Maxim bigunclemax

Как прошить REFORMAT на Ford Sync 3

English version ➡️

Intro

Данный способ позволяет прошить Sync3 по USB, даже если он был полностью окирпичен 🧱. При этом не требуется припаивать ни картридер, ни какие-либо другие провода. Единственное что нужно, так это разобрать плату и замкнуть два контакта.

How to flash reformat on FordSync3 through USB cable

Русская версия ➡️

Intro

This method allows to flash Ford Sync 3 multimedia module(APIM) through USB cable even if it was bricked 🧱. You don't need to solder either the eMMC card reader or any other wires. The only thing you need is to disassemble the Sync module and short circuit of two pads.

Sync3story: How we fixed a reformat

Intro

The Sync 3 reformat package is the special Ford's package that allows to perform a clean OS installation on the Sync 3 APIM board.

The reformat does a lot of work. It wipes and creates a new partition table on the APIM's eMMC, getting "release" OS and apps packages from the USB drive, verifies them using the built-in certificate and, if they are valid, writes these packages on the APIM's eMMC.

The reformat is the internal Ford package and it should never be publicity available. Should... 😆
So someone leaked these packages and made it publicity.

GCC toolchain for Ford SYNC3 QNX

Preparation

Download and unpack QNX sysroot
https://disk.yandex.ru/d/E9TB3jIDFZ4WtQ

unzip qnx_6.5_sysroot_24.05.zip

	<?xml version="1.0" encoding="UTF-8"?>
	<Update_Wizard VIN="xxx">
	<m module="AWD">
	<d DID="F110" Desc="On-line Diagnostic Database Reference Number" Data=""/>
	<d DID="F111" Desc="ECU Core Assembly Number" Data=""/>
	<d DID="F113" Desc="ECU Delivery Assembly Number" Data=""/>
	<d DID="F124" Desc="ECU Calibration Data #1 Number" Data=""/>
	<d DID="F162" Desc="Software Download Specification Version" Data=""/>
	<d DID="F163" Desc="Diagnostic Specification Version" Data=""/>
	<d DID="F188" Desc="Vehicle Manufacturer ECU Software Number" Data=""/>

	//
	// Created by user on 26.06.2021.
	//
	#include <cstdint>
	#include <cstdio>

	int g_CONFIG_CGEAVersion;
	int g_CONFIG_V363Strategy;
	int g_CONFIG_B299Strategy;
	int DAT_00218a20;

	/* Usage: %s [-i] [-m] raw partition

	-i Path of IFS image file
	-m Path of MLO image file
	-t Toggle active IFS partition
	-r replace current IFS with new one
	raw partition Path of raw partition to write IFS and MLO image files, default value is /dev/hd0.
	*/

	typedef unsigned char undefined;

	#include <stdint.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdio.h>
	#include <errno.h>
	#include <unistd.h>
	#include <sys/stat.h>
	#include <time.h>

	#define MAX_IN_ASCII 1024