Troubleshooting MMI 3G
12-15-2023, 10:05 AM
#11
AudiWorld Member
@sm87 -- Re "navigation data is blocked", I have a SD patch script for that here: https://github.com/DrGER2/MMI3G-Navdb-Unblocker
This isn't a function of CP, rather, the method Harman-Becker uses to "activate" a navigation database. Not my method, just my implementation of the method.
The GNU Partition Editor (gparted) will format a 64 GB SD card as FAT32 successfully -- I used it regularly on our Linux desktop(s). Yeah, it's Windows being, well, Windows. --g
This isn't a function of CP, rather, the method Harman-Becker uses to "activate" a navigation database. Not my method, just my implementation of the method.
The GNU Partition Editor (gparted) will format a 64 GB SD card as FAT32 successfully -- I used it regularly on our Linux desktop(s). Yeah, it's Windows being, well, Windows. --g
12-15-2023, 11:20 AM
#12
AudiWorld Junior Member
Thread Starter
@sm87 -- Re "navigation data is blocked", I have a SD patch script for that here: https://github.com/DrGER2/MMI3G-Navdb-Unblocker
This isn't a function of CP, rather, the method Harman-Becker uses to "activate" a navigation database. Not my method, just my implementation of the method.
This isn't a function of CP, rather, the method Harman-Becker uses to "activate" a navigation database. Not my method, just my implementation of the method.
@drgertol I'm curious, you seem to be pretty deep into this, do they use cryptographic signatures from VAG (requiring ODIS to phone home) to enforce the map activation and component protection schemes or is it mostly security-through-obscurity that no one was bothered enough to reverse engineer so far?
12-17-2023, 01:18 PM
#13
AudiWorld Member
@sm87 -- Nav database activation and CP are completely different processes -- CP lives in the main unit EEPROM (my understanding), while navdb "activation" lives in the FSC file pointed to by the navdb release PKG file, which is part of the navdb installed on the HDD. The FSC file is stored elsewhere -- in one of the flash memory file systems that is persistent across system software updates and appears to be created by a Red Engineering Menu process initiated by ODIS.
I'd say, run my unblocker script, then clear the other DTCs left in Address 5F/J794. I don't know that ODIS can tease out that an installed navdb is activated normally or that the normal H-B navdb activation process is disabled -- they both look the same without inspecting the running QNX system. Not much is known about the structure of Harman-Becker VAG FSC files of this generation, or at least that I've been able to tease out. --g
I'd say, run my unblocker script, then clear the other DTCs left in Address 5F/J794. I don't know that ODIS can tease out that an installed navdb is activated normally or that the normal H-B navdb activation process is disabled -- they both look the same without inspecting the running QNX system. Not much is known about the structure of Harman-Becker VAG FSC files of this generation, or at least that I've been able to tease out. --g
12-17-2023, 06:58 PM
#14
AudiWorld Junior Member
Thread Starter
@drgertol Alright, so the nav script worked exactly as advertised, no errors in the log file, navigation system is now fully functional even with component protection active! Gotta say, I'm a little shocked by how the MMI just runs any random run.sh as soon as an SD card was plugged in, with root none the less, and OS partitions are mounted read-write (thought maybe I'd have some integrity checks), but I digress.
Did some digging on FSC and found your other thread on the topic, are you looking for more *.fsc specimens?
After clearing the error codes this is what I'm left with:
It seems both driver and passenger front door speakers are indeed not producing any sound:
00417 - Left front DSP mid-bass speaker Open circuit
00418 - Right front DSP mid-bass speaker Open circuit
From what I've read it seems like a known problem with contacts coming loose in those speakers, yay messing with interior panel clips...
As for the window antenna code (02984 code), that one has been showing up in the old scans too (+3 years ago) but I don't remember ever having issues with FM radio (including now).
Still trying to find someone to take care of component protection. I'm mulling just getting a VAS 5054/6154 clone off aliexpress for $100 and paying another 2$5 for a 1-day ODIS login (although not sure how legit these are?), cost would end up less than an hour of shop time. Or maybe just find someone doing ODIS remotely who know what the hell they're doing with it, I hear it's a peculiar piece of software.
Did some digging on FSC and found your other thread on the topic, are you looking for more *.fsc specimens?
After clearing the error codes this is what I'm left with:
Code:
...
