Focccus PC app as-built editor AND all around reprogrammer

jdub1981 · Apr 13, 2014

Focccus PC app as-built editor AND all around reprogrammer - Discussion

UPDATED: March 20, 2015

Updating with working features.
1. Global open/close windows.
2. Removal of shift light.
3. After market HIDs
4. Add Hill Assist to non ST model
5. Turn on ecoscout display
6. Windshield wiper motor calibration
7. OEM Cruise Control added to Ford Focus SE with Sync: use option #23 Cruise Control set to "with Cruise Control"

When reading or writing config changes to the different modules you will create a slurry of DTC's on the car. This is completely normal. Download and install Forscan on your pc to read and clear out all the communications DTC's.

Things you will need: Laptop with USB port and a corded USB ELM327 code reader, or bluetooth capability if you are using an OBDlink MX or similiar adapter. A BestBuy Rocketfish micro Bluetooth adapter is what I have(id recommend the fastest bluetooth module you can get your hands on for under $40.
OBDlink MX: Shop this around, sales prices all over the place, or from here:Amazon.com: ScanTool 426101 OBDLink MX Bluetooth/OBD-II Scan Tool Interface: Automotive

First you will need a OBD2 code reader that must be capable of reading the Highspeed (HS) canbus that Ford uses. If it can read the Medium Speed (MS-CAN) bus thats a plus for other purposes such as using the software known as Forscan . For the purposes of this write up I am using the OBDLink MX(what I had already). A corded USB ELM327 may work as well but depends on the quality of the knockoff sold at most locations.

Special note: If you are using Bluetooth you will need to know which com port your computer has assigned to the Bluetooth module.
Next you will need Forscan, download from here:Download FORScan.($Free) Forscan is a PC only test tool that can log several hundred different parameters at a time, read and clear all DTC's (you will get tons of dtc's during this process but no worries no long term effects are caused when done)and run individual selftests on each CAN module.

To do the window mod and shift light change you need the Focccus App, the as-built editor both of which can be found here: Ford Tools by xGloooM from ffclub.ru
You will need a windows PC with bluetooth wireless adapter. Lastly you will need the bluetooth code reader or ELM327.
The video how to above can walk you through what to do once you have these programs.

Here is the fun part. Go here: Ford Tools by xGloooM from ffclub.ru and open the AS Built editor.

type your vin number in and click download from ETIS. You should see something like this:

navigate to block 184

click the drop down box and change to either option 02 or 03(both work) but neither will open and close the sunroof.

Now scroll back to the top and click Make XML

now your pc will ask where to save the new file. Choose at your discretion as it does not matter. Go to your car and ensure your MX is plugged into the port(or Elm327). Car should be in accesory position (KOEO) key on engine off.

Now we load up the Focccus app. if you are using an OBDlink MX set your options to this

note...the com port is totally dependent on your pc setup.
Click open. Focccus will now load up to this screen

Now click load from file and browse to where you saved your new xml file you created. Click open. Focccus should now look like this:

To confirm the settings scroll down to block 184 and verify your new global open settings. If everything is correct you are ready to write.
If everything is good click here

you should see a message about starting the write procedure. Do not turn car off or press any buttons. You will see the green bar start on the left side and transition to the right in about 7-8 seconds till it shows 100%. the lights will shut off and come right back on and then you should see a message about write successful. At this point I waited for about 30seconds at which point I turned the car off and then back on to verify startup which worked as it should. Then I rolled all the windows down and turned the car off. To verify this worked get out and push and hold the lock button for maybe 5 seconds. You will now see the windows roll up perfectly. Same procedure to roll them down only now you use unlock on the Fob. Hope this helps you!

Bugasu · Jan 17, 2015

You guys are missing some things. On an MX, the baudrate set to the driver means nothing to the MX. It's a virtual Bluetooth port and does not take it into account. (You can read around about this, but essentially the Bluetooth connection is always the same speed)
The internal Roving Networks bluetooth chip always communicates with the internal STN chip at a set baudrate (setup in the Roving Networks chip), and then the STN chip communicates at a set baudrate with the bus.

So really we have a few speeds that are setup for an OBDLink MX.
- HSCAN Bus baudrate (set in stone at 500kbps or if adjusted via link control to other rates)
- UART baudrate from the STN chip to the Bluetooth chip (I believe this is configured in the OBDLink MX to be 115200)
- Bluetooth Transfer Rate from Bluetooth to PC (dependent on connection strength and Bluetooth adapters and stacks)

The baudrate for FoCCCus would adjust the UART Baudrate when you're directly connecting using a real COM port. With a Bluetooth Virtual COM Port, it means NOTHING.
It takes some work to change the OBDLink MXs UART baudrate, as you have to configure both the STN chips UART and the Bluetooth hips UART to match.

jdub1981 · Jan 17, 2015

the pictures below are what is sent when in order the bruteforce the key. What exactly is the seed/key?

jdub1981 · Jan 18, 2015

@Bugasu @Stealthrider page 1 of the ffclub.ru thread for focccus. Maybe you can figure it out. http://ffclub.ru/topic/294958/#comments

Warrior 3000 · Jan 19, 2015

Trying to do the window mod and i connect my USB reader to my laptop and open up Focccus but the program never detects it. Do i need some type of drivers for this to work?

