Welcome to Bimmerfest -- The #1 Online Community for BMW related information! Please enjoy the discussion forums below and share your experiences with the 200,000 current, new and past BMW owners. The forums are broken out by car model and into other special interest sections such as BMW European Delivery and a special forum to voice your questions to the many BMW dealers on the site to assist our members!

Please follow the links below to help get you started!

Go Back   Bimmerfest - BMW Forums > The Best of Bimmerfest! > BMW Coding and Programming

BMW Coding and Programming
Discuss coding options and features on your BMW here.

Reply
 
Thread Tools Display Modes
  #1  
Old 07-29-2014, 10:11 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Upgrading NBT's HDD

Got an extra NBT unit (Euro spec) since I upgraded to a US-spec'd NBT. I wanted to take advantage of this opportunity to try and understand the NBT a bit more.

There are several reasons why I'm interested, HDD failure, being the top. I've personally seen a failed HDD on an NBT. The unit still booted and basic functions (radio, bluetooth...etc) still worked. All functions that deals with saving data are not visible, i.e., saving stations, adding contacts...etc. Navigation also didn't load at all. Second is speed. the NBT is not slow by any means, just wanted to see what SSD would do to it.

Here's what I found out so far:
1) HDD is 200GB 2.5" Toshiba drive, model MK2060GSC: http://storage.toshiba.eu/cms/en/hdd...?productid=366. Quick googling reveals this to be a 4200RPM Automotive-grade drive.
2) It appears to be secure and locked. Reminds me of the first Xbox HDD where it can't be use until unlocked.
3) Windows can see the drive but it wants to initialize it (Never let Windows touch it)
4) DD and GParted can't read the drive. If DD and GParted can't read it, no commercial disk cloning software will be able to -unless the drive is unlocked.
5) DVD Drive appears to be locked to the unit as well. You can't replace it and expect to work right off the bat. DVD Drive depends on working HDD
6) DVD Drive is also Toshiba (BTW, newer PSdZData seems to indicate Blu-Ray is coming)
7) HDD is under the drive tray, which can be accessed by removing the top plate. These are the only two components in this compartment. The rest you can get to from the bottom. Presumably to isolate the 2 from too much heat. The unit generates significant amount of heat, more so on the bottom front

So, it looks like the only option at this time is to try and plug an SSD and upgrade firmware and see if the process will take care of formatting the SSD with required partition information. I'll most likely lose this SSD if it fails.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites

Last edited by TokenMaster; 08-03-2014 at 09:27 AM.
Reply With Quote
Advertisement
  #2  
Old 07-30-2014, 03:28 AM
Dodge DeBoulet Dodge DeBoulet is offline
Officially Welcomed to the 'Fest
Location: Maine
 
Join Date: Jul 2014
Posts: 148
Mein Auto: 2014 535i XDrive
If you don't want to take the chance on your SSD, I have a 160GB Intel I'll offer up for the cause. I don't know if that's big enough for your testing, though.

PM me if you're interested . . .


Sent from BimmerApp mobile app
__________________
2014 Dark Graphite Metallic BMW 535i XDrive
Date Purchased: 07/02/2014
Options: Cold Weather Package, Driver Assistance Package, Multi-Contour Seating, Premium Package, Black/Dakota Leather Upholstery
Reply With Quote
  #3  
Old 07-30-2014, 08:54 AM
dandanio's Avatar
dandanio dandanio is offline
The One who Drives.
Location: Northeast
 
Join Date: Jun 2008
Posts: 862
Mein Auto: 11 f25 n55/09 Jetta TDI
Have you booted it with Linux (Knoppix/any other live CD?)? Can you get a bit more technical with it? I might be able to help you with the HDD.
__________________

Trips and Pieces - My new blog for Travelers by Travelers!
Personal Euro Delivery Blog




My, somewhat outdated, BMW Euro Delivery of 2009 blog with pics!
Reply With Quote
  #4  
Old 07-30-2014, 01:35 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Quote:
Originally Posted by Dodge DeBoulet View Post
If you don't want to take the chance on your SSD, I have a 160GB Intel I'll offer up for the cause. I don't know if that's big enough for your testing, though.

PM me if you're interested . . .


Sent from BimmerApp mobile app
Thanks for the offer, I appreciate the gesture. I have a 256GB intended for this and been sitting for a while now. Was just to chicken to try it out.