---------------------------------------------------------------
56 Radio
System description: Radio U SIRIU
Software number: 4F0035082A
Software version: 0021
Hardware number: 4F0035082
Hardware version: H45
Serial number: 335CY0A7558271
Long coding: 020000020100000001
Trouble codes:
02984 - Connection between impedance converter 2 and window antenna Open circuit
static
Priority: 5
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:20:42
00417 - Left front DSP mid-bass speaker Open circuit
static
Priority: 5
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:20:33
00418 - Right front DSP mid-bass speaker Open circuit
static
Priority: 5
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:20:33
---------------------------------------------------------------
5F Multimedia
System description: H-BN-NA
Software number: 8T1035664F
Software version: 0189
Hardware number: 8T1035664B
Hardware version: H51
Serial number: 490CS0B7611164
Long coding: 010200060005A1EF41000B0E000000030000
Subsystems:
System description: NAR 2017/2018
Software number: 8R0060884EN
Software version: 1602
System description: DU7 High
Software number: 4F0919604
Software version: 0306
Hardware version: H43
Serial number: 9356CQ0A1213962
System description: E0380 Bedient
Software number: 8T0919609F
Software version: 0100
Hardware version: H08
Serial number: 00000000486241
System description: CD-Database
Software number: 8R0060961
Software version: 1886
Trouble codes:
03276 - Checking software version management
static
Priority: 6
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:05:37
03157 - Function restriction due to communication interruption
static
Priority: 6
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:05:39
02095 - Component protection active
static
Priority: 4
Frequency counter: 1
Driving cycle: 84
Mileage: 265836 km
Date: 2023-12-17 15:05:36
---------------------------------------------------------------
62 Rear Left Door
System description: TSG HL
Software number: 8K0959795C
Software version: 0306
Hardware number: 8K0959795C
Hardware version: H10
Serial number: 0000103090638
Long coding: 010C03204000210001
Trouble codes:
No trouble codes found
---------------------------------------------------------------
6C Rear View Camera
System description: J772__Rearview
Software number: 8T0907441C
Software version: 0040
Hardware number: 4L0907441B
Serial number: 525PA8-J029249
Coding: 1000006
Trouble codes:
No trouble codes found
---------------------------------------------------------------
72 Rear Right Door
System description: TSG HR
Software number: 8K0959795C
Software version: 0306
Hardware number: 8K0959795C
Hardware version: H10
Serial number: 0000103089990
Long coding: 010C03204000210001
Trouble codes:
No trouble codes found
...
It seems both driver and passenger front door speakers are indeed not producing any sound:
00417 - Left front DSP mid-bass speaker Open circuit
00418 - Right front DSP mid-bass speaker Open circuit
From what I've read it seems like a known problem with contacts coming loose in those speakers, yay messing with interior panel clips...
As for the window antenna code (02984 code), that one has been showing up in the old scans too (+3 years ago) but I don't remember ever having issues with FM radio (including now).
Still trying to find someone to take care of component protection. I'm mulling just getting a VAS 5054/6154 clone off aliexpress for $100 and paying another 2$5 for a 1-day ODIS login (although not sure how legit these are?), cost would end up less than an hour of shop time. Or maybe just find someone doing ODIS remotely who know what the hell they're doing with it, I hear it's a peculiar piece of software.
12-17-2023, 07:58 PM
#15
AudiWorld Member
@sm87 -- DTC 03276 is cleared by entering a checksum value in Adaptation Channel 15 of Address 5F (see page 39 of my update document: https://drive.google.com/file/d/1TP6...K3dYx6eSk/view). I don't recognized DTC 03157 being related to the nav database.
This generation of Harman-Becker systems don't run just any "random" shell script -- Process proc_scriptlauncher acts on (lightly) encrypted file copie_scr.sh when it is found on an SD card at an insertion event. We use a standardized copie_scr.sh that sets up some environment variables, then launches/executes plain-text "run.sh" from the SD card root directory (described here: https://github.com/DrGER2/copie_src.sh).
Re your production FSC file, if you have a copy of it, I could use it in my collection for inspection. Cheers --g
This generation of Harman-Becker systems don't run just any "random" shell script -- Process proc_scriptlauncher acts on (lightly) encrypted file copie_scr.sh when it is found on an SD card at an insertion event. We use a standardized copie_scr.sh that sets up some environment variables, then launches/executes plain-text "run.sh" from the SD card root directory (described here: https://github.com/DrGER2/copie_src.sh).
