yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] ptodic:
Unfortunately by enabling the navigation bits in APIM, IPC etc it will not enable navigation (I can edit these bits no problem). I know this because I have killed navigation in a MK5 Mondeo (fusion) by performing a sync update and the navigation license dissapeared. Tried everything to bring it back but managed to bring it to life again yesterday by going to the official ford dealer and downloading the sync files through their server. The magic is in the downloaded file BT4T-14F500-BE.CAB which is the navigation license and enables the global navigation app. The bad news is that this is the only file in sync update which is signed to a particular APIM serial number (and not VIN!). So if we can change the serial number of the APIM to a particular one where we have a signed BT4T-14F500-BE.CAB file we can enable navigation. The best would be to leave alone the serial number and somehow install this CAB without the certificate...
[Windows Mobile Development and Hacking General] seadiel:
I compared the signature of the BT4T-14F500-BE.cab file and the BT4T-14D546-EE.cab file, the digital signatures are exactly the same. BT4T-14D546-EE.cab will install without any problems. There has to be something more to the BT4T-14F500-BE.cab within the .999 file code itself.

I'll try comparing the hex values to the different BT4T-14F500-BE.CAB files I have.

Ptodic,

You just made me have a light bulb moment! This is why we have XDA forums simple posts like these shed light/new ideas for others.

The 14F500-BE file is using the Microsoft Security Vulnerability MS13-098 to hide data within the signature block of the file. Software developers hide this data in the signature block to then use for custom installs like client information. I pulled up this BE file you sent me along with other BE files the ESN is hidden inside the signature block. You can change this area of the file using a hex editor as noted in my previous posts on this topic. The Microsoft authenticode does not hash the signature file so you can add as much data or information in the signature block without breaking the digital signature!

I added screen shots of the hex values/ authenticode structure. I XXX'd out the ESN you would place your ESN in where the X's are. I have not even tried to install this on my car but I did add my ESN to one of the files and as expected the digital signature is fine, I will try installing on my car soon.
[Windows Mobile Development and Hacking General] flsdiver:
ptodic, thanks for the clues.

I can see the APIM ID in the CAB with hex editor, below Ford Motor Company Internal SYNCGEN2 Issuing CA cert at the end of cab. Extracted the CAB to all components. APIMID is not in the extracted files that i found in quick search.

Quick test to replace with my APIM ID, install try, no luck. Still reports invalid signature. Not suprised. So perhaps signed with the ford cert and the APIM ID as the cert name/other cert field.

Seadiel, can you confirm quickly what i see by examining cert details?

To force an unsigned cab (total security hack), or set apim id on my vehicle to be a match to the one in the CAB would be 2 attack vectors i see right now. No idea which way will be easier.
[Windows Mobile Development and Hacking General] vincentka:
You must change ACM to get RDS in EU
[Windows Mobile Development and Hacking General] syrusas:
I thought that it is software related. Because, if you look at the second photo in a post before, on the bottom left, you will see a song/station scrolling to the left.

Same goes for the first photo, on the top, you can see ZIP FM (Radio Station name) and it scrolls to the left and shows a songs name.
[Windows Mobile Development and Hacking General] rioachim:
Try

7D0-01-01	A32B	E003	304B	(4B can be recalculated by Forscan)

It is software related, but so far experience with this change on ACM is limited because there aren't so many users who need it
[Windows Mobile Development and Hacking General] fblasot:
Hi,

an Italian friend forum has installed on his focus mk3 the sync2 mft bought on eBay from an US focus.

I prepared for him all the apim values using a basic focus mk3.5 and after changed it works almost well.

But...the second controller in the steering wheel for the phone it is not working, anybody of you knows which bits to change ?

Another problem is the rear view camera: the relative bit of course was changed, but when rear gear is inserted the sync2 doesn't switch to black screen...

With focus mk3.5 that is the normal operation...

Maybe the image module for MK3 is really necessary ? Even with a Chinese camera ?

Thanks.
[Windows Mobile Development and Hacking General] syrusas:
Done this already, no RDS on the Main Screen. RDS is shown only on the lower right corner, when using nav, or any other screen / function except radio and main screen.

It would be better if you look at my photos in the earlier posts.

Looking forward for further development.

