CIC HmiMain from F30

superwofy

Corporal
Jan 18, 2021
105
140
0
HmiMain is the CIC GUI binary that the user interacts with. The menus, browser visuals, navigation etc. are rendered through this executable.

I extracted this from an F30 KCAN2 CIC and wrote a script so that it can be run from USB. I haven't been able to find any changes really, but the build is from 2012...

Copy to the root of a fat32 drive and plug into the glovebox USB.
Wait about 30s, screen will go black and the new HMI will appear.

IMG_20220609_000102.jpg
 

Attachments

  • HmiMain76617.zip
    24.5 MB · Views: 47

zimmie

New Member
Jun 23, 2022
3
0
0
Great Work.

is it possible to extract the music player executable as well from the F30?

It will be intresting to see if we can get it to play *.flac as the e series cars do not suport this file format.
 

superwofy

Corporal
Jan 18, 2021
105
140
0
Great Work.

is it possible to extract the music player executable as well from the F30?

It will be intresting to see if we can get it to play *.flac as the e series cars do not suport this file format.

The MME (Multi Media Engine) binary on the CIC is the same version between E and F.

Maybe the Combox MME binary (since it has its own) is different. Are you thinking of NBT?
 

zimmie

New Member
Jun 23, 2022
3
0
0
it might have been NBT.

I totally forgot that the F30 came with both NBT on LCI and CIC.

just for fun, could you pop some Flac on a usb stick and try it on the USB port in your F30?
 

superwofy

Corporal
Jan 18, 2021
105
140
0
it might have been NBT.

I totally forgot that the F30 came with both NBT on LCI and CIC.

just for fun, could you pop some Flac on a usb stick and try it on the USB port in your F30?

Sorry, don't have an F30. I just have a CIC from one on my bench.
 

pRoxxx

Private
Feb 9, 2021
29
5
0
Interesting, could you share the filesystem from f30 and E series, so I can investigate them.
 

pRoxxx

Private
Feb 9, 2021
29
5
0
Ok, I started to investigate the HMIMain binary. The easy way to change something is to edit the ResDB.colors file because there are no headers etc., it's just 32-bit colors (RGBA) one by one, 170 colors total. I have scaled the RGB part with * 0.5, so the picture should be darker, but it doesn't work. I don't know why, maybe it still uses resources from flash or this HMI trick doesn't work for me.
superwofy
how do you check the rev and build version, should I code something?
(NM, I found ENTWICKLER_MENUE coding)
 
Last edited:

superwofy

Corporal
Jan 18, 2021
105
140
0
Ok, I started to investigate the HMIMain binary. The easy way to change something is to edit the ResDB.colors file because there are no headers etc., it's just 32-bit colors (RGBA) one by one, 170 colors total. I have scaled the RGB part with * 0.5, so the picture should be darker, but it doesn't work. I don't know why, maybe it still uses resources from flash or this HMI trick doesn't work for me.
superwofy
how do you check the rev and build version, should I code something?
(NM, I found ENTWICKLER_MENUE coding)

Sorry, I didn't reply in time. Yes, you enable the developer menu. Alternatively, open the file in a hex editor and go to 0x10E86D8.

It's also shown when executing via command:

target:/home/root> /mnt/hbuser/HmiMainf30 -c=MTP,mtp00-out,mtp00-in -mp=11 -p1=11 -z=2 -p5=9 -ro=/mnt/hbuser/f30/ro -rw=/mnt/hbuser/f30/rw

CIC_L6_1107_Release B1107-501-1123S Build 46 - Rev:76617 2012/04/05 11:26:19
 

pRoxxx

Private
Feb 9, 2021
29
5
0
Ok, I started to investigate the HMIMain binary. The easy way to change something is to edit the ResDB.colors file because there are no headers etc., it's just 32-bit colors (RGBA) one by one, 170 colors total. I have scaled the RGB part with * 0.5, so the picture should be darker, but it doesn't work. I don't know why, maybe it still uses resources from flash or this HMI trick doesn't work for me.
superwofy
how do you check the rev and build version, should I code something?
(NM, I found ENTWICKLER_MENUE coding)
Yes, the script from USB doesn't override existing files in /tmp/ dir, so I've deleted them with FTP. Now it works and I see the darker menu and etc!
 

pRoxxx

Private
Feb 9, 2021
29
5
0
At last, I have unpacked images DB

Some images that I got:
Новый точечный рисунок.jpg

Pictograms:
Новый точечный рисунок.jpg
 
Last edited:

pRoxxx

Private
Feb 9, 2021
29
5
0
Any details on what the ResDB encoding/header is? Can you re-pack it?
I had started repacking and researching NBT DB, but then got a lot of things to do at work. When I have done them and got free time, I switched to disassembling another ECU's MSV80/CAS/EGS and cracked their 5-level auth keys.
what exactly is the goal of that @pRoxxx ? Are you trying to alter the UI menues and its apperance on a cic?
Yes
 

relekexe

New Member
Oct 1, 2022
4
0
0
I had started repacking and researching NBT DB, but then got a lot of things to do at work. When I have done them and got free time, I switched to disassembling another ECU's MSV80/CAS/EGS and cracked their 5-level auth keys.

Yes
Can you share more info how you view resdb files? I want to take a look myself into it