Help needed to coding tool selection - also all other advices are gold..

[repsagarage]

Might sound stupid to many - but I'm struggeling on the phase : appropriate tool. Meaning, what physical tool must I use ? Have in-house : VCDS hex2 PEAK PCAN-USB (IPEH-002021) misc no-name K+DCAN usb interface (bmw originated, used with INPA&ISTA)

With VCDS I can contact directly to the ESM module (without can-gateway module or car) though address C0 and see that ok... but it doesn't allow anything else to be modified then the sound volume. Might be able to other things if i would have security code for it, dunno.

I have 2 different ESM's lying around that I could do some coding testing / parameter reading - most intruiging would be unit from a 2019 Porsche 982, with OE numbers (both stamped in device) : Porsche 982 907 160 K Audi 4G0 907 160 B What i recon from Youtube, this Porsche module would give out nice sounds, but honestly I don't know how to start this.

As electrical engineer, working in automotive fieId for few years (for work & hobbies), I do know some basics, but at this point I'm stucked on quite low level issues. https://repsa.kuvat.fi/kuvat/Avo2/activesound/20220611_102307.jpg POC for direct connection on image.

And, if i would need new HW, e.g. some ODIS compatible or VCP+K or other, I could use some hints&tips on how-to code. As I'm not saying that I'm stupid, but these aren't actually my normal work related issues... Sorry about that.

But, In advance, thank you all helping - and jilleb & NumberOneBot naturally. Truly amazing work on the reverse engineering.

[jilleb]

Not sounding stupid at all :-)

I'm using VCP to flash new firmware to my devices. Unfortunately, I haven't yet found a way to "download" firmware from the chip inside the soundaktor. I opened up a soundaktor module case, and it was covered in some kind of epoxy. But maybe you know of a way to get to the data!

The Porsche firmware, I wish I had that.. I love the sound! We cannot "unlock" this without flashing the firmware, but it's possible to circumvent the VIN/Engine filter inside the firmware by adding doing some CAN-bus interception. I have no experience in this however... I love your setup by the way, and it totally looks like you would know a way to intercept the CAN signals to let the unit think it's talking to a Porsche VIN/engine.

About coding: the soundaktors don't have any coding available to them, other than sound volume.

[Cuzoe]

The work both of you are involved in is beyond me... but I am using ODIS-E (offline) to flash firmware. Slow and annoying to use, but works just fine.

[crashracer]

Here's the board depotted. There's an interface to the MCU but I haven't managed to connect. The MAX9736A is analog only 30 watt power amplifier.

[erchoui]

Is a f3371 nec v850 processor, I have a c0 fucked because of uploading wrong firmware and I have opened it. Will try to read with vvdi prog tool which supports that processor. Will update this thread after successfully read it and try to rewrite to c0 again…