The patched version will allow you to use a modified Fec file with whatever activations you want in it, provided the Fec file is constructed properly. If you put a modified Fec file on unpatched IFS it will be rejected because it will fail the validation.

Basically they've hacked the code so that it doesn't even try to validate the Fec file.

The extension to the Maps update is enabled by a code that goes in the Fec file or replaces the existing code if your update entitlement has expired.

kevin#34 wrote:not sure about the surround feature as not working, it was present on mine even with original MMI version

there is a surround setting and a 3D setting presumably for models that don't have surround speakers. Surround works although I have it turned off as it sounds lame to me

understood, thanks, but it would be possible to upload a patched vers. that has the FEC for the map extension already altered?

Jannerman wrote:The patched version will allow you to use a modified Fec file with whatever activations you want in it, provided the Fec file is constructed properly. If you put a modified Fec file on unpatched IFS it will be rejected because it will fail the validation.

Basically they've hacked the code so that it doesn't even try to validate the Fec file.

The extension to the Maps update is enabled by a code that goes in the Fec file or replaces the existing code if your update entitlement has expired.

@kevin#34 They are two different things, the the Fec file isn't part of the patched IFS file. The Stage2-mod.ifs is flashed to the MMI and then the Fec file is uploaded to the MMI. You can do it in a single session but in 2 separate stages (by putting both files on the same SD card) The instructions to you about half way down this post say:
"I place the new FecContainer.fec on the SD Card, along with the stage2-mod.ifs file"
then you just carry on from there.


For anyone that's curious for more info on the content of the Fec file. This what mine looks like in a hex editor, you can see a VIN in the R/H pane in the screenshot it starts with 'TRUZZZ...' (but I've modified it!)



The Fec codes are the highlighted part in the L/H pane, so my current ones are:
00040100, 02300020, 00050000, 00070200, 00030000

Which correspond to:
00040100 Navigation
00050000 Bluetooth
00070200 SDS for Nav
00030000 AMI (USB Enable)
02300020 last authorised map update

You'll notice 02300020 is missing from the fee code list at the bottom of this post, that's because it's the code that sets the satnav maps update entitlement expiry point. The last 2 characters denote the last map update that will be accepted by the system. Note: the '20' in mine does not equate to the year 2020. You also need to be careful when changing this Fec code because the 4th character (the '0' of the '30' part of mine) varies according to the region of the maps as below:

EU: 30
NAR: 31
RoW: 3D

List of Fec / SWaP Codes
00030000 AMI (USB Enable)
00030001 Gracenote
00040100 Navigation
00050000 Bluetooth
00060100 Vehicle Data Interface
00060200 Infotaiment Control
00060300 Mirror Link
00060400 Sport HMI / Performence Monitor
00060500 Sport Chrono / Lap Timer
00060600 Logbook
00060700 Online services
00060800 Apple Carplay
00060900 Google Automotive Link / Android Auto
00070100 SDS
00070200 SDS for Nav
00070400 Electronic Voice Amplifier

NOTE: You can't just edit a Fec file in a text editor, you can do it in a Hex editor (but it MAY not work). So to be safe, I used one of the utilities mentioned earlier in this thread to create mine but there are several others.

thanks for clarifying

Hello,

Does anyone have the US firmware MU version 1462 to share? I'm trying to solve the black-screen Carplay issue on my 2016 TT.

I believe it should be: MHI2_US_AU43x_P1580

Thanks!

Finally managed to get a D link adapter & OBDeleven pro, copied all files including original fec from my car to the sd card, however keep getting these errors when trying to flash modified patched file, can anyone help ?

