How to recover SPRM module with UCDS?

Big car family

Модератор: DanMc85

Ответить
go4it
Сообщения: 36
Зарегистрирован: 10 янв 2018, 14:46

How to recover SPRM module with UCDS?

Сообщение go4it »

I have a dead 8M5T-19C112-BK Sound&Connect module. It draws about 70mA of current but refuses to send any CAN data, nor does it react on DTC scans or others inside UCDS.
I then want to try "dead module programming", but therefore i need to have the firmware-file and bootloader. I added a working SPRM to UCDS, which has nearly the same type, only "-BT" ending, but it does not recognized by UCDS either!
For the connection i use a simulated CAN-Bus on an breadboard with two 120 Ohm resistors.
I then used my ELM-Adapter and could read the infos from the working module without any issue, but UCDS can't.
8M5T-19C112-BT
DS-8M5T-19C112-AE
8M5T-14D509-AS
8M5T-14D511-BT20
8M5T-14D512-AA

I tried to directly donwload the above partnumbers using the Firmware-Download-Gateway from UCDS and other services like this, but no luck. It seems this firmware isn't available.
Also, UCDS did not recognize the module when connected to MS-CAN nor MM-CAN of the adapter.

janel
Сообщения: 47
Зарегистрирован: 02 авг 2015, 16:30

Re: How to recover SPRM module with UCDS?

Сообщение janel »

AFAIK the SPRM can't be programmed with UCDS as it does not haves a bootloader.
You can only program the module via USB port, using the VBF files available on the internet.

go4it
Сообщения: 36
Зарегистрирован: 10 янв 2018, 14:46

Re: How to recover SPRM module with UCDS?

Сообщение go4it »

Hey mate, maybe you are right... but, why is SPRM module found in the list of the Mondeo MK4 vFL/FL modules inside UCDS?
Anyway, i found some files in the official USB update archive of Ford. The files inside the ZIP are named 8M5T-14D511-*.bvc and 8M5T-14D511-*.vbf, where both are identical, so just another name. The VBFs should be useable with UCDS?!

janel
Сообщения: 47
Зарегистрирован: 02 авг 2015, 16:30

Re: How to recover SPRM module with UCDS?

Сообщение janel »

They are identical, indeed, but I don't think they're useable on a CAN connection, because it looks like the module itself doesn't support the firmware update over CAN.
If it had this function we obviously had a SBL and the firmware available over IDS (and UCDS).
I have studied a bit the way that vbf is built and it incorporates a SBL, but it will be super-tricky to extract it and make it work.

go4it
Сообщения: 36
Зарегистрирован: 10 янв 2018, 14:46

Re: How to recover SPRM module with UCDS?

Сообщение go4it »

Cool info. Yes, the SBL is needed and IS in fact the CAN bootloader. SBL stands for Secondary Bootloader, i guess. It will be loaded into the device microcontroller SRAM via UDS functions and get called. It then loads the firmware of the VBF file into a Flash.
This implies the microcontroller is running and accepts the UDS functions to establish a secure session. If not, there is also no way to push the code into the MCUs RAM, nor to execute it.
A bricked system like i have also is unlikely to load the firmware file via USB, as this also often requires a running system to access it. Some chips have native USB boot, though.
My last ressort would be to desolder the Flash chips found on the board. The BT module has three of them
https://mk4-wiki.denkdose.de/artikel/au ... innenleben
If would assume that the content of the VBF file is spread over those, or maybe just one.
If one is faulty or just looses it's content it may be possible to copy it over from the VBF or by cloning from a working device...
But, the MCU itself often has a Flash, where the PBL (Primary bootloader) is installed.
Maybe the vendor has left a backdoor interface like JTAG where it be possible to recover without desoldering.

janel
Сообщения: 47
Зарегистрирован: 02 авг 2015, 16:30

Re: How to recover SPRM module with UCDS?

Сообщение janel »

Yup.
The VBF is composed from four main Flash areas and a SBL, as far as I remember.
What I would do if I was in your position:
- split the VBF in pieces
- read the flash memories from the board
- compare the pieces with the read flash, see if they look similar.
Don't pay too much attention to the file sizes, as the voice data varies depending on the software version.

go4it
Сообщения: 36
Зарегистрирован: 10 янв 2018, 14:46

Re: How to recover SPRM module with UCDS?

Сообщение go4it »

Thanks janel, you may be right. But i only found the three flash chips (M29Wxxx), desoldered them (what a heck, because of those massive ground-layers inbetween the PCB).
One is 8MB, the other 2MB and the third is 1MB in size. I could read them and they contain something. Don't know if this is correct because it is the delivery firmware (8M5T-19C112-BK) and i only have the update-file *-BU.

janel
Сообщения: 47
Зарегистрирован: 02 авг 2015, 16:30

Re: How to recover SPRM module with UCDS?

Сообщение janel »

Well, you can try to guess their position based on the headers, or maybe size.

Ответить