Reversing FG Bluetooth Phone Module

[G6EKev]

Hey all,

I borked my original BCM so I decided to reverse engineer it and see if I can fix it in the process.
The first BCM Calibration File I could find was '8R29-14D511-AB.zip' which contains 8R29-14D511-AB.PHF.
The archive does not have a password.
PHF - Packed HEX Format?
There are two sections to this file - The description and the contents. These two sections are separated by 0x00 0x24 0x00.
The lines in the header are plain text. Replacing 0x00 with 0x0D 0x0A will give you something like this...

Code: Select all

APPLICATION>BPM Application
MASK NUMBER>Rev0 3 July 2008
FILE NAME>SW-8R29-14D511-AB.HEX
RELEASE DATE>07/03/08
MODULE TYPE>Bluetooth Phone Module
PRODUCTION MODULE PART NUMBER>8R29-14D509-AA
WERS NOTICE>
COMMENTS>
RELEASED BY>Sumitomo Wiring Systems Australia
MODULE NAME>BPM
MODULE ID>0x781
DOWNLOAD FORMAT>0x00
FILE CHECKSUM>0xE5C3
FLASH INDICATOR>1
FLASH ERASE SECTORS>0x00

The remainder of the file is Intel HEX. Easy!

...Moving on...

The two attached files are of the front and back of the PCB. The intentional overexposure is to grab the IC markings.
The PCB is from an early model '8R29 19C112 AA' BPM.
U3 - MIC5239 - 500mA LDO regulator.
U4 - MB3793 - Power Voltage Monitoring IC with Watchdog Timer
U5 - BC358239A - Single Chip Bluetooth® v1.2 System
U6 - ???2-Wire Serial EEPROM???
U8 - V850ES - 32-bit Single-Chip Microcontroller
U9 - TJA1041 - high speed CAN transceiver
U10 - ???SPI Flash???
U11 - TDA8541 - 1 W BTL audio amplifier

[TazzI]

I borked my original BCM so I decided to reverse engineer it and see if I can fix it in the process.

Do I even ask how you managed to kill the last BCM??!

The first BCM Calibration File I could find was '8R29-14D511-AB.zip' which contains 8R29-14D511-AB.PHF.
The archive does not have a password.
PHF - Packed HEX Format?
There are two sections to this file - The description and the contents. These two sections are separated by 0x00 0x24 0x00.
The lines in the header are plain text. Replacing 0x00 with 0x0D 0x0A will give you something like this...

Fantastic!
Whats interesting I find there.. is the checksum. More then likely verified during program to ensure the file is not corrupt. Guess it depends if your looking to update it via CAN or if your gonna interface directly with the main IC?

The two attached files are of the front and back of the PCB. The intentional overexposure is to grab the IC markings.
U3 - MIC5239 - 500mA LDO regulator.
U4 - MB3793 - Power Voltage Monitoring IC with Watchdog Timer
U5 - BC358239A - Single Chip Bluetooth® v1.2 System
U6 - ???2-Wire Serial EEPROM???
U8 - V850ES - 32-bit Single-Chip Microcontroller
U9 - TJA1041 - high speed CAN transceiver
U10 - ???SPI Flash???
U11 - TDA8541 - 1 W BTL audio amplifier

I cant make out the markings on the chip since I cant blow up the image enough. But Id assume one of those chips would be an external eeprom. Would be interesting to grab a read off of it and see whats in there.

[G6EKev]

Do I even ask how you managed to kill the last BCM??!

I managed to break the BCM by trying to upgrade it using IDS! I'm not sure what I did wrong exactly.
The BCM appears when running a device scan. I can't re-program / "re-install" it. Changing the VIN does not work either.

Guess it depends if your looking to update it via CAN or if your gonna interface directly with the main IC?

I've already tried over CAN a few times. I don't know what is wrong?
It could be my VCM2 but I need to speak to someone with a genuine VCM2.

I plan on connecting directly to each of the ICs. The SPI flash is easy. The JTAG interface on U8 should be easy too.

I cant make out the markings on the chip since I cant blow up the image enough. But Id assume one of those chips would be an external eeprom. Would be interesting to grab a read off of it and see whats in there.

I've added crops of the original photo. Hopefully that helps.

[TazzI]

I managed to break the BCM by trying to upgrade it using IDS! I'm not sure what I did wrong exactly.
The BCM appears when running a device scan. I can't re-program / "re-install" it. Changing the VIN does not work either.

