RCD330g Plus Desay - Discussion | [Volkswagen Skoda] Car and device on WinCE, WM



Rep: (101)
FirmwareRCD330g Plus Desay
Car and device on WinCE, WM
Firmware пїЅ Talk пїЅ Discussion MIB2-G MQB пїЅ

A machine : Volkswagen Skoda
Attention before you do anything with your radio, please kindly re-read at least the cap and instructions for restoration. And if you do not understand or are not confident in your abilities, refer to the professionals!
Features and iron recorder
Radio cassette recorder on WinCE 6.0
CPU CSR PRIMA II S3683 WinCE processor CPU-1 shell is spinning on it
Photo CPU-1
Attached Image

RAM 256MB chip IS43TR16256A-15HBLI
Memory
Attached Image

ROM 256MB NAND Flash MT29F2G08ABAEAH4-IT
Flash
Attached Image

CPU-2 Toshiba TMPM324F10FG. This processor is responsible for turning off, working with the CAN bus, polling the keys, controlling the radio, and so on.
CPU-2
Attached Image

RAM CPU-2 IS66WV51216DBLL 1 Megabyte of memory for the second processor.
Ram-2
Attached Image

CAN BUS TJA1055 / 3
Output amplifier
Attached Image
Attached Image

Radio receiver
Attached Image

Screen sensor
Attached Image

Video decoder rear view camera
Attached Image

Microphone & amp; Bluetoth Module
Attached Image

Eeprom second processor
Attached Image

Screenshots datashitov. Links to Datahita

Our radio has a pretty powerful USB port, hereHEREYou can see the result of the power check.

Merged and unpacked firmware

Instructions
Recovery Instructions.
Guide to Russification and change the color scheme of the radio RCD330GPlus with the entrance to the alt. menu by button Media.

BOOT menu through the terminal
Wiring diagram Description of how to disassemble and connect the radio
Attached Image
[1] Upload Bootloader
[2] LAUNCH existing Boot Media image
[3] Update image via USB
[4] UPDATE image from SD / MMC card
[5] DOWNLOAD image via USB RNDIS Ethernet
[6] Reset TOC
[7] Erase MBR
[8] Config menu
[9] Debug Boot Media
[A] Storage Menu
[D] Desay OEM Data menu
[E] Erase boot media
[M] Config New Feature for MMC v4.3 / 4.4 card

Selection: 8

configure operation menu:
[0] IP address: 0.0.0.0
[1] Subnet mask: 0.0.0.0
[2] DHCP: Enabled
[3] MAC address: (0: 0: 0)
[4] Boot delay: 0 seconds
[5] Startup image: Enable
[6] Program RAM image into Boot Media: ENABLED
[7] Bluetooth address: (0: 0: 0)
[E] Set Clock
[V] Set Voltage
[s] Save Configuration
[u] Configure USB PHY
[Q] quit to main menu

Selection: D

DESAY SV OEM DATA MENU
Version [vw160704]
Build at [2016-07-04 12:03:20]
[0] Version: vw160704
[1] Version type: Release
[2] Touch panel type: MXT224 touch
[3] GPS type: GSD4E
[4] Trace type: No trace
[5] Open Touch Calibration: NO
[s] Save Configuration:
[Q] quit to main menu

Selection: 9

Debug n
[1] NAND_ReadSector
[2] NAND_WriteSector
[3] Dump Flash
[Q] Quit to Main menu


Going to the desktop
To exit to the desktop, download the filehereUnzip to the root of the SD card. Sd card is small and preferably formatted in FAT. 8gb did not work for me.
Insert the card into the radio, press and hold the SETUP button until the menu appears
Attached Image
select the first item Software update is visible
Attached Image
Select Update Software menu will appear
Attached Image
Here we carefully select the second menu item.Update NAVI see the picture
Attached Image
and restarts. For a short time, the picture will show updates and fall out on the desktop. Nothing at this moment is not changed and is not updated. After logging out to the desktop, only the file flag responsible for the update is erased. To the next boot did not try to upgrade.
The next time you load the radio, it will turn on in the normal operating mode. Further, it does not matter whether the SD card is inserted or not.