Quote:
Originally Posted by dandanio View Post
Have you booted it with Linux (Knoppix/any other live CD?)? Can you get a bit more technical with it? I might be able to help you with the HDD.
I used GParted Live USB and both dd and GParted can't read it. Tell tale sign of a locked HDD.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #5  
Old 07-30-2014, 02:33 PM
wiggis wiggis is offline
Registered User
Location: Europe
 
Join Date: Jul 2014
Posts: 85
Mein Auto: BMW M135i
Seems strange to go to the trouble of locking a HDD fitted inside a very hard to remove enclosure? It's not like people are going to be swapping them out on any kind of a regular basis

Watching this thread with interest.
Reply With Quote
  #6  
Old 07-30-2014, 02:35 PM
dandanio's Avatar
dandanio dandanio is offline
The One who Drives.
Location: Northeast
 
Join Date: Jun 2008
Posts: 862
Mein Auto: 11 f25 n55/09 Jetta TDI
There is a software to unlock the locked HDD.

But, of interest, would you connect the SSD and see if the system recognizes it?
__________________

Trips and Pieces - My new blog for Travelers by Travelers!
Personal Euro Delivery Blog




My, somewhat outdated, BMW Euro Delivery of 2009 blog with pics!
Reply With Quote
  #7  
Old 07-30-2014, 03:28 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Quote:
Originally Posted by wiggis View Post
Seems strange to go to the trouble of locking a HDD fitted inside a very hard to remove enclosure? It's not like people are going to be swapping them out on any kind of a regular basis

Watching this thread with interest.
It's not that hard to get to the HDD. Just 4 screws to remove and can be done without breaking the seal.

Locking HDD is also a standard feature of ATA/IDE. Xbox (the big clunky black machine) was the first to implement it on Consumer Electronics. If you are storing info with commercial value ,i.e., maps, or have something to protect and wants to keep prying eyes from seeing it, locking the HDD is certainly a viable proposition.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #8  
Old 07-30-2014, 03:37 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Quote:
Originally Posted by dandanio View Post
There is a software to unlock the locked HDD.

But, of interest, would you connect the SSD and see if the system recognizes it?
Yup, I'm familiar with it. ataPwd and the hdd maker should have their tools too.

I did try connecting the SSD and another HDD and NBT will not use it. My theory: 1) required partition info is missing 2) Unlocking failed (can't unlock an HDD that isn't locked in the first place), thus NBT stopped all HDD-related operations.

Related to #2, if this proves to be true, HDD must be locked with password that the NBT knows, else, unlocking it with a master password would render it useless to NBT. Anyways, just theory at this time. I still have to try it within the week but I wanted to have more than one options if upgrading firmware won't do any good
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #9  
Old 07-31-2014, 02:50 AM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
It's confirmed, the HDD is locked. Master password is not modified but the HDD is configured for Maximum Security Level (as opposed to High), which means, only the user-password can be use to unlock and read the drive. In this configuration, the master password is only useful if I wanted to erase the drive and use it for something else, which of course, is not my intention.

I hope I can extract the user-password from the drive's firmware. If I can retrieve it, then I can unlock and clone the HDD. The obvious challenge is that, SSD uses AES to secure the drive. I'm not sure if it supports the ATA-style locking method. It's likely but I'm not sure. I haven't had a chance to look at it yet.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #10  
Old 08-03-2014, 09:21 AM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Flashing with SSD installed didn't work. Flashing didn't format the drive at all.

Also, the DVD drive is dependent on working HDD. If the HDD happens to stop working, DVD will too.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #11  
Old 08-03-2014, 02:07 PM
wiggis wiggis is offline
Registered User
Location: Europe
 
Join Date: Jul 2014
Posts: 85
Mein Auto: BMW M135i
With a bit of luck the password will be hidden in plain text inside the NBT firmware
Reply With Quote
  #12  
Old 08-03-2014, 02:19 PM
Sdt777 Sdt777 is offline
Officially Welcomed to the 'Fest
Location: Scotland
 
Join Date: Dec 2013
Posts: 147
Mein Auto: M4
What tick boxes are you selecting like ibadeploy etc when flashing the NBT?
Take it you tried the HDD... Tick box?
Reply With Quote
  #13  
Old 08-04-2014, 02:14 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
I didn't try hddUpdate as vithy mentioned it didn't do anything. In retrospect, I should have just included it. I can still try it later this week.

