Turbo Quattro

Tschako писал(а):"Complete firmware changing will lead to the activation the component protection, also navigation will not work."

The CP signature is not part of the Firmware or software. The CP Signature is part of the specific EEProm of the Unit.
Means, if you do a emergency recovery, normally the CP signature was protected and there was no changes in it. I´m not shure for the Map autorization?!

He meaning that he has patched unit from APG Without blocking sound even if CP is on.

...

Tschako писал(а):OK, thats possible. But for my information, the APG MIB Jail-Break has a sub-PCB for emulating like a VIN Faker, isn´t it??

Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

This`s my question too，all /MMX/*.img files

flashit -v -x -a 0x03540000 -f /net/mmx/fs/sda0/MMX1/efs-pers/40/default/efs-persist.img
Label: PL_qnx_flashit_10495A QNX: RL_qnx_650_10494A Built: 2010/12/10_11-21-47_UTC
/dev/fs0
--------
Flash size: 0x04000000 [= 512 x 0x20000]
Base addr: 0x03540000
File size: 0x00400000 (4194304)
End addr: 0x03940000
*** programming: 0x03540000 .. 0x0393FFFF amd_poll: 161 DQ5 set, program error
(devf t4::f3s_aCFI_v2write:169) over poll waiting for write completion at 2b5409fe
flashit: can't write 131072 bytes (?): Input/output error


Anybody have an idea about this error?

Some body have that firmware:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129
for mib 2 Columbus?

Why do U need those old version?

mobista писал(а):Why do U need those old version?

For updating, my unit have MHI2_ER_SKG11_P0260 (v.200), now update possible only to MHI2_ER_SKG11_P2104 / MHI2_ER_SKG11_P2129, on newer versions unit says "Train is locked".
Now i have hash for P0260 (v.200).

Sent me your eeprom.

I solved this question.

mobista писал(а):Sent me your eeprom.

I second the above request, I need some of these softwares:
MHI2_ER_SKG11_P0260
MHI2_ER_SKG11_P2104
MHI2_ER_SKG11_P2129

I have a very old MIB2 Skoda Columbus with sw 0200 and I can't update because train is blocked. I can't modify the eeprom because I don't have the root pass for sw 0200.

Anybody can share the above softwares or a root pass for 0200?

Password for energency not harman_f?

For emergency the pass is still harman_f, but I need the MMX pass as in RCC I cannot use modifyE2P because of missing DSI.

ZippeR писал(а):Unfortunately I don't know. I was used their units. Units was with CP error, but sound was not muted, also unit had Golf VIN on all of them, I think APG - is software solution with custom GEM (with disable/enable diagnostic option)

I have a question. I completely flashed all known partiotions in MIB from Emerg mode, but how I can flash app.img on MIB? Does some specific address, you know? btw. I took Adresses from metainfo2.txt from original firmware but there are no address for app.img
Thanks..

audijiJQ писал(а):This`s my question too，all /MMX/*.img files

This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

Kastrati писал(а):This is a old post but I have the same question for the MIB/MIB2 units: How to flash/replace app.img?

Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0


or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

magna413 писал(а):Open app.img file and paste partiontable header from 0x0 to 0x7fff. Then put it to mnand0.

dd if=..../path_to_sd/app(with header).img of=/dev/mnand0


or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

Thanks for your help, I am learning a lot with you, I try to undestand the structure and do not brick more my MMX.
I dumped mnand0 to sda0 with cat ... > file.img and most content from 0x0 to 0x7FFF is F3DEBC9A (attached img): Is it the expected header to paste into app.img?

magna413 писал(а):
...or

dd if=..../path_to_sd/app.img skip 64 of=/dev/mnand0

update: I think this command should be dd if=..../path_to_sd/app.img seek=64 of=/dev/mnand0