Dissasembling Cluster Firmware

[heinzboehmer]

Anyone done this before?

Want to write custom code for mine (to add a porsche-esque gear indicator for my 6MT car) and figured I'd ask before taking stuff apart and dumping EEPROM contents.

[Tomba]

I believe the stock cluster has option to be enabled for SMG. Sending the CAN messages (correct gear) with a self programmed device (Arduino, STM32) would I think be an option. Vehicle speed and engine speed would be present on the CAN-BUS.
I think PASoft 1.4 is able to dump the content of the serial eprom. But only data is present on that one, you need program code. I don't know which uP is present on the instrument cluster, from there we can check which tool could read the content.

[heinzboehmer]

I believe the stock cluster has option to be enabled for SMG. Sending the CAN messages (correct gear) with a self programmed device (Arduino, STM32) would I think be an option. Vehicle speed and engine speed would be present on the CAN-BUS.
I think PASoft 1.4 is able to dump the content of the serial eprom. But only data is present on that one, you need program code. I don't know which uP is present on the instrument cluster, from there we can check which tool could read the content.

Yeah, I thought about using an SMG cluster, but I don't love the look of it. Plus, where's the fun in using an Arduino? Would be too straightforward
Hmm, I was hoping program code would be present in that EEPROM. To be clear, this is very much still just an idea in my mind. I haven't done much investigating past looking at a couple pics of (physically) dissasembled clusters online. Guess I need to get myself a cluster that I can mess with and, like you said, first figure out what even is on there.

[Bry5on]

Is your cluster early or late? I have a spare early one and an EEPROM reader over here. Keep in mind that to flash the cluster you’re going to need to pull it completely apart, including the needles, the whole deal.

[Slideways]

Would it be possible to get the SMG cluster to show the correct gear for a manual car? My guess is the signal is coming from the SMG TCU which is not present in the manual car. Could a custom board intercept the signal from the gear position sensor and relay it back to the cluster? I think someone was looking into it on the old forum. It would be cool to see it working, mostly for kicks.

[heinzboehmer]

Is your cluster early or late? I have a spare early one and an EEPROM reader over here. Keep in mind that to flash the cluster you’re going to need to pull it completely apart, including the needles, the whole deal.

It's an early one. Don't know if there are any hardware differences between the early and late ones.

And yeah, that's why I haven't started messing with mine. Don't really want to be taking it apart a ton of times.

Would it be possible to get the SMG cluster to show the correct gear for a manual car? My guess is the signal is coming from the SMG TCU which is not present in the manual car. Could a custom board intercept the signal from the gear position sensor and relay it back to the cluster? I think someone was looking into it on the old forum. It would be cool to see it working, mostly for kicks.

Yep, that's exactly how you would do it. Except that I think the GPS only signals neutral/not neutral on manual cars. Would need to do a bit of math with rpm and wheel speed to figure out the gear you're in.

[S54B32]

Anyone done this before?

Want to write custom code for mine (to add a porsche-esque gear indicator for my 6MT car) and figured I'd ask before taking stuff apart and dumping EEPROM contents.

I don‘t want to stop you from anything, but being realistic the reverse engineering work behind this would be absolut silly and require very strong disassembling knowledge and skills. Only reasonable option in my opinion is to emulate can signals to use smg display or replace the display entire with a self build display.

[Tomba]

There might be a downside if using SMG CAN signals. If these signals are present and the modules are not coded to SMG. They will throw error codes for sure about the coding and may not function properly (DSC will show ASC light).
DME and DSC check if the CAN signals are present and check this based on the coding. If coded for SMG and no SMG CAN IDs present it will throw error code for missing bus messages. If not coded for SMG and SMG CAN IDs are present it will throw a coding error.

There are a few variants of the IKE/KOMBI, Bosch and Motometer to my knowledge. I don't know if they use the same uP (micro-processor). From quick looks on the net I can observe the NEC writings on one of the chips. I don't know if IDA, ghidra or any other disassembler has them included and if there are tools to read these uP's (XPROG, UPA, ...). I would first check which uP is present to look into the possibilities for a next step.

Serial eprom is mainly used for mileage and coding. Strongly doubt the main program is running with it. I have a 320i and will check tomorrow/this evening if I can read the uP with PASoft.

[heinzboehmer]

I don‘t want to stop you from anything, but being realistic the reverse engineering work behind this would be absolut silly and require very strong disassembling knowledge and skills. Only reasonable option in my opinion is to emulate can signals to use smg display or replace the display entire with a self build display.

Oh I'm aware that this will be a pain lol. I don't expect to gain anything from it though, just a side project that may or may not work. I've got a good amount of low level/embedded experience, so I should be able to figure stuff out.

There might be a downside if using SMG CAN signals. If these signals are present and the modules are not coded to SMG. They will throw error codes for sure about the coding and may not function properly (DSC will show ASC light). DME and DSC check if the CAN signals are present and check this based on the coding. If coded for SMG and no SMG CAN IDs present it will throw error code for missing bus messages. If not coded for SMG and SMG CAN IDs are present it will throw a coding error.

There are a few variants of the IKE/KOMBI, Bosch and Motometer to my knowledge. I don't know if they use the same uP (micro-processor). From quick looks on the net I can observe the NEC writings on one of the chips. I don't know if IDA, ghidra or any other disassembler has them included and if there are tools to read these uP's (XPROG, UPA, ...). I would first check which uP is present to look into the possibilities for a next step.

Serial eprom is mainly used for mileage and coding. Strongly doubt the main program is running with it. I have a 320i and will check tomorrow/this evening if I can read the uP with PASoft.

Thank you! I don't have PASoft myself, but know a couple people that have it. Might try messing around with that as well.

For now, I'm passively looking for a spare cluster. Once I get that I can really dive into this project.

[Bry5on]

Early and late PASoft EEPROM reads both attached. 6-4 is early 22H cluster, 10-13 is late 24H cluster. Doesn’t look like anything that relates to the uC instructions here. Enjoy anyway!

edit: my spare cluster is technically for sale here on the forum… https://nam3forum.com/forums/forum/c...hing-sw4-7-lcm