Now534 · Jan 19, 2015

You need drivers for the device you are using. On my ELM Windows Update found the right drivers for mine.

Nuked · Jan 21, 2015

jdub - got a question for you. I recently had Ford update the IPC to the newest file giving me the "quad screen". After doing so however, my drivers side window is the only one that reatined the auto up feature the car previously had. Another thing I noticed is that the global open close still works (as does fog light mod and tpms disable) but the passenger front window will not roll back up via the key fob. Rolls down fine. One other thing is that when I switch from high beam to low beam, I can hear an audible click from the passenger floor area. Sounds like a relay to me, but just odd it never did it before Ford reflashed the IPC. Have you seen anything that would make these items be related to the IPC update?

SQ
.

jdub1981 · Jan 21, 2015

Ipc update has nothing to do with your auto windows. You will need to do a window relearn procedure.

Start in the up position from the drivers door. Press and hold window down button for 5 seconds. Then roll the window backup but dont release switch. Continue to hold for 5 seconds. Congrats procedure complete. I think it can be done on just one window and it will effect all windows. If not then just do same procedure on each window seperstely.

Whenever the battery has been disconnected you will need to do this procedure.

willfromfreeport · Jan 21, 2015

Looks about right to me.

Nuked · Jan 21, 2015

Thanks jdub, will do that tonight!

SQ

jdub1981 · Jan 22, 2015

Unfortunately i ruined my MX tonight. As soon as my tax money gets here ill be getting a passthrough device of some kind. Then i can really see what can be done with Focccus.

Now534 · Jan 22, 2015

How did you do that?

Warrior 3000 · Jan 22, 2015

I know for the global windows mod you dont need to export the car XML file and you can just edit the cpu rifht there and rewrite it. Can i do this as well for the HID setting?

jdub1981 · Jan 22, 2015

I have no idea because i dont own a passthrough. Focccus essentially emulates the passthrough api using a Elm device.

What i want to do with the passthrough device is run FMP, use that or another software that will till which updates are available and then try to update with Focccus. If it works then ill post the how too for focusst.org

jdub1981 · Jan 22, 2015

I also have some much highend software that id like to try but they dont work without a 2534 device.

Stealthrider · Jan 22, 2015

Yeah would be great to know. My local garage has a Bosch J2534 device, maybe i could try it on my Tablet to see how it's connecting.

Xicutioner4768 · Jan 23, 2015

I have lots of J2534 devices through work. What are you guys trying to do?

jdub1981 · Jan 23, 2015

I want to know the each of the calibration file names and strategy for each of the modules assiciated with TSB's
I believe they are the DSP, ACM, GPSM, PSCM, AND i want the absolute newest version of the IPC.

I know where to download the files but not the names of the individual .vbf files associated with that particular update. I think the IPC has 3 files associated with it. Strategy, Calibration, and Picture.

I want to have the files and i want to see if i can get them uploaded to the vehicle with an ELM or STN device exclusively. If i brick the module ill have the J2534 device to restore the asbuilt.

RAF · Jan 23, 2015

I have a wireless code reader but it is wifi not Bluetooth, does anyone know if it wouldn't work for some reason?

jdub1981 · Jan 23, 2015

Obdlink MX wifi?

jdub1981 · Jan 23, 2015

Have you ever set up a new router wifi router at your home? Its gonna be similiar to that. To access the webpage youll enter some variation of http://192.168.0.1 (the documentation for your device will specify the correct ip address). If you have a wifi setup page respond back and ill try to help however i can.

RAF · Jan 29, 2015

Thanks. All I really want to do is disable my DRL's. Even if my wifi code reader worked would I need to put in the switch?

jdub1981 · Jan 27, 2015

I couldnt get it all done tonight. So far im tracking 21 modules, each individual part number, ecu address, stock calibration, stock strategy, latest calibration, latest strategy, and associated TSB if there is one.

Ive got all the part numbers, stock cals, stock strats, and some of the ECU addresses put into my spreadsheet. The ECU ones are good for those of us who want to do CANBUS sniffing. If you know the address of the module for a particular pid, say for example, DDM Drivers Door Module, and you want to know what message on the canbus is responsible for unlocking the door. Then you can set your obd2 reader to listen for message only from that module. Then you can go to your car and press the unlock button a few times. Now you can go to your log, figure out what code is responsible for that message. Then you can turn around and using that data make an android app that can send the remote unlock command. This is just an example, i dont actually know which module the message originates from.

