uConnect 6.5 (Alfa / Fiat) Root Access

[stefa1991]

Hi, i have a question: Is possible to update Maps to the last version and AFTER that, update the firmware of the navi to the last 18.xxxx. ?

 

[elcabone]

Hi, i have a question: Is possible to update Maps to the last version and AFTER that, update the firmware of the navi to the last 18.xxxx. ?

No it's not. Just 17xxx and lower works with this mod.

 

[lden]

Hi All,
I would like to share my negative experience with Uconnect 6.5.
Recently I played with the Uconnect a lot and I lost my sense of fear to brick the thing and successfully changed boot.sh in a bad way. It was that bad that image updater service did not start so I was not able to recover the device with a new flash.
Here is the instruction how to recover the device:
1. Remove the Uconnect from car - for most of the cars you need to remove some panels first and than unbolt the uconnect. You will see something like this:

2. Disassemble Uconnect :

3. Remove memory module:

4. Assemble Uconnect without the memory module and connect it back to car (only power connector and usb connector).
5. Turn Uconnect on. The screen will light up 2-3 times and it will switch to bootloader mode and ask for update image on USB drive.
6. Insert USB drive with swdl.iso image - the screen will say something like "Wait for 30sec to update firmware or remove flash drive". Wait for 30 sec and Uconnect will restart - right after restart you should turn it off.
7. Split Uconnect into 2 parts and insert memory module back.
8. Attach connectors to Uconnect. At start it will run update image. If you want to go bad and skip version/integrity/year/model validation - just use hex editor and fill 'units.system_check,' spaces (0x20).. Wait until flash is complete and enjoy your recovered Uconnect 6.5

 

[Tajadela]

please explain better about: "If you want to go bad and skip version/integrity/year/model validation - just use hex editor and fill 'units.system_check,' spaces (0x20)"

 

[lden]

please explain better about: "If you want to go bad and skip version/integrity/year/model validation - just use hex editor and fill 'units.system_check,' spaces (0x20)"

Seems like this is the only check that runs in bootloader mode and it is in ISO image.
There is a high chance that it is possible to downgrade Uconnect using this approach.

 

[Tajadela]

the memory module (a flash chip) it is present in older units. most uconnect have flash memory soldered on the motherboard, unfortunately

 

[lden]

the memory module (a flash chip) it is present in older units. most uconnect have flash memory soldered on the motherboard, unfortunately

Okay, good to know. I am happy that my Uconnect does not have it soldered on the motherboard....
For soldered version is it an option to unplug power pin?

 

[Tajadela]

Okay, good to know. I am happy that my Uconnect does not have it soldered on the motherboard....
For soldered version is it an option to unplug power pin?

no. is not possible...

 

[Yugiro]

What should I do my radio different?

 

[m4x23]

You have the LIVE version? Seems only "MORE" button uConnects have the removable flash capability...

 

[Tajadela]

You have the LIVE version? Seems only "MORE" button uConnects have the removable flash capability...

no. I opened several American units with the "MORE" button, but the NAND is soldered on the board. the chip on connector is in the very first versions

 

[m4x23]

Year of construction from the label?

 

[lden]

Year of construction from the label?

26-03-2013

 

[morischo]

question on software version

Goodevening to all,
I'll explain my situation:
- Fiat 500x - March 2018
- current software version: 17.35.31
- maps database: FCAVP4EU; V7
can I still try to update the maps with the files on Mega (Magic - Fiat & jeep pre UPD 17.07.46 + D 2019v2 IT Custom) or do I risk the freeze? and if so, is there a way to update with this version of software?

 

[Tajadela]

Goodevening to all,
I'll explain my situation:
- Fiat 500x - March 2018
- current software version: 17.35.31
- maps database: FCAVP4EU; V7
can I still try to update the maps with the files on Mega (Magic - Fiat & jeep pre UPD 17.07.46 + D 2019v2 IT Custom) or do I risk the freeze? and if so, is there a way to update with this version of software?

no, unfortunately, that firmware already belongs to the next generation, with the problems of version 18: the integrity check of the ISO / UPD file takes place before anything else and at the moment there is no way to bypass the initial integrity check.

 

[morischo]

no, unfortunately, that firmware already belongs to the next generation, with the problems of version 18: the integrity check of the ISO / UPD file takes place before anything else and at the moment there is no way to bypass the initial integrity check.

Are there any hopes of resolution for the future?

 

[Tajadela]

Are there any hopes of resolution for the future?

never say never...

 

[lden]

Anybody knows how exactly /dev/fram/ file system works? I studied some validation functions and they check file /dev/fram/mfg - it means that there must be a way to put it there. Can it be done using OBD port?

 

[Tajadela]

hi,
the mfg file consists of 5 bytes, normally with an FF value. With version 18,
two bytes of the file must be "MS" to activate mfg install mode.
The fram folder is contained in an eeprom. I tried to program the bytes of the mfg file with the MS string in various positions,
in the range of 5 bytes, but the mfg mode does not activate.
Maybe in the remaining 3 bytes you have to insert zeros (00 hex) or the character "0" (30 hex) ...
it is not easy to understand it from the decompiled lua script.

 

[lden]

How did you manage to write to the eeprom? Seems like only 2 first bytes have some meaning - it is from 17.09 and 18.45 for 8.4 uconnect VP3/4:

function get_flags()
  if io.open("/dev/fram/mfg", "r") then
    if io.open("/dev/fram/mfg", "r"):seek("set", 0) and io.open("/dev/fram/mfg", "r"):seek("set", 0) == 0 and io.open("/dev/fram/mfg", "r"):read(2) and io.open("/dev/fram/mfg", "r"):read(2) ~= 0 then
      io.open("/dev/fram/mfg", "r"):close()
      return (io.open("/dev/fram/mfg", "r"):read(2))
    end
    io.open("/dev/fram/mfg", "r"):close()
  end
  return nil
end
...
L3_3 = get_flags()
if L3_3 == "MS" then
  L4_4(L5_5)
  L4_4(L5_5)
else
  L4_4(L5_5)
end

For 18.45 it look like :

L19_19 = get_flags()
if L19_19 == "MS" then
  print("ISOCHK: Mfg install mode")
  os.exit(0)
else
 print( "ISOCHK: Normal install mode")
end

hi,
the mfg file consists of 5 bytes, normally with an FF value. With version 18,
two bytes of the file must be "MS" to activate mfg install mode.
The fram folder is contained in an eeprom. I tried to program the bytes of the mfg file with the MS string in various positions,
in the range of 5 bytes, but the mfg mode does not activate.
Maybe in the remaining 3 bytes you have to insert zeros (00 hex) or the character "0" (30 hex) ...
it is not easy to understand it from the decompiled lua script.