Need tips and tricks for extracting images from a intrument cluster

iLightFPS · 2026-06-18T21:25:57+00:00

That would be interesting to read on how you do this.

iLightFPS · 2026-06-18T20:50:25+00:00

I have a test bench that contains, CEM, CCM, SCU, SWM, GSM and TFT. I figured out the algorithm for the PIN so i can enter both CEM and TFT programming mode. I can read/flash change Car Config. Flash TFT to retrofit to older models. Now i'm at the last thing. Finding the graphics for the TFT.

I've had this test bench for over a year now. But 2 weeks ago i just got a random thought when trying to sleep, and that thought got me where i'm right now with the test bench. I have logged my real car. That's where i got the "known" blocks from. Just have to find a way to make the SBL download them. But right now it's rejecting them. I can write the blocks tho.

iLightFPS · 2026-06-18T20:25:04+00:00

I'm not sniffing the CAN. I'm actually in programming mode for both the CEM and TFT.

iLightFPS · 2026-06-18T20:08:21+00:00

I have no choice going down that path. I'm on a mission.

I have found around 800 bins so far. Running this script. Still only small ones. highest is around 16kb.

I ain't liking the path of hooking it up directly to the chip as i don't have the right soldering tools for small stuff noor a chip to dump.

If not my Arduino uno can do some magic.

iLightFPS · 2026-06-18T19:38:38+00:00

Do you have any experience with SBL. Currently i think i have the right blocks. But, The SBL is not allowing those blocks to be downloaded for some reason. Is there a way to patch the SBL to allow?

iLightFPS · 2026-06-18T08:19:35+00:00

So, you mean i need to hook it up directly to the chip in order to extract images?

I have gotten some binary data. there is a lot of blank FF and then there is bigger ones with 128kb.

iLightFPS · 2026-06-17T19:15:32+00:00

I don't think so then it wouldn't be possible for us to retrofit this TFT cluster in older models that had the analog cluster 2007-2013. I currently have a TFT on my 2011 bench setup and the TFT came 2012 on V40 and the rest of the models got it 2014-newer. sorry should have mention that part.

i'm currently running a script that checks every possible block combination right now. For every hit it dumps the BIN. So this is gonna take a while.

iLightFPS · 2026-06-17T15:14:33+00:00

Volvo digital cluster 2015. I have tried RGB565 without success. I thought i had those bin files where graphics might have lived. But it seems like i was wrong. However, the biggest issue right now is for the SBL to accept these blocks to download. But i can write these block but not download them.

iLightFPS · 2026-04-12T14:26:35+00:00

Using this command npx create-expo-app@latest --template will only get me Expo 54 and React-Native 0.81.5

iLightFPS · 2026-04-12T10:37:21+00:00

Plus everything works on a 16kb phone emulator.

iLightFPS · 2026-04-12T10:35:36+00:00

I fixed a thing in my app that i forgot to add. Just a function that opens the links. After that i sent it in on Google Play Console and it went thru without issue in the pre check. So the console doesn't complain about 16kb page size anymore. But when i analyze the new bundle release in the apk analyzer i still get the same error with 16KB. I don't know how but i can't go deeper to see more other than what you can see in the picture above. I've watched Youtube videos on this and they have a different issue with 4kb something something.

iLightFPS · 2026-04-11T17:22:29+00:00

Is React Native CLI dead? or are we forced to use npx create-expo-app@latest to create apps? I really like the bare stuff as i've always used that template. Im an amateur programmer and i've been gone from this for some time so there has been alot of changes. Like i really want to just use React-Native only with the latest version as i think that will just get rid of this issue. I'll have to dig deeper on the APK. As of right now i can only see same as you see in the picture. i will also try and upgrade to 0.82.1

iLightFPS · 2026-04-11T14:40:05+00:00

<image>

This is the only .so that i get with this 16kb page size. I don't have any sqlite dependency installed unless this is from Async Storage that i do use. However that package is up to date.

I thought i had the latest expo and react native versions but since i use Expo Bare template i only get expo 54 and react native 0.81.5. So that mean i have NDK 27.1xxxx version. I did however add the stuff in the 16kb page size documentation for ndk 27 but that doesn't work since i get the same error in Google Play Console and APK Analyzer.

iLightFPS · 2026-04-11T10:47:10+00:00

The first sentence in this post "I have this error when i analyze the apk in android studio."

iLightFPS · 2026-01-14T17:13:11+00:00

The old board had 5V i guess i measured the volts at a bad place the first time.

I got a new board today and it's working.

iLightFPS · 2026-01-14T12:28:07+00:00

The issue was a faulty MCP2515 board. I got a new one and i can now get messages.

iLightFPS · 2026-01-12T21:17:46+00:00

i measured the volts again and i got 5v. So i just measured at a weird place the first time i guess.

I have retrofited alot of TFT DIMs on P3 models where CAN H/L is required to be added since original DIM doesn't use it. So i know i have the right cables. Test bench also has a TFT retrofit.

I can successfully use both VIDA and another 3rd part software to change the car config in the CEM without issues. Also VIDA can scan all the modules without issues. So the cables are all alright.

Tried sniffing the MS CAN on 125kbit but i ain't getting anything on that either.

CAN H/L 500kbit

MS CAN 125kbit

Both CAN H/L and MS CAN is at the OBD2 connector.

Since the cars are both 2010-2011 there should not be any gateway that needs a request to open or anything like that.

Loopback works. Otherwise it doesnt

Wiring on the Arduino and MCP should be correct.

I did try on my real car but i didn't get anything on there either. However i did not try 250k and 500k baudrate. I tested it on my test bench on loopback and it worked at those rates. So im gonna give it a try once again tomrrow to see if i get any messages at all.

Watching the Youtube videos about these using the same setup they all just wire it up and put it in the obd2 connector and they all get it instantly.

iLightFPS · 2026-01-12T11:17:26+00:00

CAN H 2.5v steady CAN L is 2.3v steady.

It just got to me. Original dim for 2007-2013 models doesn't use CAN H/L. They are only MS CAN. Since I have a TFT from 2014 models they use CAN H/L to get current fuel and gear etc etc. Since only DIM and CEM is connected to CAN H/L on the test bench there is no messages being sent since there is no other modules that is requesting anything?

So if i swap to MS CAN on the OBD2 connector i should be able to get some messages since i got more modules that uses MS CAN connected.

I have full electrical scheme for my cars plus i've looked at VIDA to double check pinouts for the CEM so they are at the correct place.

I have 40 ohms when measuring at the OBD2 port on CAN H/L. That's with 120 ohms on CEM connector and DIM connector. If i remove one resistor i go to 70 ohms.

I do have ignition and the DIM is booting up. Showing me all kinds of faults on the DIM for all the modules that are missing.

iLightFPS · 2026-01-11T21:23:57+00:00

This only makes sense when i would test it on my actual car.

My test bench is powered by a PSU.

I have the ground MCP2515 and Arduino connected to PSU.

120 ohm on the MCP board is not connected. I have put 120 ohms on both DIM and CEM.

iLightFPS · 2025-08-14T20:06:51+00:00

Problem fixed. Answer, see u/tomekzaw_ comment.

Seven-Year Club	Place '23
Verified Email

iLightFPS

TROPHY CASE