Welcome Anonymous !

Everything you need to modify your ride
 

Interior Modifications

Reversing FG Bluetooth Phone Module

Specific interior modification information for Ford FG Series Falcons and FPV models.

Postby G6EKev » Mon Oct 12, 2015 10:59 am

Hey all,

I borked my original BCM so I decided to reverse engineer it and see if I can fix it in the process.
The first BCM Calibration File I could find was '8R29-14D511-AB.zip' which contains 8R29-14D511-AB.PHF.
The archive does not have a password.
PHF - Packed HEX Format?
There are two sections to this file - The description and the contents. These two sections are separated by 0x00 0x24 0x00.
The lines in the header are plain text. Replacing 0x00 with 0x0D 0x0A will give you something like this...
Code: Select all
APPLICATION>BPM Application
MASK NUMBER>Rev0 3 July 2008
FILE NAME>SW-8R29-14D511-AB.HEX
RELEASE DATE>07/03/08
MODULE TYPE>Bluetooth Phone Module
PRODUCTION MODULE PART NUMBER>8R29-14D509-AA
WERS NOTICE>
COMMENTS>
RELEASED BY>Sumitomo Wiring Systems Australia
MODULE NAME>BPM
MODULE ID>0x781
DOWNLOAD FORMAT>0x00
FILE CHECKSUM>0xE5C3
FLASH INDICATOR>1
FLASH ERASE SECTORS>0x00

The remainder of the file is Intel HEX. Easy!

...Moving on...

The two attached files are of the front and back of the PCB. The intentional overexposure is to grab the IC markings.
The PCB is from an early model '8R29 19C112 AA' BPM.
U3 - MIC5239 - 500mA LDO regulator.
U4 - MB3793 - Power Voltage Monitoring IC with Watchdog Timer
U5 - BC358239A - Single Chip Bluetooth® v1.2 System
U6 - ???2-Wire Serial EEPROM???
U8 - V850ES - 32-bit Single-Chip Microcontroller
U9 - TJA1041 - high speed CAN transceiver
U10 - ???SPI Flash???
U11 - TDA8541 - 1 W BTL audio amplifier
You do not have the required permissions to view the files attached to this post.
Last edited by G6EKev on Wed Oct 14, 2015 3:21 pm, edited 1 time in total.
G6EKev
Starting Ignition
 
Posts: 10
Joined: Wed Oct 07, 2015 10:35 am
Has thanked: 0 time
Been thanked: 0 time

Postby TazzI » Mon Oct 12, 2015 11:32 am

G6EKev wrote:I borked my original BCM so I decided to reverse engineer it and see if I can fix it in the process.

Do I even ask how you managed to kill the last BCM??! :lol:

G6EKev wrote:The first BCM Calibration File I could find was '8R29-14D511-AB.zip' which contains 8R29-14D511-AB.PHF.
The archive does not have a password.
PHF - Packed HEX Format?
There are two sections to this file - The description and the contents. These two sections are separated by 0x00 0x24 0x00.
The lines in the header are plain text. Replacing 0x00 with 0x0D 0x0A will give you something like this...

Fantastic!
Whats interesting I find there.. is the checksum. More then likely verified during program to ensure the file is not corrupt. Guess it depends if your looking to update it via CAN or if your gonna interface directly with the main IC?

G6EKev wrote:The two attached files are of the front and back of the PCB. The intentional overexposure is to grab the IC markings.
U3 - MIC5239 - 500mA LDO regulator.
U4 - MB3793 - Power Voltage Monitoring IC with Watchdog Timer
U5 - BC358239A - Single Chip Bluetooth® v1.2 System
U6 - ???2-Wire Serial EEPROM???
U8 - V850ES - 32-bit Single-Chip Microcontroller
U9 - TJA1041 - high speed CAN transceiver
U10 - ???SPI Flash???
U11 - TDA8541 - 1 W BTL audio amplifier


I cant make out the markings on the chip since I cant blow up the image enough. But Id assume one of those chips would be an external eeprom. Would be interesting to grab a read off of it and see whats in there.
User avatar
TazzI
Moderator
 
Posts: 986
Images: 2
Joined: Thu Dec 22, 2011 8:02 pm
Has thanked: 16 times
Been thanked: 41 times

Postby G6EKev » Mon Oct 12, 2015 12:33 pm

TazzI wrote:Do I even ask how you managed to kill the last BCM??! :lol:

I managed to break the BCM by trying to upgrade it using IDS! I'm not sure what I did wrong exactly.
The BCM appears when running a device scan. I can't re-program / "re-install" it. Changing the VIN does not work either.