Option number 2here


Instructions for flashing through the terminal
WinCE update from SD card via terminal commands. Requires disassembly of the device and connect the COM port. We read two topicsDescription of how to disassemble and connect the radioandRecovery Instructions.
Downloading firmwareHEREWe unpack to the root of the SD card. The card before this is best formatted. Insert the card in the radio.
We open the terminal program at a speed of 115200.
Clamp a space and turn on the radio. Serve in the menu
test key []
[1] Upload Bootloader
[2] LAUNCH existing Boot Media image
[3] Update image via USB
[4] UPDATE image from SD / MMC card
[5] DOWNLOAD image via USB RNDIS Ethernet
[6] Reset TOC
[7] Erase MBR
[8] Config menu
[9] Debug Boot Media
[A] Storage Menu
[D] Desay OEM Data menu
[E] Erase boot media
[M] Config New Feature for MMC v4.3 / 4.4 card

Press 4 get into the boot menu
Selection: 4
SDMLC_Prepare: store media SDMMC
[s] [291]: SD (Clk = 50000000, Ratio = 12), CLKC_SDPHY_CONFIG = 0x550004, pll3clk = 0x23C34600

SDMMC_Init SD base add: A0400000

SD clock, div = 0x0, supported = 50000000, max = 50000000

going to use 0 div

SDMMC_GetInfo addr 0xA0400000

SDMLC_Prepare Finish

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! Now we try to update image from SD card. Please ensure
! your Monolithic or MultiXIP image in SD card root dire-
! ctory. Monolithic or Mul-
! tiXIP image in SD card. If you select to download Mono-
! lithic image and put MultiXIP image in SD card, there
! will be errors! Vice versa. Here you have three choice:
! 1 ----- MultiXIP
! 2 ----- Monolithic
! 9 ----- Give up to download image
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Click 1 and watch the download process on the screen of the radio and in the terminalker
Do you want to download: input 1
Try to download MultiXIP image, please wait ....
Eboot Splash Window!
OS: MSG: update NK update? [0] 0-0-0

DownloadImage finish
ROMHDR at Address 8FC00044h
:: OEMLaunch, ImageStart: 0x8FC00000, ImageLength: 0x1531470, LaunchAddr: 0x8FC01000
OEMLaunch: Write image to nandflash
OEMLaunch: (IMAGE_TYPE_MXIP | IMAGE_TYPE_BINFS)
WriteRegionsToBootMedia: ImageStart: 0x8FC00000, ImageLength: 0x1531470, LaunchAddr: 0x8FC01000
INFO: WriteRegionsToBootMedia: Found chain extenstion: '' @ 0x8FC00000
INFO: WriteRegionsToBootMedia: Found chain extenstion: 'chain information' @ 0x8FC00000
INFO: WriteRegionsToBootMedia: Found 'chain information' (pChainInfo = 0xA1F0B728 Extensions = 0x3).
Found the Chain region: StartAddress: 0x81404000; Length: 0x00000528
Writing multi-regions
BINFSPartMaxLength [0]: 0x1000, TtlBINFSPartLength: 0x1000
dwMaxRegionLength [2]: 0x1000
BINFSPartMaxLength [1]: 0x1800000, TtlBINFSPartLength: 0x1801000
dwMaxRegionLength [0]: 0x1800000
BINFSPartMaxLength [2]: 0x2000000, TtlBINFSPartLength: 0x3801000
dwMaxRegionLength [1]: 0x2000000
Open / create RAWFS partition 3595 sectors ...
GetPartitionTableIndex: dwPartType = 38 fActive = 1

Open / create BINFS partition 28675 sectors ...
GetPartitionTableIndex: dwPartType = 33 fActive = 1

dwRegionStart: 0xA1B50000, dwRegionLength: 0x1531470, dwStoreOffset: 0x0
BP_SetDataPointer at 0x0

WriteData: Start = 0x0, Length = 0x1531470.

