Audi A6 4G MIB Head Unit HIGH

[paskuale]

Hello to all forum member !
I open this thread to talk about the new MMI 3GP unit that equipped the Audi A6 4G Facelift (4G1035044)
Can we talk about differences and similarities from previus head unit 3GP (4G0035666-670).

Does it have an internal eeprom where are stored information about CP, coding, part number ?
It's possible to read internal eeprom like previus generation ?

It's true that after firmware upgrade MIB units need always CP unlock ?

Does this unit have internal Radio Tuner ?

If someone has other info, please talk here about.

I'm sorry if I write in english, but I can't speak Russian Language.
I will traduce with Google Translator for the Russian Friends and apologies for some mistakes due using translator

Best Regards

------------------------------------------------------------------
Привет всем участником форума!
Я открываю эту тему, чтобы поговорить о новом блоке MMI 3GP, что оборудовал Audi A6 4G Facelift (4G1035044)
Можем ли мы говорить о сходствах и различиях от закупочных руководитель отдела 3GP (4G0035666-670).


Есть ли у внутреннюю EEPROM, где хранятся сведения о CP, кодирование, номер детали?
Это можно прочитать внутреннюю EEPROM как закупочных поколения?


Это правда, что после обновления прошивки MIB единицы должны всегда разблокировки CP?

Есть ли у этого подразделения внутренней радио-тюнер?

Если кто-то имеет другую информацию, пожалуйста, здесь говорить о.


Я извиняюсь, если я пишу на английском языке, но я не могу говорить на русском языке.
Я злословить с Google Переводчик для российских друзей и извинения за ошибки вследствие помощью переводчика


С Уважением

[MMI]

Привет,


Кто знает, какие кнопки нажимать для получения "зеленых меню"?


Активация делается, только нормальные кнопки не работают для зеленых человечков
и.


Спасибо и уважением,


Рой

[audijiJQ]

I have seen in other places, to enable development mode 5F, and then enter the green menu The middle section, you may need to use "MENU" button to replace the "BACK" button
MIB_A3按键组合.png

[audijiJQ]

Memory read the script already have it?

[paskuale]

Someone tests the audijiJQ procedure ?
I think it will work for Audi A3 8V, because MIB for A6 4G has the same panel command as first 4G.

No any news avaible at moment ?

--------------------------------------------------------------------
Кто-то испытывает процедуру audijiJQ?
Я думаю, что это будет работать для Audi A3 8V, потому что MIB для A6 4G имеет ту же самую команду панели, как первый 4G.


Нет никаких новостей доступна в данный момент?

[audijiJQ]

Someone tests the audijiJQ procedure ?
I think it will work for Audi A3 8V, because MIB for A6 4G has the same panel command as first 4G.

No any news avaible at moment ?

--------------------------------------------------------------------

Кто-то испытывает процедуру audijiJQ?
Я думаю, что это будет работать для Audi A3 8V, потому что MIB для A6 4G имеет ту же самую команду панели, как первый 4G.


Нет никаких новостей доступна в данный момент?

Sorry, A6 MIB operation panel does not change, I ignore this; it should still "CAR" and 'MENU "combination, but first you have to enable the development of pattern matching, such as images inside as marked.

[MMI]

HI,


Любой, кто может изменить сценарии для захоронения APP? Свое основанное на тех же системах, как 3G и + так что только файловая система отличается.


Таким образом, то, что существуют sripts можно использовать, они должны быть изменены.


С Уважением,


Рой

[paskuale]

We need new login too I think !
VCP can do VIM on this unit, so I think that login is avaible...

[MMI]

Hi,

Can anybody tell me if i "need" to write in russian or will English do ?

Anyway, this login is the same as MIB A3 8V I guess.

I will have some testing units here next week, i will post info when i have it.

I would need some help on the DES hash with the password to have root acces.

Regards,

Roy

[Tschako]

@ Pascuale:
VCP and Others using the known EOL-Login for coding MIB units: 20103
But the Engineering Mode Login Other Needs an ... somebody with news ?? Lets share Our ​​Knowledge!
@ MMI: What kind of Activation you Talk About ??

[audijiJQ]

@Tschako I use 20103 Log MMI system, suggesting that access authorized to be accepted, but hidden match channel 48 is still not open.It appears to only be used in MIB system, right?

[MMI]

Hi,

The activation of the "green menu", i think there are 2 menu's green, or, the rest of the content of the green menu needs to be activated. I have lots of units here and also some test units, they all have green menu but only the test unit has the coding options for the settings in the car as we are used to in the 3G(+) units. So my guess is that this "important" settings for us are hidden or in other menu.