TazzI wrote:Guess it depends if your looking to update it via CAN or if your gonna interface directly with the main IC?

I've already tried over CAN a few times. I don't know what is wrong?
It could be my VCM2 but I need to speak to someone with a genuine VCM2.

I plan on connecting directly to each of the ICs. The SPI flash is easy. The JTAG interface on U8 should be easy too.

TazzI wrote:I cant make out the markings on the chip since I cant blow up the image enough. But Id assume one of those chips would be an external eeprom. Would be interesting to grab a read off of it and see whats in there.

I've added crops of the original photo. Hopefully that helps. :)
You do not have the required permissions to view the files attached to this post.
G6EKev
Starting Ignition
 
Posts: 10
Joined: Wed Oct 07, 2015 10:35 am
Has thanked: 0 time
Been thanked: 0 time

Postby TazzI » Tue Oct 13, 2015 11:05 am

G6EKev wrote:I managed to break the BCM by trying to upgrade it using IDS! I'm not sure what I did wrong exactly.
The BCM appears when running a device scan. I can't re-program / "re-install" it. Changing the VIN does not work either.

AAhhhh... that would be problem number one!. I find it amusing in IDS you cant select Ford Falcon from predefined list. Just popped IDS on the BA XR8 and its an "unknown" ecu. Yet, I can then put the tear code or pcm num in and it works :?
Sort of leads on that their systems really dont truly support Aussie Ford falcons, or they are just chucked in on the sie without much suport. So I wouldnt attempt it unless on a bench setup while monitoring with a separate device to check when/if the communication pauses or why it fails.
Which options are you going into exactly in IDS, which option did you select specifically for updating? And which vehicle/code did you enter right at the beginning? (Eg. Tear code ect)

G6EKev wrote:I've already tried over CAN a few times. I don't know what is wrong?
It could be my VCM2 but I need to speak to someone with a genuine VCM2.

I plan on connecting directly to each of the ICs. The SPI flash is easy. The JTAG interface on U8 should be easy too.

Might be about time to monitor the bus to see what IDS is actually doing, and if your BCM is even responding any more. If programming failed part way through, it would be the BCM has a completely blank calibration or part-number, thus IDS doesnt know what it is or what cal to program into it. Something like that is recoverable if you manually wrote to the canbus to update it.

Would be interested in see the IC's directly interfaced though! But you will still need a "good" module to grab a read from. :D
User avatar
TazzI
Moderator
 
Posts: 986
Images: 2
Joined: Thu Dec 22, 2011 8:02 pm
Has thanked: 16 times
Been thanked: 41 times

Postby G6EKev » Wed Oct 14, 2015 7:27 pm

Got another BPM today...
8R29 19C112 CA

Installed and tested no worries at all! All modules pass the Network Test
I have not figured out how I managed to damage the older BPM but now that the new module is working, so I'll start taking f/w dumps.

Connecting to an Australian Ford...
I cannot connect to the FG without using the automatic option. To connect, I go 'Start New Session', 'All Other'. The vehicle is detected right away and everything works as it should.

Installing the BPM...
Module Identification 1st to determine if the BPM is present and at least semi functional.
Module Programming, Programmable Module Installation, BPM - to install the BPM. Follow the procedure but do not turn the ignition key.
G6EKev
Starting Ignition
 
Posts: 10
Joined: Wed Oct 07, 2015 10:35 am
Has thanked: 0 time
Been thanked: 0 time

Postby TazzI » Thu Oct 15, 2015 11:26 am

G6EKev wrote:Got another BPM today...
8R29 19C112 CA

Installed and tested no worries at all! All modules pass the Network Test
I have not figured out how I managed to damage the older BPM but now that the new module is working, so I'll start taking f/w dumps.

