Troubleshooting MMI 3G
#21
AudiWorld Super User
https://stackoverflow.com/questions/...r-to-intel-jxe
I wonder if that jxe converts to a jar that JD Gui can convert back to any manner of understandable Java.
https://stackoverflow.com/questions/...va-source-code
As the discussion in the second link points out, JD-GUI can't always produce useful decompile. Ran into this when I wanted to fix a "shareware" toolset that the origins of were long gone. It chewed up a CPU all the time after an event. Luckily, the defect was in one of the .java that had fully decompiled, so I was able to mod it, recompile it, and "fix the issue" with the .jar product. But a lot of the files had long strings of gibberish.
I wonder if that jxe converts to a jar that JD Gui can convert back to any manner of understandable Java.
https://stackoverflow.com/questions/...va-source-code
As the discussion in the second link points out, JD-GUI can't always produce useful decompile. Ran into this when I wanted to fix a "shareware" toolset that the origins of were long gone. It chewed up a CPU all the time after an event. Luckily, the defect was in one of the .java that had fully decompiled, so I was able to mod it, recompile it, and "fix the issue" with the .jar product. But a lot of the files had long strings of gibberish.
#22
AudiWorld Junior Member
Thread Starter
Results with JD were so-so, many "// INTERNAL ERROR //" and methods left as JVM byte code.
Going to try with fernflower tomorrow, looks much more promising:
https://www.decompiler.com/jar/187db...eeringApp.java
https://www.decompiler.com/jar/d9dd7...onnection.java
Definitely some interesting looking stuff there
#23
AudiWorld Senior Member
#24
AudiWorld Junior Member
Thread Starter
I've checked all the usual suspects (8-pin SMDs packages) but they all turned out to be something else, here's both sides of the motherboard:
https://1drv.ms/i/s!Ao-UlylWvwgziapx...A5fhg?e=V7nL13
https://1drv.ms/i/s!Ao-UlylWvwgziapy...r_Osg?e=DFRx3N
(forum won't accept the upload, too big maybe)
Notes on components I've checked so far, there's one that I couldn't match to a datasheet (4453) but there were a couple of those and surroundings didn't seem typical for an EEPROM:
Top side with HDD (marked BS in corner):
AD8052 / ARZ / #002
Rail-to-Rail Amplifier
https://www.analog.com/media/en/tech..._8052_8054.pdf
TDA8579 / 61 13 / n6003 / NXP
Dual common-mode rejection differential line receiver
https://www.nxp.com/docs/en/data-sheet/TDA8579T.pdf
L75A / 33 07 / 949
Digital temperature sensor and thermal watchdog
https://www.nxp.com/docs/en/data-sheet/LM75A.pdf
A1770 / M / 002
MOSFET
https://mm.digikey.com/Volume0/opasd...770_4-1-10.pdf
Other side:
431AIY / E9936
Programmable Voltage Reference
https://pdf1.alldatasheet.com/datash...CS/431AIY.html
33202 / PCSE
Low Voltage, Rail-to-Rail Operational Amplifier
https://pdf1.alldatasheet.com/datash...I/MC33202.html
CY2305C / SXA-1H / 9496490
Zero Delay Clock Buffer
https://www.infineon.com/cms/en/prod...y2305csxa-1h/#
https://www.infineon.com/dgdl/Infine...7d0ec649ec3c6d
4453
SS (logo) AD (hollow triangle)
.WO1B
989 / ATA6662 / 68506A-2
LIN Transceiver
https://ww1.microchip.com/downloads/..._Datasheet.pdf
AD8052 / ARZ / #002
Rail-to-Rail Amplifier
https://www.analog.com/media/en/tech..._8052_8054.pdf
TDA8579 / 61 13 / n6003 / NXP
Dual common-mode rejection differential line receiver
https://www.nxp.com/docs/en/data-sheet/TDA8579T.pdf
L75A / 33 07 / 949
Digital temperature sensor and thermal watchdog
https://www.nxp.com/docs/en/data-sheet/LM75A.pdf
A1770 / M / 002
MOSFET
https://mm.digikey.com/Volume0/opasd...770_4-1-10.pdf
Other side:
431AIY / E9936
Programmable Voltage Reference
https://pdf1.alldatasheet.com/datash...CS/431AIY.html
33202 / PCSE
Low Voltage, Rail-to-Rail Operational Amplifier
https://pdf1.alldatasheet.com/datash...I/MC33202.html
CY2305C / SXA-1H / 9496490
Zero Delay Clock Buffer
https://www.infineon.com/cms/en/prod...y2305csxa-1h/#
https://www.infineon.com/dgdl/Infine...7d0ec649ec3c6d
4453
SS (logo) AD (hollow triangle)
.WO1B
989 / ATA6662 / 68506A-2
LIN Transceiver
https://ww1.microchip.com/downloads/..._Datasheet.pdf
#25
AudiWorld Senior Member
Cannot read the chip numbers in your two board pics as the resolution is too low.