Also, I have a second full MFT setup from a donor 2012 focus. So if any one is interested and need something, PM me, willing to sell. US spec. VIN: 1FAHP3H22CL226782

---------- Post added at 05:49 PM ---------- Previous post was at 05:47 PM ----------

MK3 had a separate camera module from the rear view camera, 3.5 camera had module built into it. So I think that yeah, it is needed.
[Windows Mobile Development and Hacking General] fblasot:
Today he solved​ the problem, it was a false contact of video signal from camera...no needs​ of the image module...of course he hasn't the white active steering lines...
[Windows Mobile Development and Hacking General] David_ra:
Hello everyone, I have a us spec Mustang GT with mft, I want to enable even frequencies and RDS. Any help regarding this would be highly appreciated. Thank you!

I tried reading most pages of this thread, the problem is, I'm a bit of an idiot when it comes to stuff like this. I already have an OBD2 dongle and the forscan software, and I was able to activate the navigation. It's just the RDS and the even radio frequencies that won't work.
[Windows Mobile Development and Hacking General] syrusas:
I have enabled all the frequencies on my MFT, but I do not have RDS yet. But, one of guys I know, have managed to enable RDS on his car, so today or tomorrow, I will scan his cars as built data, then compare to mine and will let you know what must be changed for the frequencies and RDS
[Windows Mobile Development and Hacking General] knevelsg-j:
Interested in this! as i'lm doing the same european conversion on my F150
[Windows Mobile Development and Hacking General] David_ra:
Thank you for your help:)
[Windows Mobile Development and Hacking General] knevelsg-j:
Do you mean: actually phisically change ACM, or just make the changes in ACM using forscan?
[Windows Mobile Development and Hacking General] RogerWilco486:
Greetings! Thanks to the information in this thread I was easily able to enable the Navigation on my 8" MFT equipped 2015 Fusion SE (North American) without any trouble. I appreciate all the effort that's gone into making this possible!

I do have a question. My car uses the instrument cluster with an analog speedometer in the center and two color displays, one on either side of the speedo. The right hand display has menus for various functions, and from what I gather the vehicles factory equipped with Nav enabled should display Navigation instead of Compass at all times. Mine only displays Navigation when the nav is actively navigating, otherwise it stays at Compass. Is this normal?

I've seen a few posts referring to changing an IPS AsBuilt register to tell the IPS that the car has NAV which permanently changes the Compass menu item to Navigation whether or not a route is active, but the examples are for the Taurus and Focus I believe.

Since my Fusion's IPS AsBuilt data doesn't look anything like the examples I've seen posted here, I'm hesitant to try any changes.

Has anyone successfully configured a Fusion's IPS to switch the Compass menu to Navigation? If so, which bits require changing, and to what values?

For reference, he is my Fusion's IPS AsBuilt data (Saved with FORScan, formatted for easier reading):

;Block 1

720-01-01 0423 1064 6024

720-01-02 0C1F 1065

;Block 2

720-02-01 79C4 3C30 1EF1

720-02-02 1000 F934

;Block 3

720-03-01 2002 7100 00BE

720-03-02 880C 28E8

;Block 4

720-04-01 0001 0000 002D

720-04-02 5553 00D5

;Block 5

720-05-01 D0A8 0100 00A6

720-05-02 0000 002E

;Block 6

720-06-01 0000 0000 002E

720-06-02 0000 002F

;Block 7

720-07-01 0000 0000 002F

720-07-02 0000 0030

Thanks!!!
[Windows Mobile Development and Hacking General] knevelsg-j:
I have an F150 with factory navigation and it behaves the same, (compass when not navigating and navigation otherwise) so it is normal! can't help you with the correct IPS values to change it tho
[Windows Mobile Development and Hacking General] syrusas:
So, to get all Bands + RDS you will need to do these changes.

If there is any difference, changes are done on 2012 Focus

First, I have installed European 3.10 version that rioachim posted: https://xdaforums.com/sho...&postcount=937

Then done these changes to

APIM

7D0-01-01 A32B E003 304B (4B can and will be recalculated to correct value by Forscan)

7D0-02-01 4C54 0001 0083 (83 can and will be recalculated to correct value by Forscan)

ACM

727-04-01 0303 0235 (35 can and will be recalculated to correct value by Forscan)

Also, I dont know why, but first time, on my car, conversion did not work.

