mobista

Did U finished this retrofit?

chris2

Still working on it, i was able to patch out FEC and possibly component protection. The last thing I need is an adaptation map from a car without a premium sound system

chris2011

Hi Chris2

Can you please post the pinout of the emmc memory I already desolder it but I can't find pinout of chip

Thx a lot

chris2

Resolder it to the board and use the test points from the image, or read it out with a socketed eMMC reader. The voltage pins are not tied together on this chip so if you don’t have a reader you will need to run too many wires for it to be practical

chris2011

are there any interresting infos stored in the emmc , i saw there are the maps stored, also the mnand has partitions /app but i not really know for what the partiotions are, i am trying to read it in a vw unit the pcb layout
is different.

have you maybe find some Jtag pins for the MMX board or the RCC to read write the NOR flash,

chris2

To get access to the system you need to dump the NOR and pull the shadow file off of the root file system. The main applications are stored in the NOR, so that would be of more interest than the MMC.

You could dump it over JTAG but I wound up not doing that since it was easier to desolder the NOR and dump it with a flash reader. If you can force the system into emergency mode, the password is “harman_f” and you can dump the NOR to the sd card through there

chris2

This project is slowly nearing completion, I am now just waiting for a CAN gateway from a 991.2 and need to remove the amplifier + rewire the sound system.

Some more coding findings
Byte 1 = 07 (Porsche)
Byte 2 = 46 (911), 44 (Cayman/Macan)
Byte 3 = 44 (GT3): Bit 1 = Car Generation (0-9), Bit 2 = Car Variant (0-9). Change these two bits to match your 911's model.
Byte 20 = 02 (External Amp Bose - MOST), 01 (Internal Amp), ?? Burmeister

Note that in addition to the PCM4 head unit you will need:
Amplifier (ASK / Bose / Burmeister have changed in 991.2 and may not work properly w/ PCM4)
CAN Gateway (95B907530G)
USB:
- Multiple USB Ports: USB Hub (5G0-035-953-C) + USB Cable / Port (9A7-642-953-00 center console, 9A7-642-222-00 aux + usb) + USB Hub Mount (9P1-035-925-A)
- Or, for single port: USB+Aux Cable (5Q0 035 726E) + Port (5G0-035-222-E), you can reuse glove box usb/aux/12v trim.
Dashboard PCM slot requires cutting to accommodate PCM4 cooling intake fan

PCM4 can communicate with the 991.1 CAN gateway, but for some reason the clock is set at 12AM and the instrument cluster can not see any information from PCM. I think the gateway can be recoded to work correctly with PCM4, however the gateway is locked with a security access code, which I can not find, if somebody knows it please let me know.
If you do not have an amplifier (under passenger seat), you can wire your speakers to PCM4. Otherwise, you may need to replace or bypass your amplifier. My car has an ASK amplifier (SPP) and I am unable to code it properly to the PCM4 since SPP now uses the internal PCM amplifier; feeding the PCM4 speaker outputs to the ASK amplifier results in super loud audio since PCM4 either outputs amplified audio or pre-amplified audio over MOST. Options for SPP cars are either upgrade the audio to Bose, or remove the amp and wire speakers to PCM4.

herr_frei

Are you willing to share your knowledge about patching the FEC check? I'm trying to do the same for my car...

chris2011

patching fec and CP is done in the root, you need IDA pro and much sw knowleadge to do it.

herr_frei

I have IDA pro and the extracted MIBroot executable. It would be fine to get some hints whate and where to patch. Or your unpatched root and the patch...

Option Plus

i should say i was planing to install Bose amplifier and complete package to macan PCM 4 and because of CP i had to change pcm4 to pcm3.1 so i can make it work .
maybe i can help you to finish your project
please check your direct messages
regards

chris2

Guys, I don't want to make the CP patch openly available since I am concerned that outlining how to bypass an antitheft feature could allow stolen radios to return to use. If you have IDA pro it is relatively simple to search through the strings, find the component protection function, and patch it out. You can refer to the ARM information center for the relevant instruction codes http://infocenter.arm.com/help/index...m_cegihjgh.htm. Your SW image must be dumped, unpacked, modified, then repacked to patch the system out. I have the steps to repack the root ifs with MKXFS in my Github repo. https://github.com/ibreakifix/PorschePCMStuff

Also, it certainly is possible to flash over another VAG brand MIB2 to PCM4 (for example Audi) as long as the unit has three HSD connectors (Grey, Curry Yellow and Green), but I can not provide NOR images to do so... you will need to get a Porsche PCM Display and purchase + flash the software from Porsche (9P1-906-961-E) if you want to embark on that project.

I know this is probably beyond most people's technical abilities here, so I want to keep this thread limited to talk about the PCM retrofit, I won't answer any questions or visitor messages from new members asking about patches.

chris2011

Hi Chris, can you maybe tell me how it is possible to update fw from audi to Porsche?

I always get variant conflict when I am trying to update the fw via sd card.

I also tried to change train Nr. In eeprom but nothing works.

flgfish

This seems like a lot of work to enable Carplay! I love it.

chris2

If you have root access, flash the images using the "flash.it" utility. I believe variant is also stored in /mnt/efs-persist/storage*.raw files, so you may need to delete and re-create the storage files by manually setting all adaptations. There is also a storage.raw file in /mnt/efs-system/opt/sysetbackup/. I would try running flash.it for all images, delete the storage files, then reboot and cross your fingers.

I'm not sure if that would solve everything, but how I would approach this if I wanted to convert variants would just be to clone the NOR and EMMC using a programmer.