yashsingh1/xdaforums huggingface dataset:
[MTCD Android Head Units General] SkyBeam2048:
I got a Subaru Levorg MY2016 with factory non-navi radio which uses resistor based SWC. I heard the models equipped with factory navigation might use something different so this might not apply to you.

Actually you should be fine connecting SWC ground and SWC1 + SWC2 to the corresponding pins (brown cables) on the MTCD head unit. You don't need any axxess or maestro. I tried to use axxess as well as often my buttons did stop working as it looks the resistor values might "drift" slightly after a while of operation. Results were that the ADC on the head unit reads different resistor values and therefore different button keypresses every now and then. You can see this if you go into the SWC learning app, then press any button. You should be able to map any button. If they stop working go into SWC learning app again and press one of the already mapped buttons. Now you will see if the HU recognizes the already-mapped button as a "new" button and asks you to map it.

As of later MTCE MCU versions on my KLD unit the SWC buttons don't work immediately after turning on the radio but just after about 20 seconds. But the mapping seems to be more stable.

Another work-around I implemented was to connect both SWC wires (SWC1 and SWC2 from the car) to SWC1 input on the HU adding a 680 Ohm resistor to one of the SWC outputs from the car in order to allow it to distinguish between them. Connected to a 3.5mm jack the mapping looks as follows:

_
/ \ -> SWC1 ----------------------------------- SWC1
--- /
| | -> SWC2 ------[R, 680 Ohm] ---/
---
| | --> GND ------------------------------------ GND
|_|

Things got much better with later MCU versions. So perhaps this hardware hack is not required any more for me too.

Also note that in factory settings (password 126) in "others" screen you can change the mapping of resistors for SWC, though I kept my one at default (10k/10k I believe). Caution: Don't change any values in factory settings if you don't know what you're doing or at least take screenshots/notes of the default values and export them before doing any change. You have been warned.
[MTCD Android Head Units General] w0ng3r:
I have a pumpkin 7.1.2 headunit and a 2015 STI, most of the head units will have a unit to handle SWC inputs. ae64.com has a good write up for the pinouts for key 1 and key 2.

Check your wiring,
[MTCD Android Head Units General] Chetski:
you have no idea how helpful your post has been. I just installed a Pumpkin 7" Android 8 octa core AE0273B-08A in my 2005 Ford Excursion. Your trick is exactly what I needed to get my SWC buttons to work properly. I just kept reprogramming them under different conditions, like engine on then off, lights on, etc. I haven't tried the resistor yet. :D
[MTCD Software Development] Wadzio:
At the beginning:

Flash/Upload modified MCU firmware can brick unit !!!! (in particular from an unknown source, untested etc.)

Maybe this thread will not only affect the modification of the MCU firmware.

I hope that this will help us understand the functioning of the MCU software, get to know bugs, new features and maybe even tricks.

So, if anyone finds something (any functions names, permanent tables), please share with us

MCU firmware was compiled using Keil and uses library (most likely these versions):

STM32F0xx_HAL_Driver 1.3.1 from STM32Cube_FW_F0_V1.5.0

FreeRTOS V8.2.1

What we need:

Tool to decode/encode MCU firmware from here:

mtcdmcutool.zip

The Interactive Disassembler

Useful additions for IDA from here:

MTCDida.zip

(copy appropriate folders to IDA directory)

Short explanation how to do:

Decode MCU firmware:

mtcdmcutool.exe -d dmcu.img decodedDMCU.img

Open decodedDMCU.img in IDA. IDA should ask with wich loader to load the binary file:

Of course, we choose "Android auto MTCD/E MCU firmware"

After a while, we should see:

other disassembled examples:

We can also load HAL/FreeRTOS structures/enums(script: MyScripts\MTCDLibStructsEnums.idc) and disassembled structures/enums (script: MyScripts\MTCDLFuncStructsEnums.idc)

Analyze, analyze, analyze and at the end patch the firmware :)

Encode MCU modified firmware:

mtcdmcutool.exe -e decodedDMCU.img modifiedDMCU.img

Flash/Upload to the unit (according to the standard uploading procedure dmcu.img)

Remarks:

if anyone know more HCT_CMD constants/names (MTCDFuncStructsEnums.idc) share with us

if someone disassembles meaning of fields from structures (MTCDFuncStructsEnums.idc) share with us

if someone disassembles meaning new functions please share

signatures was prepared based on GS_V2.72, but I tested on other versions and most functions was recognized
[MTCD Software Development] marchnz:
Excellent thread and very useful information. I can help map GPIOs to actual MCU pins from the schematic if that helps?
[MTCD Software Development] Wadzio:
Any help will be appreciated :)
[MTCD Software Development] ThirtyOne34:
Are you planning on releasing MCU firmware updates yourself? Or just gathering info so people can modify their own firmware?

