[jdub1981]

I couldnt get it all done tonight. So far im tracking 21 modules, each individual part number, ecu address, stock calibration, stock strategy, latest calibration, latest strategy, and associated TSB if there is one.

Ive got all the part numbers, stock cals, stock strats, and some of the ECU addresses put into my spreadsheet. The ECU ones are good for those of us who want to do CANBUS sniffing. If you know the address of the module for a particular pid, say for example, DDM Drivers Door Module, and you want to know what message on the canbus is responsible for unlocking the door. Then you can set your obd2 reader to listen for message only from that module. Then you can go to your car and press the unlock button a few times. Now you can go to your log, figure out what code is responsible for that message. Then you can turn around and using that data make an android app that can send the remote unlock command. This is just an example, i dont actually know which module the message originates from.

 

[Now534]

I couldnt get it all done tonight. So far im tracking 21 modules, each individual part number, ecu address, stock calibration, stock strategy, latest calibration, latest strategy, and associated TSB if there is one.

Ive got all the part numbers, stock cals, stock strats, and some of the ECU addresses put into my spreadsheet. The ECU ones are good for those of us who want to do CANBUS sniffing. If you know the address of the module for a particular pid, say for example, DDM Drivers Door Module, and you want to know what message on the canbus is responsible for unlocking the door. Then you can set your obd2 reader to listen for message only from that module. Then you can go to your car and press the unlock button a few times. Now you can go to your log, figure out what code is responsible for that message. Then you can turn around and using that data make an android app that can send the remote unlock command. This is just an example, i dont actually know which module the message originates from.

So have you figured out how to flash updates?

 

[jdub1981]

So have you figured out how to flash updates?

Yes. They are using a terminal program like hyper terminal or putty to set all the same commands that a j2534 device normally does. For me, it was always about not knowing which file to use for the update and not knowing what the name of the file was in order to download it. 500k minimum connection speed, 1MB or higher is the preffered method. Bluetooth and wifi is a no no. You need to extremely minimum latency which only a wired connection can give. You MUST have access to the medium speed CANBUS as well. Some modules cant be flashed either such as PSCM. Others, arent recommended because if the flash fails not even a dealer can revive it. Its better to wait to actually have a problem with item before risking a flash.



Btw my 2013 ST has had 4 ipc updates but only one was for the tsb

 

[Now534]

Yes. They are using a terminal program like hyper terminal or putty to set all the same commands that a j2534 device normally does. For me, it was always about not knowing which file to use for the update and not knowing what the name of the file was in order to download it. 500k minimum connection speed, 1MB or higher is the preffered method. Bluetooth and wifi is a no no. You need to extremely minimum latency which only a wired connection can give. You MUST have access to the medium speed CANBUS as well. Some modules cant be flashed either such as PSCM. Others, arent recommended because if the flash fails not even a dealer can revive it. Its better to wait to actually have a problem with item before risking a flash.



Btw my 2013 ST has had 4 ipc updates but only one was for the tsb

Sounds like a lot of work. Also would be best to have a reliable device.

 

[jdub1981]

Sounds like a lot of work. Also would be best to have a reliable device.

Focccus is the terminal. When you click upload VBF it makes all the necessary changes in order to address the specific ecu address. You just need to know which modules shoulnnt be fooled with.

 

[Now534]

Focccus is the terminal. When you click upload VBF it makes all the necessary changes in order to address the specific ecu address. You just need to know which modules shoulnnt be fooled with.

I would love to have the newest IPC I would just be worried about it making my car honk when he keys are taken out.

 

[jdub1981]

I would love to have the newest IPC I would just be worried about it making my car honk when he keys are taken out.

What is your build date?

 

[WizzBang]

I would love to have the newest IPC I would just be worried about it making my car honk when he keys are taken out.

Same here. Build Aug 2012

 

[Now534]

What is your build date?

Same here. Build Aug 2012

08/12

 

[jdub1981]

08/12

Run Forscan and find out what you IPC part number is. Im wondering if is hardware or software or a different module alltogether that controls the honk feature. Jan 13 build here and mune does honk.

 

[Now534]

Run Forscan and find out what you IPC part number is. Im wondering if is hardware or software or a different module alltogether that controls the honk feature. Jan 13 build here and mune does honk.

I know it changes to say engine on in the screen mine doesn't do this. I'll scan when I get to it.

