ambulanceonfire

iTrader: (3)

We both know nothings free but now that i have your attention, maybe the community can come together to make this happen.

Ive been discussing how to upgrade the firmware in our HUs with Jon316G. After a lot of back and forth of wondering in what way it was upgraded, ive decided to reach out to everyone for help.

Id like to get a look at the inside of someones HU that has been upgraded. If ANYONE feels up to the task of disassembling and snapping some GOOD pictures at very least it would be a start. Were trying to figure out whether or not the whole chip was removed or they just soldered on some send/ receive / power points to the board to flash it. Looking at the joints on the board where the chips sit should give us a good idea on which way they went about it.

Ultimately this is a NOT FOR PROFIT project. Information should be free and if its too big of a project for someone to undertake, they should have the OPTION to have it done professionally. .

In the end id like to see those of you that can hack your xbox dvd firmware do the same to your HU

If ANYONE has ANY information that can help PLEASE do so. Anyone with experience in this sort of work, we'd like to see you join in too!

Jon316G

iTrader: (1)

This is from my conversation with ambulanceonfire:
Now its possible that the white paint pen marks is used to identify the whole PCB was tested and not just the prom (if that QFP is indeed it).
You can tell when a PCB is reflowed through an oven and when its been reworked/hand soldered.

A Screen Printer uses a stencil to evenly distribute solder paste across the PCB.
One the components are placed onto the paste and reflowed in an oven, the solder joints look clean and consistent.
When a component is reworked/hand soldered, you'll notice that the solder joints do not look consistent from lead to lead where the operator added to much/not enough solder here and there.
Find out which IC has this inconsistent solder joints and we'll have an idea which one was tampered with.

paulmasoner

iTrader: (1)

i'm amazed that they werent flashing through one of the existing connections at the back of the radio

Jon316G

iTrader: (1)

I can disassemble an Xbox360 and hack the DVD firmware much faster that this HU
BTW.. I have an idea on how to fix the BGA issues with the Xbox360 without the stupid "X-Clamp" or removing it with a BGA rework machine
And it involves a step I already mentioned above.

Anyway... sorry to change the topic so quickly...

ambulanceonfire

iTrader: (3)

My guess is that the chip is pre-programmed so none of the leads on the back of the radio would trace back to the programming leads on the chip. Again, speculation only.

Jon316G

iTrader: (1)

You're correct.
Coming from someone who works for a company building circuit boards, our programmed components (or PROMS) are burnt/flashed before the component gets placed onto the PCB.
Now we do have some modules that get flashed after they are built, but they were meant to have that capability.
I don't believe Mazda would have thought about doing this in the early stages.

paulmasoner

iTrader: (1)

it works, done it

yeah, i just cant imagine that during the design phase someone wouldnt see the need for future FW upgrades

Jon316G

iTrader: (1)

Yeah... I'm assuming the manufacture didn't have a good reflow oven profile for that build and it created, what we call, foot prints.
Basically... the the BGA ***** create a "footprint" in the solder because the oven didn't reflow the solder (heat it up) enough to make the connections.
So once I receive a bad 360 board, I'm going to add flux to the BGA, find a good oven profile, and run it through our reflow ovens.
Then check it under our xray machines.

ambulanceonfire

iTrader: (3)

It seems that the Mazda3 uses the same HU component. If thats common knowledge or not i do not know. However if you google something along the lines of "rx8 hu firmware upgrade 9.55" you'll keep finding some different forums where a guy claims to be able to upgrade rx8 and mazda3 firmwares. His first site looks like it was rx8garage.net which eventually changed to mazdaparts.com

paulmasoner

iTrader: (1)

sounds like a good approach. the xray should verify what i've seen so far, that kind of word on the street could put a serious hurt on manufacturers of the clamps because as i see it most of the people willing to do one, would do the other - bandaid/fix the issue...

ambulanceonfire

iTrader: (3)

keep the xbox chatter down girls lol

Jon316G

iTrader: (1)

Not many people have access to a reflow oven

Sorry boss... Paul and I can take our geek talk to PMs....

paulmasoner

iTrader: (1)

sorry lol

but seriously from things i've seen in other communities, there may the possibility of having a tool made that can flash w/o any solder work. this would be the real answer because there just arent that many people willing to put an iron to IC legs. just something that provides a means of attachment/alignment, lighty sprung leads that can bend to correct in fine aignment to contact points, and whatever interface stuff you need on a board supported from an attachment point

Jon316G

iTrader: (1)

LOL... this was more of a topic we started discussing with the idea of me doing it, so soldering isn't a big deal (we get tested on 208 leaded QFPs).
So we are really just trying to identify which component is the prom, then find out the best way to extract the flash.
I was going to talk with our group that burns our proms to see what is involved because that is a process I've never personally dealt with.

ambulanceonfire

iTrader: (3)

i wouldn't worry too much about it as everybody knows somebody that does mod chips (here we go again) and im sure if we got it down those in the know would be willing to help those that are not.

