Modifying As-Built Data Guide

[papinist]

Found that FORSCAN will connect up and read thru the BT/OBD2 connector that I already have. Hoping that it can write also....

Not with the android version
http://forscan.org/comparsion.html

Sponsored

 

[OrangeCali16]

Hey all,

This is going in the right direction. Any chance of having the Forward Collision warning lights on the dash work like the RPM/Shift Light in the Shelby? That will be the coolest thing ever!

 

[sldghmr]

Not with the android version
http://forscan.org/comparsion.html

Well THAT blows chunks!!! I'm not buying a computer just so I can do this (well that's what I say now lol). Maybe I can team up with someone in my area....

 

[dotJake]

Did the fog/blinker, fog/hi-beam and double honk exit running car mods last night with my old trusty ELM327. Afterward I was thinking about the double honk a little more. When the car is locked, if you toss the keys in the trunk and close it, it auto unlocks and double honks. Happy to report that the double honk still works for that event. Not that you'd miss the trunk auto-unlocking immediately, but a certain pretty lady in my house might (ahem).

On a side note, I know some of you are doing a lot of stare-and-compare between as-built reports, and of course there is no API or equivalent for what you're doing, but I have to ask - is this information not published somewhere (and obviously well-guarded)? I would think that Ford must have a bible for this for their shops to reference. Or maybe it isn't published outside of HQ and if a Tech needs to replace a module they just shoot in a VIN-specific load of bytes and don't have a clue what they do. I don't know - just thinking out loud

Anyway, keep up the good work!

 

[AngelDeath]

Did the fog/blinker, fog/hi-beam and double honk exit running car mods last night with my old trusty ELM327. Afterward I was thinking about the double honk a little more. When the car is locked, if you toss the keys in the trunk and close it, it auto unlocks and double honks. Happy to report that the double honk still works for that event. Not that you'd miss the trunk auto-unlocking immediately, but a certain pretty lady in my house might (ahem).

On a side note, I know some of you are doing a lot of stare-and-compare between as-built reports, and of course there is no API or equivalent for what you're doing, but I have to ask - is this information not published somewhere (and obviously well-guarded)? I would think that Ford must have a bible for this for their shops to reference. Or maybe it isn't published outside of HQ and if a Tech needs to replace a module they just shoot in a VIN-specific load of bytes and don't have a clue what they do. I don't know - just thinking out loud

Anyway, keep up the good work!

"We interrupt our regularly scheduled discussion, for this important news bulletin."

Think of it this way, Ford has the software to make the changes in the computers that looks like a word document, what we see (The as built data) is the encrypted machine language of this document, they send out the encrypted document to the dealerships to flash the computer, but the dealer doesnt know what it deciphers to, with the exception of the lite version of the main program (Dealer program: IDS which can read the file), but they still have to release for legal reason what each module controls and provide ways to fix or correct values when repairing a car, they just dont have to tell you what each line does.

As for what we are doing is taking the machine code language (encrypted file) and changing number from 0 to 1 or vice versa to see what if anything noticeable changes in that module, hence: hacking. Some people have access to certain things, and anonymously might leak the direction to look at, or give a general diagram, but more then that your not going to get the motherload.

Hope that made sense to you.

"We continue now with our regularly scheduled discussion, already in progress".

 

[gt_stang]

Hi guys! I just got my OBDLink MX and I am ready to contribute to this thread. My focus is on reverting (eu) homologation changes on export ponies (not eu spec cars).

I have imported a 2016 Premium GT and I'd love to get two things solved:

1. Enable turn signal switchback functionality:
Currently the "lower lights" (don't know what the right name for them is) above the fog lights are doing nothing but blinking when indicating. The homologation guys have simply unplugged the marker lights next to them because here (EU) amber front lights are not allowed. So I changed bulbs to white LEDs and re-plugged - Perfect. However, the "normal/lower" lights (next to them) should be on, too. It seems it is not a wiring issue. AS built for the DRL configuration at 726-50-01 says "disabled". Now I wonder to change that to whatever I need to get those regular light setting you US guys have.
Is anybody willing to provide me with his VIN or factory AS built for his 2016 premium GT? I assume 726-50-01 is not the only value to change.

