Подключение терминала на Columbus (Skoda A7) / Connecting the terminal to Columbus A7

ZippeR · Чт мар 10, 2016 10:30 pm

Tschako писал(а):"Complete firmware changing will lead to the activation the component protection, also navigation will not work."

The CP signature is not part of the Firmware or software. The CP Signature is part of the specific EEProm of the Unit.
Means, if you do a emergency recovery, normally the CP signature was protected and there was no changes in it. I´m not shure for the Map autorization?!

He meaning that he has patched unit from APG

Without blocking sound even if CP is on.

Tschako · Чт мар 10, 2016 10:56 pm

ZippeR · Пт мар 11, 2016 12:24 am

Tschako писал(а):OK, thats possible. But for my information, the APG MIB Jail-Break has a sub-PCB for emulating like a VIN Faker, isn´t it??

Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

audijiJQ · Пт мар 11, 2016 3:20 am

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

This`s my question too，all /MMX/*.img files

ZippeR · Пт мар 11, 2016 4:04 pm

flashit -v -x -a 0x03540000 -f /net/mmx/fs/sda0/MMX1/efs-pers/40/default/efs-persist.img
Label: PL_qnx_flashit_10495A QNX: RL_qnx_650_10494A Built: 2010/12/10_11-21-47_UTC
/dev/fs0
--------
Flash size: 0x04000000 [= 512 x 0x20000]
Base addr: 0x03540000
File size: 0x00400000 (4194304)
End addr: 0x03940000
*** programming: 0x03540000 .. 0x0393FFFF amd_poll: 161 DQ5 set, program error
(devf t4::f3s_aCFI_v2write:169) over poll waiting for write completion at 2b5409fe
flashit: can't write 131072 bytes (?): Input/output error

Anybody have an idea about this error?

Phaeton · Пн июн 17, 2019 1:00 am

Some body have that firmware:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129
for mib 2 Columbus?

mobista · Вт июн 18, 2019 2:05 pm

Why do U need those old version?

Phaeton · Чт июн 20, 2019 11:52 pm

mobista писал(а):Why do U need those old version?

For updating, my unit have MHI2_ER_SKG11_P0260 (v.200), now update possible only to MHI2_ER_SKG11_P2104 / MHI2_ER_SKG11_P2129, on newer versions unit says "Train is locked".
Now i have hash for P0260 (v.200).

mobista · Сб июл 13, 2019 12:54 pm

Sent me your eeprom.

Phaeton · Пн июл 15, 2019 9:55 am

I solved this question.

mobista писал(а):Sent me your eeprom.

mibmaster · Вт май 12, 2020 1:03 pm

I second the above request, I need some of these softwares:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129

I have a very old MIB2 Skoda Columbus with sw 0200 and I can't update because train is blocked. I can't modify the eeprom because I don't have the root pass for sw 0200.

Anybody can share the above softwares or a root pass for 0200?

magna413 · Чт май 14, 2020 11:32 pm

Password for energency not harman_f?

mibmaster · Чт май 14, 2020 11:42 pm

For emergency the pass is still harman_f, but I need the MMX pass as in RCC I cannot use modifyE2P because of missing DSI.

Kastrati · Вт ноя 24, 2020 3:55 pm

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

audijiJQ писал(а):This`s my question too，all /MMX/*.img files

This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

magna413 · Чт ноя 26, 2020 7:45 pm

Kastrati писал(а):This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0

or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

Kastrati · Вс ноя 29, 2020 12:40 am

magna413 писал(а):Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0

or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

Thanks for your help, I am learning a lot with you, I try to undestand the structure and do not brick more my MMX.
I dumped mnand0 to sda0 with cat ... > file.img and most content from 0x0 to 0x7FFF is F3DEBC9A (attached img): Is it the expected header to paste into app.img?

Вложение header.JPG больше недоступно

Kastrati · Ср дек 02, 2020 10:06 am

magna413 писал(а):
...or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

update: I think this command should be dd if=..../path_to_sd/app.img seek=64 of=/dev/mnand0