Update TOC!
dwRegionStart: 0xA3081470, dwRegionLength: 0x1BB0114, dwStoreOffset: 0x1800000
BP_SetDataPointer at 0x1800000

WriteData: Start = 0x1800000, Length = 0x1BB0114.

dwRegionStart: 0xA4C31584, dwRegionLength: 0x528, dwStoreOffset: 0x3800000
BP_SetDataPointer at 0x3800000

WriteData: Start = 0x3800000, Length = 0x528.

Written Chain Region to the Flash
LoadAddress = 0x81404000; FlashAddress = 0x00007E0C; Length = 0X00000002


GetPartitionTableIndex: dwPartType = 33 fActive = 1

Image start sector: 3596, total sectors: 28674

Please wait for calculating checksum ...

CUR: ImageDataCheckSum: 0xA5627A74

TOC: ImageDataCheckSum: 0xA5625637, ImageInfoCheckSum: 0x62

CreatePartition: can't find free sector.

GetPartitionTableIndex: dwPartType = 5 fActive = 1

Extend partition CREATE ERROR !!
-WriteRegionsToBootMedia
+ TOC_Write
g_pTOC->dwSignature: 0x434F544E
g_pTOC->dwTOCVersion: 0x00000018
write TOC, checksum = 0x2302
TOC_Write 0th TOC, start sector 2561 1 sectors
g_ptoctemp [0] = 0x814CD800TOC_Write 1th TOC, start sector 2562 1 sectors
-TOC_Write

ratio = 0x24424221, src = 0x42240422, clkinfo = 0x258BFF20, voltage = 0x48

Jumping to image at virtual address 0x8FC01000h

Russification
Latest versionHERE. thankMg355
Previous version of Russification. Description, instructions and screenshotsHERE. In this version, English is unchanged and Russian is in place of Chinese. Added Russian flag.
The version in which the Russian language instead of English and English instead of Chinese. Set by copying language files in manual mode.HERE
One of the first versions is set by manually copying language files.HERE
Russification Screenshots
Attached Image
Attached Image
Attached Image
Attached Image
Attached Image
Attached Image



Logo change
You can change the logo in the BOOT menu via the terminal.
InstructionHERE.

Skoda logoHERE
Skoda logo old styleHERE.

EasyConnect
The program for displaying the phone screen on the radioHERE
Connection instructions and latest versions.
Video output to the desktop and mirroring the screen of the smartphone.

Solving problems with the display image on the screen recorder

Linear output
Attached Image

Another description of how to make a linear output.HERE.
Detailed description with pictures about installing a linear outputHERE.

12 Volt output at power on
[
Attached Image
]

Exit the menu by long pressing MEDIA.

Skoda color scheme Green. Instructions for changing the color of the shell to green.
VW color scheme Red. Files to change the color of the shell to red.
The way to exit to the desktop with sound.
Adding shortcuts to the desktop description.
Description how to create shortcuts.
Change ringing incoming call.
Description and solution of the problem with the rear view camera
USB Ublox7 USB Connection
Tune GPS Ublox module
Remote USB connector in the glove box.
COM ports description
GPS receiver connection
Alternative 5 volts for GPS connectivity
Script for nailing process G3NavHMI.exe

Photo
Attached Image
Attached Image
Attached Image
Attached Image
Attached Image

Alternative menus

Useful

You can thank inprofile.
Thank you all for your support!
Many thanks to the active participants in the project!


Post has been editedCrazyzy - 09.05.19, 00:29
Reason for editing: Useful



Rep: (11)
I propose to add a video about the operation of the gps module. I tried to hold the media button for a long time, the radio tape recorder cursed. It seems that this module is not just a refinement of the Chinese Kulibin, but an additional option to the dealer.
http://m.youku.com/vid...tuid=UNDMxODQ4MDQ1Mg==



Rep: (26)
* muhinalex94,
This module is a separate board with its own operating system (WinCE, Android or something else), which is placed in the gap between the display with the buttons and the main board of the radio and re-commits the display to the display and intercepts the buttons on itself or on the main board of the radio. IMHO, for such an add. Volkswagen option would have deprived dilstvo.
This is how the module looks and is mounted in the radio:Video

Post has been editedNautilus90 - 29.01.17, 14:13



Rep: (11)
* Nautilus90
Maybe so. But the head with a long press on the media gives a beep. No other button like this. So in it, something is sewn up on this command.



