Ford-VCM2-V100-Diagnostic-Appareil

Windows OS cannot do all for VCM 2

Outils de diagnostic de voitures

I’d have to answer that not everything can be done from Windows operation system.

For example I can’t modify and rebuild initrd, rootfs, or the kernel from windows.
Sure, I can use winimage (or the like) to read files but that’s not everything and honestly it’s more effort to achieve even that level of access on windows than using it natively on Linux.

I am very comfortable with Linux having done minor development for a distro. I don’t have a automotive background, but instead an IT background. I realize that not everyone has Linux experience and that’s fine. But it’s a highly effective and versatile tool platform.

FYI, I was able to restore my VCM2. If you find yourself in the same situation:

1 Download and use ExtraPuTTY (Use Ymodem mode for transfers)

2 Download firmware from https://mega.nz/#!utIHlA7b!0EA9jWLptCtQx1-Rlxh5KwcytGsxsS1aGqpZjZKBVG0 (Big thanks to baner)

3 Connect to the serial bootloader

In detail…

Ford VCM2 Serial Console

4 Run the following commands one group at a time and using the corresponding mtd partition (list below). You’ll need to follow the onscreen prompts.

Code:

setenv baudrate 115200; funlock; saveenv

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off fpga; erase fpga; cp.b 0xa2000000 fpga 0x000a0000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off linux2; erase linux2; cp.b 0xa2000000 linux2 0x00180000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off initrd2; erase initrd2; cp.b 0xa2000000 initrd2 0x00600000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off linux1; erase linux1; cp.b 0xa2000000 linux1 0x00300000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off initrd1; erase initrd1; cp.b 0xa2000000 initrd1 0x012e0000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off jffs2; erase jffs2; cp.b 0xa2000000 jffs2 0x00100000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off linuxvars1; erase linuxvars1; cp.b 0xa2000000 linuxvars1 0x00020000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off linuxvars2; erase linuxvars2; cp.b 0xa2000000 linuxvars2 0x00020000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off serialnum; erase serialnum; cp.b 0xa2000000 serialnum 0x00008000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off macaddress; erase macaddress; cp.b 0xa2000000 macaddress 0x00008000

mw.b 0xa2000000 FF 0x01400000; loady 0xa2000000; funlock; protect off bootvars; erase bootvars; cp.b 0xa2000000 bootvars 0x00020000

reset

MTD Partitions

Code:

Name             Location   Size       Type      Source    Guard   MTD Part.
—-             ——–   —-       —-      ——    —–   —-
fsboot           0x00000000 0x00040000 Flash     bootargs  Off     mtd0
boot             0x00040000 0x00040000 Flash     bootargs  Off     mtd1
bootvars         0x00080000 0x00020000 Flash     bootargs  Off     mtd2
fpga             0x000a0000 0x000a0000 Flash     bootargs  Off     mtd3
linux2           0x00140000 0x00180000 Flash     bootargs  Off     mtd4
initrd2          0x002c0000 0x00600000 Flash     bootargs  Off     mtd5
linux1           0x008c0000 0x00300000 Flash     bootargs  Off     mtd6
initrd1          0x00bc0000 0x012e0000 Flash     bootargs  Off     mtd7
jffs2            0x01ea0000 0x00100000 Flash     bootargs  Off     mtd8
linuxvars1       0x01fa0000 0x00020000 Flash     bootargs  Off     mtd9
linuxvars2       0x01fc0000 0x00020000 Flash     bootargs  Off     mtd10
serialnum        0x01ff0000 0x00008000 Flash     bootargs  Off     mtd11
macaddress       0x01ff8000 0x00008000 Flash     bootargs  Off     mtd12
zImage           0xa0008000 0x00300000 DRAM      Initial   Off
scratch          0xa2000000 0x01400000 DRAM      Initial   Off
script           0xa3400000 0x00100000 DRAM      Initial   Off
Stack            0xa3e9ff00 0x00020000 DRAM      System    On
GD               0xa3ebff00 0x00000100 DRAM      System    On
Heap             0xa3ec0000 0x00040000 DRAM      System    On
Text             0xa3f00000 0x0002e6e8 DRAM      System    On
BSS              0xa3f2e6e8 0x00044218 DRAM      System    On

* Be careful to not mess with the fsboot/mtd0 & boot/mtd1 partitions. If you do you’ll need to use a flash programmer or JTAG to recover your VCM2.

If there is any interest, I expect to write a slightly modified version of the most recent firmware that doesn’t block WiFi, always boots to testmode, and has some additional utilities in the web interface (change VCM type, spoof version, web based firmware update. I’m open to suggestions).

@mattydr67 & baner
I’ll be glad to as soon as I have some info to share.