flash memory: AM29LV640 or S29GL064N
MCU: STA2052
Read sector59 with j-link clone
Settings:
Target Interface :
JTAG
JTAG speed before init - Auto selection
JTAG speed after init - Auto selection
JTAG scan chain configuration - Auto detection
CPU :
Core - ARM7 Big endian
Init sequence:
Action Value0 Value1 Comment
Reset 0 0ms
Write 32bit 0xFFFFFFE0 0x00004007 Disable illegal address reset;
Write 32bit 0xFFFFFE00 0x00000000 MemSel 0
Write 32bit 0xFFFFFE04 0x00000090 MemSel 0
Write 32bit 0xFFFFFE08 0x00000004 MemSel 1
Write 32bit 0xFFFFFE0C 0x00000080 MemSel 1
Write 32bit 0xFFFFFE10 0x00000040 MemSel 2; RAM @ 0x4..
Write 32bit 0xFFFFFE14 0x00000060 MemSel 2
Write 32bit 0xFFFFFE04 0x00000190 Activate mapping
Flash:
BaseAddr - 00000000 Organization 16 bits x 1 Chip
Manufacturer - Spansion
Chip - S29GL064MxR1
Size - 8192K Sectors: 128 BusWidth: 16 Id:1227E
Code location:
$3B0204 ... $3B020B or
$3B0234 ... $3B023B depending on model
01 5F 37 00 A2 00 D8 A1 0000
01 5F 37 00 CA C9 6A 33 0001
01 5F 37 00 01 1E 8D 56 0002
01 5F 37 00 .......... 0000 FIS2
01 5F 37 D0 .......... 0001 FIS2
01 5F 37 A0 .......... 0002 FIS2
71 3F 87 C0 .......... 0003 FIS2
01 5F 37 40 .......... 0004 FIS2
01 5F 37 10 .......... 0005 FIS2
01 5F 37 E0 .......... 0006 FIS2
B1 BF 47 C0 .......... 0007 FIS2
01 5F 37 80 .......... 0008 FIS2
01 5F 37 50 .......... 0009 FIS2
41 DF E6 1F 9F A3 21 0074
01 5F 37 F8 C2 C1 62 23 0081
01 5F B7 E8 32 31 52 03 0085
E1 1F 47 F0 30 F5 1C E5 0096
D1 FF A7 40 EA 19 9A A3 0100
D1 FF A7 40 EA 19 9A A3 0100 (First 4 bytes are like 0110 but the last 4
unknown)
01 3A 12 E2 01 25 EB D2 0105
71 9F 4E EE 0E FA 60 57 0133
D1 FF E7 80 E0 25 8C 55 0151
D1 D9 4D B2 D6 EF 9E A3 0166
01 58 30 F2 C3 E1 39 3E 0171
81 BA 52 22 01 A5 2B D2 0185
01 FF D7 A0 01 5E 0D 76 0200
01 5B 33 FC FC 39 E8 A1 0201
01 FF D7 80 82 60 B8 01 0206
01 5F 37 00 01 1E 8D 56 0222
01 A1 A8 A0 00 1D 4D 76 0277
01 6F C7 A0 32 30 A8 D1 0282
51 EB 4B 64 C4 49 28 E1 0289
E1 7D 93 9A DA 5B CA 61 0366
01 04 5C CA C7 21 9D CE 0389
41 0F 27 C0 DA 69 5A E3 0401 ****
01 4F 27 F0 CA D9 8A 43 0401
01 5F 23 E3 85 A6 75 F5 0453
41 0F EE 27 BA 49 DF C1 0454
01 47 1F D0 01 AE ED 86 0464
01 3B C2 3A 01 C6 DC 6B 0499 ($20,$40,$60)
01 3A 12 7A 01 25 EB 3A 0501
51 BF E7 00 60 65 CC 95 0599
01 09 8B 4E 46 53 D1 40 0619
01 D3 E7 B0 DE 2C 34 4D 0620
E1 47 8F 60 B2 A9 D2 FB 0634
01 D3 E7 B0 DE 2C 34 4D 0620
01 5F 36 FE C9 C8 0C D1 0711