Connecting to an Australian Ford...
I cannot connect to the FG without using the automatic option. To connect, I go 'Start New Session', 'All Other'. The vehicle is detected right away and everything works as it should.

Installing the BPM...
Module Identification 1st to determine if the BPM is present and at least semi functional.
Module Programming, Programmable Module Installation, BPM - to install the BPM. Follow the procedure but do not turn the ignition key.

Glad you got it working!

Yep thats exactly what I did in terms of connecting up with the BA XR8. Monitored the line at the same time and the ECU is responding as it should, but IDS simply doesnt like it for whatever reason.

With module identification, it will be good to start writing down the firmware numbers, it could be that possibly a specific firmware version corrupts when attempting to update.
User avatar
TazzI
Moderator
 
Posts: 986
Images: 2
Joined: Thu Dec 22, 2011 8:02 pm
Has thanked: 16 times
Been thanked: 41 times

Postby G6EKev » Thu Oct 15, 2015 12:16 pm

TazzI wrote:Yep thats exactly what I did in terms of connecting up with the BA XR8. Monitored the line at the same time and the ECU is responding as it should, but IDS simply doesnt like it for whatever reason.


What version of IDS are you using?
Is your VCMII a clone?
I'm using 94.03 with a clone. IDS can download resources as required.

TazzI wrote:With module identification, it will be good to start writing down the firmware numbers, it could be that possibly a specific firmware version corrupts when attempting to update.


Forgot to mention that in previous posts. The firmware that IDS is downloading / trying to install is the same for both modules. You could be right about the possible cause of corruption.

BPM Application - SW-8R29-14D511-AB.HEX
BPM Secondary Bootloader (Function File) - 8R29-14D513-AA.hex
G6EKev
Starting Ignition
 
Posts: 10
Joined: Wed Oct 07, 2015 10:35 am
Has thanked: 0 time
Been thanked: 0 time

Postby TazzI » Fri Oct 16, 2015 1:08 am

G6EKev wrote:What version of IDS are you using?
Is your VCMII a clone?
I'm using 94.03 with a clone. IDS can download resources as required.

96.01 and its a clone. Very odd... Im going to have to maybe roll back and see if that makes a difference.

G6EKev wrote:Forgot to mention that in previous posts. The firmware that IDS is downloading / trying to install is the same for both modules. You could be right about the possible cause of corruption.

BPM Application - SW-8R29-14D511-AB.HEX
BPM Secondary Bootloader (Function File) - 8R29-14D513-AA.hex


Sweet. Ill compare with the components Im grabbed from a wrecker if I get this damn software downloading updates
User avatar
TazzI
Moderator
 
Posts: 986
Images: 2
Joined: Thu Dec 22, 2011 8:02 pm
Has thanked: 16 times
Been thanked: 41 times

Postby hunty19 » Mon Mar 06, 2017 6:13 pm

I might be offtrack with this, but it;s a bluetooth problem with 2008FG Xr6 with premium sound. Samsung Galaxy s2 2011MY using bluetooth V3 works great.Huawei P7 MY2016 using Blue tooth V4 connects well, but no conversation either way. I have been thinking that an upgrade of the ICC Bluetooth module to the "CA" version may fix the problem. Part NO BPM1008642. Is that too simple a solution, or is there much more to do?. Even with Bluetooth V4 there are subsets in the spec , ie 4.1, 4.2. I am hoping all level 4's will work. anyone know the answer?
hunty19
Newbie Modder
 
Posts: 1
Joined: Mon Mar 06, 2017 4:01 pm
Has thanked: 0 time
Been thanked: 0 time


Return to Interior Modifications

  • View new posts
  • View unanswered posts
  • Who is online
  • In total there is 1 user online :: 0 registered, 0 hidden and 1 guest (based on users active over the past 5 minutes)
  • Most users ever online was 564 on Mon Jan 20, 2020 9:00 am
  • Users browsing this forum: No registered users and 1 guest