Modifying .dat files (engineering mode)
#1
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
Modifying .dat files (engineering mode)
I realize that the Engineering Mode is no longer available once the HU software has been updated to a certain version. However, I suspect that Mercedes didn't get rid of the Engineering Mode completely, but rather made it more difficult for us to access.
I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever.
I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable.
Here's a sample of what I've found:
************************************************** ********
e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O"
n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC
......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d...
..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//.
************************************************** ********
This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.
This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle.
Is anybody up for the challenge? Please share your thoughts or comments. Thanks.
I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever.
I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable.
Here's a sample of what I've found:
************************************************** ********
e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O"
n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC
......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d...
..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//.
************************************************** ********
This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.
This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle.
Is anybody up for the challenge? Please share your thoughts or comments. Thanks.
Last edited by jkv11503; 10-11-2009 at 06:02 PM.
#3
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
By the way, I don't think we actually need to modify the code, but rather just find a way to decipher it to determine if the Engineering Mode "keycodes" are indeed present as I suspect they are.
#4
Administrator
![](https://staticssl.ibsrv.net/autocomm/Content/MB/mbwambassador2.gif)
Looked through your posts but couldn't find where you listed this. Would you mind re-listing it for the benefit of the membership.
#5
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
Here are the instructions: https://mbworld.org/forums/audio-ele...step-step.html
Last edited by jkv11503; 10-13-2009 at 12:55 PM. Reason: added link
#6
Senior Member
Finally I am glad to see somebody trying to figure this out it’s about time, I wish I can help but I am not too good with programming and software side. Keep up the good work and keep us posted.
Trending Topics
#10
PREMIUM SPONSOR
Join Date: Mar 2007
Location: Chicago, IL
Posts: 615
Likes: 0
Received 3 Likes
on
2 Posts
ML350, Lotus Elise
I realize that the Engineering Mode is no longer available once the HU software has been updated to a certain version. However, I suspect that Mercedes didn't get rid of the Engineering Mode completely, but rather made it more difficult for us to access.
I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever.
I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable.
Here's a sample of what I've found:
************************************************** ********
e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O"
n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC
......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d...
..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//.
************************************************** ********
This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.
This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle.
Is anybody up for the challenge? Please share your thoughts or comments. Thanks.
I have a copy of the latest Service Update CD so I thought I would look inside it to see what I could find. There are several .dat files which contain information referencing the Engineering Mode. Yes, that is the same mode that is reported to be gone forever.
I'm viewing these files using Hex Workshop Hex Editor which means that I am unable to view the code as it was actually written. I have to filter thru all of the code to look for clues that are readable.
Here's a sample of what I've found:
************************************************** ********
e.A.d.~.o.O&n.i...h......2W..yY..@...yY./.n.n......./.n.n......./...n.t...$.~.o...n./.n.n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringFunctionController.cpp.. .Welcome to..ENGINEERING MODE..../././././././.O"
n.......NULLPTR != mPanelPtr....DCW211high\Becker\MMIControl\Engineer ing\private\CRBEngineeringDisplayController.cpp... .NULLPTR != mDecisionPanelPtr....Driver Distraction..Region code.Backdoors...PgUp....PgDn..../././././././.O"..n.mC
......A...~.o.O&..n....`..o.NULLPTR != pKeyCode.DCW211high\Becker\MMIControl\Navi\NavComm on\private\CXDCW211HNavTrippleKeyCode.cpp..******* ************************************************** ******.* Adding a new key to the current key code combination..KEY_RELEASE.KEY_REPEAT..KEY_PRESS...* KeyCode: 0x%02X; KeyState: %s.** Checking if the key should be added to the current key code combination..*** Key found in mask at position %i and was inserted...*** Key pressed at %u...** Checking if the key should be removed from the current key code combination..*** Key found in combination at position %i and is removed....../././././././.O"..n.jCkS.N.O@.d....NI... ...+...I....J.K@..:+..za.q.a.i..G.HA.d..G.FA.d.a.q .a.a.`........B...B.....B.B.=f.A.d.a.q.a.`....'.>. 7A.d...8..F,..D`..3..a.1...a.1.q..6@.!...f..4K.d.V ..3K.d...x...8..*,..(`.....{.a.`.... .+.!A.d...8...,.......`...a.1...a.1.q.!...f..!M.d. ..x...8...,...`.....A.d.....A.d.....A.d.~.o.O&n.m. l.k.j.i...h...0........,...4...H............... .......,...8...X..................D........* Checking if a key code was pressed....* Comparing the key code fields:....** Index: %d; mKeyCodesSearch = %u, mKeyCodesMask = %u..*** Current key code does not fit!..*** Key codes are matching! Check the time interval.....**** Actual time: %u; stored time: %u; difference: %u...***** Key code matches!.***** Key code does NOT match!../././././.O"..n.jC.;.;@.d...
..// Project : Harman Car Multimedia System........// (c) copyright 2002........// BECKER GmbH........// All rights reserved........//........// File : RBUserVersionInfo.h........// Description: Build information for Engineering Mode........// This file is generated automaticaly by Version.exe........//........// Author : Lars Thomas (Xcc Software AG)........// Date : 04.02.2002........// Comment : Modified Mid Version........//.
************************************************** ********
This is just a very small sample of what is available in these .dat files. I've already proven that Mercedes' files can be successfully modified as I have recently changed one the NAV disc's files so that my default voice is a British woman even though I have a USA system.
This Service disc, however, is proving to be a bit more difficult for me. I'm hoping that some of you software developers can help me figure out how to sift through all of the code and find the missing pieces to this puzzle.