B1 BF 36 9E 49 98 1C 61 0711 // FIS2
A1 2E A6 76 41 B1 23 B6 0725 RNS310
01 C5 DB E2 1E E3 65 D8 0736
01 57 CC 15 BF FA 06 AC 0758
01 8E 02 FA 6D AF 83 58 0767
01 2E D5 9E 9E B8 BB 20 0771
01 1F F7 C0 CA 09 EA 73 0801
01 DF F7 C0 E2 00 98 A1 0840
51 37 3F 58 B8 8D E4 6D 0869
51 C6 3D 76 2A 44 93 F8 0913
D1 B7 D7 E8 81 0E 35 26 0918
01 29 E6 AF 01 58 4A 0C 0936
01 3B EF 94 A6 C9 B2 5F 0944
01 5F 01 CA CA C9 A0 73 0960
B1 ED 86 EF B1 CC FE 84 0972
01 AE 06 FE 51 9B 4F 24 0987
01 0E 95 5E CA 04 23 68 0993
A0 0E 85 29 8A 24 DC 05 1015
FE 5C 31 DF 9E EC 63 EA 1039
A0 CE BD 25 06 A0 58 01 1091
18 76 9D A3 94 D0 5F E0 1093
A0 9D 45 AE AF C4 4B 2E 1102
A0 9D 45 EE EF 04 8B 2E 1106 RNS300
A0 9D 14 7C 7D 92 EA 33 1111
6F 3B B9 28 08 D1 F8 89 1125
FE 59 2E F3 DA 3A 68 17 1134 or 1332 (FIS1)
A0 9D B1 55 36 74 AC 55 1145 RNS310
AB B3 5D F8 C0 8D 9C FD 1165
C9 EF 8F 51 8B 42 D3 DD 1187
FC 50 0F BF 00 5E 72 37 1255
49 E3 CB D0 EE 91 86 DF 1282
6F AB 61 FA 95 F5 02 11 1290
49 E4 94 C5 92 E0 E8 CD 1385
18 B3 DA 13 4C E2 8C 8D 1390
00 52 21 E1 E2 FC D4 9D 1433
FD 57 1B C6 CC E0 D6 BD 1456
A0 6E 4E 87 28 42 96 3D 1464
D1 3F 27 69 93 83 83 4D 1507
A0 D9 50 55 B6 44 4C 85 1512
01 66 45 e0 7b 5b b5 9e 1516 ?
FD 47 0B CD EF 22 1B 15 1547
F9 2F F7 A0 01 BE 3D A6 1548
6F 77 BD F4 5C 69 1D C2 1612
AB 6F AD DC E9 E3 B8 8D 1676
A0 9A 12 4B 6C 26 2A AD 1684
7A 88 6C 05 8E 1C 7C 9D 1740
7A 88 6C 05 8E 1C 7C 9D 36 71 5C 60 -1740
DC B3 92 2F 5C E6 F0 55 1754
7A 07 7C 74 5D 8F 4F D0 1757
A0 7E 56 BE FF 9D B5 BE 1801
49 EF 97 37 11 16 7D 75 1803
49 EF 9F B0 8A 98 20 B9 1838
A0 2E 0E 07 A8 C2 16 7D 1846
49 EF 77 10 EA 58 C0 F9 1870
A0 BE 56 BE FF 9D B5 BE 1881
49 2F 8F E0 01 BE 55 FE 1898
A0 15 3D 1D FE 3C F4 9D 1909
FC 2D EA 9A 43 8F 0F 40 1935
A0 15 F9 61 C2 00 38 61 1941
FD 37 EB B1 73 76 0F 5D 1943
3E 41 8A F8 F5 5B C7 E0 1953
7A 99 0E 98 75 FB 27 A0 1957
DC 6D 06 D6 AF EF 9F 80 1975
F8 05 8C 51 7A 1C 38 B5 1992
A0 15 04 3D 1E 5C 40 E9 1994
18 C5 EC E8 A9 6E 26 2F 1995
A0 15 04 8D 6E AC 50 F9 1998
EF 4C 1B DC 79 E3 87 EC 2194
ef 3b 0b cc b8 7d cc d1 3618
50 FD 24 5D 4E 9C 60 19 9994
7A 88 6C 05 8E 1C 9D 36 1740 RNS310
7A 88 6C 05 8E 1C 7C 9D 36 71 5C 60 1740 Correct one
Didn't you make a mistake on this line?
7
A
8
8
6
C
0
5
8
E
1
C
7
C
9
D
must be for this code!
Raimax
2nd February, 2020, 06:56 PM
7
A
8
8
6
C
0
5
8
E
1
C
7
C
9
D
must be for this code!
Interesting! Apparently only the first 4 bytes are important or ??!
