yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] seadiel:
I have not tried that yet.

In order to do an APIM transfer/Full flash you hookup to the OBD2 port and USB. Log into OASIS and hit the sync button. My guess is this will use he OBD2 port to verify the vin via the PCM. ADB data is then downloaded directly from Ford based on the vin and software files are all installed via the USB port due to the CAN bus speed it would take forever to install over the CAN.

---------- Post added at 08:00 PM ---------- Previous post was at 07:57 PM ----------

Yea I saw the modifications on it already, I just wasn't sure if that was my problem for the lack of modules showing up in the programming section or if I needed the extended license. The ELM327 I have now just read's the HS-CAN I am going to work on the DPDT mod this weekend.

I can see many modules on the HS-CAN it is just that programming area I only have 2 or 3, nothing like you had.
[Windows Mobile Development and Hacking General] sheltonfilms:
FORD ETIS is on lock down so I can't see all the modules that came with your vehicle, but I could pull the AS BUILT DATA. Going by the first 3 digits of the ABD, I compared to the first three of my modules and got these:

7A7

7D0-APIM

7D5

701-GPSM

716

720-IPC

724-SCCM

726-BCM

727-ACM

730-PSCM

736

737-RCM

740

741

744

751

754

760-ABS

I'm sure a lot of the ones I don't know are control units related to the high voltage hybrid system.

Are you looking in the right section? Are you clicking on the microchip icon on the right? Or are you clicking on the clipboard/pencil or wrench icon?
[Windows Mobile Development and Hacking General] seadiel:
Yea I clicked on the microchip and could only see a couple of the modules. I am going to do my ELM327 mod this weekend and get the extended license then try again.
[Windows Mobile Development and Hacking General] blackra1n.x:
Hello guys , i can help in this ...

This system use ARM chip and windows mobile ( wince 7 ) , anyone here try to install any application to the system ?
[Windows Mobile Development and Hacking General] seadiel:
Problem is we can't install anything unless the .CAB file has an approved digital signature (certificate) that is accepted by the system.
[Windows Mobile Development and Hacking General] blackra1n.x:
Yea i test this yesterday and the system reject any application not signed with ford cer.

I checked the sec file it contain NK.bin and if we can dig into the windows mobile image we can find a recovery agent that can call engineer mode from USB or it call a force emergency system recovery if update fail due power off or something else ..
[Windows Mobile Development and Hacking General] seadiel:
Yea, I started looking through the .sec file but with it being 2gb in size I had to split the file to smaller sizes in order to de-compile it better otherwise it won't load. There is a section in the .sec file that does talk about "image bad Error" loading emergency system recovery. When I look at the strings the .sec file has I did find interesting strings in the .sec such as

"\Software\Microsoft\Shell"

"Welcome to the Windows CE Shell. Type ? for help."

"Software\Micorosoft\Txtshell"

HKEY_LOCAL_MACHINE & HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, ect ect
[Windows Mobile Development and Hacking General] YellowFocusST:
Hey, I don't have much experience decompiling but I do have a pretty fast computer with a lot of RAM(24GB thinking of upgrading to 32), a 13 ST3 with nav and a couple CAN adapters. I could take a crack at decompiling the whole 2GB file if you write a couple lines on what to do. I'm very interested in seeing some more features here and can help however you need. I also have experience programming CAN on Arduino so I could do some bus snooping.
[Windows Mobile Development and Hacking General] flsdiver:
So, the cab with the .sec is not listed in the autoinstall.lst, presumably even if added it won't install (not signed code). So, why does ford give this file to the users in a download? Especially if this is the base OS, why would they give us this? When it could be decompiled and used to find possible attack vectors of the OS itself, that seems very dangerous to provide. Only 2 conclusion would be, 1) when the OS can't be found, and the underlying APIM processor can use this file to reload the OS from scratch, 2) the update is needing a base OS upgrade itself (rare if ever). So, key question is what can trigger this cab to be used? Is it used every time? OS is flashed on every update? Seems like custom code/program could be attached into this cab or into this sec to find out. (dangerous bricking activity). What happens to the upgrade when this file doesn't exist on USB? Errors on update?

I was upgrading mine last weekend to play around a bit, put the update on sd card with NTFS, menu choice to install update (not auto detected). It started the update, after some time, it said can't find update file on USB blah blah. Tried USB stick with NTFS, same errors. Tried another USB with FAT32, it finally proceeded. End result i definitely had the update in a very bad place of it trying and failing to continue, but at a totally known and controllable point as as opposed to randomly pulling the USB/SD. Possible way to force the load of a custom .sec file? Don't Know.

