Mib1 Patch en Mhig V0.1.de - en
Mib1 Patch en Mhig V0.1.de - en
com
Table of contents
1 Introduction ............................................... .................................................. ................................................ 2
6.1.2. Extracting the MIBRoot file from the new.ifs file ........................................ ................ 11
This Quick Start Guide is largely based on the wonderful work of the authors of the
InstructionMIB2.pdf and MIB2_Patch_EN_v0.7.pdf files, some information has been
omitted and little has been added. The credits therefore go to the authors of these
documents!
Everyone has to decide for themselves whether a firmware update should definitely be carried
out on the vehicle. In principle, a backup of the existing software is sufficient for patching the
MIB.
This step isoptionalrequired if the "friendly" has set access to the engineering mode to
"not active" during an update.
The key combinations to switch to Engineering Mode vary depending on the year of
manufacture and the vehicle.
- Switch to the CAR menu (press the menu button, go to the CAR setting)
- Press the key combination BACK + upper left function key (next to the multi-wheel) at the same
time.
If it doesn't work immediately, try several times. Pressing them at the same time doesn't
always work immediately. However, if it does not work at all, then the engineering mode
must be enabled via VCDS/VCP etc.
Basically, the desired setting is in control unit 5F. However, in the example vehicle, the
parameter IDE02122 Developer Mode is not active. The attempt to set this to active is
acknowledged with an error (invalid value). VCDS does not show any code under Access
Permissions. Even when entering the security number "20103", which is acknowledged
as valid, the behavior does not change.
The following steps are necessary once for VCDS to display the developer code:
• Note the VAG number in the STG 5F (top left). In my case "8V0 035 019".
• In the Labels directory (C:\Ross-Tech\VCDS-DRV\Labels) look for the file corresponding to
the installed MMI, in my case 8V0-035-MIB-HIGH1.clb. Duplicate the file and rename it to
the controller's name, i.e. 8V0-035-019.clb.
• Restart VCDS
• Select STG 5, the necessary code should now appear under ACCESS
AUTHORIZATION 16, in my case "S12345"
a Prepare SD card with firmware image, should look something like this:
b Checking that the new version lists the current firmware version under "Supported
Trains". This information can be found in the metainfo2.txt file.
ca For Audi A3 8V 2016: MENU – CAR – key combination BACK + top function
key next to the steering wheel.
e When the update is complete, the setup asks for the new firmware information to
be uploaded to the manufacturer's server. Cancel this query.
Telnet: eg Puttyhttps://www.putty.org/
Dumpifs:https://github.com/askac/dumpifs
Linux:
- Ghidra:https://ghidra-sre.org/
XOR calculator:http://mib-helper.com/im-so-xory/
Preliminary remark: This step is not necessary if the tool IFSTool.exe is used, firmware for
the MIB is available and no dump of rcc_fs0 should serve as a basis. In my opinion, it is
better to start with a dump. After all, this information comes from the functional vehicle.
A Linux environment is required to work with the dumpifs tool. Windows 10 offers an
easy way with the subsystem for Linux. However, it is also possible with a fully installed
Linux. The subsystem is used below.
On Windows 10, install the Windows Subsystem for Linux (Control Panel -> Programs and
Features), then restart the computer.
In the next step, install Ubuntu (development tools for the command line) from the
Windows Store.
After installation click on the Open button. A terminal window opens. Enter a username
and password there.
O c:
O CD \
O mkdir a
Preliminary remark: This step is not necessary when working with the IFSTool.exe tool.
After downloading dumpifs from askac's Github repository, unzip the dumpifs ZIP
archive in the working directory (aka c:\a).
- In some vehicles, an adapter cable from the Audi Multimedia Interface -> USB is
required. The other USB sockets are usually marked as "charge only" and cannot
be used.
- Telnet program
There are a number of different passwords for the different vehicles of the VW Group,
most of the access data can be found with a little internet research. Below is a brief list for
the example vehicle:
The MIB unit offers 2 ways to log in via Telnet. Each of its main components - MMX and
RCC - has its own access. The RCC component is interesting because it contains the
MIBRoot and FecContainer.fec files.
