Jump to content
Do Not Sell My Personal Information


Cluster Swap


flash22
 Share

Recommended Posts

Another little project - I was thinking of doing a cluster swap, as i have an intermittent fault with mine

The clusters are a plug and play swap with the 17 onwards with the mid are so much cleaner

898009752_xp130cluster14on.thumb.jpg.57eb82bd5206075d6f0d6446d2b394db.jpg

1079021629_xp130lcdcluster17on.thumb.jpg.1c9c9bc729d5a950aa56c1879ca2afda.jpg

 

Even tho the cluster is plug and play there are 3 issues

1. The mileage needs to be corrected

This one is fairly easy to overcome after a fair bit of digging i found the information required, The cluster needs to be read with a programmer luckily it uses the same board as the Auris/Rolla and Rav4, it uses a nor flash chip and is programmed via the Motorola/Fujitsu Processor (MB91F060BS) and needs direct connection to the pcb

This can not be done with Techstream as it requires access to Techdoc and security clearance with a Techdoc TARS username and password

2. The cluster is throwing a code for the PCS and LDA as the cluster is looking for the camera module

My car doesn't have TSS, so it needs to be disabled, it seems this can be done by changing the calibration file - Toyota do this via Techstream and requires a valid VIN, im hoping to find a CAL file or to modifying the bin/hex from the cluster.............. if i can

Found a TSB for the US trucks/4x4's  T-SB-0026-20

3. Audio controls (right side joystick)

2 options

1. swap the audio controls for the later type (i have a set i picked up dirt cheap) will have to swap the radio for full nav and hands-free support

2. mount these controls else where

 

 

Link to comment
Share on other sites

  • 3 weeks later...

A follow-up post

This may be a bit techy

After having a play and figuring what does what - the Mainflash (1MB) is the core software for the cluster and the Workflash contains the settings by pure accident i flashed a blank Workflash this defaulted the cluster but was unable to write the mileage

we now know the mileage is stored in the Workflash so if we compare a pair of files with different mileages we can see what changes are made to the binary with ExamDiff pro

we can now ignore any added, changed and removed data this should give us something to work with, the next step is to ignore any 00 or FF hex

either, i have to find a way to decompile the binary or just brute force it till i find the Switch/Key

 

To be continued..........................................

Link to comment
Share on other sites

More babble.......................

Getting somewhere now, think the settings are held in the 4000 offset range just 96 lines of 16 hex blocks, so 1536 entries around 1/4-1/3 are changed or added - that leaves 1153 - 1013 entries untouched, i should be able to reduce that by removing the 00 entries

here's a sample

1056469197_43EFto4578.thumb.jpg.fcf5faac440f0315bff93142ac33f2d2.jpg

 

Link to comment
Share on other sites

Do you also wear shades, a black trenchcoat and are unusually gifted at martial arts...? :laugh: 

Is that hexdump the encoded flashrom or decoded tho? I assumed the odo data was just stored as a plain number on the raw flash chip so I assumed you could just search for a number matching the odo value. I recall someone did that by attaching a SOIC8 clip to the flash chip and fudging the odo that way, although admittedly that was with a Ford, who don't tend to obfuscate their stuff as much as Toyota..

Link to comment
Share on other sites

No not at all just poking at things and seeing what works

that is the raw binary, I can not find any software that will decompile FR (Fujitsu Risc) to machine code/programming code - standard clusters without a MID use a standard SOIC 8 you just use a calc to adjust the mileage algorithm

flash works in the same way but is stored in a 64KB Workflash

 

I have "corrected" a few locked BIOS's over the years, so it is very similar to that, it's not genius, just pure dumb luck 70% of the time

Link to comment
Share on other sites


Yay, the PCS and LDA are now disabled after much modifying i couldn't pin it down to a few hexes so i replaced a section with FF fill (A000 - B820) mileage is correct, and it's still in Miles and MPG

I'm yet to test the full function in car yet, but it looks promising

 

 

TBC

  • Like 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...




Forums


News


Membership