Investigating Soundaktor firmware part 2!

Previously, I wrote about diving into the Soundaktor firmware. (see here: www.drive2.com/l/604217649542468739/ )

Drive2-buddy Dark did some very advanced research on the data files, and now we've got basically most of the relevant data mapped to something logical. There still remains 1 challenge, which I will write about later in this post.

First let me talk you through the findings!
First of all, where to find the data? Let's open up an example ODX file, in this case it's FL_8W0907159___0002.odx.
Open it in your favorite text editor, and you will see the following:

Found on photo: 8W0907159

There's a lot inside, like commands to erase the previous data on the module, stuff like that.
But. there's also a datafile which contains the settings of the Soundaktor, sized at 57344 bytes:

Found on photo: 8W0907159

There's also a checksum on the data. It's a format that's not known to me, but it's called "CRC32_ADLATUS".

Whenever changes are made to the data, this checksum needs to be updated too.
Luckily, ODX-Generator can do this for us:

Found on photo: 8W0907159, CR032

If you know how exactly this CRC32_ADLATUS is performed, let me know. I would love to be able to generate it without the need for an external tool. I tried decompiling ODX Generator to learn more from it, but so far no luck there.

Let's take the 57344 bytes of data, and paste it into 010 Editor as Hex data:
After running the script that you can find at github.com/jilleb/mqb-soundaktor, you will see the following:

Found on photo: 8W0907159, 000000009, 20100008, 00666600

Colorful bunch. Everything that's green is data that has a meaning we know. Let's have a look at what determines if this firmware actually does something on your car. There's a limitation inside the Soundaktor control module that prevents it from working when your car does not fit the VIN Mask and engine code in this file. I highlighted the relevant data in blue here:

Found on photo: 000000009, 20100008, 00666600

Translating that to something we can understand, it means the following:

The VIN mask here is:
?8W?
Which means your car will only work if the VIN matches this, for instance:

There's also the engine code. In this case, the engine code is "63", which is ASCII for ?, and means every engine code is accepted.

If you go a bit more down, there are a lot of tables.
Dark made a nice display of these, shown in the output window. For instance the Gain/Speed table. This determines what gain level is used at a certain speed, depending on the used mode:

Found on photo: Q4862

Of course, this is better readable as a graph, so I exported it to Excel:

Found on photo: 200211, 1305316P

I guess this means the sound level goes down as the speed goes up. That sounds a bit counter intuitive to me, but there will be more road noise going on when you're driving 300km/h, and then the Souindaktor would only be an additional annoyance.

There's also this HUGE table, showing the gain level related to the RPM value:

Found on photo: O1310, 1072900, Q0845

Which translates to:

That's a bit more logical, louder at higher RPM, depending on the chosen driving mode.

We've noticed there's a lot of difference in configuration, depending on the car type and brand.
It would be nice to be able to change the sound inside the car, by flashing for instance, a Macan soundaktor firmware which sounds a bit different than your Skoda. If you can get Macan firmware files, let me know!

And now to the biggest challenge, that's been keeping me awake for 2 weeks now: the checksum inside the file itself!
There's some kind of protection mechanism, which prevents us from making changes. Changes cause checksum errors, and we think the cause of this is in the first 2 bytes:

I have no clue, and I've tried all kinds of ranges and CRC methods to determine what it could be. So far, no luck!
So if you have any ideas… feel free to share your thoughts! Thanks!