2. Sync3 FM radio frequency intervals
Here in Europe we have different frequency spans and shorter intervals for scanning stations. You guys have 87.9 to 107.9 MHz with a 200 kHz interval and we have 87.5 to 108.0 MHz with a 50 kHz interval. So with Sync3 we are missing a lot of radio stations.
According to my Ford dealer he could change the band to meet eu requirements and I wonder if this could be done via FORScan, too (I would save about 200 USD)
EU spec Mustangs (except upcoming 2017 version) don't come with Sync3 so I can't compare as builts.
Again, any help appreciated!

Thanks!

 

[dotJake]

"We interrupt our regularly scheduled discussion, for this important news bulletin."

Think of it this way, Ford has the software to make the changes in the computers that looks like a word document, what we see (The as built data) is the encrypted machine language of this document, they send out the encrypted document to the dealerships to flash the computer, but the dealer doesnt know what it deciphers to, with the exception of the lite version of the main program (Dealer program: IDS which can read the file), but they still have to release for legal reason what each module controls and provide ways to fix or correct values when repairing a car, they just dont have to tell you what each line does.

As for what we are doing is taking the machine code language (encrypted file) and changing number from 0 to 1 or vice versa to see what if anything noticeable changes in that module, hence: hacking. Some people have access to certain things, and anonymously might leak the direction to look at, or give a general diagram, but more then that your not going to get the motherload.

Hope that made sense to you.

"We continue now with our regularly scheduled discussion, already in progress".

HEX isn't a cipher for encryption. But that's neither here nor there. What I wrote wasn't meant to slight your efforts. It is nice work. One of the most frustrating things about reverse engineering is also the most intriguing. If you've done this kind of work before you know you'll eventually come across some Rosetta-type of info or it'll just exhaust you until you give up. You're somewhere in between these two right now and I wish you all the luck!

I don't know the inter-workings between F and their dealer Techs. I'm not one. But I assume this is similar across other manufacturers, too. So all I can draw on is a Tacoma I took into the dealer to silence the seat belt reminder when my dog rode shotgun. They knew right where to go, made the edit, and off I went. So does that type of knowledge not transfer to Ford Techs or are you saying the IDS tool exposes some of the access, just not all of it? I would think they have a list of the things they can do, and how to execute them. Maybe FORScan exposes that same access, again, I wouldn't know, not a Tech but I'm sure there a are more than a few of these guys on here.

So again, nice work. But no need to announce a news bulletin.

 

[Spart]

Anybody messed with figuring out whether we can set the timeout for our power points (12v cig adapter) yet?

The F150/Fusion guys have that one figured. I really want to set mine to timeout as immediately as possible without having to wire in a relay.

ETA: more info from the F150 crew: https://docs.google.com/spreadsheets/d/1uDSQ1Z5a2Wt8-kjrSiVSlDFGFHnfeuhb3RTMVz95730/edit#gid=1125804616

 

[buzz-dee]

Hey all,

This is going in the right direction. Any chance of having the Forward Collision warning lights on the dash work like the RPM/Shift Light in the Shelby? That will be the coolest thing ever!

That'd be awesome!

 

[AngelDeath]

HEX isn't a cipher for encryption. But that's neither here nor there. What I wrote wasn't meant to slight your efforts. It is nice work. One of the most frustrating things about reverse engineering is also the most intriguing. If you've done this kind of work before you know you'll eventually come across some Rosetta-type of info or it'll just exhaust you until you give up. You're somewhere in between these two right now and I wish you all the luck!