 

[jdub1981]

OK, this document isn't done, but it is up on google docs for your perusing pleasure. The doc should auto update as I make changes to it from my pc.
https://docs.google.com/spreadsheets/d/1Zboq2POlNbevQIanwOhCEhxf5lFvbC0Z02Qn0blg2SY/edit?usp=sharing

 

[Nuked]

I have a Feb 13 build date, mine honks with the original IPC software (non quad) and now updated to quad and still does honk. New IPC update shows the "Engine On" graphic now like Now534 stated.

SQ

 

[jdub1981]

I have a Feb 13 build date, mine honks with the original IPC software (non quad) and now updated to quad and still does honk. New IPC update shows the "Engine On" graphic now like Now534 stated.

SQ

I believe there are atleast 3 part numbers for the IPC for the 2013 ST. However, I still dont think the IPC is responsible for this, i think its just displayed on the screen. Remember that all signals travel either through the IPC or the BCM since they are gateways. Whatever module reports to the ipc that the key has been removed is the best starting point.


Edit.. it looks like it may be controlled by the PATS function. @Now534 do you have an IA key fob with push button start?

2nd edit... that feature is most likely never going to be removable. Its a new federal law that will be mandatory in 2015 for all new cars with IA type keys. Ford just implemented it early.

 

[Now534]

I believe there are atleast 3 part numbers for the IPC for the 2013 ST. However, I still dont think the IPC is responsible for this, i think its just displayed on the screen. Remember that all signals travel either through the IPC or the BCM since they are gateways. Whatever module reports to the ipc that the key has been removed is the best starting point.


Edit.. it looks like it may be controlled by the PATS function. @Now534 do you have an IA key fob with push button start?

2nd edit... that feature is most likely never going to be removable. Its a new federal law that will be mandatory in 2015 for all new cars with IA type keys. Ford just implemented it early.

Nope I have a factory fob.

 

[Bugasu]

@jdub1981
Thanks for starting a compilation list.

Any chance you actually have any of the VBFs for the ICM. It's a simple module so it should be relatively lightweight and small, but I have some future plans for replacing the ICM with my own setup, so it'd be nice to have a peak at whats inside so I can emulate any of the functionality required of it

 

[Xicutioner4768]

@jdub1981
Thanks for starting a compilation list.

Any chance you actually have any of the VBFs for the ICM. It's a simple module so it should be relatively lightweight and small, but I have some future plans for replacing the ICM with my own setup, so it'd be nice to have a peak at whats inside so I can emulate any of the functionality required of it

Just curious do you plan on running it through a decompiler or what's your plan on figuring out its functionality?

 

[Bugasu]

Just curious do you plan on running it through a decompiler or what's your plan on figuring out its functionality?

IDA Pro and me are good friends in my normal line of work. I'm not a super pro at it, but I believe I've correctly identified the processor in the ICM.

So load it into IDA, find the reference to CAN control registers, and then figure out which messages are the norm being sent out and coming in.
As far as I'm aware it's a super simple module that only responds to just a few messages from the BCM and ECU, but it sits on the bus and probably sees way more than it cares about.

My idea is to roll my own hardware module in that spot that has access to all the messages flying around and allows me to essentially monitor them all from that.
I.e. build my own device to sit there.

I need to know what specific messages it responds to so that I can make sure that it functions the same as the one already there and acts like the base module, but running with my own software stack on top of it to display more info

I could probably just pull the data out of the flash, but I haven't even checked or tried. I assume it probably has a simple code lock on it, so it'd be easier to just pull it out of the vbf instead

 

[jdub1981]

Ive tried opening the vbf files with IDA pro. Im a total newb when it comes to software engineering or in this case reverse engineering. Ive used a few disassemblers, ive even been able to completely revert Torque Pro back to its source code. But once there i dont know what to do with it.

 

[jdub1981]

@jdub1981
Thanks for starting a compilation list.

Any chance you actually have any of the VBFs for the ICM. It's a simple module so it should be relatively lightweight and small, but I have some future plans for replacing the ICM with my own setup, so it'd be nice to have a peak at whats inside so I can emulate any of the functionality required of it

I believe i have all the individual VBF files for the stock calibrations. I dont have have the original stock ipc file names from before the quad screen update. I also downloaded about 30 files the other night to be added to the spreadsheet later tonight hopefully.