I've got a unit for my Opel Astra J and the default buttons in the car don't work correctly. I would love to be able to modify their CANBUS decoding... Would that be possible through the MCU?
[MTCD Software Development] Wadzio:
More to collect information for others. It would be nice if others would also share what they were modified.

For my knowledge as of today MCU only translates messages from CANBUS into messages known for Android. While msgs from CAN bus are (these necessary) recognized/filtered in the CanBox. So if your CanBox does not send the right messages, MCU modification will not help. BTW: did you try Opel/Mazda Raise, Opel/Mazda Simple in factory settings? I've got version H and only these two settings work. For SteringWheel of course, becasue AirConditions etc does not work :(
[MTCD Software Development] ThirtyOne34:
Let's hope so :)

Yes, that's why I thought maybe I could change the translations for Android?

I tried a lot of different factory settings, but I can't remember if Opel/Mazda Raise/Simple was available... Default it was set to 55 GM Simple. I will check again, though.

Airconditioning settings do work for me. (I have got manual airco.) I can turn the knobs and it shows an MCU pop-up on screen with temperature of air, airflow force (don't know how to call this in English), which fans are used, etc.

I can't use the default media controls on my dashboard, however. Some of them work, but incorrectly. These are the buttons I can remember without going to my car:

The "home" button for example turns the unit on/off.

The "next song" button is the back button in Android.

The "tone" button is the Android home button.

Pressing the big knob is next song, pressing the back button is previous song.

"Phone" button is GPS app.

"Previous song" button is mute/unmute.

The six number keys don't do anything (as far as I know).

"Play/pause" works correctly.

Volume knob works correctly.

"Open trunk" works correctly.

Turning ESP on/off works correctly.

Turning park assist sensors on/off works correctly when putting car into reverse. Also shows sensor strength on screen and there are audible beeps. Music volume is automatically turned down a bit.

Steering wheel controls all work correctly.
[MTCD Software Development] Wadzio:
Have you tried other settings in FactorySettings-> CanBus (Type, KeyMode, SwapKey)? Is there any difference in the work of these buttons? Or maybe would try another firmware? HA, GS, KGL etc and see if there is any difference.
[MTCD Software Development] ThirtyOne34:
Yes, I tried all combinations of type/keymode/swapkey, but nothing changes... Very weird.

Installed HA instead of KGL yesterday, but no difference. Still have to search for Opel/Mazda Raise/Simple.
[MTCD Software Development] Wadzio:
Forget Opel/Mazda, you'll only have the SteeringWheel as mine. GM is better choose. Maybe you should contact with your seller and ask them what you must set to. BTW: do you remember what version you have on CanBox sticker? I'm curious because when I asked my seller why I dont have AirConditions infos and he told me: because I dont have dualCAN.
[MTCD Software Development] ThirtyOne34:
Oh, ok. Too bad. Contacting the seller (Seicane) didn't help, unfortunately... :(

This is the only picture I have of my CANBUS decoder:

https://imgur.com/AqPlrxD
[MTCD Software Development] 0xb0ba:
why the segment "CODE" begins with 0x8004000?

Is the "options bytes" state known?
[MTCD Software Development] Wadzio:
0x8000000 - 0x8003FFF => Bootloader

0x8004000 - 0x80.... => Main App

Readout Protection
[MTCD Software Development] 0xb0ba:
STM bootloader are 0x1FFFD800 (system memory) on STM32F09, or it bootloader from manufactured of mcu?

STM32F09 init vector is 0x00000004 (0x00000000 for SP) its maped to 0x08000004, not 0x80004004.

only? nothing specific?
[MTCD Software Development] 0xb0ba:
yes, its bootloader from manufactured.

but is it possible to get it?

if I copy the table of vectors from 0x8004000 to 0x8000000 the device will start?
[MTCD Software Development] Wadzio:
Yes. Bootloader from producer. Is it possible to get it? From device/mcu no beacuse Readonly Protection (other "options bytes" I didn't check). I think the only way to get the bootloader is from producer. Or write your own :)

If you copy table vectors from 0x8004000 to 0x8000000 device will start.