Re your production FSC file, if you have a copy of it, I could use it in my collection for inspection. Cheers --g
12-18-2023, 09:19 PM
#16
AudiWorld Junior Member
Thread Starter
@sm87 -- DTC 03276 is cleared by entering a checksum value in Adaptation Channel 15 of Address 5F (see page 39 of my update document: https://drive.google.com/file/d/1TP6...K3dYx6eSk/view). I don't recognized DTC 03157 being related to the nav database.
This generation of Harman-Becker systems don't run just any "random" shell script -- Process proc_scriptlauncher acts on (lightly) encrypted file copie_scr.sh when it is found on an SD card at an insertion event. We use a standardized copie_scr.sh that sets up some environment variables, then launches/executes plain-text "run.sh" from the SD card root directory (described here: https://github.com/DrGER2/copie_src.sh).
, reminded me of some of the shenanigans when windows would autorun CDs by default.Attached zip has the .fsc files pulled from the MMI, in the 00040003.fsc file I see VIN of the donor car embedded in it (matches the ebay listing), if that helps.
The following users liked this post:
drgertol (12-19-2023)
12-19-2023, 05:56 AM
#17
AudiWorld Member
@sm87 -- Thanks for the ZIP -- I'll poke at that later, as time permits. The flash memory & SD card filesystems are all (mostly?) mounted read-only initially, hence our need to update the mount when our "run.sh" script is run with "mount -uw /path/to/dir". If you haven't examined the contents of your MMI3G/HNav system yet, take a look at my MMI3G Info Report script: https://github.com/DrGER2/MMI3G-Info
One bit that eludes me so far is finding a way to read the contents of the main unit EEPROM from the shell. We know the Java user interface (the UI, including the Red & Green Engineering Menus run in a Java VM) can read the EEPROM -- alas, H-B didn't give us a separate QNX binary to do that, too. --g
One bit that eludes me so far is finding a way to read the contents of the main unit EEPROM from the shell. We know the Java user interface (the UI, including the Red & Green Engineering Menus run in a Java VM) can read the EEPROM -- alas, H-B didn't give us a separate QNX binary to do that, too. --g
12-20-2023, 09:00 AM
#18
AudiWorld Junior Member
Thread Starter
On a different note, I need to replace both front door speakers (wires going to the coil rotted form moisture, seems to be a common failure). I'm trying really really hard to go down another rabbit hole with this one
, so in light of that I want to stick to stock wiring and amp here. I found the kit captain_video here sells to put Dayton RS75 tweeters in the dash (seems like great value for the $) so I figured those should pair well with door woofers from the same RS series ...but those only come in 6", 7" and 8" - because of course - so they won't fit the 6.5" speaker adapters available for this car. Any suggestions for another 6.5" midrange woofer to complement the RS75s? On all the other threads people are getting more elaborate with the upgrades ..must ..resist.@SMac770 I came across this diagram you posted https://www.audiworld.com/forums/a4-.../#post25812870
If the door woofer and tweeter are wired in parallel, and I'm seeing an open circuit at the amp/radio harness, does this mean the tweeter is also kill? If I short out the door speaker harness with a jumper wire I see continuity again,
Last edited by sm87; 12-20-2023 at 09:04 AM.
12-20-2023, 09:26 AM
#19
AudiWorld Super User
Yeah, all the tweeter branches have in-line caps for a first order low cut filter for the tweeter. Whether that's for bass blocking, turn on thump protection, or both, can't guarantee the why; just that the function is there.
I believe the cap is at the tweeter itself, so if you can lift those up and out of the dash corners, you can get to the wiring plug and then test the wiring per normal.
I believe the cap is at the tweeter itself, so if you can lift those up and out of the dash corners, you can get to the wiring plug and then test the wiring per normal.
12-20-2023, 10:47 AM
#20
AudiWorld Member
@sm87 -- All of the UI Java code lives in a proprietary IBM JXE jar in /mnt/ifs-root/lsd/lsd.jxe. I have ZIP archives of some ifs-root.ifs & efs-system.efs image files over on AZ in case you're really interested in poking at any of this: https://www.audizine.com/forum/showt...1#post14904929 --g