Announcement

Collapse
No announcement yet.

Dissasembling Cluster Firmware

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Dissasembling Cluster Firmware

    Anyone done this before?

    Want to write custom code for mine (to add a porsche-esque gear indicator for my 6MT car) and figured I'd ask before taking stuff apart and dumping EEPROM contents.
    2002 Topasblau M3 - Coupe - 6MT - Karbonius CSL Airbox - MSS54HP Conversion - Kassel MAP - SSV1 - HJS - PCS Tune - Beisan - MK60 Swap - ZCP Rack - Nogaros - AutoSolutions - 996 Brembos - Slon - CMP - VinceBar - Koni - Eibach - BlueBus - Journal

    2012 Alpinweiss 128i - Coupe - 6AT - Slicktop - Manual Seats - Daily - Journal

    #2
    I believe the stock cluster has option to be enabled for SMG. Sending the CAN messages (correct gear) with a self programmed device (Arduino, STM32) would I think be an option. Vehicle speed and engine speed would be present on the CAN-BUS.
    I think PASoft 1.4 is able to dump the content of the serial eprom. But only data is present on that one, you need program code. I don't know which uP is present on the instrument cluster, from there we can check which tool could read the content.

    Comment


      #3
      Originally posted by Tomba View Post
      I believe the stock cluster has option to be enabled for SMG. Sending the CAN messages (correct gear) with a self programmed device (Arduino, STM32) would I think be an option. Vehicle speed and engine speed would be present on the CAN-BUS.
      I think PASoft 1.4 is able to dump the content of the serial eprom. But only data is present on that one, you need program code. I don't know which uP is present on the instrument cluster, from there we can check which tool could read the content.
      Yeah, I thought about using an SMG cluster, but I don't love the look of it. Plus, where's the fun in using an Arduino? Would be too straightforward
      Hmm, I was hoping program code would be present in that EEPROM. To be clear, this is very much still just an idea in my mind. I haven't done much investigating past looking at a couple pics of (physically) dissasembled clusters online. Guess I need to get myself a cluster that I can mess with and, like you said, first figure out what even is on there.
      2002 Topasblau M3 - Coupe - 6MT - Karbonius CSL Airbox - MSS54HP Conversion - Kassel MAP - SSV1 - HJS - PCS Tune - Beisan - MK60 Swap - ZCP Rack - Nogaros - AutoSolutions - 996 Brembos - Slon - CMP - VinceBar - Koni - Eibach - BlueBus - Journal

      2012 Alpinweiss 128i - Coupe - 6AT - Slicktop - Manual Seats - Daily - Journal

      Comment


        #4
        Is your cluster early or late? I have a spare early one and an EEPROM reader over here. Keep in mind that to flash the cluster you’re going to need to pull it completely apart, including the needles, the whole deal.
        ‘02 332iT / 6 | ‘70 Jaguar XJ6 electric conversion

        Comment


          #5
          Would it be possible to get the SMG cluster to show the correct gear for a manual car? My guess is the signal is coming from the SMG TCU which is not present in the manual car. Could a custom board intercept the signal from the gear position sensor and relay it back to the cluster? I think someone was looking into it on the old forum. It would be cool to see it working, mostly for kicks.

          Comment


            #6
            Originally posted by Bry5on View Post
            Is your cluster early or late? I have a spare early one and an EEPROM reader over here. Keep in mind that to flash the cluster you’re going to need to pull it completely apart, including the needles, the whole deal.
            It's an early one. Don't know if there are any hardware differences between the early and late ones.

            And yeah, that's why I haven't started messing with mine. Don't really want to be taking it apart a ton of times.

            Originally posted by Slideways View Post
            Would it be possible to get the SMG cluster to show the correct gear for a manual car? My guess is the signal is coming from the SMG TCU which is not present in the manual car. Could a custom board intercept the signal from the gear position sensor and relay it back to the cluster? I think someone was looking into it on the old forum. It would be cool to see it working, mostly for kicks.
            Yep, that's exactly how you would do it. Except that I think the GPS only signals neutral/not neutral on manual cars. Would need to do a bit of math with rpm and wheel speed to figure out the gear you're in.
            2002 Topasblau M3 - Coupe - 6MT - Karbonius CSL Airbox - MSS54HP Conversion - Kassel MAP - SSV1 - HJS - PCS Tune - Beisan - MK60 Swap - ZCP Rack - Nogaros - AutoSolutions - 996 Brembos - Slon - CMP - VinceBar - Koni - Eibach - BlueBus - Journal

            2012 Alpinweiss 128i - Coupe - 6AT - Slicktop - Manual Seats - Daily - Journal

            Comment


              #7
              Originally posted by heinzboehmer View Post
              Anyone done this before?