Look at: https://xdaforums.com/android-auto/...uide-how-to-unlock-bricked-mcu-units-t3748646

I have prepared a tool for doing this similar thing
[MTCD Software Development] 0xb0ba:
someone watched an android application that updates mcu? is there a protocol for reading a flash from mcu?
[MTCD Software Development] doyouknowthemuffinman:
Is it possible to edit the code within the MCU to change temperature unit readout on the AC readout? Celsius to Fahrenheit.

I have a 10in intel sofia 3gr unit in my 2003 honda accord and have been able to do everything on it (root,custom mods, etc...) but for the life of me can not figure out how to change the temperature units. There is no option in my android settings and I've messed around with my canbus protocal which makes the temperature badge in the notification bar disappear for a second but reappears moments later unchanged.

I've tried posting on the Joying Sofia 3gr thread but I haven't been able to find a fix.

Any help would be awesome! Thank you.
[MTCD Software Development] joeyz400:
Bump^^^^^
[MTCD Software Development] PhilXe:
First of all, many thanks for your tool and info about MCU

sorry my very pour English becouse it's not my native language

I want to finding and recognize functions, but I don't know what version of IDA need (I have IDA pro 5.5 now)?

What of Keil compiler version used by MCU image compiled?

How to step by step signature creating for new finding functions?

Thanks in advance
[MTCD Software Development] Wadzio:
I used 7.0

Probably 1.3

IDA SDK Flair

1. Prepare pat file contains:

1420401E0006000EFBD17047........................................ 00 0000 000C :0000 I2C_Wait20
3220401E0006000EFBD17047........................................ 00 0000 000C :0000 I2C_Wait50
1E20401E0006000EFBD17047........................................ 00 0000 000C :0000 I2C_Wait30
F3B50024012681B0254676031C4F........012231463846................ 00 0000 007E :0000 I2C_DTV_ReadByte

..B0....0026..7E..4C0228..D001202076............................ 00 0000 00CE :0000 CarTaskHandle
..B0..4D0026E87E..4C022810D0012020760121227EC902..48..........48 00 0000 00CE :0000 CarTaskHandle
..B0....00....7E..4C0228..D001202076............................ 00 0000 00DA :0000 CarTaskHandle
92B0F74F0125F87E0026F64C02280FD0A5750121A27DC902F348........F048 00 0000 00A0 :0000 CarTaskHandle
..B0....01....7E0026..4C02280FD0....0121....C902..48..........48 00 0000 00A0 :0000 CarTaskHandle

etc

2. From SDK Flair run:

sigmake.exe -a128 "Description" file.pat file.sig

zipsig.exe file.sig
[MTCD Software Development] typos1:
You can remap the front buttons in factory settings, theyre nothing to do with CAN Bus.
[MTCD Software Development] Xorit:
Sorry man, but there are canbus profiles which hard map buttons.

Like in my Opel/Vaux car, all the panel buttons including SWC are hard coded and not recoqnized by any remapping tool.

Also they don't show in the MTCManager and MTCCanbus as far as I could see.

Though, if you change canbus profile, they change aswell. It's GM55 raise iirc for my car.
[MTCD Software Development] typos1:
I see what you mean - the Opel units are different from most other units because they also contain buttons for the car dashboard as well.

Still, have you tried remapping them in factory settings ? MTCD/E units have the ability to change the panel buttons mapping in factory settings it may be that, due to the Opel stereos having panel buttns that also work car functions, this has been disabled, but you should at least try it.
[MTCD Software Development] Xorit:
Tried and no button are recoqnized at all.

Not in factory settings, nor in mtcd tools, nowhere :)

The only button I can map is the self-attached one for my reset/recovery mod - because I **** you not, they even "forgot" to add a reset hole ;)
[MTCD Software Development] typos1:
Ok, so this is unique to some Opel MTCD/E units because the panel buttons also control some car functions.

On MTCD/E units the reset hole has no use, I dont even know why they put it there. On MTCB/C units its used with the power button (or on its own for full touch units) to get into recovery, on MTCD/E units, the power button gets the unit into recovery, the reset has no function, so youre not missing out on anything.
[MTCD Software Development] Xorit:
Actually there are no buttons drectly controlling car functions.

The panel actually is split up and has two button clusters directly connected to the car for esp, pdc, trunk, eco. Those are not connected to the radio part of the buttons.

But this doesnt matter, as no buttons are recoqnized in any software.

Suspect them to be mapped via mcu profile (05 GM raise, looked it up)
[MTCD Software Development] typos1:
Thats very strange then, cos all MTCD/E units have the ability to remap the panel buttons in factory settings, unlike MTCB/C units.
[MTCD Software Development] Xorit:
My unit proves that wrong I believe.