But this is all hot air until we get someone with an upgraded HU willing to snap some shots or close enough to one of us that we can take a look.



ORRRR... the community donates to us to have one of our HUs upgraded =)
maybe in exchange for a repaired xbox? lolololol

paulmasoner

iTrader: (1)

i was wondering that^^

Chainu127

iTrader: (1)

Actually, coming from someone who works for a company that builds the CHIPS that contain the firmware for any type of application imaginable, including automotive, I would argue the opposite.

Bootloaders are very inexpensive, in terms of both extra hardware cost and program flash memory size. I've seen thermostats and coffee makers with bootloaders in them.

Agreed. The fact that engineers put a method of viewing the firmware revision through software helps me to believe the upgrade process can be done without taking the headunit out. Granted, this would also be useful even if the process was replacing an IC, as it could tell a technician whether he even needs to bother to take everything apart.

Further, looking at the connector CN701 pinout, the main radio harness, pin K is UART1, pin m is UART2, and pins O and Q are CAN-H and L. The radio as-is may have up to 3 serial communications ports in use.

The bootloader can be completely transparent. All of the "secret stuff" on the radio like viewing firmware, DTC codes, LCD test modes, etc, are all done by holding a combination of buttons down. Entering the bootloader may be just as well. When the radio is turned on, look for button presses X and Y, if yes, look for upgrade data. The data might come from one of the 2 UARTS, the can bus (OBD-II port under the steering wheel), or even an upgrade CD in the drive.

Jon316G, you are correct that most of the time, programmable IC's are shipped pre-programmed in large quantities for final designs. My company offers this service, of course. When orders are placed, if requested, the customer just needs to supply the .hex file to be programmed to the chip. This program might contain the bootloader and default firmware version.
When an upgrade is released, it's as easy as the customer sending us a new .hex file and saying for all future runs, use this. The bootloader is most likely unchanged. The other usefulness of such a service is serialization. Each chip can have a unique serial number programmed in, or other custom information, such as an unlock code like some radios use.

As for the reverse engineering aspect of the project, I'm not sure where the right place to begin is. Is it better to probe both of the UARTs and try to decode the bus? Or sniff the CAN bus and try to make any sense of what might be coming from the radio? Keep in mind, if you do find the IC itself which gets upgraded, whether it be through software or hardware, every modern programmable IC has some sort of code protection setting specifically made so the contents can't be read out.

That being said, I'm happy (lucky) with my current firmware revision, as it works for me with my Car2PC I might be up for a fun project like this though, kind of like the navi hood controller was when I worked on that. Sorry for the long-winded post, just throwing out some ideas and my $0.02

~Chainu

ambulanceonfire

iTrader: (3)

Don't you guys think that if it was software upgradeable there would be SOME note of it SOMEWHERE in one of the service books? Is the information about checking which firmware you have on your HU listed in a service book?

Is anyone friends or at least good speaking terms with a Mazda tech that might help out in getting the ball rolling? Doesn't even have to be an RX8 tech because the Mazda3 shares the same HU.

Tamas

iTrader: (1)

He still does offer this upgrade: http://www.mazdaparts.com/ProductDet...000-1151625276
No idea if this involves reflashing or replacing a component.

Jon316G

iTrader: (1)

I just spoke with one of are associates who program components and he said that their machine can extract a flash.
Only thing he would need to know is the manufacture and JEDEC of the IC because our machine has a list of different raw component types that you need to choose.
So once we find out where the prom is, I'll write down the information and see if we're able to do this.

And please keep in mind... this isn't about "where can we send this to have it upgrade", we got curious and wanted to perform this ourselves without shelling out the cash (and it raises the "geek" factor) .
I personally don't need it because I have a "usable" HU for my iPod adapter, but I have an older HU that I'm willing to use to experiment with.

ShellDude

iTrader: (12)

Subscribed

ambulanceonfire

iTrader: (3)

lol, did you read my ENTIRE post or only the part you quoted?

Tamas

iTrader: (1)

Yes I did.
I just posted the link, wasn't meant as advertising or anything like that.

ambulanceonfire

iTrader: (3)

The chip in the dead center is the audio processor. .
crazy thought i know but i just googled it lol. If i could see the rest id do the same!

http://www.datasheetcatalog.org/data...cs/mXruwsz.pdf

Jon316G

iTrader: (1)

I got a quick tour of our prom burner since its the one process I know nothing about.
We have fixtures based on the component needing flashed.
Here is one for a 44-pin QFP:


Now the only problem is finding out how to extract a flash.
Going through the program, it had a list of various vendors, JEDEC, and package types that needed to match the component.
I couldn't find anything that matched the JEDEC on our components.
This might be something I have to ask the one guy that actually does the programming.
Problem is... I don't know him that well and I'm a little hesitant to ask him about using company property to flash a non-company component.
If I learn anything more I'll let you know.