All codes are 8 bytes.
but in FIS1 more then one code can happen because the first 4 bytes are read first
then the next 4.
In FIS2 all 8 bytes are needed.
Type1 = code range 0000~1999 (8 bytes then 8 bytes of "0" then 2 bytes of CRC)
Type2 = code range 0000~1999 (8 bytes of code then 8 bytes of CRC)
Type3 = code range 0000~9999 (8 bytes of code)
type 2 algo in 99.5% of codes only needs first 4 bytes for code...
codes from 0000-1999 there are only 10 arrays that produce 2 different codes
If the string starts with 01 59 2B EE then possible codes are: 0322, 0332, 0611 and
0661.
From Martech this 01 59 2B EE 96 03 E1 B0 is 0332.
Any explanation ?!? 01 29 CB 5E 36 03 51 90
this must be 0699. Of course the second nibble is the same for both: 19BE6310.
Carradio2001.
Wrong line code , he,he,he...
Wrong... if you say Martech says this then Martech is wrong.... again...
01 59 2B EE 96 03 E1 B0 = 0611 maybe 0699 if CRC is different
(X1 X9 XB XE X6 X3 X1 X0 = XX11)
From my point of view, certain If the string starts with
01 59 2B EE then possible codes are: 0322, 0332, 0611 and 0661.
Well Martech gives this time different codes for the same strings :
0332 and 0699. Voila !
Because Martech isn't always correct....
FIS1 is 8bytes and FIS2 & FIS3 are 16bytes long, Martech only looks at 4bytes
so can never be accurate... Those codes are only POSSIBLE codes....
It uses 4bytes because the old FIS1 radios accepted any code from the first
4 bytes, but later models use 8bytes.
FIS2 use 16bytes but accept any code from the first 8bytes.
All FIS data is 8bytes of code and 8bytes of CRC,
FIS1 CRC is always "00 00 00 00 00 00 00 00"
Maybe now you understand.......
An example:
01 5F 37 00 A2 00 D8 A1 = 0000
01 5F 37 00 CA C9 6A 33 = 0001
6F DD FD A4 89 1E 8D 3A 36 97 D0 99 85 AD A0 39 othere algo code 1289 calculator
Fis does not work
00 5E 2D ED EE C8 A0 69 00 00 00 00 00 00 00 00 other algo code 1033 calculator
Fis works
6F DD FD A4 89 1E 8D 3A code 1289 is correct
Here's an example:
01 5F 37 00 A2 00 D8 A1 = 0000
01 5F 37 00 CA C9 6A 33 = 0001
You are saying these should have the same code... there are many other examples if
you like
wbr
that is FIS 1 where the majority of codes begin 01 for 0000 -0999
in FIS 2 there are a lot more first numbers 01-41-51-71-81 etc. so code is code
calculated
that is FIS 1 where the majority of codes begin 01 for 0000 -0999
in FIS 2 there are a lot more first numbers 01-41-51-71-81 etc. so code is code
calculated
FIS1 2 or 3 ... all the same layout, code then checksum, 16 bytes
I'm not going to argue with you, try your theory on an actual radio
----------------------
01 5F 37 00 00 F5 FC C5 = ????
01 5F 37 F0 F0 E5 EC B5 = ????
There are 37 possible codes from 0000-9999 range.
I don't have now a navi to test, only FIS_2 I can. Two codes I know but can be more
OK ...
Carradio2001.
01 5F 37 00 00 F5 FC C5 Code: 0003
01 5F 37 F0 F0 E5 EC B5 Code: 0304
----------------
I need 1111 for FIS 1 algo [00 5D 34 FC xD x2 xA x3]
I have a navigation with speed button defective, I need code 1111 for FIS_1.
Try this:
eg: 00 5D 34 FC FD 92 FA 53 00 00 00 00 00 00 00 00
This line of code it is NOT 1111 (FIS_1), waiting for another opinion ..
----------------
------------------------
VWZ1Z7.......
7H0 035 191
7 612 002 018
-----------------------
Only 0355 and 0755 will work.
0055 had another nibble bytes --> 01 5F 1E CE x1 xE x8 x3
---------------------
Can somebody please help me with missing codes: 0737, 0880, 0888, 0915, 0951, 1004,
1010 and 1070 for FIS_1 codes
All starting with 01 5F 37 00 xx xx xx xx
As far as I'm aware codes with data 015F3700xxxxxxxx are 0000~0500
----------------
Another and the thousandth code 2194 !!!!! :guns:
FOLKS ! If you will see EF4C1BDC79E387EC on the lines 020,040,060 that means
code 2194, code which is not genuine from radio, it is implemented by Carprog and
NYO
Apparently only the first 4 bytes are important
All codes are 8 bytes.
but in FIS1 more then one code can happen because the
first 4 bytes are read first then the next 4.