Regards,

ROy

[MMI]

Hello,

Anybody knows the checksum algo's used in the META file for the MIB update SD cart ? I do not mean the CRC32 for the metafile it self but for the calulation of checksum of let say EFS-PERSIST.IMG, in meta file there are 8 checksums for that file.

Regards,

Roy

[bertelsmann]

FW MIB
uses Sha1 Algo But at the end of the file there is A (RSA) Signature (128 bytes) That is Probably the dealbreaker :-( regards

[bertelsmann]

btw
does anybody have an idea what format the ifs-images
in the MIB Firmware updates are ?!
They look encrypted to me

[audijiJQ]

yes it's use SHA1 ,but some checksum is not right,and one file has multiple checksum

Most files have a cryptographic signature, including the map files and FSC documents

[MMI]

@ bertelsmann, you think you can recalculate the checksums ?

Regards,

Roy

[bertelsmann]

checksum recalculation is no problem at All
Just Spit it into 512 kbyte blocks

openssl dgst -sha1 block1
openssl dgst -sha1 block2
...
does all you need

but the problem is probably the signature block at the and of the metafile
seems to me like a rsa signature
probably it is the metafileChecksum (20 bytes)
rsa signed with a 1024 bit private key
the corresponding public key has to be in the unit

but without the private key ... well ...

[audijiJQ]

MIB system IFS-ROOT.IFS DUMPIFS command can be used directly. This is what I get the table of contents, but I do not know how to extract the files to a designated place.