Rep: (101)
Muhinalex94 @ 01.29.17, 14:17*
But the head with a long press on the media gives a beep.


With a long press on the MEDIA button, the head takes a screenshot on the Sd card.



Rep: (11)
* dima_s30,
And the truth is ... some useless function ...



Rep: (2)
Photos of the disassembled faces and the size of the LEDs, for those who want to solder:https://www.drive2.ru/b/462704730611647090/



Rep: (0)
May help knowledgeable people. I rummaged through the Internet about the unlock and firmware rcd 330 plus and came across a forum of the Chinese car industry. There, I also understood Desay. Here is an excerpt from that forum: Unlock the head unit. Theory:
To unblock, we use the last item of the update program (the one with four buttons in Chinese), which is responsible for updating the update program itself (sorry for the tautology). In order for this item to become active, an empty file "SwDnlUpdate.flg" must be in the root of the SD card, and the file "SwDnl.exe", which itself will be written in its place. I used Total comander. As a result of the steps below, the native update program will be replaced in the internal memory of the device with the total comander, and it cannot be restored. Therefore, I strongly recommend uploading the file I checked. If you pour something that does not start on our head unit, or it starts but it will be useless - nothing else can be done.
The instruction is certainly not on our head. But as you can see the file names are the same, the only file extension is different.



Rep: (101)
So far I have found this. If you put the file swdnl_debug.config in the root of the SD card, then when you open the UPDATE SOFTWARE menu, a menu opens that we will update NAVI or RADIO or all of them. The format of this file is unclear.
I strongly recommend not trying !!!!



Rep: (10)
I propose to make cross-references in the header on the topic with noname
It does not develop much there, but links to new firmware appear
Someone can facilitate the search)



Rep: (9)
With the localization (Russification) of the interface, everything seems to be pretty simple.
language files with QM extension - as I understood the standard, localized / corrected by software like Radialix.
Sorry the shell does not work in the emulator to run, it would be possible while they are engaged in translation ...
I look forward to "opening" a simple way to build / fill the firmware.
Give the Russian menu and support for FLAC !!!! and maybe video / navigation: blush: ...

here by the way, I found info about building an emulator for GU on WinCE
http: //progandhack.blo...ws-ce-6-roadrover.html
I have not tried it myself yet ...

Post has been editedEric777 - 30.01.17, 13:09



Rep: (0)
Noname on another OS. What for?

Post has been editeddmt-sav - 30.01.17, 13:16



Rep: (26)
dmt-sav @ 01/30/2017, 15:17*
... stumbled upon the Chinese automotive industry forum ...

Attach a link to this forum, it will be useful.

It’s probably even better to make a link in the header to Noname, such as: “a discussion of rcd330g Plus Noname here (link)”.

Post has been editedNautilus90 - 30.01.17, 13:38



Rep: (0)
Here is this topichttp: //www.geely-club...tola-v-emgrand/page-59



Rep: (26)
Perhaps something like this can roll on the 330th:
//savagemessiahzine.com/forum/index.php?showtopic=786470&view=findpost&p=56319627



Rep: (11)
Nautilus90 @ 01.30.17, 16:02*
Perhaps something like this can roll on the 330th:
//savagemessiahzine.com/forum/index.php?showtopic=786470&view=findpost&p=56319627

Hmmm, and maybe it’s a ride. WinCE is all the same because the Windows and the files like Autorun have not been canceled, most likely

And in one of the filesInitapp.exe which, judging by the registry, is automatically started, there is a line inside c: \ Documents and Settings \ Administrator \ Desktop \ InitApp \ InitApp \ Desay_SDK_Atlas_VI (ARMV4I) \ Release \ InitApp.pdb
Hence the conclusion that we needDesay_SDK_Atlas_VI (where to get it HZ). Well, the development is sweat XP apparently.
Further search by combinationDesay_SDK brought here to the forum MMS Lada Vesta
There is a photo inside, a description of the transition to the desktop.