I had to change APIM data from:

7D0-01-01 A32B E003 304B to 7D0-01-01 A12B E003 304B

and only then it have worked. After it worked, I have reverted it back to 7D0-01-01 A32B E003 304B

(dont know, why and how this helped, but it helped)

But now, I have another issue. Traffic Announcments (TA) button does not engage, same goes for News Announcments and Regional Settings.

Also, RDS text looks hideous in the radio settings, as is font that is used for the radio that is shown in Mhz on the main screen :D

So, anyone has some ideas, how and what to change to make TA and other settings work?
[Windows Mobile Development and Hacking General] knevelsg-j:
Thx man!

And same here with the TA button and the news and stuff.
[Windows Mobile Development and Hacking General] rioachim:
[MENTION=2659075]syrusas[/MENTION], those changes are specific to your car. Other owners should not copy them but instead post their values so I can check them.

Try and report behavior after:

7D0-01-01 8B2B E003 304B (4B can and will be recalculated to correct value by Forscan)
[Windows Mobile Development and Hacking General] syrusas:
Nope, nothing changed
[Windows Mobile Development and Hacking General] rioachim:
go for 7D0-01-01 832B E083 304B (4B can and will be recalculated to correct value by Forscan)

at least one change you should have seen, Sirius is no longer in input list, right?

also I see you have "i" notification on, is there an error reported?
[Windows Mobile Development and Hacking General] DreaderX:
SD card not available

I was able to activate Navigation on my Ford Everest using Sync 2, however I could not find an SD card with map of the Philippines.

I tried using Philippines map data from MapFactor but it didn't work.

My Sync 2 was able to detect the SD card, but was not able to detect the map data.

Any recommendations as to where I could get map data/software that's compatible with Sync 2?

Are there alternatives?

Thanks
[Windows Mobile Development and Hacking General] syrusas:
Done this, now Sirius is no longer in input list. "i" was for expired Sirius subscription.

TA, News and Regional still does not work.

Maybe this must be configured in ACM?
[Windows Mobile Development and Hacking General] David_ra:
Any updates to the RMS and European frequencies by chance?
[Windows Mobile Development and Hacking General] knevelsg-j:
Not really. I've been reading up on the whole thing and tried getting a hold of the as-built files from a Belgian Ford edge with MFT, so I can compare them with the as-built files from my f150. But nobody really wants to share their VIN so I'm kinda stuck at the moment. ?
[Windows Mobile Development and Hacking General] syrusas:
On a Focus, I was not able to get TA and few other features to work. RDS and EURO works, but no TA, Regional and News Announcements features work.

But, I have managed to make it work on a Escape. Even station names are saved and shown instead of frequencies on the main screen.

Attaching As-built files of APIM and ACM before and after the change.

I have enabled EURO frequencies, RDS and NAV. Sirius is gone from the input list. Everything else works and looks good. No errors.

Also, I can take a photo of a VIN of any Ford here in Europe with a 8" MFT. If needed :)
[Windows Mobile Development and Hacking General] knevelsg-j:
Sounds like this is exactly what I need! :fingers-crossed: will check to see if I can get the same result on the F150 when I have the time. But thanks!

The reason I wanted to use an Edge is because it has the same type of options (heated and cooled seats etc.) As my F150. But this should work nevertheless :good::D
[Windows Mobile Development and Hacking General] sakp10:
Copy of an original SD Card

Hello,

Where can I find and download a copy of an original SD card for America/Canada?

Cheers.
[Windows Mobile Development and Hacking General] syrusas:
Any luck?
[Windows Mobile Development and Hacking General] knevelsg-j:
I've been working night shifts so while I did compare the files and made a small list of things to change, I have not made time to try it. I will probably do it friday evening and wil report back then!
[Windows Mobile Development and Hacking General] vgun2015:
Video in mft

I have EU Mondeo mk5 and it has RCA connectors (red, yellow, white). When I connect my phone, I can listen video sound "even in motion". But can't watch video even in park.

How can I watch video at least in park? What are the bits in APIM need to change?