On the S160 we had another forum (roadnav) where some precious guy from russia made us a tool to change those hard coded mappings, since even there no buttons where recoqnized from the hu.

Just like the MTCKeys xposed for MTCB, but this bootloops the MTCD..tried it..
[MTCD Software Development] typos1:
Well, put it this way, in 5 years of posting about MTCB/C/D/E headunits I ve never heard of an MTCD/E unit that does not have the facility in factory settings for panel remapping or has the facility but it doesnt work, I wonder if theres something wrong with your unit.

If you change the CAN Bus type to a completely unrelated car type does it work then ?

You do have the facility in factoy settings but it doesnt work ?
[MTCD Software Development] Xorit:
Like I said, the S160 also had a remapping via resistive wires from the control port. Course those didn't work, because the Opel / better say GM cars 2010 and up use canbus codes.

Also the canbus decoder was an ealier version for buick verano (SUV), no sauce.

Now it's a box for the chevy cruze 2012 up, no sauce either.

Wonder if anybody else with a GM car can remap the buttons, but that car must be chevy, buick brand, since those share the infotainment with my model.

Would be worth a try setting the profile to something unrelated, but even if that works, I need the visual indication for climate, pdc and such, you know :D

Since the mappings aren't totally off, most ppl accept them being slightly uncomfortable I believe.

YES, I have the mapping function in factory settings, but as said it does not recoqnize any presses beside the manual added button.
[MTCD Software Development] typos1:
You didnt answer the question - if you change to a completely unrelated CAN Bus type, (actually change the settings to no CAN Bus), can you remap the panel buttons then ?
[MTCD Software Development] Xorit:
I did answer the question as I said that it would be worth a try.

Havent done that yet, but will try and report back.
[MTCD Software Development] typos1:
Ah, ok sorry.
[MTCD Software Development] cs-x(RU):
in the head units MTCB/C the buttons on the front panel are uneducated and rigidly defined in the MCU firmware, while in the head units MTCD/E the buttons on the front panel are trained as well as the steering resistive buttons, directly connected to HU.

If the steering buttons are not directly connected to the head unit, but through the CAN adapter, then they are uneducable too. In this case, the codes of these buttons from the CAN bus are read by the CAN adapter. Further, the CAN adapter encodes them through the UART to the MCU, and then the MCU recodes from the machine-specific code into the universal codes of the buttons of the HU and sends it to the Android side. This also applies to buttons on the car's torpedo instrument panel, which are read from the CAN bus.
[MTCD Software Development] typos1:
Yes, but MTCD Tools usually can remap the buttons, but he cant on his.
[MTCD Software Development] Xorit:
Most funny thing here is, that when I'm in either of the key studies (MTCD tools or factory settings) pressing any pre-assigned button executes it's function, throwing me to the app behind..

-> this tells me, that android doesn't know of the buttons and the presses are directly routed to MCU. -> this would mean that in order to remap them, one would need to intercept the MCU call to the assigned android function.

Our buddy from S160 times got me an idea I will check when Im back home roadnav forums S160 keys thread
[MTCD Software Development] Xorit:
Changed the canbus profile back and forth - only GM05 raise works. No sauce in the factory remap BUT

MTCD tools does see the codes now -_- even FCC Launcher does. Could swear it wasn't like that before.

Leaves me with having the default behaviour not being changable.. Almost blinded myself trying to find any evidence of keycodes in the MTCManager - it's all there I believe, but I'm no codemonkey, so I can only compare the strings :-p
[MTCD Software Development] 666cin:
Hi!

I have a problem with my PX3 steering wheel keys. Car: MB W203 with canbus decoder.

In this car buttons next/back on steering wheel are used for changing trip computer screens.

So now if I press next/back on steering wheel my songs are changing and screens on my trip computer too...

I would like to disable those buttons for radio. I do not need to change songs from my steering wheel - i prefer to change my trip screens.

Can I do this via MtcdTools? and assign to next/back button = no action?

or is there a chance to edit somehow canbus profile in factory settings?

MtcdTools showesthat those buttons are 278 and 276 coded

Regards,

Marcin
[MTCD Software Development] 666cin:
Hi again

Was trying to solve my issue and I still did not get the answer...

I found lines related to 'canbus' profiles from 'factory settings'.

But I can not find any relationship with steering wheels buttons in this profiles.

