requires access to the serial port on the quadlock connector and the root password (oaIQOqkW but it changes with each software version). When you replace the public key files, you will need to re-sign any software updates you want to apply, so apply any software updates prior to doing this.
Chris2, absolutely amazing work so far. Once you get all your codes and have it working, can you give us a price for setting up a module? I'm not talking about a guide - I want to know how much you would charge to make a complete unit that I could buy from you and then plug into my 991.1...
I need help from any rl'er who has a 991.2 and access to a coding tool (VCDS or the like). Please dump your long coding for module 5F (Infotainment / PCM) and post here along with your options (carplay, porsche connect, sound package, etc...). I've figured out how to code some features to the radio but a lot of it is still not working, for example I need the correct value of byte 03 in order to tell the PCM that my car is a 911.
Chris, I don't have a coding tool but if you can bring the hardware down to LA sometime, I've got a 991.2 GT3 we could plug into. We have a GT4 that I may like to upgrade the PCM in sometime so this is pretty interesting. Excellent GitHub handle BTW!
Chris2, absolutely amazing work so far. Once you get all your codes and have it working, can you give us a price for setting up a module? I'm not talking about a guide - I want to know how much you would charge to make a complete unit that I could buy from you and then plug into my 991.1...
and, I call dibs on first in line
Wish I could help but there are people who already hack VW and Audi MIB2 (and PCM4 by extension) for plug and play installation, but they are all overseas and require shipping off your expensive head unit to them. Otherwise, I unfortunately don't have the time and don't need the money, so the only thing I'm looking at offering is a wiring harness adapter kit since that's a bit of a pain to do by hand.
Originally Posted by bigkraig
Chris, I don't have a coding tool but if you can bring the hardware down to LA sometime, I've got a 991.2 GT3 we could plug into. We have a GT4 that I may like to upgrade the PCM in sometime so this is pretty interesting. Excellent GitHub handle BTW!
That would be an absolute life saver. I'm trying to find a dealership that can remove component protection from the new PCM, and I'll probably be in the LA area so I'll shoot you a PM once I know the appointment date. Thanks
Wish I could help but there are people who already hack VW and Audi MIB2 (and PCM4 by extension) for plug and play installation, but they are all overseas and require shipping off your expensive head unit to them. Otherwise, I unfortunately don't have the time and don't need the money, so the only thing I'm looking at offering is a wiring harness adapter kit since that's a bit of a pain to do by hand.
@chris2 Hi, interesting thread, did some very similar research trying to enable CarPlay in a Audi Q7 4M. Quick question, have you verified that replacing the public key files generated with your script actually works? There is a SO thread that suggests the keys are signed by some data stored in OTP flash area https://reverseengineering.stackexch...fication/12287 which I had assumed would stop the public keys from being replaced as the chain of trust would be broken?
@chris2 Hi, interesting thread, did some very similar research trying to enable CarPlay in a Audi Q7 4M. Quick question, have you verified that replacing the public key files generated with your script actually works? There is a SO thread that suggests the keys are signed by some data stored in OTP flash area https://reverseengineering.stackexch...fication/12287 which I had assumed would stop the public keys from being replaced as the chain of trust would be broken?
-Nic
I saw that and I’m waiting to get component protection removed before replacing the files. My dealership scheduled this for the 9th unfortunately, since they are constantly booked.
The keys are stored in two locations (/mnt/efs-system and /mnt/efs-persist) both are writeable but the backup key location requires remounting. I believe the efs-system partition is the “OTP” area he is referring to, even though it is not OTP.
I have not found the key anywhere else, and I don’t even believe there is any one time programmable flash on the board. There are regions of the eeprom that are protected by the software, but those contain the fazit id and not keys, additionally the entire NOR is writeable from within QNX. Given that, he might have a MIB2 from Delphi which is apparently designed much differently than the Harman Becker unit
This is totally wrong and you should ignore this post
06-09-2019, 08:37 PM