              Want to write custom code for mine (to add a porsche-esque gear indicator for my 6MT car) and figured I'd ask before taking stuff apart and dumping EEPROM contents.
              I don‘t want to stop you from anything, but being realistic the reverse engineering work behind this would be absolut silly and require very strong disassembling knowledge and skills. Only reasonable option in my opinion is to emulate can signals to use smg display or replace the display entire with a self build display.
              …under construction.

              Comment


                #8
                There might be a downside if using SMG CAN signals. If these signals are present and the modules are not coded to SMG. They will throw error codes for sure about the coding and may not function properly (DSC will show ASC light).
                DME and DSC check if the CAN signals are present and check this based on the coding. If coded for SMG and no SMG CAN IDs present it will throw error code for missing bus messages. If not coded for SMG and SMG CAN IDs are present it will throw a coding error.

                There are a few variants of the IKE/KOMBI, Bosch and Motometer to my knowledge. I don't know if they use the same uP (micro-processor). From quick looks on the net I can observe the NEC writings on one of the chips. I don't know if IDA, ghidra or any other disassembler has them included and if there are tools to read these uP's (XPROG, UPA, ...). I would first check which uP is present to look into the possibilities for a next step.

                Serial eprom is mainly used for mileage and coding. Strongly doubt the main program is running with it. I have a 320i and will check tomorrow/this evening if I can read the uP with PASoft.

                Comment


                  #9
                  Originally posted by S54B32 View Post
                  I don‘t want to stop you from anything, but being realistic the reverse engineering work behind this would be absolut silly and require very strong disassembling knowledge and skills. Only reasonable option in my opinion is to emulate can signals to use smg display or replace the display entire with a self build display.
                  Oh I'm aware that this will be a pain lol. I don't expect to gain anything from it though, just a side project that may or may not work. I've got a good amount of low level/embedded experience, so I should be able to figure stuff out.

                  Originally posted by Tomba View Post
                  There might be a downside if using SMG CAN signals. If these signals are present and the modules are not coded to SMG. They will throw error codes for sure about the coding and may not function properly (DSC will show ASC light). DME and DSC check if the CAN signals are present and check this based on the coding. If coded for SMG and no SMG CAN IDs present it will throw error code for missing bus messages. If not coded for SMG and SMG CAN IDs are present it will throw a coding error.

                  There are a few variants of the IKE/KOMBI, Bosch and Motometer to my knowledge. I don't know if they use the same uP (micro-processor). From quick looks on the net I can observe the NEC writings on one of the chips. I don't know if IDA, ghidra or any other disassembler has them included and if there are tools to read these uP's (XPROG, UPA, ...). I would first check which uP is present to look into the possibilities for a next step.

                  Serial eprom is mainly used for mileage and coding. Strongly doubt the main program is running with it. I have a 320i and will check tomorrow/this evening if I can read the uP with PASoft.
                  Thank you! I don't have PASoft myself, but know a couple people that have it. Might try messing around with that as well.

                  For now, I'm passively looking for a spare cluster. Once I get that I can really dive into this project.

                  2002 Topasblau M3 - Coupe - 6MT - Karbonius CSL Airbox - MSS54HP Conversion - Kassel MAP - SSV1 - HJS - PCS Tune - Beisan - MK60 Swap - ZCP Rack - Nogaros - AutoSolutions - 996 Brembos - Slon - CMP - VinceBar - Koni - Eibach - BlueBus - Journal

                  2012 Alpinweiss 128i - Coupe - 6AT - Slicktop - Manual Seats - Daily - Journal

                  Comment


                    #10
                    Early and late PASoft EEPROM reads both attached. 6-4 is early 22H cluster, 10-13 is late 24H cluster. Doesn’t look like anything that relates to the uC instructions here. Enjoy anyway!

                    edit: my spare cluster is technically for sale here on the forum… https://nam3forum.com/forums/forum/c...hing-sw4-7-lcm
                    Attached Files
                    Last edited by Bry5on; 02-17-2023, 12:13 PM.
                    ‘02 332iT / 6 | ‘70 Jaguar XJ6 electric conversion

                    Comment

                    Working...
                    X