Hacking Ford Mustang Dash 2019 5.0

[nivs]

So I've tried to reverse engineer the ford mustang dash (2019) to edit it and add new gauges

I have the VBF (actually a tarball) of the dash and the ability to reflash it (have the security algorithm and keys).

I extracted the tarball from the VBF and it appears to be for QNX which is a cut down unix system. You can download a vmware image here of their QNX trial
http://www.qnx.com/download/feature.htm ... amid=20725

user manual here:
http://www.qnx.com/download/download/14 ... _guide.pdf

If you open the VBF in notepad you can read the flashing script commands to write the file system image (bitmaps.bin) which I've extracted from the VBF using my own code I wrote.

I work full time and this is not a priority for me, so I thought someone else could continue on from where I got to. I'm sure there would be commercial opportunities here from the various aftermarket flashing companies if you get it working.

First step would be to flash the file system image inside the QNX vmware demo package. Then you could attempt to run and edit the package. If anyone gets this far I can try and flash it into a vehicle.

I've linked a 7z archive with all the VBF modules for the vehicle, and also the extracted binary image from KR3T-14C088-KH (VBF for the dash).
https://megaupload.nz/s6D0M2gbn9/KR3A_2 ... ng_VBFs_7z

I think the SBL (secondary boot loader) is the following VBF file
JR3T-14C025-JA.vbf

The dash is this:
KR3T-14C088-KH

Enjoy peeps!

[all35]

Hi.Link to mega doesnt work

[jakka]

[Gatecrasher]

Loading it up in the QNX VM won't be useful for much besides manipulating the filesystem. You'll be missing the graphics and CAN hardware, among other things, so you'll never get the cluster software started.

If you want to add new functionality you'll need to reverse engineer the Kanzi software.

https://rightware.com/blog/kanzi-in-the ... xperience/

They make specific mention of 18+ Mustang and 21+ F150. I strongly suspect 17+ Continental and 18+ Navigator also used it for their digital dashes.

GM used similar systems in their pre-2020 digital Cadillac dashes (Mecel Populus), and the pre-2020 8" digital + analog dashes (EB Guide). In both cases it's a pile of PNG images tied together by a proprietary database format that defines image layout and functionality.

If you can't reverse engineer the database format then the best you can hope for is to replace the png files and do a light re-skin. Even if you do figure out the database, you have to hope the CAN interpreters receive the signals you need and pass them on to the graphics engine.

*Edit* Replaced 18+ Expedition with 18+ Navigator

[jakka]

Way ahead of you bro, I've pulled the kanzi .kzb files out of the bin out of the VBF and extracted them.

[Gatecrasher]

Cool. What have you found? Is it some arcane binary crap or something that can actually be understood?

[jakka]

That's a secret bro, only the Alliance knows about this.

[jakka]

AAA

[pman92]

AAA

Who's that?

[hjtrbo]

Possibly a South Australian thing. Some of them are odd.