Just brain storming around possibilities at this point.
[Windows Mobile Development and Hacking General] lucasb8888:
I am sure glad I found this thread. I found the other thread mentioned in the first post about two months ago when I first started can bus sniffing. I am still trying to figure out how to turn on the backup camera without being in reverse.

Another project is that I would like to add a backup camera to my parents Taurus. I have access to IDS but I have yet to play with as built data.
[Windows Mobile Development and Hacking General] COMpulse:
Keeping an eye on this.

I recently got a 2013 Taurus SHO, and used a program called FORScan to extract my As-Built data and modify it to enable an AWD gauge, reprogramming the As-Built data with an OBD Link MX Bluetooth adapter. The process involved flipping two bits from zero to one.

I also wrote a tool in VB.Net for comparing As-Built files (.AB or .ABT format). The tool lists modules and values and highlights differences.

Still trying to find a community for As-Built tweaking and wondering if my compare tool will be useful to anyone...

[IMG="My As-Built compare tool"]http://www.compulsivecode.com/images/asbuilttool.png[/IMG]
[Windows Mobile Development and Hacking General] YellowFocusST:
That is interesting. If we could get a pool of asbuilt together, we could start going to work on understanding what needs to be done. I would like to see someone pull their data, install a lockpick then pull it again and compare it. That would cover the rear-view cam. Also, it would be possible to snoop the CAN with a couple of diodes on the CAN line of a lockpick to see its programming sequence.
[Windows Mobile Development and Hacking General] lucasb8888:
Yeah that looks like a nice tool. I ended up just using winmerge after formatting the xml to see the differences. But this is definitely more robust.

---------- Post added at 04:25 PM ---------- Previous post was at 04:16 PM ----------

I have been sniffing the CAN bus with an arduino and can bus sheild (seeedstudio). I have been plugging into the OBD2 port but I think you are on to something with tapping the CAN at the MFT as I haven't been able to find the data for the back up camera. I was able to get the back up sensor display to show the MFT screen tho. I was hoping to figure out the backup camera before the new lockpick air comes out so I don't have to drop 4 bills on it lol.
[Windows Mobile Development and Hacking General] COMpulse:
One nice thing about this tool is that it can compare a .AB file to a group of .ABT files. This makes it pretty easy to do a before/after comparison by either getting your .AB file from motorcraft, or by using FORScan to dump each module to a .ABT file before and after making any changes.

It's a pretty basic program right now. Only spent a few hours on it so far. It has room to grow.

I don't know of any other forum where I might find people interested in this so I'll post the link:

http://www.compulsivecode.com/images/asbuiltexplorer.zip

Just select a single .AB file or multiple .ABT files for each box at the top. Then click the Load Files button, and it should list the data. Module IDs that exist in both sets of data will be paired up to compare. Modules that do not exist in both end up un-paired at the top or bottom of the list. If anyone tries it, all I request is some feedback (PM to avoid cluttering the thread). If you have a suggestion, suggest it. I'm new to As-Built data, so I may not know all the ins and outs just yet.

I don't have a ton of time to mess with my car, so I'm hoping other people can benefit from this tool and share what they discover.

Also, I don't want to hijack this thread. If this should be a separate thread, please tell me. However, since this forum is about MFT and my program isn't directly related to MFT, I decided to post here.
[Windows Mobile Development and Hacking General] seadiel:
Yea I noticed that as well in the autoinstall.lst. I suppose you could remove that file/update then try to do a full update and see if it goes through. Maybe one of the updates within the code calls this file? Looking at this file it contains all the certificates. If one of the other updates does actually call and use this .sec file when it does the update, I suppose you could inject your own certificate within the .sec file. But not sure if it does a hash check at the end.

That looks like a nice tool to compare ABD.

I have been messing around with FORScan as well. I was able to figure out for my car the ABD on what was different with the navigation hex values for the APIM, but for some reason I can't see the APIM in ForScan on mine to make changes. I ended up finding the same year/model/trim as mine with the exception of navigation/backup cam. I then just visually compared the hex values to spot the differences.

I did find another update pack, which seems to be for a non-english lanugage update. I noticed it had a file called "BT4T-14F500-BE.CAB" the description for this is "...." looking at the file it appears to be a navigation unlocking tool

I attached a picture of the "strings" it displays in the main .999 file. I tried installing just this file on my unit and it reports back as a bad/invalid or unsigned file. The file matches the signature of all the other update files, so not sure why it rejected it.