HDD password is also in rheingold and I'm about 90% sure! it's also in E-Sys. I have my work cut out for me.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #14  
Old 10-03-2014, 10:24 AM
bomax bomax is offline
Officially Welcomed to the 'Fest
Location: USA
 
Join Date: Nov 2013
Posts: 125
Mein Auto: 2014 535i M-Sport
Did you ever end up getting this to work?
__________________
2014 535i M-Sport
Reply With Quote
  #15  
Old 10-03-2014, 10:48 AM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
Life got in the way and I entered another hobby so it's still where it was 2 months ago. My NBT is in my garage wide open lol. I keep saying "I'll do it this weekend" - that was 8 or so weeks ago.
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #16  
Old 10-03-2014, 10:56 AM
bomax bomax is offline
Officially Welcomed to the 'Fest
Location: USA
 
Join Date: Nov 2013
Posts: 125
Mein Auto: 2014 535i M-Sport
Haha, it happens. Do keep us updated "this weekend" once you finish it.
__________________
2014 535i M-Sport
Reply With Quote
  #17  
Old 10-03-2014, 08:50 PM
gbyleveldt gbyleveldt is offline
Registered User
Location: Benoni
 
Join Date: Sep 2014
Posts: 32
Mein Auto: F10 528i
Hehe, I only see this thread now. Explains why I couldn't clone it either. My NBT is also in pieces, busy with my own little CAN protocol analyzer to see if I can start this sucker up on my bench. I'll hopefully start sniffing packets on my car this weekend to see if the CIC and NBT uses the same commands.

I have a theory that the only reason the NBT runs on a 500k CAN bus is because the new touch controller sends a lot more data than the older controller and would have too much latency on the old 100k CAN bus. Let's hope I'm right because then the commands might be the same

Last edited by gbyleveldt; 10-03-2014 at 08:58 PM.
Reply With Quote
  #18  
Old 10-04-2014, 03:44 AM
shawnsheridan's Avatar
shawnsheridan shawnsheridan is offline
Officially Welcomed to the 'Fest
Location: Houston, TX
 
Join Date: Jan 2009
Posts: 27,449
Mein Auto: 2011 535i M-Sport
I don't think it is Controller related. When NBT was introduced in MY2013 F10, the old Controller was still being used. The Touch Controller was not introduced until the following LCI MY 2014.
__________________

- 2011 535i M-Sport (Born 10/10) - AW/BLK/DW - /ZMP (w/ARS, EDC, DHP, & AD) /ZPP /ZP2 (w/ZPS & ZPT) /ZCV (w/SCAD) /6FL /6VC
- Mods - M5 343M 20" Forged Wheels / 6WB MFID / 2TB SAT / 4U1 Ceramic / 6NR Apps / PDV 5k Fogs / Rear Fogs / Euro Tail Lights / Cyba Quad Tips
Reply With Quote
  #19  
Old 10-04-2014, 06:46 AM
gbyleveldt gbyleveldt is offline
Registered User
Location: Benoni
 
Join Date: Sep 2014
Posts: 32
Mein Auto: F10 528i
^^^ hey, don't ruin a good story with facts That being said, I can't think of another reason to increase the rate other than because of the controller? Nav data for the Kombi goes through MOST if I'm not mistaken

Last edited by gbyleveldt; 10-04-2014 at 06:48 AM.
Reply With Quote
  #20  
Old 10-04-2014, 07:47 AM
svc0x80 svc0x80 is offline
PM for free tokens.
Location: USA
 
Join Date: Apr 2014
Posts: 22
Mein Auto: F82 (soon)
Quote:
Originally Posted by gbyleveldt View Post
Hehe, I only see this thread now. Explains why I couldn't clone it either. My NBT is also in pieces, busy with my own little CAN protocol analyzer to see if I can start this sucker up on my bench. I'll hopefully start sniffing packets on my car this weekend to see if the CIC and NBT uses the same commands.

I have a theory that the only reason the NBT runs on a 500k CAN bus is because the new touch controller sends a lot more data than the older controller and would have too much latency on the old 100k CAN bus. Let's hope I'm right because then the commands might be the same
Every module in a BMW on the 500k BUS. (Except for the new ones that use Flexray).
Reply With Quote
  #21  
Old 10-04-2014, 12:54 PM
TokenMaster's Avatar
TokenMaster TokenMaster is offline
Token Master
Location: Java Land
 
Join Date: Jul 2013
Posts: 1,036
Mein Auto: Coded F30
The speed is related to bus length, and the shortest bus length can only go as fast as 1Mbits. NBT listens using both CAN(1) and CAN2.0A, but I think, communicates to gateway using CAN2.0A protocol only. Media info is thru MOST, but it shouldn't be critical in keeping NBT powered up.

What are you using to sniff messages? Did you build your own rig? Is it Arduino based?
__________________
Code My Bimmer| FDL Coding Video Guide -Blogger/Youtube | EST Software Token demo | E-Sys Launcher Premium and PRO
Never download already patched E-Sys from Torrent sites
Reply With Quote
  #22  
Old 10-04-2014, 01:57 PM
vithy vithy is offline
Officially Welcomed to the 'Fest
Location: Toronto
 
Join Date: Apr 2013
Posts: 159
Mein Auto: F30 320i
This might be unrelated to the topic, but...

