Turbo Quattro

What is the full train version?

MHI2 Root Password List
https://bit.ly/37LHHc1

MHI2 Root Password List
https://bit.ly/37LHHc1

Feel free to send me PN request for root password based on HASH:
Include:

• SW Train
• HASH from RCC partition (normal root)
• HASH from MMX partition (emergency root)

Will take 1-2 days to get the keys.

In the spirit of all the **** who do not want to share.
Here we go:

[TABLE="width: 642"]
[TR]
[TD] MU version
[/TD]
[TD] Brand
[/TD]
[TD] FW version
[/TD]
[TD] HASH
[/TD]
[TD] Password
[/TD]
[/TR]
[TR]
[TD]1119
[/TD]
[TD]Porsche
[/TD]
[TD]MHI2_ER_POG11_K4185
[/TD]
[TD]wCvBZ8buAIz/E
[/TD]
[TD ...

M.I.B. - More Incredible Bash
https://bit.ly/3nPIHl8

MHI2 Root Password List
https://bit.ly/37LHHc1

MIB2 MHI2/MH2P/MHS2/MST2/RMC FW and Solutions Collection
https://bit.ly/3nunsEj

Telegram Group
https://t.me/joinchat/EHt4RRksHcMQk6Xi6tFaBw

RUS - Перевод V0.7.5

https://filehorst.de/d/dmoBwaEf
https://anonymousfiles.io/M8NT7vve/

ENG - English V0.7:
https://filehorst.de/d/drvcntfl
https://anonymousfiles.io/xzi8Nq2r/

ES - Español V0.7:
https://filehorst.de/d/dwyowtEI
https://anonymousfiles.io/HQal6oc4/

DE - Deutsch V0.7:
https://filehorst.de/d/dlolHieF
https://anonymousfiles.io/i0RoCjsY/

Source: https://bit.ly ...

How far gone is your MMX?

Mine is completly dead and I do not have success with the qboot and BCT I extracted from my MMX backup.

Could you share your setting or compare with mine I postet earlier?

@aleka

I'm still stuck with the issue:
[ATTACH=CONFIG]69214[/ATTACH]

Any ideas?

No, the solution was for MIB1.
I tried to follow a similar way on my MIB2, but git stuck. I think the NVFlash Version I got is still not the right one.

Found this on one of the neighboring board:

RUS - Перевод V0.7.5 https://filehorst.de/d/dmoBwaEf
https://anonymousfiles.io/M8NT7vve/

ENG - English V0.7:
https://filehorst.de/d/drvcntfl
https://anonymousfiles.io/xzi8Nq2r/

ES - Español V0.7:
https://filehorst.de/d/dwyowtEI
https ...

Still stuck with the situation mentioned above.
ROM Table and Corex-9 are missing in the ROM Table.

Which hex range from the Original MMX dump would this be?

Sorry, for missing this!

I changed the settings, however situation is exactly the same.

011.PNG

During testing I just booted the unit (no tegrarcm and hidden button).
In this state I can connect via JTAG!

Just trying to read a part of the flash 48000000 - 49000000.
The whole flash does not ...

@ aleka

I tried to follow your steps and got close.
But something is not working...

Do you have an idea?

JTAG connection points:
Bild13.jpg
J-Link pinout:
16.png

[TABLE="width: 1"]
[TR]
[TD] JTAG Pin [/TD]
[TD] Function [/TD]
[TD] J-Link Pin [/TD]
[/TR]
[TR]
[TD] 1 [/TD]
[TD] TDI [/TD]
[TD ...

Not JTAG, you mean serial. On quadlock, find pinout and you can directly get to MMX console and RCC. If RCC dead, only reprogram NAND with programmer, if RCC emergency still alive - you can put it to emrgency download mode (IOC will not power off the device), and then use 'flashit' for RCC and MMX ...

KBN писал(а):760000 -> mifs-stage1.img 3145728 need some modifications

What do you mean by this?

I'm manly looking for a way to recover my unit with a broken MMX image.

qboot seems to be located between 60000 - 70D00

Start and end as well as the middle part of that part of the MMX are very similar to the qboot.bin you provided.

I could extract the BCT from my MMX dump.
How do I get my qboot.bin, is it also a part of the MMX dump?

Flasing via JTAG starting from base address: 4800 0000.
Do I flash the full MMX dump or do I have to cut the BCT off?

Thanks a lot again!

I agree, on the software side.
However, I could still shorten or damage the hardware.

Killing RRC and MMX was not that smart...