RCC MMX
IP4: 172.16.250.248 IP4: 172.16.250.248
Port: 123 port: 23
Users: root Users: root
Password: see above Password: see above
Creation of a backup of the original MIB software. After successful login to the MIB RCC,
please back up the following files:
- EEPROM
- FecContainer.fec
- Variant.txt
- RCC
- MMX
O cp -r /net/rcc/mnt/efs-persist/FEC/FecContainer.fec /net/mmx/fs/sda0/FecContainer.fec
O cp -r /net/rcc/mnt/efs-persist/SWDL/Variant.txt /net/mmx/fs/sda0/Variant.txt
Then transfer the files from the SD card to a safe location. The files "rcc_fs0" and
"FecContainer.fec" are needed in the next steps.
There are different ways of patching the ifs-root.ifs container. The method presented
below is based on the fact that hash value checking is switched off. This means that
unsigned FEC files are also recognized.
The process of extracting the MIBRoot file from the created backup, adapting it and
reintegrating it back into an IFS container so that the file can be imported to the MIB is
described below.
Of course, firmware images contain the ifs-root.ifs file. The file can be broken down into the
desired parts using the IFSTool and the "Split" function. You get the two files ifsroot-part1.ifs
and ifs-root-part2.ifs. The ifs-root-part2.ifs file is the most interesting of the two, as this file
contains the MIBRoot and FecContainer.fec files.
DANGER: Many firmware versions have multiple ifs-root.ifs files in different folders, which
have different hashes. If it is not 100% clear which ifsroot.ifs is used in the vehicle, then it is
better to go the more tedious way of extracting it from the backup! Nevertheless, at least
the file size of the ifs-root-part2.ifs file can be an important clue as to whether the correct
file size was extracted in the next step.
a Copy the rcc_fs0 from the backup location to the already created working directory c:\a
- Most MIBs have their offset start for the second part of the ifs-root at 00BA0000.
But this is no guarantee! It is best to compare with the ifs-root-part2.ifs file. The
same applies to the offset end.
- In the example, the offset start is 00BA0000 and the offset end is 01865CDF
- Danger: In particular, the ending needs to be looked for, since it can and will be
different in each firmware.
- Select the block (offset start to offset end) via the "Edit - Select block" menu:
There are two ways to extract the MIBRoot file. The first is via the Linux console using the
dumpifs tool, the second option is via the IFSTool tool. The way via the IFSTool is easier
and will be preferred in most cases.
First we need to find out the offset address of the MIBRoot file as well as the file length. This is
done using the "dumpifs" tool.
To do this, we go to the Linux console, change to the working directory and execute the following
command:
100 4 startup.*
...
...
Dumpifs decompresses the new.ifs file and then lists both the start offset of the contained files
and the respective file length. We are interested in the MIBRoot file, which in the example
above is in theOffset address 01698000starts and oneFile length of a66c54 having. We
remember these two values.
It should be noted that the offset address and file length refer to the decompressed/
unpacked version of the new.ifs file, which we need to create in the next step.
lzo1x_decompress(buf, 9393344...)
...
The MIBRoot file can now be extracted from the decompressed file using the hex editor.
- Use the Edit - Select Block menu (CTRL E) to specify the range of data to
extract. For this we need the offset address and the file length, which we
have noted.
- Save the selection as a new file "MIBRoot" via the menu "File - Save selection".
With the IFSTool, the steps to extract the MIBRoot are much easier and more convenient. After
starting the tool, we load the new.ifs file and extract it by clicking on the “Extract” button. The
IFS tool now unpacks the contents of the new.ifs file into the new subfolder.
C:\a\new\usr\apps
The MIBRoot file was extracted correctly. The only problem is if you try a direct "repack" at this
point, then the file size will vary from the original file. An extraction from the previously
unpacked new.ifs in new-unpacked.ifs failed in the version of the IFS tool available to me with
an exception error message. Therefore, the only way to do it is to integrate it later manually
using a hex editor.
Extraction of MIBRoot file from new.ifs file. Unpack the new.ifs file into new-unpacked.ifs.
Rename the new-unpacked.ifs file to new_dk.ifs (so that the file names below match).
It is important that you write down the offset address and the file length from the IFSTool
at this point - for later reintegration of the patched MIBRoot file. Otherwise, putting the
patched MIBRoot's code into the decompressed new_dk.ifs file will fail.
This means that the two files required for the rest of the process are available:
a..1 new_dk.ifs
a..2 MIB Root
Regardless of whether the path was chosen via dumpifs or via IFSTool. The original
MIBRoot file must now be available as a result. In the following steps we need a
disassembler to find out the places that need to be modified. The disassembler must
support the ARM platform.