I think you are right. When i plugged in a NBT on a F10 2010 I was still able to see the NBT on SVT tree. I know the CIC on F10 was CAN1 (Pre 07/2012). But NBT never powered on. There must be some sort of initiation command sent through CAN2 for NBT to power on. I think NBT can communicate on BN2020 and BN2000 networks. But it must be listening to some command for initiation.

Quote:
Originally Posted by TokenMaster View Post
The speed is related to bus length, and the shortest bus length can only go as fast as 1Mbits. NBT listens using both CAN(1) and CAN2.0A, but I think, communicates to gateway using CAN2.0A protocol only. Media info is thru MOST, but it shouldn't be critical in keeping NBT powered up.

What are you using to sniff messages? Did you build your own rig? Is it Arduino based?
Reply With Quote
  #23  
Old 10-04-2014, 02:01 PM
vithy vithy is offline
Officially Welcomed to the 'Fest
Location: Toronto
 
Join Date: Apr 2013
Posts: 159
Mein Auto: F30 320i
http://www.canb.us/code

maybe get one of these and see if we can intercept CAN commands
Reply With Quote
  #24  
Old 10-04-2014, 03:14 PM
svc0x80 svc0x80 is offline
PM for free tokens.
Location: USA
 
Join Date: Apr 2014
Posts: 22
Mein Auto: F82 (soon)
Quote:
Originally Posted by TokenMaster View Post
The speed is related to bus length, and the shortest bus length can only go as fast as 1Mbits. NBT listens using both CAN(1) and CAN2.0A, but I think, communicates to gateway using CAN2.0A protocol only. Media info is thru MOST, but it shouldn't be critical in keeping NBT powered up.

What are you using to sniff messages? Did you build your own rig? Is it Arduino based?
Yes, the maximum speed is 1Mb for CAN2.0A/B, however the speed has more to do with spec (protocol) than the length of the bus. The length of the bus limits a negotiated speed. For D-CAN this is 500Kbits with a sample point of 75%. CAN is usually 125Kbit, 250Kbit, 500Kbit or 1Mbit.
Reply With Quote
  #25  
Old 10-05-2014, 11:22 PM
gbyleveldt gbyleveldt is offline
Registered User
Location: Benoni
 
Join Date: Sep 2014
Posts: 32
Mein Auto: F10 528i
Quote:
Originally Posted by TokenMaster View Post
The speed is related to bus length, and the shortest bus length can only go as fast as 1Mbits. NBT listens using both CAN(1) and CAN2.0A, but I think, communicates to gateway using CAN2.0A protocol only. Media info is thru MOST, but it shouldn't be critical in keeping NBT powered up.

What are you using to sniff messages? Did you build your own rig? Is it Arduino based?
Ok, I won't proclaim to be a canbus expert at all, my knowledge thus far is based on understanding the protocol from reading up on it the last few weeks. As far as I can gather (and some testing I've done) is that both the CIC and NBT use the CAN 2B protocol. The only difference is that the CIC runs on 100k and the NBT runs on 500k. Again, this is verified through listening to the bus.

On powering up, the NBT send out a stream of broadcast messages on the canbus, waiting for a response (from the CAS I assume) to stay powered up. The CIC does the same thing. Once this authentication step has been done, the NBT then listens for the wake up command from the bus and then powers up.

I wanted to do a lot more testing on my car this weekend in order to build up a little database of commands, but didn't get around to it unfortunately. The part I need to figure out is if the NBT uses the same instructions as the CIC. This I can only test once I've got my little database going.

I've built my own little CAN bus interface based on an AVR (as used in the Arduino) but I'm not using the Arduino IDE, I'm using AVR studio. There's too much overhead in the Arduino platform and speed is important here, especially at 500k bus speeds. The hardware simply translates the Can packets into a serial stream and the decoding part is done on my PC with a Visual C app, this has a lot more horsepower to analyse the packets with. Once I've built up my little database of commands, I can then look at more suitable hardware to handle the filtering stuff the NBT needs to function in the car. To be honest, I could just go buy a Can filter and newer ZGW, but for the moment I'm more curious to see what's going on in the car. I might just end up doing that anyway

The main reason for my interest is because the KCAN protocol is not documented in the public space (if it is, it will help a lot if someone can point me there) so my goal is to at least document it a little better, hopefully helping others in playing with it.
Reply With Quote
Reply

See More Related BMW Stories


Forum Navigation
Go Back   Bimmerfest - BMW Forums > The Best of Bimmerfest! > BMW Coding and Programming
Today's Posts Search
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On



Forum Jump


All times are GMT -7. The time now is 02:03 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2016, vBulletin Solutions, Inc.
© 2001-2015 performanceIX, Inc. All Rights Reserved .: guidelines .:. privacy .:. terms