If your CP data is in a separate SMD eeprom then the chip is most likely located near a large QFP processor.
Yes the newer modules have CP content moved inside large multifunction processors. It is possible yours is one of the early ones to do so.
Yes the newer modules have CP content moved inside large multifunction processors. It is possible yours is one of the early ones to do so.
#26
AudiWorld Member
@sm87 -- Did you see this reference: https://www.audienthusiasts.com/Info...nt_EEPROM.html ?
8-pin device "Q3 A / AT64A" appears to be in the lower right of the underside of the system board in this image: blob:https://photos.onedrive.com/29b026fa...b-26c3678f3270
Just to the right of the "ISSI" chip. --g
8-pin device "Q3 A / AT64A" appears to be in the lower right of the underside of the system board in this image: blob:https://photos.onedrive.com/29b026fa...b-26c3678f3270
Just to the right of the "ISSI" chip. --g
#28
AudiWorld Junior Member
Thread Starter
@sm87 -- Did you see this reference: https://www.audienthusiasts.com/Info...nt_EEPROM.html ?
Dang that chip is tiny, roughly zero chance I'll manage to solder it back on successfully.
On a good note, I found more interesting information in the java source! There's a class called CarCodingEEPROM and true to the name has methods to read a bunch of version/model data using an abstraction called StorageManager.
Long story short - and many many abstraction layers apart - it's simply reading/writing to /dev/dsi/data, literally boils down to:
Code:
this.out = new FileOutputStream("/dev/dsi/data"); this.in = new FileInputStream("/dev/dsi/data"); DSIStream request = new DSIStream(); request.init(componentType: 12, instanceNumber: 0, processType: 3, subType: 1000, handle); // subType is the "command" indicating read/write and data type, rest are constants. request.writeTo(this.out); DSIStream response = new DSIStream(); response.readMessage(this.in);
The request and response messages format seems very straight forward, header + payload type deal, the DSIStream class handles all of that business. And I don't see any FileOutputStream.getChannel().lock() calls so file might not even be blocked (so perhaps no need to kill or preempt the MMI process). I haven't tested any of this yet, but if this all holds messing with the MMI EEPROM could be as simple as:
Code:
dd if=/mnt/sdcard/dsi-request.bin of=/dev/dsi/data dd if=/dev/dsi/data of=/mnt/sdcard/dsi-response.bin
#29
AudiWorld Member
@sm87 -- Oh, well done ! Merry Christmas ! I see that we have two named special files /dev/dsi/data and /dev/dsi/debug at run-time.
Except that we don't have a native QNX binary for dd, but I can give this a quick look tomorrow:
and see what gets captured to the SD card.
BTW, some docs on QNX 6.3.0 here: https://openqnx.com/static/neutrino/bookset.html --g
Except that we don't have a native QNX binary for dd, but I can give this a quick look tomorrow:
Code:
cat /dev/dsi/data > ${SDVAR}/dsi-$(getTime).dat
BTW, some docs on QNX 6.3.0 here: https://openqnx.com/static/neutrino/bookset.html --g
Last edited by drgertol; 12-25-2023 at 04:07 PM.
#30
AudiWorld Senior Member
Would be awesome to figure out how to copy CP data and reflash content into a replacement module!
Takes about 10 minutes to move the chip. Works well for instances where a module is dead.
It’s not too bad if you can find someone who works on stuff like this.
It’s not too bad if you can find someone who works on stuff like this.