In FIS2 all 8 bytes are needed.
Exampe for you:
01 5F 37 00 A2 00 D8 A1 = 0000 - OK
01 5F 37 00 CA C9 6A 33 = 0001 - OK
you can search 4 bytes and find a code but it won't always be correct
CODE: 1995 LINE(Type1): F8058C28E92E666F
CODE: 1995 LINE(Type2): 18C5ECE8A96E262F
CODE: 1995 F8058C28E92E666F = MFD2
CODE: 1995 18C5ECE8A96E262F = MFD1, RNS300,RNS310
Again not correct, RNS300 uses Type 1 and Type 2
Type1 = code range 0000~1999 (8 bytes then 8 bytes of "0" then 2 bytes of CRC)
Type2 = code range 0000~1999 (8 bytes of code then 8 bytes of CRC)
Type3 = code range 0000~9999 (8 bytes of code)
type 2 algo in 99.5% of codes only needs first 4 bytes for code...
codes from 0000-1999 there are only 10 arrays that produce 2 different codes
--------------
A0 7E 56 BE FF 9D B5 BE
For information, FIS is 16 bytes not 8 bytes,
example: A0 7E 56 BE FF 9D B5 BE ?? ?? ?? ?? ?? ?? ?? ??
FIS1 = ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 (Code retrievable from first
4 bytes)
FIS2 = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? (Code retrievable from first
8 bytes)
FIS 2 code is available from first 4 bytes
Agreed but for accurate code 8 bytes are needed
btw, What is the code for this: 01 5F 37 00 (FIS2)
it is 0000 exactly like FIS 1
------------------
0001 for fis 2 = 01 5F 37 D0 9A 99 3A D3
------------------
4th byte AO should read 00
FIS1 01 5F 37 00 01 1E 8D 56 = 0002
FIS2 01 5F 37 A0 01 1E 8D F6 = 0002
A0 does not compute
-----------------
It's in Fis2 radios tho, this dump is another example with the A0 & F6
How doesn't it compute btw? It fits into the algo
wbr
I know the algo for getting the code
A0 does not compute with the first 3 bytes in any algo
Either I don't understand the answer or something is wrong here. Here is also the
fourth byte A0
01 FF D7 A0 01 5E 0D 76 = 0200
01 A1 A8 A0 00 1D 4D 76 = 0277
01 6F C7 A0 32 30 A8 D1 = 0282
yes, A0 computes with those but it does not compute with 01 5F 37
I will put this whole line of code into the Audi navi radio right away and I will
see if this code is accepted by the radio
01 5F 37 A0 01 1E 8D F6 CA 7F 94 D5 9D DD 80 BD
0002 code works
To be accurate you must also try
"01 5F 37 00 01 1E 8D 56 CA 7F 94 D5 9D DD 80 BD"
Unfortunately, this data is not accepted
--------------------------------------
definitely not 0081 and change 37 to B7 to give 0088
-------------------------------
If the string starts with 01 59 2B EE then possible codes are:
0322, 0332, 0611 and 0661.
From Martech this 01 59 2B EE 96 03 E1 B0 is 0332.
Any explanation ?!? 01 29 CB 5E 36 03 51 90
this must be 0699. Of course the second nibble is the same for both: 19BE6310.
Wrong... if you say Martech says this then Martech is wrong.... again...
01 59 2B EE 96 03 E1 B0 = 0611 maybe 0699
if CRC is different (X1 X9 XB XE X6 X3 X1 X0 = XX11)
Because Martech isn't always correct....
FIS1 is 8bytes and FIS2 & FIS3 are 16bytes long, Martech only looks at 4bytes
so can never be accurate...
Those codes are only POSSIBLE codes....
It uses 4bytes because the old FIS1 radios accepted any code from the first
4 bytes, but later models use 8bytes.
FIS2 use 16bytes but accept any code from the first 8bytes.
All FIS data is 8bytes of code and 8bytes of CRC,
FIS1 CRC is always "00 00 00 00 00 00 00 00"
An example:
01 5F 37 00 A2 00 D8 A1 = 0000
01 5F 37 00 CA C9 6A 33 = 0001
