Turbo Quattro

**Kastrati** » Ср дек 02, 2020 10:06 am

magna413 писал(а):
...or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

update: I think this command should be dd if=..../path_to_sd/app.img seek=64 of=/dev/mnand0

**Kastrati** » Вс ноя 29, 2020 12:40 am

magna413 писал(а):Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0

or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

Thanks for your help, I am learning a lot with you, I try to undestand the structure and do not brick more my MMX.
I dumped mnand0 to sda0 with cat ... > file.img and most content from 0x0 to 0x7FFF is F3DEBC9A (attached img): Is it the expected header to paste into app.img?

Вложение header.JPG больше недоступно

**magna413** » Чт ноя 26, 2020 7:45 pm

Kastrati писал(а):This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0

or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

**Kastrati** » Вт ноя 24, 2020 3:55 pm

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

audijiJQ писал(а):This`s my question too，all /MMX/*.img files

This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

**mibmaster** » Чт май 14, 2020 11:42 pm

For emergency the pass is still harman_f, but I need the MMX pass as in RCC I cannot use modifyE2P because of missing DSI.

**magna413** » Чт май 14, 2020 11:32 pm

Password for energency not harman_f?

**mibmaster** » Вт май 12, 2020 1:03 pm

I second the above request, I need some of these softwares:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129

I have a very old MIB2 Skoda Columbus with sw 0200 and I can't update because train is blocked. I can't modify the eeprom because I don't have the root pass for sw 0200.

Anybody can share the above softwares or a root pass for 0200?

**Phaeton** » Пн июл 15, 2019 9:55 am

I solved this question.

mobista писал(а):Sent me your eeprom.

**mobista** » Сб июл 13, 2019 12:54 pm

Sent me your eeprom.

**Phaeton** » Чт июн 20, 2019 11:52 pm

mobista писал(а):Why do U need those old version?

For updating, my unit have MHI2_ER_SKG11_P0260 (v.200), now update possible only to MHI2_ER_SKG11_P2104 / MHI2_ER_SKG11_P2129, on newer versions unit says "Train is locked".
Now i have hash for P0260 (v.200).

**mobista** » Вт июн 18, 2019 2:05 pm

Why do U need those old version?

**Phaeton** » Пн июн 17, 2019 1:00 am

Some body have that firmware:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129
for mib 2 Columbus?

**ZippeR** » Пт мар 11, 2016 4:04 pm

flashit -v -x -a 0x03540000 -f /net/mmx/fs/sda0/MMX1/efs-pers/40/default/efs-persist.img
Label: PL_qnx_flashit_10495A QNX: RL_qnx_650_10494A Built: 2010/12/10_11-21-47_UTC
/dev/fs0
--------
Flash size: 0x04000000 [= 512 x 0x20000]
Base addr: 0x03540000
File size: 0x00400000 (4194304)
End addr: 0x03940000
*** programming: 0x03540000 .. 0x0393FFFF amd_poll: 161 DQ5 set, program error
(devf t4::f3s_aCFI_v2write:169) over poll waiting for write completion at 2b5409fe
flashit: can't write 131072 bytes (?): Input/output error

Anybody have an idea about this error?

**audijiJQ** » Пт мар 11, 2016 3:20 am

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

This`s my question too，all /MMX/*.img files

**ZippeR** » Пт мар 11, 2016 12:24 am

Tschako писал(а):OK, thats possible. But for my information, the APG MIB Jail-Break has a sub-PCB for emulating like a VIN Faker, isn´t it??

Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

**Tschako** » Чт мар 10, 2016 10:56 pm

**ZippeR** » Чт мар 10, 2016 10:30 pm

Tschako писал(а):"Complete firmware changing will lead to the activation the component protection, also navigation will not work."

The CP signature is not part of the Firmware or software. The CP Signature is part of the specific EEProm of the Unit.
Means, if you do a emergency recovery, normally the CP signature was protected and there was no changes in it. I´m not shure for the Map autorization?!

He meaning that he has patched unit from APG

Without blocking sound even if CP is on.

**Tschako** » Чт мар 10, 2016 10:02 pm

"Complete firmware changing will lead to the activation the component protection, also navigation will not work."

The CP signature is not part of the Firmware or software. The CP Signature is part of the specific EEProm of the Unit.
Means, if you do a emergency recovery, normally the CP signature was protected and there was no changes in it. I´m not shure for the Map autorization?!

**SkyFlyer** » Ср мар 09, 2016 9:37 am

You have to use the exactly the same region and variant of the FW on a FAT32 formatted SD Card for an emergency update.
Wrong variant or region doesn´t work.

I have EU version, so everything ok with this.

Tschako писал(а):Bad idea to activate the trace function w/o any need... sorry to say! The problem would be, that the trace writes and writes and fullfill the flash ramdisk til it crashes.

Yes...
It was my fault. Now I can not turn off this trace, after deactivation option, reboot the device - option is active again.
It is necessary to disable this option, but it is unknown how.

There is any way to clean/restore the virtual ramdisk?
Complete firmware changing will lead to the activation the component protection, also navigation will not work. Not a best way.

**Tschako** » Ср мар 09, 2016 12:45 am

Bad idea to activate the trace function w/o any need... sorry to say! The problem would be, that the trace writes and writes and fullfill the flash ramdisk til it crashes.

I´m sorry, but for the Columbus FW versions I don´t have any information.
For the Audi MIB the version 0337 is quite old and 1531 is the actual one...

You have to use the exactly the same region and variant of the FW on a FAT32 formatted SD Card for an emergency update.
Wrong variant or region doesn´t work.

Turbo Quattro

Подключение терминала на Columbus (Skoda A7) / Connecting the terminal to Columbus A7

Ответить

Развернуть Обзор темы: Подключение терминала на Columbus (Skoda A7) / Connecting the terminal to Columbus A7