Turbo Quattro

mobista писал(а):I think 30...

malec писал(а):0xxx0010 -> it is Q1 2014 and that means for each year you increment by 4.
Map update is usually released in Q1 and Q3
14 -> Q1 2015
18 -> Q1 2016
1C -> Q1 2017
1E -> Q3 2017
20 -> Q1 2018
24 -> Q1 2019
28 -> Q1 2020
2F -> Q4 2021
............

malec писал(а):0xxx0010 -> it is Q1 2014 and that means for each year you increment by 4.
Map update is usually released in Q1 and Q3
14 -> Q1 2015
18 -> Q1 2016
1C -> Q1 2017
1E -> Q3 2017
20 -> Q1 2018
24 -> Q1 2019
28 -> Q1 2020
2F -> Q4 2021
............

mobista писал(а):Hello,

Do anyone know algo for Map Care FEC? 0230001E -> how long this FEC is valid for map update?

br,
mobista

PopDog писал(а):I bought new MIB2 Unit for my Q7 4M because I also want DAB+ - before i will fit this new MIB2 unit, i would like to hacktivate it after Update to newest Version (e.g. Map Lifetime, AndroidAuto/CarPlay all fecs, and remove CP) and want to learn how it is done

In my MIB2 from Q7 4M P Software there is a scripts folder, also with some files called - activate_AndroidAuto.sh activate_CarPlay.sh
There are also some Scripts to deactivate FEC, Activate FEC and activate FECSigOn.sh maybe from that it is possible to know where to deactivate FEC Signing over Telnet

look at fecSig_on.sh


so if we remove USE_FEC_SIG and touch a USE_FEC, maybe it works. But why is it in /navigation mount/folder...

fec_off.sh


navpre.sh makes some mounts writable
Can it be this easy? Don't want to kill one of my units ... so not tested yet

congo писал(а):I don't have time to register in the other forum so i will quote something here



For OTP and NOR flash - ignore the S29 model it's just from that flash type pdf


What Harman did is to put the pkey there, btw it's the same in old MMI. This have nothing to do with the EEPROM or the efs partition. Sad but true.
You can read that region when chip is off with special reader or with custom code running on the mib.

Having said this i dont say it's impossible to use own keys but here are some important points to consider:
1. Still need to patch MIBRoot to ignore OTP
2. Dont touch the data keys only fec and/or metainfo as data key is used to verify other things

That's why i said it's not worth the effort because you still need to patch something in the unit.

Regards.

#!/bin/sh

/eso/hmi/engdefs/scripts/navpre.sh
rm -fv /navigation/USE_FEC
touch /navigation/USE_FEC_SIG
echo "created /navigation/USE_FEC_SIG"
sync

rm -fv /navigation/USE_FEC
rm -fv /navigation/USE_FEC_SIG

mount -u /mnt/system/
mount -u /mnt/app/
touch /etc/mcd.writable
/eso/hmi/engdefs/scripts/remountSDCard.sh

I believe the efs-system partition is the “OTP” area he is referring to, even though it is not OTP.

I have not found thekeyanywhere else, and I don’t even believe there is any one time programmable flash on the board. There are regions of the eeprom that are protected by the software, but those contain the fazit id and notkeys, additionally the entire NOR is writeable from within QNX. Given that, he might have a MIB2 from Delphi which is apparently designed much differently than the Harman Becker unit

The S29GL-S flash devices have 1024 bytes of one time programmable (OTP) memory. This Secure SiliconRegion (SSR) is divided into two areas, the lower 512B region, SSR Region 0, is Factory modifiable and the upper512B region, SSR Region 1, is Customer modifiable. SSR0 can be ordered Factory pre-programmed. SSR0 isFactory locked and cannot be Customer modified

After some research i came to conclusion that we cannot simply change the keys. As you already know they are all signed, and although the sign key looks to be the MIB-High_MI_public its actually a key that's in the NOR flash OTP area. In our case it happens to be the same is the public key but we cant change that. MIBRoot check this before it uses the keys found the the persist area. Unless you change the flash chip you cant use your own keys so it just not worth the effort Regards.