Retrofitting PCM4 in a 991.1
#46
@chris2 Hi, interesting thread, did some very similar research trying to enable CarPlay in a Audi Q7 4M. Quick question, have you verified that replacing the public key files generated with your script actually works? There is a SO thread that suggests the keys are signed by some data stored in OTP flash area https://reverseengineering.stackexch...fication/12287 which I had assumed would stop the public keys from being replaced as the chain of trust would be broken?
-Nic
-Nic
#47
Instructor
Thread Starter
Code:
FM2-P-TNSL-US-PO-MLP e0dd4567
https://github.com/ibreakifix/Porsch...2_SNE2PROM.bin
Once you change those, you can possibly reflash your unit with user-defined SWDL enabled in GEM, then update via SWDL menu. Please let me know if this helps.
#48
Actually, ignore my post from above, I think you just have to correct your EEPROM edit to convert your unit to PCM. There might be other variant related info stored in storage*.raw and sysetbackup, so go ahead and remove those anyway since you can recreate them later. You also might need to change /mnt/efs-persist/SWDL/variant.txt to the following (line 1 = variant, line 2 = crc32b of variant string)
Somebody else asked for a copy of my EEPROM, so here is the backup I took before messing with adaptations. You can not flash this via E2PModify since FAZIT ID and a couple other values are write-protected via that application (at least on my unit).
https://github.com/ibreakifix/Porsch...2_SNE2PROM.bin
Once you change those, you can possibly reflash your unit with user-defined SWDL enabled in GEM, then update via SWDL menu. Please let me know if this helps.
Code:
FM2-P-TNSL-US-PO-MLP e0dd4567
https://github.com/ibreakifix/Porsch...2_SNE2PROM.bin
Once you change those, you can possibly reflash your unit with user-defined SWDL enabled in GEM, then update via SWDL menu. Please let me know if this helps.
Code:
FM2-P-TNSL-US-PO-MLP" -> may work, but there is small possibility to break unit (some time ago I broke CAN communication on Audi unit playing with unit HW info)
#49
As I know eeprom change not works, ee contains cp data and unit will not boot.
EE has also encrypted area the Aes key is in the Nec.
I already change the variant. Txt and the eeprom train. But variant conflict is still there.
There must be something in Rcc which must be changed....
EE has also encrypted area the Aes key is in the Nec.
I already change the variant. Txt and the eeprom train. But variant conflict is still there.
There must be something in Rcc which must be changed....
#50
[QUOTE=mobista;15971061]If U will get advanced engineering menu U will be able to do this with proper eeprom values editted.
How can I get this advanced engineering menu?
Is this a script? What is the name of it
I heard it is possible with it to skip variant check
How can I get this advanced engineering menu?
Is this a script? What is the name of it
I heard it is possible with it to skip variant check
#51
Instructor
Thread Starter
As I know eeprom change not works, ee contains cp data and unit will not boot.
EE has also encrypted area the Aes key is in the Nec.
I already change the variant. Txt and the eeprom train. But variant conflict is still there.
There must be something in Rcc which must be changed....
EE has also encrypted area the Aes key is in the Nec.
I already change the variant. Txt and the eeprom train. But variant conflict is still there.
There must be something in Rcc which must be changed....
mib2_ioc_flash updateAppNow /net/mmx/fs/{your_sd_path}/V850app_MLBPO.bin
mib2_ioc_flash updateBoloNow /net/mmx/fs/{your_sd_path}/V850bolo_MLBPO.bin
Last edited by chris2; 07-15-2019 at 11:31 PM.
#52
#53
I think the V850 controls variant information, what if you flash the Porsche app and bootloader to the IOC with mib2_ioc_flash, then clone eeprom and reboot?
mib2_ioc_flash updateAppNow /net/mmx/fs/{your_sd_path}/V850app_MLBPO.bin
mib2_ioc_flash updateBoloNow /net/mmx/fs/{your_sd_path}/V850bolo_MLBPO.bin
mib2_ioc_flash updateAppNow /net/mmx/fs/{your_sd_path}/V850app_MLBPO.bin
mib2_ioc_flash updateBoloNow /net/mmx/fs/{your_sd_path}/V850bolo_MLBPO.bin
btw do you know does the MMX NOR load the scipts,and greenmenü into the EMMC ? or is this stored in the EMMC over SW updates ?