The path using the disassembler IDA is described below. In theory, it should work just
as well with other disassemblers.
In the file selection window that opens, we set the file extensions to * and select the MIBRoot file
from the working directory. IDA now recognizes the file type and presents the following window:
The preselected settings can be accepted by clicking the "OK" button. The next step may
take a while as IDA will now start disassembling the MIBRoot file.
In the dialog that opens, “aCalculatedHash” is entered as the search string and – if not
already preselected – the “Find all occurrences” box is checked. The search is started by
clicking the "OK" button. Of course, this also takes some time.
Double-clicking on the first line (LOAD:006A4818…) opens the tree view in IDA View-
A at the relevant point in the first search result.
In this case, the tree view is not very clear, so you switch to the text view. Right-clicking
on the gray frame opens a pop-up window in which "Text view" is clicked.
First of all, the address highlighted in yellow is important. From the instruction
become. To do this, switch to the HEX view and get the following view:
After pressing the "F2" function key, the editing mode is enabled and the HEX values 00 40
A0 13 can be changed to 01 40 A0 13. To complete the editing, press the "F2" key again and
switch to the "IDA View-A" view, in which the result of the editing can be seen:
LOAD:006A4880 BL MEMCMP
LOAD:006A4884 RSBS R4, R0, #1
LOAD:006A4888 MOVCC R4, #0
LOAD:006A4880 NOP
LOAD:006A4884 NOP
LOAD:006A4888 MOV R4, #1
The end result of the first block in IDA View-A looks like this:
Here the process begins again. Then make the changes according to the generated
screenshots.
After completing the work in the IDA View-A window, scroll up and mark an address, see
the following excerpt:
In the following dialog, I also select the "Create backup" checkbox and confirm the dialog
by clicking on the "OK" button.
If everything runs correctly, then I should find the following notice in the "Output Window" (below):
The goal here is to reintegrate the patched MIBRoot file into the IFS container.
The files new_dk.ifs and MIBRoot are opened in a hex editor. The entire contents of the
MIBRoot file are selected and copied to the clipboard.
Now we need the offset address and the file length of the previously extracted MIBRoot
file, which we noted. In this case it was heroffset address 01698000 and a file length of
A66C54.
In the new_dk.ifs file, select the above area using the Edit - Select Block (CTRL E) menu. Then
paste the contents of the clipboard (the contents of the new MIBRoot) (CTRL V) and save the
modified new_dk.ifs file and close the hex editor.
Finally, the new_dk.ifs file must be compressed again. The easiest way is via the IFSTool.
There we load the new_dk.ifs file and click on the “Pack” button.
If everything worked correctly, the new file new_dk-repacked.ifs and the base file new.ifs now
have the same file size. In this case it is 13392853 bytes aka 13080 kb.
In the crucial step, the patched version of the second part of ifs-root.ifs is transferred to the MIB. To
do this, we place the SD card with the patched file in slot 1 of the MIB and execute the following
commands on the MIB RCC console:
O flash unlock
O flash lock
After you reboot the MMI, the patched MIB software is active and should now accept the
adjustments to the FEC file in the following chapter.
In the example vehicle, the MMI can be rebooted/reset using the key combination MENU – WHEEL
– UPPER RIGHT FUNCTION KEY.
0ABCCCDD—Cards:
DD:
- 4c= 2030
- FF = ~2075/Lifetime
The signature is green, so it can also be used on unpatched MIBs. Now we add another
FEC (here MAPS extension until 2030).
The signature is now red (invalid) and cannot be used on unpatched MIBs.
O cp -r /net/mmx/fs/sda0/FecContainer.fec /net/rcc/mnt/efs-persist/FEC/FecContainer.fec
Restart the MMI via key combination (e.g. MENU/WHEEL/UPPER RIGHT FUNCTION KEY).
After the adjustments, I found errors in the 5F control unit, including the error "Software
version management check failed" after the update in the error memory of the 5F control unit.
But since I hadn't made any changes to the type of installation, the errors could simply be
deleted with VCDS without having to resort to tools such as XORechner-XTR etc.
If changes have been made to the type of installation, then the following path leads to the goal with
VCDS:
9 The controller should now display the new value. The old value may be displayed
again. Then deleting the error memory has proven itself. However, if no design
change has been made, the old value remains. However, the error in the control
unit should have disappeared.