Offset Size Name 0 8 *.boot
8 100 Startup-header flags1=0x9 flags2=0 paddr_bias=0
108 22008 startup.*
22110 5c Image-header mountpoint=/
2216c 34cc Image-directory
---- ---- Root-dirent
---- ---- mnt/ifs-root/usr/apps/config
---- 1a lib/libcpp-ne.so.4 -> /proc/boot/libecpp-ne.so.4
---- 16 usr/lib/factories/libbrokerproxy.so -> /lib/libbrokerproxy.so
---- 21 usr/lib/factories/libasirccpersistenceproxy.so -> /lib/libasirccpersistenceproxy.so
---- 19 usr/lib/factories/libasirccrvcproxy.so -> /lib/libasirccrvcproxy.so
---- f usr/lib/libcomm.so -> /lib/libcomm.so
---- 1d usr/apps/config -> /mnt/ifs-root/usr/apps/config
---- 24 opt/sys/lib/libsys_dsi_colibry.so.2 -> /opt/sys/lib/libsys_dsi_colibry.so.3
---- 2a opt/sys/lib/libsys_dsi_servicebroker.so.1 -> /opt/sys/lib/libsys_dsi_servicebroker.so.2
---- 22 opt/sys/lib/libsys_dsi_trace.so.2 -> /opt/sys/lib/libsys_dsi_trace.so.3
---- 2a opt/sys/lib/libsys_trace_clienttrace.so.3 -> /opt/sys/lib/libsys_trace_clienttrace.so.4
---- 26 lib/libSysMoCCAFrameworkSharedSo.so.5 -> /lib/libSysMoCCAFrameworkSharedSo.so.6
---- 13 lib/libsocket.so.2 -> /lib/libsocket.so.3
---- 8 bin/rz -> /bin/lrz
---- 9 dev/serkeypanel -> /dev/null
---- a tmp -> /dev/shmem
---- 9 dev/console -> /dev/ser1
---- 8 bin/sh -> /bin/ksh
25638 96b etc/symlinks.cfg
25fa3 56 etc/system/enum/include/net
26000 8a000 proc/boot/procnto-j5-instr
b0000 610 proc/boot/.script
b0610 7f3 etc/mib_i2c.cfg
b0e03 1f8 etc/mib_spi2_VICS.cfg
b1000 170 proc/boot/serverstarterboot
b1170 c04 etc/system/enum/include/usb-class
b1d74 25f etc/mib_spi3.cfg
b1fd3 29 etc/version/ifs-root-version.txt
b2000 144 proc/boot/start_pcie_cbc
b2144 aad etc/inetd.conf
b2bf1 350 etc/mib_spi0.cfg
b2f41 be etc/group
b3000 88 proc/boot/server.cfg
b3088 f33 usr/bin/modifyPackage.sh
b3fbb 44 etc/qnet_hosts
b4000 c etc/mib_C1
b400c 765 etc/system/enum/devices/usb/net
b4771 699 etc/NavPositioning.hbtc
b4e0a 1f1 etc/devc-navsens.config
b5000 299c proc/boot/mkprocsymlinks
b799c 502 etc/mcd.cfg
b7e9e 158 usr/bin/startup_problems_debug.sh
b8000 77000 proc/boot/libc.so.3
---- 9 proc/boot/libc.so -> libc.so.3
12f000 9fdaf bin/io-pkt-v4
1cedaf 249 etc/profile
1cf000 19059 bin/ifconfig
1e8059 2db etc/system/enum/devices/usb/char
1e8334 2cc usr/bin/hbhogs
1e8600 235 etc/mib_spi2_DAB.cfg
1e8835 217 mnt/ifs-root/usr/apps/config/tracing.json
1e8a4c 210 usr/bin/dhcp_ifconfig.sh
1e8c5c 1e8 etc/system/enum/devices/usb/mass
1e8e44 18d usr/bin/mount_efs_rw.sh
1e8fd1 26 usr/bin/stfu
1e9000 541f bin/if-test
1ee41f 1da usr/bin/stop_efs_driver.sh
1ee5f9 16a mnt/ifs-root/usr/bin/mocca_watchdog_warn_dump.sh
1ee763 141 etc/system/enum/common
1ee8a4 130 bin/login
1ee9d4 128 etc/passwd
1eeafc ff usr/bin/set_variant.sh
1eebfb fe etc/version/RCC-version.txt
1eecf9 eb etc/suid_profile
1eede4 b6 etc/mcd.mnt
1eee9a a2 etc/system/enum/include/block
1eef3c 9b etc/version/version.txt
1eefd7 26 mnt/ifs-root/usr/apps/config/probes.json
1ef000 6218 usr/sbin/tracelogger
1f5218 89 etc/cfmem.cfg
1f52a1 70 mnt/ifs-root/usr/bin/mocca_watchdog_timeout_dump.sh
1f5311 62 etc/hosts
1f5373 54 usr/bin/DAB_Enable.sh
1f53c7 1b etc/shadow_rcc
1f53e2 16 mnt/ifs-root/usr/apps/config/dsiagentmapping.json
1f6000 10c5c sbin/devc-seromap
207000 7e78 lib/dll/devnp-mib-rcc.so
20f000 2e719 lib/libsocket.so.3
---- e lib/libsocket.so -> libsocket.so.3
23e000 33e4f lib/dll/lsm-qnet.so
272000 3c04 usr/bin/rcc-pcie-init
276000 41bb sbin/slogger
27b000 81cf sbin/route
284000 59b1 usr/bin/setconf
28a000 60a1 bin/waitfor
291000 653f bin/dsploader
298000 25f0 usr/sbin/if_up
29b000 45bf bin/mount
2a0000 41d68 bin/ksh
2e2000 13270 bin/lrz
2f6000 13ff8 bin/lsz
30a000 5653 bin/ls
310000 355b bin/ln
314000 2be7 bin/sloginfo
317000 36ce bin/chmod
31b000 836ce lib/libcomm.so