Now534 · Jan 27, 2015

So have you figured out how to flash updates?

jdub1981 · Jan 28, 2015

OK, this document isn't done, but it is up on google docs for your perusing pleasure. The doc should auto update as I make changes to it from my pc.
https://docs.google.com/spreadsheets/d/1Zboq2POlNbevQIanwOhCEhxf5lFvbC0Z02Qn0blg2SY/edit?usp=sharing

Nuked · Jan 28, 2015

I have a Feb 13 build date, mine honks with the original IPC software (non quad) and now updated to quad and still does honk. New IPC update shows the "Engine On" graphic now like Now534 stated.

SQ

jdub1981 · Jan 28, 2015

I believe there are atleast 3 part numbers for the IPC for the 2013 ST. However, I still dont think the IPC is responsible for this, i think its just displayed on the screen. Remember that all signals travel either through the IPC or the BCM since they are gateways. Whatever module reports to the ipc that the key has been removed is the best starting point.

Edit.. it looks like it may be controlled by the PATS function. @Now534 do you have an IA key fob with push button start?

2nd edit... that feature is most likely never going to be removable. Its a new federal law that will be mandatory in 2015 for all new cars with IA type keys. Ford just implemented it early.

Bugasu · Jan 28, 2015

@jdub1981
Thanks for starting a compilation list.

Any chance you actually have any of the VBFs for the ICM. It's a simple module so it should be relatively lightweight and small, but I have some future plans for replacing the ICM with my own setup, so it'd be nice to have a peak at whats inside so I can emulate any of the functionality required of it

Xicutioner4768 · Jan 28, 2015

Just curious do you plan on running it through a decompiler or what's your plan on figuring out its functionality?

jdub1981 · Jan 28, 2015

Ive tried opening the vbf files with IDA pro. Im a total newb when it comes to software engineering or in this case reverse engineering. Ive used a few disassemblers, ive even been able to completely revert Torque Pro back to its source code. But once there i dont know what to do with it.

jdub1981 · Jan 28, 2015

@Bugasu I dont know if there is a specific vbf for that module. I believe it is simply 3 CAN messages that are sent to it from the IPC or PCM. Anyhow here are 2 word documents relavent to this discussion @Xicutioner4768 you may be interested as well.

https://docs.google.com/file/d/0ByGK_TuslUj1M3pydDh1Q0t0QVE/edit?usp=docslist_api

https://docs.google.com/file/d/0ByGK_TuslUj1TzN4NWVpeVFXVlU/edit?usp=docslist_api

Xicutioner4768 · Jan 28, 2015

@Bugasu, I bet you could delete the ICM without any repercussions. You just need to reverse engineer the CAN messages which contain those sensor values.

EDIT: To test this you could probably just unplug the thing and see what happens

Bugasu · Jan 28, 2015

I was kind of thinking that as well. Its literally just for information. My goal was to keep the other modules happy just in case though. I might just end up doing that though.

EMS/T · Feb 26, 2015

Thank you! I got it working tonight with the USB cable because my neighborhood has a lot of Wireless signals running around it.

I bought the recommended USB cable and bluetooth (non MX version) adapter from this thread
@jdub1981, version 0.8.4 is released as a few days ago. I tried to use the As-Build Editor but it wouldn't download anything from my VIN nor would it load my XML file from my BCM read. So I read the file with Foccus, saved the original one, made my tweaks to Global Windows & Shift Indicator and then saved that file. Reloaded my changed file and uploaded it back to my BCM.

jdub1981 · Feb 26, 2015

Thanks for the headsup, can you post the changelog?

Now534 · Feb 26, 2015

v0.8.4:
*Added ESP support

Jstump2490 · Feb 27, 2015

Anyone know what the Towbar setting does?

jdub1981 · Feb 27, 2015

Jstump2490 said:
Anyone know what the Towbar setting does?

View attachment 86164

You will need an external harness in order to make that work if it works at all.
It probably needs that plug most trucks have that allows you to run external brake lights, trailer brakes and turn signals.

UnfocusedST · Feb 27, 2015

So I may have missed it. Can you turn on the auto fog lamp on with headlights and disable the double honk when you leave your car running with this?

Sent from another galaxy.

Jstump2490 · Feb 27, 2015

No and no, sorry.

jdub1981 · Mar 2, 2015

@jad3675 I have no idea how that software works. I think it is very similar to a VAGCOM but once again I cant answer on things I don't know about. Good Luck! Please report back!

Btw. I just read they added something called a VIN configuration option which must be how nav gets enabled.

Focccus PC app as-built editor AND all around reprogrammer

Attachments

Our Vendors

Top Contributors this Month

Recommended Communities