AAhhhh... that would be problem number one!. I find it amusing in IDS you cant select Ford Falcon from predefined list. Just popped IDS on the BA XR8 and its an "unknown" ecu. Yet, I can then put the tear code or pcm num in and it works
Sort of leads on that their systems really dont truly support Aussie Ford falcons, or they are just chucked in on the sie without much suport. So I wouldnt attempt it unless on a bench setup while monitoring with a separate device to check when/if the communication pauses or why it fails.
Which options are you going into exactly in IDS, which option did you select specifically for updating? And which vehicle/code did you enter right at the beginning? (Eg. Tear code ect)

I've already tried over CAN a few times. I don't know what is wrong?
It could be my VCM2 but I need to speak to someone with a genuine VCM2.

I plan on connecting directly to each of the ICs. The SPI flash is easy. The JTAG interface on U8 should be easy too.

Might be about time to monitor the bus to see what IDS is actually doing, and if your BCM is even responding any more. If programming failed part way through, it would be the BCM has a completely blank calibration or part-number, thus IDS doesnt know what it is or what cal to program into it. Something like that is recoverable if you manually wrote to the canbus to update it.

Would be interested in see the IC's directly interfaced though! But you will still need a "good" module to grab a read from.

[G6EKev]

Got another BPM today...
8R29 19C112 CA

Installed and tested no worries at all! All modules pass the Network Test
I have not figured out how I managed to damage the older BPM but now that the new module is working, so I'll start taking f/w dumps.

Connecting to an Australian Ford...
I cannot connect to the FG without using the automatic option. To connect, I go 'Start New Session', 'All Other'. The vehicle is detected right away and everything works as it should.

Installing the BPM...
Module Identification 1st to determine if the BPM is present and at least semi functional.
Module Programming, Programmable Module Installation, BPM - to install the BPM. Follow the procedure but do not turn the ignition key.

[TazzI]

Got another BPM today...
8R29 19C112 CA

Installed and tested no worries at all! All modules pass the Network Test
I have not figured out how I managed to damage the older BPM but now that the new module is working, so I'll start taking f/w dumps.

Connecting to an Australian Ford...
I cannot connect to the FG without using the automatic option. To connect, I go 'Start New Session', 'All Other'. The vehicle is detected right away and everything works as it should.

Installing the BPM...
Module Identification 1st to determine if the BPM is present and at least semi functional.
Module Programming, Programmable Module Installation, BPM - to install the BPM. Follow the procedure but do not turn the ignition key.

Glad you got it working!

Yep thats exactly what I did in terms of connecting up with the BA XR8. Monitored the line at the same time and the ECU is responding as it should, but IDS simply doesnt like it for whatever reason.

With module identification, it will be good to start writing down the firmware numbers, it could be that possibly a specific firmware version corrupts when attempting to update.

[G6EKev]

Yep thats exactly what I did in terms of connecting up with the BA XR8. Monitored the line at the same time and the ECU is responding as it should, but IDS simply doesnt like it for whatever reason.

What version of IDS are you using?
Is your VCMII a clone?
I'm using 94.03 with a clone. IDS can download resources as required.

With module identification, it will be good to start writing down the firmware numbers, it could be that possibly a specific firmware version corrupts when attempting to update.

Forgot to mention that in previous posts. The firmware that IDS is downloading / trying to install is the same for both modules. You could be right about the possible cause of corruption.

BPM Application - SW-8R29-14D511-AB.HEX
BPM Secondary Bootloader (Function File) - 8R29-14D513-AA.hex

[TazzI]

What version of IDS are you using?
Is your VCMII a clone?
I'm using 94.03 with a clone. IDS can download resources as required.

96.01 and its a clone. Very odd... Im going to have to maybe roll back and see if that makes a difference.

Forgot to mention that in previous posts. The firmware that IDS is downloading / trying to install is the same for both modules. You could be right about the possible cause of corruption.

BPM Application - SW-8R29-14D511-AB.HEX
BPM Secondary Bootloader (Function File) - 8R29-14D513-AA.hex

Sweet. Ill compare with the components Im grabbed from a wrecker if I get this damn software downloading updates

[hunty19]

I might be offtrack with this, but it;s a bluetooth problem with 2008FG Xr6 with premium sound. Samsung Galaxy s2 2011MY using bluetooth V3 works great.Huawei P7 MY2016 using Blue tooth V4 connects well, but no conversation either way. I have been thinking that an upgrade of the ICC Bluetooth module to the "CA" version may fix the problem. Part NO BPM1008642. Is that too simple a solution, or is there much more to do?. Even with Bluetooth V4 there are subsets in the spec , ie 4.1, 4.2. I am hoping all level 4's will work. anyone know the answer?