How US cars watch video in park?
[Windows Mobile Development and Hacking General] syrusas:
Never tried RCA in my car, I think a lot of us did not tried it. But Video in Motion to my knowledge is yet to be hacked.

Also, its strange that you cannot see video even when in park. Can you send me your apims and acm's as-built file? You can do it in PM. VIN also would be appreciated. It would let us to know your car's option's.
[Windows Mobile Development and Hacking General] vgun2015:
Hi syrusas

Thanks for the reply. I will send apim, acm and vin in a week to you via PM. Now I am on vacation but will send you.

Really want to watch video in park at least.
[Windows Mobile Development and Hacking General] andresmorago:
Hello to all

Im working on a Sync 4" to 8" APIM upgrade. So far, i have achieved a lot but im having some issues with the Parking aids (active parking lines). I havent been able to identify the byte which enables them.

Im currently able to see the video feed, the parking sensors visual (car drawing) and audio feedback but the active parking lines wont show/respond with the steering wheel. All i see is 2 fixed lines

I have noticed that they momentarily appear (1 or 2 seconds) the first time I start the car and put it on Reverse but they dissapear and wont show again.

Can anyone please advise which byte segment i should give it a try?

My car is a 2015 Focus SE

This is my current asbuild data for APIM

7D0-01-01	2A20	8402	20C9

7D0-01-02	0488	5300	02BB

7D0-02-01	5753	0001	0085

7D0-02-02	0200	0000	00DD

7D0-02-03	0000	DC

7D0-03-01	1F4D	4601	008E

7D0-04-01	0103	0201	00E3

7D0-04-02	0001	DE

I will appreciate any help

Regards
[Windows Mobile Development and Hacking General] fblasot:
I added aftermarket to my 2015 Focus Titanium X the original ford rear view camera and to have the white active steering lines I changed in BCM

726-01-06 (data1)

no camera:1240

with camera:9240 (+8 hex)
[Windows Mobile Development and Hacking General] andresmorago:
Thanks.

Camera has been always enabled on my car since it came with it. BCM line 726-01-06 is OK.

Active parking lines used to work with my previous Sync 1 system but now they don't with my Sync 2 apim
[Windows Mobile Development and Hacking General] fblasot:
I checked electrical schematic of MY2015 and from original ford camera the LIN wire goes to same BCM input point, both for SYNC1 and SYNC2...

If you have also changed central config #172 to "with display - no touch, color tft, DM8 with Navi" and BCM is ok, then probably the problem is in APIM config.

My config is this, hope that you can understand difference (use AsBuiltExplorer...):

7D0-01-01 0B6C, 6592, 10

7D0-01-02 041C, 1B00, 04

7D0-02-01 4954, 0005, 00

7D0-02-02 0108, 0000, 00

7D0-02-03 0000

7D0-03-01 024D, 3800, 00

7D0-04-01 0100, 0000, 00

7D0-04-02 0007

take care that my focus is EU, with Sony audio system with 10 speaker, no DAB, with RDS and TMC.
[Windows Mobile Development and Hacking General] syrusas:
Maybe you can provide us with also with full ACM asbuilt data? I have US spec Focus and cannot make TA, AF and few other things to work.

On Edge / Escape, i had no problem, with a focus right now I am struggling.
[Windows Mobile Development and Hacking General] fblasot:
MY2015 Focus does not have ACM module..
[Windows Mobile Development and Hacking General] syrusas:
ACM is the thing you insert CD and etc, how the hell a 2015 Focus does not have it? :) First time hearing that. Maybe your OBD cable works only on one CAN bus, HS or MS (i dont remember which one is for APIM and which is for ACM). Oh well, will search for another EU Focus with all the options :)
[Windows Mobile Development and Hacking General] fblasot:
Of course there is the hardware, ie the radio with cd reader..., but no ACM config to read, the relative configurations are in the APIM...

That is what I understood reading here and there.

I have the Russian ELS27 with autoswitch MS/HS can.
[Windows Mobile Development and Hacking General] luehrs45:
Any Luck?

