[TUTO] Télécodage et calibration d'un NAC / RCC / CIROCCO / CMB_NUM SANS Diagbox via Arduino

Thank you both for the fixes!

After changing the time to 2000 on the sketch i was able to read the parameters of Bosch RCC but not able yet to change any parameter or upload new calibration. I will take it from my car and provide better information.

AIO now displays the "telecoding session" screen using the software but hangs and do nothing then.

Log output:

Code:
> 00
< 7F0022

> 10C0
< 50C0

I also want to share this file to the database: Citroën C5 Chine for RCC/NAC_CN
Citroen_C5_CHINE_9692911680.CAL : https://drive.google.com/file/d/1Ap-NeWvPpiTTkKbGENlF0j2EmiN_HOaB/view?usp=sharing
 
  • J'aime
Reactions: manege

Bosch RCC is read-only at the moment due to stronger seed. We have to entirely break the algorithm

You shouldn’t have to change the timeout to get it working it means that the soft has to wait 2 seconds for each command sending based on what you said because it is not finding \n

Please try to get a seed using Arduino serial console and raw commands (see precious message) so we can adapt the code ( I’m not sure unlocking service is on 6703 for AIO )
 
  • J'aime
Reactions: manege


sketch arduino has been updated in the meantime.
url in tuto is the good file with correct speed.
 



Only NAC supported for writing with soft at this time.

Could you share file log ?
 
Dernière édition:

Boujour,

Nouveau ici, je me demandais s'il était possible d'activer le Park Assist sur une C5AC avec caméra arrière seulement.

Merci pour votre travail !
 
  • J'aime
Reactions: manege


Merci pour votre réponse, mais la voiture a les capteurs tout le tour et la direction est pilotée , je pense, puisqu'elle a le suivi de voie. (que j'active uniquement sur autoroute)
C'est alors peut-être possible ?
 
  • J'aime
Reactions: manege


aah il fallait préciser tout ça :) (et pas seulement "camera arrière"...)

Je ne saurai te confirmer si une activation purement logiciel dans le NAC suffit à activer le Park Assist.
Il y a sans doute d'autres activations à effectuer dans le BSI par exemple, et autres calculateurs...

Quelqu'un de plus renseigné saura mieux répondre que moi
 
  • J'aime
Reactions: manege and VLud


Had some time with the AIO and OBDII monitor doing automatic telecoding and trying to see the conversation.
The output is not detailed since i was not able to take anything logged out from the VCI software or MCComm exe. Just the "ssh" file which is unreadable.

I did not get the "precious message" thing ..

Code:
Serial
-------- Response

            (begins with the handshake for diagnostic session)

10C0
    50C0
            (then reads Zx zones)
21FE
    61FEFFFF00000DF50101016802FF06020914FEFBFBFB02937622
0000
    7F0011
2180
    61809825649080000D98256494802352000000640000338610
21FE
    61FEFFFF00000DF50101016802FF06020914FEFBFBFB02937622
013E
017E
013E
017E
            (Repeats ..... to keep the diagnostic session alive)
013E
017E
013E
017E

| Telecoding starts |

But since there is no output on the serial from this, i will leave the conversation done over OBDII.

The 3E / 7E / 3E / 7E [..] please read as a pause, since the telecoding asked for manual parameters input or used to show errors. And i had to reboot it four times, so it will show reconnections.

https://pastebin.com/iHt5gpGS
 
  • J'aime
Reactions: manege

It seems completely different

Unlocking service on 2783 instead of 2703
Reading is using 21XX instead of 22XX where ZI zone is at ID FE instead of F0FE

and so on.
Same "flaw" on the seed by the way so same Continental base

Do you have a link to AIO Firmware ? It is probably not encrypted and can be used to make the config for it
 
  • J'aime
Reactions: manege

Yes. Important to note the last firmware released to this day changes ZI zone and also opens a window for upload a new Calibration file, regarding the units part number. The dumps i wrote are based on this firmware. So, if the software checks for the zone before making anything (like the PSA software does), the user must update it first.

It is encrypted but binwalk can handle.

https://majestic-web.mpsa.com/mjf00...651560332812&uin=0D01111219D4EA9A216F&type=fw
 
  • J'aime
Reactions: manege

It is not encrypted if binwalk can handle :ange:
Thank's I will check it

EDIT: This one is encrypted
 
Dernière édition:
  • J'aime
Reactions: manege

Just checked, all zones are strictly identical except ZI & ZA shouln't be hard to add support for AIO ;)
Will be doing this soon

By the way yor dump does not seem to contain anything else than reading ZI & ZA (and strange B2 zone)
 
Dernière édition:
  • J'aime
Reactions: manege


Hi, apologies for not translating. Didn't want to get the translation wrong.
I have successfully activated android auto on my proace but can't get carplay to activate. When I make the change and save I get an error saying failed.
Am I doing something wrong or is this a seed/hack limitation?
I'd also like to make some other adaptions but also get write failed responses. Using the current 1.03 version.

Thank you
 
  • J'aime
Reactions: jordan87 and manege



thanks.
I analysed log file: the problem is the same as the other users encounter: long write frames are not recognized.
we are looking to solve this...
 
  • J'aime
Reactions: manege

Hi, everyone.
Tell me please, may I use arduino uno V3 instead arduino uno shown on first page? It look different by elementary base, but connectors same.
 
  • J'aime
Reactions: manege




Hi,
Same answer: there is a bug with long write frames...
zone 2108 is a long frame, so we searching solution....

You use OBD pins 3,8 or CAN bus NAC for connection ?
Can you retry with CAN bus connection ? (modify sketch can_speed_125kbps)
 
  • J'aime
Reactions: manege


Hi,
Same answer: there is a bug with long write frames...
zone 2108 is a long frame, so we searching solution....

You use OBD pins 3,8 or CAN bus NAC for connection ?
Can you retry with CAN bus connection ? (modify sketch can_speed_125kbps)

I am not aware about the difficulty of this in terms of windows software coding. But seems VCI send the commands in parts with a regular time interval and the radio seems to like it. Is it possible to mimic this behaviour?