I then found an update that actually includes this file in the update path, I plan to look into the files before BT4T-14F500-BE.CAB is called.

[SYNCGen2_4.32.14073]

Open1=SyncService\DM5T-14D621-AB.CAB

Open2=SyncService\DA5T-14F496-PA.ZIP

Open3=SyncService\EA5T-14D546-BB.ZIP

Open4=SyncService\EA5T-14F496-AB.ZIP

Open5=SyncService\EA5T-14F497-JD.ZIP

Open6=SyncService\EA5T-14F657-AC.ZIP

Open7=SyncService\BT4T-14F500-BE.CAB

Open8=SyncService\EA5T-14D546-AUA.CAB

Open9=SyncService\EA5T-14D546-ATD.ZIP

Open10=SyncService\EA5T-14D546-AVA.CAB

Options=AutoInstall,
[Windows Mobile Development and Hacking General] mrclean64:
Thank you for that!
[Windows Mobile Development and Hacking General] TScott69:
Ford disabled the "Audio Visualizer" probably for safety reasons. https://www.youtube.com/watch?v=vy6sd-ovYPQ

I found references to a MFT glitch that when going into the Audio Settings, a menu item flashed briefly displaying "Audio Visualizer ON/OFF" then disappears. Ford probably fixed this glitch on later versions of MFT as they also removed it from user manuals as well.
[Windows Mobile Development and Hacking General] fblasot:
[MENTION=253582]Rio[/MENTION]chim:

Are you writing a document that shows all the options ?
[Windows Mobile Development and Hacking General] SchimiEX:
hmmm,

the TMC didn't work kn my us 2013 explorer sport... It shows a button in the nav but don't find a tmc signal....

I drive over 1000km and there never been a message...
[Windows Mobile Development and Hacking General] rioachim:
yes, I have been looking into this and I believe the ACM (radio) has to be flashed with a different VBF (sw) file that allows TMC reception. On a polish forum there is a similar discussion (http://forum.fordclubpolska.org/showthread.php?t=221780&page=58)

Now this is tricky, because we have regular cd-player and Sony ACM system, both with different sw files, and I don't know what happens if one flashes a wrong file on his ACM. Also the files get updated in production, so comparing the .AB files for two identically equipped cars does not always yield the same sw files.

E.G.: in the attached file, F1BT-14G316-BD.vbf is from a Ford Focus car with regular ACM without TMC, F1BT-14G316-CD.vbf is from a Ford Focus car with Sony ACM with TMC. I have no idea if they are compatible, not to mention there is an additional Strategy (calibration) file on top of the ACM unit.

Note: flashing vbf files is possible on Ford Focus using Focccus application and a USB ELM adapter.
[Windows Mobile Development and Hacking General] pomyslowy_dobromir:
Yes, we have been trying to compare 727-XX-XX registers of various cars. Up to 727-04-01 there is no difference but vbf files. However, it was noticed that AsBuilt Explorer is not comparing above 727-04-01. Can you confirm? Forscan shows up to 727-07-05 - there could be difference there - not sure if that would help with TMC. The other question is if all ACMs have double FM tuner built-in (perhaps there is only one where with digital radio DAB+, which is quite popular option in Poland). Single tuner seems to have DSP different to that in double tuner.
[Windows Mobile Development and Hacking General] DanMc85:
If I remember correctly. 07-05 and on to the end contains two things. Sat radio ESN and hexadecimal representation of the default FM radio station presents. Only blocks 04 and above would have any vehicle specific code.

Again I could be wrong but I remember this being the case in the past.
[Windows Mobile Development and Hacking General] pomyslowy_dobromir:
Chance the presets include info on stations broadcasting TMC or licence / certificate - subject to agreement between Ford and TMC provider in a country?
[Windows Mobile Development and Hacking General] DanMc85:
No idea. I live in USA. We don't have TMC, I believe.
[Windows Mobile Development and Hacking General] rioachim:
I wouldn't look inside 727-XX-XX for TMC because Ford Focus doesn't even have AB data for this module. It's either in ACM hardware or in VBF
[Windows Mobile Development and Hacking General] MarcinXDA:
Ford Mondeo has 727 section in .ab
[Windows Mobile Development and Hacking General] rioachim:
And it doesn't matter, it needs to have AB data because it doesn't have CCC (central config)
[Windows Mobile Development and Hacking General] MarcinXDA:
Yes, I know. I mentioned about mondeo because it is easy to compare thru .ab files. My first findings showed that up to 727-04-01 there are no differences in ACM between TMC and non TMC, but I didn't check next bits because it was not available from asbuiltexplorer. Now I go on holiday for 3 weeks and I wouldn't check it out during this period. See you.
[Windows Mobile Development and Hacking General] COMpulse:
My AsBuiltExplorer should show all module addresses and blocks that are in the .AB file. If you have a file that is not being read correctly, please send it to me and I will investigate.
[Windows Mobile Development and Hacking General] ulao2:
If we can flash vbf files to ACM can we not flash to APIM and thus get NAV on non NAV systems?
[Windows Mobile Development and Hacking General] mrclean64:
Is it possible to activate OEM Remote Start using the factory key fobs by turning on some bits in the BCM and IPC?