Is anybody up for the challenge? Please share your thoughts or comments. Thanks.
you are on the right track... but its not going to be anywhere as easy as the nav voice mod... im pretty sure that mb made a code change to remove the engineering menu so you are going to have to disassemble the base code which is i believe ARM machine code... (the telematics software was written in C++ but since its compiled there is no source code to look through)
that means break out the telematics update dvd into individual files and reverse them in a program like IDA Pro... once you do that you can find those same references to the engineering menu as above and then find the code sections that reference them....
#11
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
you are on the right track... but its not going to be anywhere as easy as the nav voice mod... im pretty sure that mb made a code change to remove the engineering menu so you are going to have to disassemble the base code which is i believe ARM machine code... (the telematics software was written in C++ but since its compiled there is no source code to look through)
that means break out the telematics update dvd into individual files and reverse them in a program like IDA Pro... once you do that you can find those same references to the engineering menu as above and then find the code sections that reference them....
that means break out the telematics update dvd into individual files and reverse them in a program like IDA Pro... once you do that you can find those same references to the engineering menu as above and then find the code sections that reference them....
#12
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
The keycode to access the Engineering Mode was posted in a seperate thread.... https://mbworld.org/forums/audio-ele...ring-menu.html
I don't know how many models this keycode applies to; however, I can confirm that it works on the '05 W211 with the HU service (software) update.
Will keep looking for a way to access the Secret Menu.
I don't know how many models this keycode applies to; however, I can confirm that it works on the '05 W211 with the HU service (software) update.
Will keep looking for a way to access the Secret Menu.
Last edited by jkv11503; 10-21-2009 at 03:05 PM.
#13
PREMIUM SPONSOR
Join Date: Mar 2007
Location: Chicago, IL
Posts: 615
Likes: 0
Received 3 Likes
on
2 Posts
ML350, Lotus Elise
no problem.. here ill give you the 30 second tutorial on exactly how to find the code you want... (i do reverse engineering for a living)
The easiest way to find it is to follow the button presses. so first you need to find how the buttons are mapped to the inputs on the processor. To do this you basically need to open up a comand and use an ohmmeter to probe the circuit between the actual button and the processor (e.g. put one lead on the switched side of the button and then move the other around the leads on the processor looking for the resistance to drop when the button is pressed. this allows you to know that button X terminates at pin # Y on the processor. Then you get the manual for the processor from the manufacturers site and look up the pin # and see what port name that it is assigned to. Do this for each button used to get into engineering mode...
Once thats done you go back into IDA (preferrably with the older firmware first) and look for each instance where those same port values are read by the processor and at each point is potential code of interest. Then you follow through the code to look for a instructions that specifically check for the same combination of buttons and see where that code goes. That will be the engineering mode entry routine. then look at the newer firmware to see whats different in that same area...
The easiest way to find it is to follow the button presses. so first you need to find how the buttons are mapped to the inputs on the processor. To do this you basically need to open up a comand and use an ohmmeter to probe the circuit between the actual button and the processor (e.g. put one lead on the switched side of the button and then move the other around the leads on the processor looking for the resistance to drop when the button is pressed. this allows you to know that button X terminates at pin # Y on the processor. Then you get the manual for the processor from the manufacturers site and look up the pin # and see what port name that it is assigned to. Do this for each button used to get into engineering mode...
Once thats done you go back into IDA (preferrably with the older firmware first) and look for each instance where those same port values are read by the processor and at each point is potential code of interest. Then you follow through the code to look for a instructions that specifically check for the same combination of buttons and see where that code goes. That will be the engineering mode entry routine. then look at the newer firmware to see whats different in that same area...
#14
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
...To do this you basically need to open up a comand and use an ohmmeter to probe the circuit between the actual button and the processor (e.g. put one lead on the switched side of the button and then move the other around the leads on the processor looking for the resistance to drop when the button is pressed. this allows you to know that button X terminates at pin # Y on the processor...
![EEK!](https://mbworld.org/forums/images/smilies/eek.gif)
![Big Grin](https://mbworld.org/forums/images/smilies/biggrin.gif)
Seriously, thanks for the 30-second lesson. The instructions sound pretty straightforward; however, I'm not too keen on opening up my Comand. Maybe someone here has a spare unit that they can use for testing purposes. In the meantime, I'll keep poking around the code in hopes of making a miraculous discovery.
#15
PREMIUM SPONSOR
Join Date: Mar 2007
Location: Chicago, IL
Posts: 615
Likes: 0
Received 3 Likes
on
2 Posts
ML350, Lotus Elise
![EEK!](https://mbworld.org/forums/images/smilies/eek.gif)
![Big Grin](https://mbworld.org/forums/images/smilies/biggrin.gif)
Seriously, thanks for the 30-second lesson. The instructions sound pretty straightforward; however, I'm not too keen on opening up my Comand. Maybe someone here has a spare unit that they can use for testing purposes. In the meantime, I'll keep poking around the code in hopes of making a miraculous discovery.
![Smilie](https://mbworld.org/forums/images/smilies/smile.gif)
#16
Member
Thread Starter
Join Date: Dec 2007
Location: USA
Posts: 121
Likes: 0
Received 0 Likes
on
0 Posts
2005 E320
If you have a chance, take a look through your supplies and see if you have a W203 (C-class?) Comand. It appears to use the same code to access the engineering mode as does the W211 (E-class). Perhaps it is also the same for the secret menu.
#17
MBWorld Fanatic!
![Smilie](https://mbworld.org/forums/images/smilies/smile.gif)