/ > mount -uw /net/mmx/fs/sda0
/ > cd /net/mmx/fs/sda0
/net/mmx/fs/sda0 > ./flashlock
[flashlock] locking flash
0 image type=1(IPL ) 0... 1ffff ( 131072)|0...1 (1):LOCKED
1 image type=2(IFS ) 20000... 3b0e53 ( 3739220)|1...30 (29):LOCKED
2 image type=2(IFS ) 540000... b9dbc7 ( 6675400)|42...93 (51):LOCKED
3 image type=2(IFS ) ba0000...1ae052f (15992112)|93...216 (123):LOCKED
4 image type=4(DSP ) 3d00000...3dc6923 ( 813348)|488...495 (7):LOCKED
5 image type=5(BIOS/ADJ) 3f00000...3ffffff ( 1048576)|504...512 (8):NOT LOCKED
/net/mmx/fs/sda0 > ./flashit -a ba0000 -v -d -f stage2-mod.ifs
Label: PL_qnx_flashit_10495A QNX: RL_qnx_650_10494A Built: 2010/12/10_11-21-47_U TC
/dev/fs0
--------
Flash size: 0x04000000 [= 512 x 0x20000]
Base addr: 0x00ba0000
File size: 0x00f40534 (15992116)
End addr: 0x01ae0534
*** erasing: 0x00BA0000 .. 0x01AE0533 [01AFFFFF] flashit: DCMD_F3S_ERASE fai led: Read-only file system
/net/mmx/fs/sda0 > ./flashlock
[flashlock] locking flash
0 image type=1(IPL ) 0... 1ffff ( 131072)|0...1 (1):LOCKED
1 image type=2(IFS ) 20000... 3b0e53 ( 3739220)|1...30 (29):LOCKED
2 image type=2(IFS ) 540000... b9dbc7 ( 6675400)|42...93 (51):LOCKED
3 image type=2(IFS ) ba0000...1ae052f (15992112)|93...216 (123):LOCKED
4 image type=4(DSP ) 3d00000...3dc6923 ( 813348)|488...495 (7):LOCKED
5 image type=5(BIOS/ADJ) 3f00000...3ffffff ( 1048576)|504...512 (8):NOT LOCKED
/net/mmx/fs/sda0 > ./mib2_ioc_flash reboot
ShutdownResetRequest 3 to ipc2
ShutdownResetRequest 3 to ipc2
Sent Shutdown Request 4 to ipc2
Sent Shutdown Request 5 to ipc2
Sent Shutdown Request 7 to ipc2
Sent Shutdown Request 5 to ipc2
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
Sent Shutdown Request 7 to ipc2
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1
ShutdownResetRequest 7 failed: write -1
ShutdownResetRequest 5 failed: write -1

Hi @Glacier_TTRS

/ > mount -uw /net/mmx/fs/sda0
/ > cd /net/mmx/fs/sda0
/net/mmx/fs/sda0 > ./flashlock

your third command above should have been:

/net/mmx/fs/sda0 > ./flashlock unlock

Just repeat all the steps with the correct command, shouldn't be any harm done, as you were just trying (and failing) to write to locked flash memory.

I did this update on my car yesterday, I got the same errors when I issued the /net/mmx/fs/sda0 > ./mib2_ioc_flash reboot and then 'Connection closed by foreign host.' (as you might expect) but those don't seem to matter because ASI is woking now.

Also what adaptations do I need to make in OBDeleven to the 5f module, thanks

https://www.ttforum.co.uk/forum/viewtopic.php?p=9358061#p9358061

From the above, with OBD11, I did:
I had to use Obdeleven to make an adaptation change "confirmation of software installation". Take the value and XOR with C9D2 and put that new value back. It won't look like it was done when you write it, but it will take. Other adaptations done are below.

5F adaptations
confirmation of software installation -> change the value by XOR with c9d2
vehicle configuration / Google_GAL- > on
vehicle configuration / Apple_DIO -> on
vehicle configuration / MirrorLink -> on
vehicle configuration / Smartphone_interface_for_rhmi -> activated

5F long coding
Byte_19_usb -> usb_ipod (you might try "full" as well, but usb_ipod works for me)

The bolded parts were already correctly set on my car.
I used this online xor calculator for the first part, that setting wasn't exactly named 'confirmation of software installation', so I just searched for confirmation to find it.

All working now guys many thanks for your help took me a long time but we got there in the end

Finally working