There is a hardware mod that can accomplish this using an iDatalink device, but I was wondering if the same could be accomplished through the software without purchasing additional hardware.
[Windows Mobile Development and Hacking General] NYG2009:
Quick question. I have a 2015 explorer limited with MyFord Touch. I have a 3 month trial of SiriusXM. The sound quality is terrible compared to FM HD radio, using a memory card, using Bluetooth from my phone or using just about anything else as an audio source. Is something wrong here or something that can be tweaked, or is SiriusXM just a poor heavily compressed service.
[Windows Mobile Development and Hacking General] mrclean64:
It's been my experience that the sound quality from SiriusXM is just poor to fair compared to other formats. I have a free trial running right now also, and you're right, they heavily compress their audio channels. :(

I haven't found any setting that really improves this, the service is not worth their $15/month that they are asking, IMO.
[Windows Mobile Development and Hacking General] tent228:
In China, somebody declare they can download the nav license now. But they didn't told the method to the others....
[Windows Mobile Development and Hacking General] omar302:
I am little new to this, so please take it easy with me. I was trying to enable RDS (Radio Data System) on my 2011 Lincoln MKX, it is an export model for the GCC market. I was able to compare as built data from a US model with the same options and found out that the ACM as built data "727-04-01" if changed to the US model will enable RDS to my car & the station names will start to appear, but, I lose the even number radio frequencies which we use here in Qatar (FM 103.4, 103.6 ...etc).

My As built data (without RDS, with all frequencies enables): 727-04-01 is 0103 0239

US As built data (with RDS, with only odd number frequencies): 727-04-01 is 0001 0135

Can someone help in what values I can try for 727-04-01 perhaps I can get both, RDS & all frequencies?
[Windows Mobile Development and Hacking General] DanMc85:
Have you tried changing just single parts of the block string instead of all the hexadecimal digits to see what effect it has?
[Windows Mobile Development and Hacking General] COMpulse:
At a glance, I think the changes listed above reflect a change of 4 different bits, assuming the last byte is the checksum.

01 to 00, turned a single bit off.

03 to 01, turned a single bit off.

02 to 01, turned a bit off, and turned a bit on.

00000001 00000011 00000010

00000000 00000001 00000001

(I'm fresh out of surgery and in no condition to try to do anything with binary while on pain killers.)
[Windows Mobile Development and Hacking General] omar302:
You mean the "0001" part only? I tried and I think I had no RDS. But I also got an error message that the checksum (or something like it) didn't match. I also don't know what values I could try. If the 2 values, from the US vehicle & my vehicle are somehow close, I'd try the values in between. But what are those values?
[Windows Mobile Development and Hacking General] DanMc85:
Just the different parts. Technically each digit us a different part.

Checksum will be different on any change that isn't an official match to a existing string. Just hit okay and it will update it.
[Windows Mobile Development and Hacking General] NYG2009:
I want a nav license. Too bad they gave no details.
[Windows Mobile Development and Hacking General] Arrio:
We should decompile the latest ETIS software again to see if there is any new method to obtain the license since they changed the link.
[Windows Mobile Development and Hacking General] omar302:
Tried it again, yes it is only the first part; changing the "01" to "00" makes the changes (RDS working but with US frequencies only) i.e. changing "0103" to "0003". Tried different random numbers, but they all made it work as the per the US version (with RDS with US frequencies). Need a way to get RDS with all frequencies enabled.
[Windows Mobile Development and Hacking General] flsdiver:
really, did that day 1. they did not change the link. they started passing the etis.ford.com cookie. session id seems only thing important. they can tell who you are. if you have permission to download you will get the file, if not 403. they added this cookie pass in all get requests performed now. they may also more strictly check other parameters, but don't know that, cookie is the stopper anyway.
[Windows Mobile Development and Hacking General] rioachim:
For TMC trials, I'm adding two more files from Ford Focus (RH is Sony ACM, GH is regular ACM, both WITHOUT TMC) and some info taken from the .ab files

you can see that each ACM has 2 software files (e.g. F1BT-14G316-BD.vbf and F1BT-14C044-GH.vbf/-RH.vbf) but different hardware part numbers too (GK/RK)
[Windows Mobile Development and Hacking General] ulao2:
it has not changed. They just added a cookie to check login info. Hence why you get 403 and not 404.