I just started looking into this. I would like to be able to customize my sync, but have no clue howor where to start.
[Windows Mobile Development and Hacking General] andresmorago:
Thanks

Youre correct. LIN goes to the same pin on BCM. I have already modified BCM parameters with foCCCus in order to support the new SYNC2 system

73 Loudspeaker quantities 2 - As i dont have a DSP on my car, i kept it this way (6 speakers)

112 In Car Entertainment 18 - Original value was 16

157 Bluetooth handsfree 9 - Original value was 8

172 Touchscreen 9 - Original value was 4

214 Integrated Control Panel 8 - Original value was 3

As you can see config #172 to "with display - no touch, color tft, DM8 with Navi" has been modified (new value is 9).

Video and zoom as well, work OK. I havent been able to activate the active parking lines. I will check your AB data

Thanks
[Windows Mobile Development and Hacking General] andresmorago:
Hello again

I was able to represent my issue with the parking lines. I can see them working only for 5 seconds and just right after rebooting the apim. After that, active lines will disappear

[YOUTUBE]qbMgNHXNsT8[/YOUTUBE]
[Windows Mobile Development and Hacking General] fblasot:
Very strange.

But I see that you could have an old sync2 software version...

Is it the lastest 3.08 ? If not, try to update it.
[Windows Mobile Development and Hacking General] andresmorago:
It's on 3.08.15128.EA.10 :eek:
[Windows Mobile Development and Hacking General] fblasot:
Very strange, look the central botton button here
[Windows Mobile Development and Hacking General] andresmorago:
Your central button looks different because you have the climate quadrant enabled and I don't. Since that quadrant is used for date and settings when climate is disabled, the central button won't show the settings icon
[Windows Mobile Development and Hacking General] fblasot:
Ah, I didn't know about that...
[Windows Mobile Development and Hacking General] andresmorago:
I ended up fixing this by performing a master reset from the apim menu. Everything got erased except, of course, the as built data.

Active parking guidelines are now functional
[Windows Mobile Development and Hacking General] fblasot:
Arghh...it was so easy...in the end, the sync is Windows...
[Windows Mobile Development and Hacking General] andresmorago:
I know. I was always relying on the module reset that forscan performs but that would fix anything
[Windows Mobile Development and Hacking General] Vispen74:
Hi!

Was trying to get a line out for sub frpm my Sony Sync 2 on a Mondeo Mk5. I tryed to follow the guide, but the connectors colors are not the same, at least not the 240B connector. Has any one managed this on a mondeo?

Original thread:

Variable Line Level Preamp Outputs From ACM
[Windows Mobile Development and Hacking General] voasy:
I have a few questions.

Can you recommend an Android device that reads a full SD card? Or do you recommend a Micro SD with Adapter?

Also step 6:

6.) Copy all Contents of the original SD to your own created SDCard (DO NOT OVERWRITE SdCard.key!!!!!)

I may have read this wrong - where do the contents of Original SD come from?

Is there somewhere you can download these?
[Windows Mobile Development and Hacking General] jagred:
Just use microSD

About SD Content - its content from original SD Card Map. You could copy it from original card, or found on the internet. (google for ford A6 or F6 and you will find it)
[Windows Mobile Development and Hacking General] miko13ko:
tpms off ford fusion 2014

hi,can any one can help me with tmps off in ford fusion 2014 ? how to disable, i was try in ipc 720-04-01 (2015+ MY) xXxx xxxx xxxx 0 wher is bigX but no luck,may be have to change some line in bcm but i don know wich ?
[Windows Mobile Development and Hacking General] newmanEU:
rca connector in EU sync2 version

Hi, can you share/mirror the cell phone display into sync2 (EU version)? The US version has a RCA connector through which the mirror is easy. But we not have this slot in the EU. So my question is. Is there any way to mirroring? Or is possible add a RCA connector to sync2? Thank you for the answers
[Windows Mobile Development and Hacking General] fblasot:
With EU sync2 it isn't available line-in RCA.

You can have it but you have to create pin connections in the sync2 connector and mod the config apim; in the end bypass the in movement block if enabled on EU, but this last problem I don't know...
[Windows Mobile Development and Hacking General] TheSt33v:
If anyone finds an upload of the A8 card, please PM me.
[Windows Mobile Development and Hacking General] vincentka:
HI :)

SYNC2 real license still avalible :laugh:

vinc
[Windows Mobile Development and Hacking General] VBBoston:
Hello, have you found A8 maps for North America yet?

Thanks )