#55
Instructor
Thread Starter
Run on MMX
Code:
mount -u /mnt/app mkdir -p /eso/hmi/lsd/jars #file location choosen to preserve consistency after flashing /mnt/app touch /eso/hmi/lsd/development_activated cp -vRf /eso/hmi/lsd/lastmode_gemmi_enabled.properties.devel /eso/hmi/lsd/lastmode.properties if [ ! -d /eso/hmi/lsd/jre ]; then mkdir /eso/hmi/lsd/jre cp -vRf /ifs/jre/* /eso/hmi/lsd/jre cp -vRf /ifs/lsd.jxe /eso/hmi/lsd/lsd.jxe fi
Code:
VMOPTIONS="$VMOPTIONS -DIS_PRODUCTION_MODE=true"
-> PCM4 Head Unit (Known PNs Listed, Pick One)
- 9P1-035-891 NAR, No Telephone Module
- 9P1-035-880 NAR, Telephone Module Installed, Satellite Radio Installed
- 9P1-035-036 NAR, Telephone Module Installed, No Satellite Radio
- 9P1-035-038 NAR, No Telephone, No Satellite Radio
- 9P1-035-868 AUS, No Telephone Module
- MIB2 Can be converted from other VAG brand if green LVDS connector is present.
-> Display Module (Pick based on your MIB2 having a SIM card slot or not)
- 9P1-919-607 991 / 982 / 981 Compatible (ABTHigh 2 slot - Units w/o tel module)
- 9P1-919-606 991 / 982 / 981 Compatible (ABTHigh 3 slot - Units w/ tel module)
-> Display Module Wiring
- 8L0-971-883 Display CAN + Power Connector (requires crimp tool + TE pins, pinout below) Can be sourced pre-wired from junkyard 05-14 VW dashboard light switches (ex: 1K0 941 334)
- 9P1 970 349 Display LVDS Cable
Sound:
-> Bose Cars
- Must be changed to 4G0-035-220 if Bose is fitted
- MOST wiring must be removed from PCM3.1 harness, and transferred into its own connector:
- TE Connectivity 1-1355531-1 - MOST fiber optic connector inner housing
- TE Connectivity 1-1355426-1 - MOST fiber optic connector outer housing
-> ASK Cars
- Remove ASK amplifier. Amplifier is now part of PCM4, so jumper the wires from one harness to the other. Run additional wires from PCM4 to this location for the additional speakers, depending on sound package.
#57
Instructor
Thread Starter
Your MMX SKU is the same as my PCM4's MMX SKU - 900-61852-3902-210 L, so there should be no differences in hardware.
What is the VAG part number of your MIB2?
#58
Same pinout as in the first post. Look at the bottom of the board underneath U1 for the EMMC pinouts. If you are reading the EMMC while installed on the MMX PCB, you need to remove the resistors to the CMD and CLK lines, then replace them when done. One is 0 Ohms, the other (CLK) is 21k ohm IIRC.
Your MMX SKU is the same as my PCM4's MMX SKU - 900-61852-3902-210 L, so there should be no differences in hardware.
What is the VAG part number of your MIB2?
Your MMX SKU is the same as my PCM4's MMX SKU - 900-61852-3902-210 L, so there should be no differences in hardware.
What is the VAG part number of your MIB2?
which are different here for eg mib2
#59
Instructor
Thread Starter
https://www.digikey.com/product-deta...157-ND/2043052
The correct rev board is 180-61852-BAAC-DC1 for PCM4. Also, I could not help but notice you ignored the question I asked you about the MIB2 part number you have
#60
Rennlist Member
Well, we can call off the search for the missing MLCC production capacity...