Is it there somewhere? I need to cut 278 and 276 buttons from it.
[MTCD Software Development] kaise123:
[MENTION=8817431]Wadzio[/MENTION] I have got this all set up on my machine, however I was wondering if you may be able to point me in the direction I would need in order to edit the shutdown delay time (Shutdown delay on ACC off)? I havce measured the power draw of my unit, and when it is in standby/sleep mode, it draws less than 10mA. I would like to modify my MCU to keep the unit on for 24 hours instead of 1 hour. Would you be able to assist at all?

Thanks in advance to any advice!
[MTCD Software Development] marchnz:
leave it set to always on sleep? It would take months to drain an average car battery assuming the car wasn't used for months.

Please everyone, resist the urge to post off topic and think/read/research before posting.
[MTCD Software Development] kaise123:
Sorry, I'm a bit confused by your meaning here. This thread is about modifying the MCU, correct? I agree that draining the battery would take a very long time, which is why I want the unit to stay on sleep. Currently it will not sleep for any longer than 1 hour, due to a restriction in the MCU that I would like to modify or disable.

To clarify, the unit completely powers off after a maximum of 1 hour, which I believe is the case in all MTCE/MTCD units. I would like to either delay or remove the power off timeout completely, and have the unit sleep indefinitely.
[MTCD Software Development] javlada:
This was the case for old MTCB units. My actual PX5 headunit stays in sleep mode form many days.
[MTCD Software Development] kaise123:
Hmm. Are you able to tell me what MCU you are running? I'm on KLD 2.88b and it still only stays in sleep for only 1 hour before shutting down. It is definitely a PX5 and it is definitely MTCE.

Edit: this is the delay I'm talking about. This option cannot be set longer than 1 hour:
[MTCD Software Development] javlada:
I have a a-sure (KGL) headunit. I just upgraded from MTCD_KGL_V2.54_4 to MTCE-_KGL_V2.80sp. With both MCUs the unit always only goes to sleep and then wakes up in 2 seconds. The setting you mention was in my old MTCB and came after an update (originally it always shut down immediately). Which ROM are you running?
[MTCD Software Development] kaise123:
I'm currently running the latest Malaysk Android 8 rom, but this was there in 6.x as well. I have 2 of these units, both PX5's and both with the same behaviour
[MTCD Software Development] javlada:
This is really strange. I have the Malaysk Marshmallow ROM. I'll check how the settings look like in my car when I get there. But as I said the behavior is definitely no shutdown and cold boot even after a few days. It might be possible that only some MTCD/MTCE headunits support the quick start.
[MTCD Software Development] Wadzio:
My two units (one with Android 6 Malaysk, second with original Android 8) also remain in sleep mode for more than 1 hour. In settings I have "Shutdown delay when ACC OFF" to "auto sleep".

Answering your question: unfortunately at the moment I don't know in which part of the firmware you should look for this option to change to a different value than 1 hour.

I would start with the function CarTaskHandle and this fragment:
[MTCD Software Development] kaise123:
Thanks! I can't believe I didn't realise that this was an option. I always assumed that 'Auto Sleep' meant instantly shut down, and I wasn't able to find any other information about it online. I made that change and it seems fine now.

Thanks for the pointer too. If I can figure out how to edit the delay, I'll let everyone know for future reference.
[MTCD Software Development] bdomi40:
Hello, I have a MCU KGL 2.80 (MTCD) and I can not follow the guide "Guide_ GS288.pdf" to modify my MCU on a KGL post.

I do not know where to go for "make proc and decompil" ?

Is there a video to follow this tutorial?

How to do with HAL/FreeRTOS structures/enums (script: MyScripts\MTCDLibStructsEnums.idc) and disassembled structures/enums (script: MyScripts\MTCDLFuncStructsEnums.idc) ?

Thank you for your help and sorry for my english.
[MTCD Software Development] loriss75:
Hi All,

I need to enable Video-out from my unit to connect rear headrest monitor. (now only video from dvd player activate the video-out connector).

Is possible to modify the mcu to do that?

If anybody is able to do that I can pay for the work.

My unit is a 10.2" dasaita (hotaudio), running latest MCU available.

Thanks
[MTCD Software Development] k0taperk0t:
I had the same problem with button panel from CD600. You could try MCU firmware by KGL v2.96:

https:// yadi.sk/d/YkSa9ua2vGxrPg (sorry, I can't post links)

For me it works. After update U will can choose key mode 'CD600' for Canbus '55 GM'

https:// a.d-cd.net/UcAAAgDHTOA-1920.jpg
[MTCD Software Development] Xorit:
since most of the Opel replacements use MX MCUs you may also try this:

https://xdaforums.com/showpost.php?p=78158956&postcount=1395