GWM module findings in FORScan

[hb.sagen]

I could not find any info on programming the GWM, so I did some digging.

In GWM / module 716, an URL is stored in rows 716-20-01 through 716-20-04.

Each row has 5 payload bytes plus 1 checksum byte. Dropping the checksum byte, the ASCII decodes like this:

716-20-01 6874 7470 3A38 -> payload 68 74 74 70 3A -> "http:"
716-20-02 2F2F 6370 2E9E -> payload 2F 2F 63 70 2E -> "//cp."
716-20-03 666F 7264 2E19 -> payload 66 6F 72 64 2E -> "ford."
716-20-04 636F 6D2F 00AF -> payload 63 6F 6D 2F 00 -> "com/" + null

Combined:

http://cp.ford.com/

The rest of the 716-20 block after that is null padding:

716-20-05 0000 0000 0042
716-20-06 0000 0000 0043
716-20-07 0000 0000 0044
716-20-08 0000 0000 0045
716-20-09 0000 0000 0046
716-20-10 0000 0000 004D

There is also a readable text block in 716-251-03 through 716-251-09:

716-251-03 5B6D 6170 432E -> "[mapC"
716-251-04 6F6E 6669 6770 -> "onfig"
716-251-05 7572 6174 6983 -> "urati"
716-251-06 6F6E 5D0A 6D09 -> "on]\nm"
716-251-07 6170 4E61 6DDF -> "apNam"
716-251-08 6520 3D20 4E03 -> "e = N"
716-251-09 4F4E 450A 0AAE -> "ONE\n\n"

Combined:

[mapConfiguration]
mapName = NONE

So the exact readable GWM locations are:

716-20-01 to 716-20-04:
http://cp.ford.com/

716-251-03 to 716-251-09:
[mapConfiguration]
mapName = NONE

Sponsored

 

[ZSC100]

Thanks for posting this.

It's pretty odd indeed what they have there. I find it odd what they choose to bake into the firmware versus what they store in config across multiple modules in general. I'd love to see more plain text in the configs,, it alludes to real engineers making decisions.

 

[Lohugo]

I don't think you ever will find useful information what is stored in the GWM, and If you figure that out you will now why.

 

[rugedraw]

I don't think you ever will find useful information what is stored in the GWM, and If you figure that out you will now why.

It's actually the complete opposite. There is plenty going on in there. There is a reason why there is no spreadsheet showing what's in there. It's also why the few people that do know what's in there don't talk about it.

The first rule about Fight Club is:

 

[Lohugo]

It's actually the complete opposite. There is plenty going on in there. There is a reason why there is no spreadsheet showing what's in there. It's also why the few people that do know what's in there don't talk about it.

The first rule about Fight Club is:

This is what I was trying to say.

 

[ZSC100]

LOLOL,, I think both of you are wrong on the GWM. I think everything juicy is baked into the firmware and specifically the GWM runs QNX and rightfully so, it's dealing with security, has gobs of ethernet and CAN ports and is probably the only means of cybersecurity they are employing. I'd hope they have a good professional software engineer heading up anything to do with Telematics and the GWMs across all of Ford. But you never know.

 

[rugedraw]

This is what I was trying to say.

After rereading it, I see what you are saying now.

 

[Lohugo]

LOLOL,, I think both of you are wrong on the GWM. I think everything juicy is baked into the firmware and specifically the GWM runs QNX and rightfully so, it's dealing with security, has gobs of ethernet and CAN ports and is probably the only means of cybersecurity they are employing. I'd hope they have a good professional software engineer heading up anything to do with Telematics and the GWMs across all of Ford. But you never know.

Oh I assumed you knew it, I can give you a small hint if we meet one day at the Free chargers in Tusla. I have the Black Lariat

 

[hb.sagen]

So the next irresponsible step is to buy a can adapter for my mac and let codex loose on the network

VW used qnx and they left an autorun script through, and then we had access to the entire thing.

 

[ZSC100]

Oh I assumed you knew it, I can give you a small hint if we meet one day at the Free chargers in Tusla. I have the Black Lariat

You're in Tulsa and hack on modern vehicles????

 

[Lohugo]

You're in Tulsa and hack on modern vehicles????

Yes,

 

[ZSC100]

Yes,

Geeze man, DM me let's hook up. I'm working on a few cool things.

Sponsored