[Hotter]

Is it possible to connect module to ODB2 cable directly or do I need anything else? I am trying to identify module on Tool32 and getting error:

apiJob("RAD2","ident","","")
EDIABAS Error 19 : IFH-0009: NO RESPONSE FROM CONTROLUNIT

My setup:
4 - ground
5 - ground
6 - CAN High -> RAD2 orange/green
14 - CAN Low -> RAD2 green
16 - +12V
and also radio power +12V and ground

[icon2015]

You will need a JBBF or a KGM, properly wired to start and connected to the CAN,

[ctuna]

Programing a module with a bench setup would be cool.
Tell us how it goes.

[Sensible_]

Originally Posted by icon2015

You will need a JBBF or a KGM, properly wired to start and connected to the CAN,

I think you need a CAS and key / ignition slot / button too?

A KOMBI is also useful.

Here is a diagram. Not mine but useful for those interested:

[Hotter]

Its working, I can communicate with RAD2 radio with cable. All I needed was JBBF! I even got indentification with INPA:


But still not sure if its possible to read flash memory with tool32. Any one knows exact function?

[ctuna]

Well wouldn't you just go through the normal NCSexpert procedure
and get a trace file then modify to a Man file and re-code the module.
If you can read it you should be able to write it I would think.

[icon2015]

Originally Posted by Hotter

But still not sure if its possible to read flash memory with tool32. Any one knows exact function?

Why would you like to read the flash? I don't think this is possible through OBD. To write the flash that is a different story.

[ctuna]

This setup would allow you to program modules outside the car.
Which would be valuable if you are repairing or installing modules.
Actually that list of code you bypass when you read a trace file is
the programming.

[Hotter]

Originally Posted by icon2015

Why would you like to read the flash? I don't think this is possible through OBD. To write the flash that is a different story.

I would like to disassemble it and maybe modify.

[rjahl]

Originally Posted by Hotter

I would like to disassemble it and maybe modify.

Not so easy, many modules are protected with an RSA signature check. They will not allow a modified file to be flashed via ODB.

There are work arounds, but it takes time to resolve.

[ctuna]

I thought changing the blink count for lane changing was
a direct manipulation of bits.

[rjahl]

Originally Posted by ctuna

I thought changing the blink count for lane changing was
a direct manipulation of bits.

There are area of the ram that are designed to be modified and have limited protection, coding areas .

Then there are boot sector, program and calibration areas. Different level of security.

[ctuna]

How do the tuners get to that stuff in the DME or are they
only playing with changeable bits.

[rjahl]

Originally Posted by ctuna

How do the tuners get to that stuff in the DME or are they
only playing with changeable bits.

They find holes or flaws in the security systems.

Vulnerabilities seem to exist in the software updating processes. Mostly the program update process.

Most of the DMEs have been hacked but the smaller modules don't get that much attention.

[Hotter]

Originally Posted by rjahl

They find holes or flaws in the security systems.

Vulnerabilities seem to exist in the software updating processes. Mostly the program update process.

Most of the DMEs have been hacked but the smaller modules don't get that much attention.

And what about software update?
You can update software with WinKFP (I beleve through K-Can bus), doesn't that mean there should be a way at least to write to flash?
But of course it would be nice to read first...

[rjahl]

Originally Posted by Hotter

And what about software update?
You can update software with WinKFP (I beleve through K-Can bus), doesn't that mean there should be a way at least to write to flash?
But of course it would be nice to read first...

You can flash nearly anything but the module will check it for authenticity and enter recovery mode if the new file fails the test.

[Hotter]

Originally Posted by Sensible_

I think you need a CAS and key / ignition slot / button too?

A KOMBI is also useful.

Here is a diagram. Not mine but useful for those interested:

Image correction:
https://www.newtis.info/tisv2/a/en/e...rature/q0GsS8s

KOMBI pin 5 -> 15 JBBE (not 5->5)

[Hotter]

Originally Posted by rjahl

You can flash nearly anything but the module will check it for authenticity and enter recovery mode if the new file fails the test.

I am planning to spoof K-Can bus and see what information flows, maybe I will find something useful. I guess I will do some kind of Arduino unit with display which displays some kind of useful information and keep it in car. Modifying firmware on radio seems more complicated then making new Arduino unit and playing with it.

[Hotter]

Originally Posted by rjahl

You can flash nearly anything but the module will check it for authenticity and enter recovery mode if the new file fails the test.

Is there a way to exit recovery mode?
It seems I have bricked few radios already.

[icon2015]

To recover them, have you tried to update the flash with WinKFP?

[rjahl]

Originally Posted by Hotter

Is there a way to exit recovery mode?
It seems I have bricked few radios already.

If Winfkp comfort mode does not recognize the module, try going into Expert mode and flashing new software. Warning expert mode is all manual, you select the .ipo , prg file, ECU address along with the file to be flashed. There are very few safety protocols to keep you from doing something wrong.