I don't know the inter-workings between F and their dealer Techs. I'm not one. But I assume this is similar across other manufacturers, too. So all I can draw on is a Tacoma I took into the dealer to silence the seat belt reminder when my dog rode shotgun. They knew right where to go, made the edit, and off I went. So does that type of knowledge not transfer to Ford Techs or are you saying the IDS tool exposes some of the access, just not all of it? I would think they have a list of the things they can do, and how to execute them. Maybe FORScan exposes that same access, again, I wouldn't know, not a Tech but I'm sure there a are more than a few of these guys on here.

So again, nice work. But no need to announce a news bulletin.

[MENTION=25154]dotJake[/MENTION], Sorry if I offended you, it was meant more to be humorous then insulting, sometimes whats in your head or in person doesnt sound the same on the Web, so for that I'm sorry if you took it the wrong way.

But your surmising is correct, the Dealerships have the IDS system, which think of it as a lite version of the main system Ford has at Flat Rock, the one in Flat rock (Or wherever the system is) it the deluxe model that can do anything, the dealerships have the lite version and somethings are plain english that they can go into a drop down menu and change, where others they cant for legal reason, as the example of the Fog lights and signal lights, that being a "Law" they dont give the dealership the authority to change the location, it doesnt even show up in their system from what i am aware of, seat belt minder, yes, interior lights off (Police/Dark Mode) yes, Changing the DRLs from say signal lights to low beam headlights yes. Fogs and high beams on together no.

I used the encryption as an example off the top of my head so others could understand why these changes arent as easy as black and white.

 

[dotJake]

[MENTION=23778]AngelDeath[/MENTION] - No worries. My period is almost over.

 

[AngelDeath]

[MENTION=23778]AngelDeath[/MENTION] - No worries. My period is almost over.

:lol:

 

[dbranger94]

Hi guys! I just got my OBDLink MX and I am ready to contribute to this thread. My focus is on reverting (eu) homologation changes on export ponies (not eu spec cars).

I have imported a 2016 Premium GT and I'd love to get two things solved:

1. Enable turn signal switchback functionality:
Currently the "lower lights" (don't know what the right name for them is) above the fog lights are doing nothing but blinking when indicating. The homologation guys have simply unplugged the marker lights next to them because here (EU) amber front lights are not allowed. So I changed bulbs to white LEDs and re-plugged - Perfect. However, the "normal/lower" lights (next to them) should be on, too. It seems it is not a wiring issue. AS built for the DRL configuration at 726-50-01 says "disabled". Now I wonder to change that to whatever I need to get those regular light setting you US guys have.
Is anybody willing to provide me with his VIN or factory AS built for his 2016 premium GT? I assume 726-50-01 is not the only value to change.

2. Sync3 FM radio frequency intervals
Here in Europe we have different frequency spans and shorter intervals for scanning stations. You guys have 87.9 to 107.9 MHz with a 200 kHz interval and we have 87.5 to 108.0 MHz with a 50 kHz interval. So with Sync3 we are missing a lot of radio stations.
According to my Ford dealer he could change the band to meet eu requirements and I wonder if this could be done via FORScan, too (I would save about 200 USD)
EU spec Mustangs (except upcoming 2017 version) don't come with Sync3 so I can't compare as builts.
Again, any help appreciated!

Thanks!

I know it's been mentioned before, but all you need to do is go onto any major website that has cars for sale, look up a car that has the correct year and options you want and copy the VIN number. Then download the as-built data for that car.

 

[Bill-O]

I know it's been mentioned before, but all you need to do is go onto any major website that has cars for sale, look up a car that has the correct year and options you want and copy the VIN number. Then download the as-built data for that car.

Has anyone ever discovered a way to program a digital speedo into a '16 GT or has that possibility been completely ruled out? TIA

 

[fionic]

Found that FORSCAN will connect up and read thru the BT/OBD2 connector that I already have. Hoping that it can write also....

as far as I know you cannot do programming on the android version. windows only.

http://forscan.org/comparsion.html

Sponsored