For not having Desay I can not try.
* dima_s30, read it, maybe it will work out.

Post has been editedsiabr - 30.01.17, 17:09



Rep: (101)
This situation was played with the files I mean for the Update on the SD card you need a file named swdnl_debug.config if it is, the Software Update menu opens with this picture
SW Update
Attached Image

When you select any menu in the root of the internal memory, a SwUpdate.flag file is created with a length of 1 byte and the tape recorder is sent to reboot. When downloading, if there is this file, then the radio tape recorder is trying to be updated from the SD card.
This means that when starting up when the update is enabled, the swdnl_debug.config file must be in the root of the SD card, and the file is searched by masks VW 20SD VWOSBASE .pack. If you selected the Radio update, then the RdDnl.bin file is also searched.
Actually, I did all this the result of the radio tape recorder does not work :) I am writing so that they do not step on my rake, if I choose an update until it is updated with a positive result, I’ll not be able to exit the update. Do not get a brick.
Actually, I tried to pick up the update file and it spilled the RdDnl.bin file and updated the second TMPM324F10FG processor on which there is no merged firmware.

Now I'm trying to find the firmware of the radio, well, or try to merge with the already killed in order to develop an algorithm for reading.

Post has been editeddima_s30 - 30.01.17, 22:36



Rep: (26)
* dima_s30,
That is, at the moment it does not work at all and does not react to anything?
And how did you determine that it was the second processor that was flashing?



Rep: (101)
Nautilus90 @ 01/31/17, 3:15*
And how did you determine that it was the second processor that was flashing?

Determined rather suggested for several reasons.
1. in the main memory, nothing has changed. In addition to the file that is responsible for the status of the update.
2. During the update, a log was collected and there were lines offset: 0x00010000 is similar to the displacement of the boot
Log
****** DebugMsg: CSwDnlDownloadProgressDlg :: UpdateRadioThread line359 m_uRadioTotalSize = 1 SWDNL: Radio Update srtart
rmt nav send to radio: 5413 0x00 00 10
rmt nav send file size to radio: 5411 0x00 00 00000001

SPI RD: 01 51 10 09 00 00 00 01 00 ffffffbc 00 00 00
SWDNL: Radio Require File offset: 0x00010000, File size: 188Byte
SWDNL: Request size: 188, Actually read size: 0.
SWDNL: Send command read file End.
rmt nav send to radio: 5411 0x00 01
ReadFileThred: Complete Radio Upate!

3. And now the WM_USER_WATCHDOGEVENT error is flying in the log
Nautilus90 @ 01/31/17, 3:15*
That is, at the moment it does not work at all and does not react to anything?

Magnetic tape was not completely corroded. It starts, first, the inclusion after the update writes an unsuccessful update attempt, while re-writing the SwUpdate.flag file and the next inclusion looks like a normal update mode. only now everything is in chinese.

PS: Although maybe the radio chip was sewn. 188 bytes it took from the answer SPI bus. But also sadly I didn’t find the manual on the Radio chip.

Post has been editeddima_s30 - 31.01.17, 08:19



Rep: (101)
Thanks to all!
I will continue thinking about the fact that I flashed it more precisely.
More all the same I am inclined that this is the second percent. It has an SPI bus while there is no SPI bus in the radio chip. Also, there is no memory in the radio chip.
There is a small probability that I spilled an EEPROM which stands next to the second process.
Salt today, I will see everything in it whole.

Now how to try to merge the second flash drive.
It has a SWD (Serial Wire Debug) bus through which you can read, write, and debug percents. If not recorded a bit of protection.
In general, it is worth a try. J-Link old somewhere lying around you can try to connect.



Rep: (101)
Add a purse to the header

In the evening at home I will find passwords add.

From the beginning I will try to read eepprom. Suddenly, everything is easier and the wallet is not required.


Full version    

Help     rules

Now: 29.06.19, 01:55