* edit Sorry flsdiver, didnt see your post *

They can not contain themselves. I'll be leaked or announced soon enough. After all this is a m$ device, no one is going to resist beating m$ !

There are only two options.

Bit 4	"Radio Tuner Market"

0 – Non RDS Market (NA)

1 – RDS Market (Europe, APA, SA)

bit 3 is ECALL and 2 is reserved.
[Windows Mobile Development and Hacking General] rioachim:
And still for TMC, here are the two software files from a Ford Focus with Sony ACM with TMC (main F1BT-14G316-CD.vbf and additional F1BT-14C044-UAH.vbf with description Comment: c346e_ahu_ngl0cplus_hi_tmc_ese_c_prod):

AND if I look over the VBF download site (https://www.fordtechservice.dealerc...Reprogram/DSFM_PCMReprogram.asp?swproduct=IDS) I can find:

F1BT-14C044-GAH.vbf: c346e_ahu_ngl0cplus_mid_ese_c_prod

F1BT-14C044-HAH.vbf: c346e_ahu_ngl0cplus_mid_dab_ese_c_prod

F1BT-14C044-KAH.vbf: c346e_ahu_ngl0cplus_mid_tmc_ese_c_prod

F1BT-14C044-LAH.vbf: c346e_ahu_ngl0cplus_mid_dab_tmc_ese_c_prod

F1BT-14C044-NAH.vbf: c346e_ahu_ngl0cplus_hi_tmc_sot_ese_c_prod

F1BT-14C044-UAH.vbf: c346e_ahu_ngl0cplus_hi_tmc_ese_c_prod

F1BT-14C044-VAH.vbf: c346e_ahu_ngl0cplus_hi_dab_tmc_ese_c_prod

F1BT-14C044-ZAH.vbf: c346e_ahu_ngl0cplus_hi_dab_tmc_sot_ese_c_prod
[Windows Mobile Development and Hacking General] Weees:
Thanks for sharing, but can you help me abit more, since im bad with the bit conversion. How to get the RDS without losing European frequency list ?
[Windows Mobile Development and Hacking General] ulao2:
That info I gave you is for APIM.

7D0-01-01	AA2A	0503	24D9

24 hex = 100100 binary

so bit 4 in this case is on making it a zero turns it off.

I think 727 is the ACM, not sure that will work?
[Windows Mobile Development and Hacking General] Weees:
Thanks, but the APIM isnt the place to control RDS. I have already tried that. The option of RDS will appear but it wont be possible to turn it ON. Its stuck into OFF position.

So it seems the RDS control is in the ACM, not APIM.
[Windows Mobile Development and Hacking General] ulao2:
hard to say as I don't have ACM data but this example has it on if you are right about the 727-04-1

727-04-01	0001	0155	53DD

Do you know what byte should be RDS?
[Windows Mobile Development and Hacking General] Weees:
Yes, its in this group : 0001 , the second digit from the left. If its 1 , RDS is off, 0 is on. BUT the problem is that also control the frequency group it seems. Turning it ON, changes to US frequency list so I can no longer get European frequencies.

Dont know if there is another bit that would turn it on for European frequencies ! :\
[Windows Mobile Development and Hacking General] ulao2:
Right correct, same is true with APIM. You get one or the other not both.

I think the ACM in both cases has memory provisioned for x stations. And setting to us makes it odd were otherwise its even. So there is only room for x stations not x*2
[Windows Mobile Development and Hacking General] Weees:
You know, I dont think so. I have seen ford cars in Europe equipped with and using RDS. So, its just a matter of settings. It seems RDS setup has alot of variables, because for example, even when I turn on the bit that activated it, but with the US Frequencies, the station names werent showing on the main screen instead of the numbers. The station name was appearing in small text on top (alongside where the artist name and title appears), but it didn't replace the big frequency numbers.