Investigating soundaktor firmware

We all know the controversial soundaktor… Some love it, some hate it. Personally, I like having as much controllable (and customisable!) features in my car, so I retrofitted it some time ago. Read more about that here.

There's 1 major downside to the soundaktor: it has firmware that makes it work on specific cars and engine types. This means you need modified firmware for it to work on your specific car. I got modified firmware gifted by a good friend, but we didn't know how it was modified. My Drive2 mates Dark and Borg123 were struggling with the same: how to modify this firmware to work on our cars? We collectively took a deep dive into the firmware, and started making a 010 Editor template that would make it easier to analyse things.

The most interesting part of the ODX file turned out to be the 2DATA part, the second block of data.

Looking at it in 010 editor, you probably recognise some useful text on the right. Some XLS filename, and a bunch of ? and "5F". Already interesting! But what is what? Luckily, somewhere in my MQB archives, I found a document which was a similar XLS file! (No, I cannot share it because it's confidential). Previously, I never really looked into this document, because I was too occupied with FPA dataset analysis. But now it was of use! There were some values inside that we could map directly to the data in the firmware.

We started filling in the knowns and unknowns in the 010 Editor template, which brought us to the following colorful bunch:

Found on photo: 5F0907159B, 00010001

And we added some descriptions, which makes it easier to analyse.

Found on photo: 5F0907159, CC021

The "+?5F?" turned out to be the VIN mask, with "+" (or 43) being the specific engine code, and the 5F is the car type, in this case a Seat Leon 5F. Modifying the engine code to a "?" would remove the engine code lockout. However, modifying this leads to a checksum error! The firmware block itself has a checksum:

This can be generated by ODXGenerator, so that wasn't the problem. There had to be another checksum inside the firmware block!

I wrote a script to forcefully search for checksums inside the file, going along each byte inside the file and looping along each possible range from there:

So far I found only 1: a CRC16-CCITT checksum on the XLS filename. But we found no plausible checksums on the VIN mask yet!
If you have any info about this, or can point us in the right direction… let me know!

But… there's more!
While looking into this file, I saw some interesting patterns. First, let's have a look at how 010 Editor sees things. Since the latest version, a graphical display is added to 010 Editor. To some it might look like a Persian carpet, but you can make some quick conclusions when looking at it:

— the data is not completely random. Then it would be looking like noise
— there are different sections in the file different types of data
— there is some gradual change in the colors in certain areas, which means there's some kind of "shape" in the data there.

Let's bring out the trusty old WinOLS, that can show this in a much more fancy and understandable way!
There are some interesting curves to be seen here:

The same data, but with the WinOLS visualisation

In 2D:

In 3D:

Let's have a look at an other piece of data:
Binary:

Found on photo: O1532, 60605293, Q000000000164

2D:

3D:

Found on photo: O1808

Interesting!

Hopefully we soon find out what influencing this data will do to the sound and function of the Soundaktor. It would be nice to apply the same logic to the External Soundaktor as well, so we could enable more control over the sounds the 'fake exhaust' makes!

In the mean time we keep on looking for the checksums that need to be changed in order for the firmware to fully work without any troubles.

If you want to cooperate in the research, feel free to use the 010 Editor template that can be found here:
github.com/jilleb/mqb-soundaktor

Enjoy!