Modifying .dat files (engineering mode)

[jkv11503]

I realize that the Engineering Mode is no longer available once the HU software has been updated to a certain version. However, I suspect that Mercedes didn't get rid of the Engineering Mode completely, but rather made it more difficult for us to access. I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever. I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable. Here's a sample of what I've found: ************************************************** ******** e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O" n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC ......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d... ..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//. ************************************************** ******** This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system. This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle. Is anybody up for the challenge? Please share your thoughts or comments. Thanks.

To remove this ad, register today or login if you already are registered!

[pinebaron]

Sure; I'm game. I have had success in decompiling code; in the old days I could decompile anything.

[jkv11503]

Originally Posted by pinebaron

Sure; I'm game. I have had success in decompiling code; in the old days I could decompile anything.

Excellent. Do you have a copy of the Mercedes Comand HU Service CD (W211 589 14 22 00)?

By the way, I don't think we actually need to modify the code, but rather just find a way to decipher it to determine if the Engineering Mode "keycodes" are indeed present as I suspect they are.

[amdeutsch]

Originally Posted by jkv11503

...... I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.......

Looked through your posts but couldn't find where you listed this. Would you mind re-listing it for the benefit of the membership.

[jkv11503]

Originally Posted by amdeutsch

Looked through your posts but couldn't find where you listed this. Would you mind re-listing it for the benefit of the membership.

No problem. I just did the language mod this past weekend and I haven't yet had a chance to post my notes. I've been too busy trying to figure out this enginneering mode puzzle. I'll try to get something posted later today in a new thread.

Here are the instructions: Changing NAV Voice (step-by-step)

[Preet]

Finally I am glad to see somebody trying to figure this out it’s about time, I wish I can help but I am not too good with programming and software side. Keep up the good work and keep us posted.

[Preet]

Any update

[jkv11503]

Nothing yet. Will post update as soon as we have more information. Maybe this weekend.

[Preet]

Cool good luck!

[rob13572468]

Originally Posted by jkv11503

I realize that the Engineering Mode is no longer available once the HU software has been updated to a certain version. However, I suspect that Mercedes didn't get rid of the Engineering Mode completely, but rather made it more difficult for us to access.

I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever.

I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable.

Here's a sample of what I've found:


************************************************** ********

e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O"

n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC

......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d...

..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//.

************************************************** ********

This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.

This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle.

Is anybody up for the challenge? Please share your thoughts or comments. Thanks.

you are on the right track... but its not going to be anywhere as easy as the nav voice mod... im pretty sure that mb made a code change to remove the engineering menu so you are going to have to disassemble the base code which is i believe ARM machine code... (the telematics software was written in C++ but since its compiled there is no source code to look through)

that means break out the telematics update dvd into individual files and reverse them in a program like IDA Pro... once you do that you can find those same references to the engineering menu as above and then find the code sections that reference them....

[jkv11503]

Originally Posted by rob13572468

you are on the right track... but its not going to be anywhere as easy as the nav voice mod... im pretty sure that mb made a code change to remove the engineering menu so you are going to have to disassemble the base code which is i believe ARM machine code... (the telematics software was written in C++ but since its compiled there is no source code to look through)

that means break out the telematics update dvd into individual files and reverse them in a program like IDA Pro... once you do that you can find those same references to the engineering menu as above and then find the code sections that reference them....

Thanks for the tips. As you suggested, I've taken a look at the DAT file using IDA. I can see certain patterns where the keycode info should be listed, but I'm not sure what to make of it all. I'll keep trying.

[jkv11503]

The keycode to access the Engineering Mode was posted in a seperate thread.... W203 Command APS Engineering Menu

I don't know how many models this keycode applies to; however, I can confirm that it works on the '05 W211 with the HU service (software) update.

Will keep looking for a way to access the Secret Menu.

[rob13572468]

no problem.. here ill give you the 30 second tutorial on exactly how to find the code you want... (i do reverse engineering for a living)

The easiest way to find it is to follow the button presses. so first you need to find how the buttons are mapped to the inputs on the processor. To do this you basically need to open up a comand and use an ohmmeter to probe the circuit between the actual button and the processor (e.g. put one lead on the switched side of the button and then move the other around the leads on the processor looking for the resistance to drop when the button is pressed. this allows you to know that button X terminates at pin # Y on the processor. Then you get the manual for the processor from the manufacturers site and look up the pin # and see what port name that it is assigned to. Do this for each button used to get into engineering mode...

Once thats done you go back into IDA (preferrably with the older firmware first) and look for each instance where those same port values are read by the processor and at each point is potential code of interest. Then you follow through the code to look for a instructions that specifically check for the same combination of buttons and see where that code goes. That will be the engineering mode entry routine. then look at the newer firmware to see whats different in that same area...

[jkv11503]

Originally Posted by rob13572468

...To do this you basically need to open up a comand and use an ohmmeter to probe the circuit between the actual button and the processor (e.g. put one lead on the switched side of the button and then move the other around the leads on the processor looking for the resistance to drop when the button is pressed. this allows you to know that button X terminates at pin # Y on the processor...

Care to donate your Comand for the good of the forum?

Seriously, thanks for the 30-second lesson. The instructions sound pretty straightforward; however, I'm not too keen on opening up my Comand. Maybe someone here has a spare unit that they can use for testing purposes. In the meantime, I'll keep poking around the code in hopes of making a miraculous discovery.

[rob13572468]

Originally Posted by jkv11503

Care to donate your Comand for the good of the forum?

Seriously, thanks for the 30-second lesson. The instructions sound pretty straightforward; however, I'm not too keen on opening up my Comand. Maybe someone here has a spare unit that they can use for testing purposes. In the meantime, I'll keep poking around the code in hopes of making a miraculous discovery.

ahh... i actually have lots of command units laying around.. just not one from an E...

[jkv11503]

Originally Posted by rob13572468

ahh... i actually have lots of command units laying around.. just not one from an E...

If you have a chance, take a look through your supplies and see if you have a W203 (C-class?) Comand. It appears to use the same code to access the engineering mode as does the W211 (E-class). Perhaps it is also the same for the secret menu.

[pinebaron]

Originally Posted by jkv11503

If you have a chance, take a look through your supplies and see if you have a W203 (C-class?) Comand. It appears to use the same code to access the engineering mode as does the W211 (E-class). Perhaps it is also the same for the secret menu.

Rob has probably decompiled software for all Command units and has all the answers. I think he just wants you to have fun

[Mackhack]

What OS is used in our COMANDs?

[rob13572468]

Originally Posted by pinebaron

Rob has probably decompiled software for all Command units and has all the answers. I think he just wants you to have fun

nah, i havent done much with the comand firmware yet... theres only so many hours in the day... but... it is on the list of things for me to look at

[rob13572468]

Originally Posted by jkv11503

If you have a chance, take a look through your supplies and see if you have a W203 (C-class?) Comand. It appears to use the same code to access the engineering mode as does the W211 (E-class). Perhaps it is also the same for the secret menu.

I have a W203 command but its not the same hardware as the W211... the W203 is the MCS2 unit and has the AGW built in whereas the W211 does not...

[rob13572468]

Originally Posted by Mackhack

What OS is used in our COMANDs?

it depends on what platform... mostly UNIX/QNX RTOS but some variants are linux and others are WIN CE

[Mackhack]

I found out it is VXworks OS.