39f000 4cd7 lib/libdsicommon.so
3a4000 3c6cb lib/libiplcommon.so
3e1000 5c79e lib/libosal.so
43e000 18d40 lib/libprobes.so
457000 7699 lib/libprobesTraceMessageBackend.so
45f000 a3cc lib/libprobesTracingBackend.so
46a000 6d9ed lib/libtracing.so
4d8000 ab398 lib/libunicodestring_data.so
584000 8e6ee lib/libutil.so
613000 4816 lib/libasirccrvcproxy.so
618000 ec64 lib/libasirccpersistenceproxy.so
627000 c2fd lib/libbrokerproxy.so
634000 26f29 proc/boot/libm.so.2
---- 9 proc/boot/libm.so -> libm.so.2
65b000 1d8c8 proc/boot/libecpp-ne.so.4
---- f proc/boot/libecpp-ne.so -> libecpp-ne.so.4
679000 5ccc bin/exec_login
67f000 247b bin/cat
682000 3252 bin/mv
686000 9fb2 bin/cp
690000 323d bin/rm
694000 2cb5 bin/mkdir
697000 67c0 bin/df
69e000 318a bin/du
6a2000 531b sbin/pipe
6a8000 845d sbin/enum-devices
6b1000 5842 sbin/enum-usb
6b7000 b152 sbin/devb-umass
6c3000 1d3c1 sbin/devc-serusb
6e1000 60a1 bin/on
6e8000 1346f bin/pidin
6fc000 207e bin/sleep
6ff000 15ed7 sbin/dumper
715000 9a3b sbin/mcd
71f000 10357 bin/ircCtrl
730000 4c5c bin/slay
735000 1ddb bin/umount
737000 18ef8 usr/sbin/fs-cifs
750000 113c7 usr/sbin/dhcp.client
762000 50d7 usr/sbin/nicinfo
768000 ffa2 sbin/devc-pty
778000 b0b1 usr/bin/pdebug
784000 b465 usr/sbin/inetd
790000 37c89 sbin/devf-generic
7c8000 4c61 usr/bin/flashctl
7cd000 3cd3 usr/bin/flashit
7d1000 421b usr/bin/flashmib
7d6000 11334 usr/bin/checkFreeMem
7e8000 2a8f usr/bin/mib_dumper
7eb000 acdb usr/bin/grep
7f6000 29af usr/bin/touch
7f9000 538e usr/bin/use
7ff000 57cb usr/bin/hogs
805000 affe usr/bin/ping
810000 1df21 usr/bin/netstat
82e000 bb2e usr/bin/qkcp
83a000 59b1 usr/bin/setconf
840000 4aaf usr/bin/date
845000 1f675 sbin/io-usb
865000 b8c6 lib/libusbdi.so.2
---- d lib/libusbdi.so -> libusbdi.so.2
871000 2572a sbin/servicebroker
897000 9c14 lib/dll/devnp-shim.so
8a1000 d54f lib/dll/devn-asix.so
8af000 13d6e lib/libcam.so.2
---- b lib/libcam.so -> libcam.so.2
8c3000 229a1 bin/starter
8e6000 46d0 lib/dll/cam-disk.so
8eb000 5c40 lib/dll/cam-cdrom.so
8f1000 2b7ba lib/dll/io-blk.so
91d000 15da0 lib/dll/fs-dos.so
933000 e436 lib/dll/fs-cd.so
942000 fe51 lib/dll/fs-qnx4.so
952000 14700 lib/dll/fs-qnx6.so
967000 14ff2 bin/watchdog
97c000 11a44 usr/lib/libz.so.2
---- 9 usr/lib/libz.so -> libz.so.2
98e000 5061 usr/lib/libbacktrace.so.1
---- 11 usr/lib/libbacktrace.so -> libbacktrace.so.1
994000 5dc4 usr/lib/libfileupload.so
99a000 2000 lib/libwdgadapter.so.1
---- 12 lib/libwdgadapter.so -> libwdgadapter.so.1
99c000 818d lib/libheartbeat.so.3
---- 11 lib/libheartbeat.so -> libheartbeat.so.3
9a5000 6000 opt/sys/lib/libsrm_client.so
9ab000 7000 opt/sys/lib/libsrm_client_cmd.so
9b2000 11000 opt/sys/lib/libsnoopy.so
9c3000 1e000 opt/sys/lib/libsys_trace_clienttrace.so.4
---- 1d opt/sys/lib/libsys_trace_clienttrace.so -> libsys_trace_clienttrace.so.4
9e1000 b000 opt/sys/lib/libsys_dsi_trace.so.3
---- 15 opt/sys/lib/libsys_dsi_trace.so -> libsys_dsi_trace.so.3
9ec000 5000 opt/sys/lib/libsys_dsi_servicebroker.so.2
---- 1d opt/sys/lib/libsys_dsi_servicebroker.so -> libsys_dsi_servicebroker.so.2
9f1000 1e000 opt/sys/lib/libsys_dsi_colibry.so.3
---- 17 opt/sys/lib/libsys_dsi_colibry.so -> libsys_dsi_colibry.so.3


d5d000 1165bc usr/apps/NavigationPositioning
e74000 79cc usr/apps/setVariant
e7c000 90ac usr/apps/startVariant
e86000 1a6c usr/apps/iocBootMode
e88000 2c40 usr/apps/flashReader
e8ac40 ef9f etc/srv-starter.cfg
e99bdf 3a8a usr/lib/factories/symlink.config
e9d669 3211 etc/IRCConfig.cfg
ea087a 2fef mnt/ifs-root/usr/apps/config/framework.json
ea3869 1b9f etc/dev-InicServer-mib-C1.cfg
ea5408 1987 etc/sysregs-jacinto-mib.cfg
Checksums: image=0xaf377e04 startup=0x1860b9d

[audijiJQ]

Friends, do you have a Chinese version of MIB firmware?